feat(permissions): Ask asks before every edit; add Accept Edits [skip ci]

Ask (`suggest`) now opens a card for file edits inside the workspace too,
as its name, the Plan handoff copy ("Edits and commands ask you first") and
the founder-agreed model (2026-11-07, modeled on Claude Code's permission
modes) promise. CW-7663 found that the desktop edit card could not appear
with default settings because Ask ran in-repository writes unasked.

The #5185 in-workspace write carve-out moves to a new posture, Accept Edits
(`ApprovalMode::AcceptEdits`; settings and config.toml `accept-edits`,
Runtime wire `accept_edits`), between Ask and Auto-Review: an edit whose
every target stays inside the workspace git work tree runs without a card;
`.git`, `.codewhale`, `.env*`, credential and key files, folders without
git, commands, network and MCP actions ask exactly as in Ask. Everywhere
else Accept Edits is an asking posture (`ApprovalMode::is_ask_family`):
repo-law asks, sandbox escalation and Computer Use consent open a card;
remembered grants treat it as Ask; non-authoritative provenance narrows it
to Ask with a recorded narrowing event; live-authority narrowing ranks it
between Ask and Auto-Review.

- Shift+Tab: Ask -> Accept Edits -> Auto-Review -> Full Access.
- Settings schema rows (permission_posture, approval_mode,
  approval_policy), /permissions, /status, /config, the Plan handoff
  ("Work (Accept Edits)"), footer chip and help strings; 7 new and 3
  updated strings in all 15 locale packs.
- config.toml `approval_policy = "accept-edits"`; a project file may only
  tighten: auto < accept-edits < on-request < never.
- ACP runs Accept Edits as Ask, because ACP turns never apply the carve-out.
- /import-claude maps Claude Code's acceptEdits to Accept Edits.
- Docs: MODES, KEYBINDINGS, CONFIGURATION, INSTALL, GUIDE, README and its
  18 translations (restamped), zh_hans mirrors, features.toml row,
  CHANGELOG entry, regenerated web/data/agent-docs.generated.json.

Stated limits: write-capable workers keep #5186's in-folder edits under Ask
(their spawn card is the consent); modes, Tab and Operate are unchanged
pending the founder's answers to the modes/postures design
(CW/artifacts/modes-postures-20261107/DESIGN.md D1-D4; Operate in CW-7849).

Verification (shared checkout, source b3d18fe6bc plus this diff):
- scripts/dev-cargo.sh test --locked --offline -j6, focused filters
  (approval_mode, posture, permission*, carve_out, authority::,
  protocol_parity, repo_law, sandbox_escalation, computer_use, narrow,
  approval_request, runtime_policy, project_config, settings_schema,
  plan_handoff, import_claude, file_edit_card, config_choice, keybinding,
  locale parity): codewhale-engine lib 263 passed, 0 failed;
  codewhale-tui lib 103 passed, 0 failed; codewhale-app-server lib 13
  passed, 0 failed; codewhale-config 35 passed; codewhale-runtime 20
  passed; codewhale-localization 15 passed; codewhale-execpolicy 12
  passed; all 0 failed. Includes write_carve_out_posture_is_exactly_
  accept_edits, workspace_write_carve_out_covers_accept_edits_only,
  file_write_card_names_the_missing_repository..., permission_cycle_is_a_
  closed_loop..., cycle_approval_scenario, permission_postures_persist_
  across_restart, shift_tab_migrates_user_root_policy..., plan handoff
  locale test, file_edit_card_says_when_it_asks_for_lack_of_a_git_repo.
- codewhale-tui --test feature_registry: this row passes; the run fails
  only on another session's uncommitted clipboard-image-prune row, which
  this commit does not contain.
- rustfmt --check on every touched .rs file; check-tui-locale-parity PASS
  (2823 keys x 15 packs); check-tui-product-vocabulary exit 0;
  check-readme-translations OK (18, stamp 20d0bb7c0784);
  check-readme-locales PASS; check-versions OK; check-dead-code-budget
  PASS (137). check-blocking-calls-budget fails only on another session's
  untracked crates/engine/src/session_image_prune.rs (not in this commit).
- Not run: a live desktop/TUI turn showing the edit card (CW-7663's App
  acceptance); full workspace suites (final release validation owns them).
  Tests ran on the shared working tree, which also held other sessions'
  uncommitted edits; this commit stages only this slice's hunks
  (private index, HEAD + these changes).

Refs CW-7663, CW-7849

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CHANGELOG.md

@@ -212,6 +212,19 @@ until the matching tag, packages, checksums, and release assets exist.
 - **Bundled skill `goals` is now `personal-goals`.** It tracks personal resolutions in `goals.md` and no longer collides with goal mode; `goals` still resolves to it. An untouched installed `goals` copy becomes `personal-goals` on upgrade; an edited one stays as `goals`.
 - **Each sub-agent is told its name, its scope and that its final answer is delivered to the parent automatically.**
 - **Thread-owned terminals (Runtime API, breaking):** Engine terminal shells now belong to the conversation that started them, so two conversations using `term-1` in one folder get separate shells instead of sharing cwd, running command and output. Clients list a thread's shells at `GET /v1/threads/{id}/terminals` and drive one at `/v1/threads/{id}/terminals/{terminal_id}/output|input|resize|kill`; a reset shell, another thread's or workspace's shell, or one from before an Engine restart answers 404 instead of attaching to a same-named shell. The name-addressed `/v1/terminal/{name}/*` routes now answer 410, and `/v1/runtime/info` advertises `thread_scoped_terminals` in place of the four `terminal_*` flags. Client input meets the thread's shell consent and sandbox-reuse guard, and a lone Ctrl-C uses the dock's confirmed interrupt. In the TUI, a new conversation starts its own `term-1` rather than reusing the previous conversation's shell, which the dock still lists.
+- **Ask asks before every edit; new Accept Edits posture:** Ask now opens a
+  card for file edits inside the workspace too, as its name and the Plan
+  handoff ("Edits and commands ask you first") promise. The in-repository edit
+  rule moved to a new posture, **Accept Edits** (Claude Code's `acceptEdits`):
+  an edit whose every target stays inside the workspace git work tree runs
+  without a card, while `.git`, `.codewhale`, `.env*`, credential and key
+  files, folders without git, commands, network and connected apps still ask.
+  Shift+Tab cycles Ask → Accept Edits → Auto-Review → Full Access, so one
+  press restores the previous Ask behaviour. `/permissions`, `/status`,
+  `/config` and the Plan handoff offer it; the Runtime wire spells it
+  `permission_posture: "accept_edits"`, settings and `config.toml`
+  `accept-edits`. Project config may tighten Accept Edits to Ask but never
+  loosen Ask to it. ACP sessions run it as Ask.
 - **Brighter terminal working states:** the Ocean palette has stronger accents,
   and active work uses a restrained left-to-right text sweep. Quiet and
   reduced-motion settings keep stable working indicators. The shared

README.md

@@ -72,8 +72,9 @@ two copies end up on `PATH` and whichever comes first wins.
 ## Quickstart
 
 1. Commit or stash your work, then run `codewhale` from the root of a git
-   repository. By default it applies file edits there without asking and
-   shows you the diff.
+   repository. By default it asks before each file edit and command; press
+   `Shift+Tab` once for **Accept Edits** to let it edit files in the
+   repository without asking.
 2. Run `/provider` (or press `F3`), pick a provider, paste its API key, and
    choose a model. DeepSeek is the default provider. With no key, pick a local
    runtime instead. If no provider is configured and Ollama is already serving
@@ -107,7 +108,7 @@ A fresh install starts in Work mode with the Ask permission.
 | | Switch with | Options |
 | --- | --- | --- |
 | Mode | `Tab` (when the input is empty) or `/mode` | **Plan** reads and searches but changes nothing. **Work** edits files and runs commands. **Operate** has the same access as Work, treats your request as a goal, and keeps going until the goal is verified or it needs input from you. |
-| Permission | `Shift+Tab` | **Ask** applies file edits in your repository without asking and asks before shell commands that are not read-only. **Auto-Review** lets rules and a reviewer model approve routine calls and refuses high-risk ones; switch to Ask to approve those yourself. **Full Access** never asks and turns off Codewhale's sandbox; repository rules and managed policy still apply. |
+| Permission | `Shift+Tab` | **Ask** asks before every file edit and every shell command that is not read-only. **Accept Edits** applies file edits in your git repository without asking and still asks before commands. **Auto-Review** lets rules and a reviewer model approve routine calls and refuses high-risk ones; switch to Ask to approve those yourself. **Full Access** never asks and turns off Codewhale's sandbox; repository rules and managed policy still apply. |
 
 See the [modes and permissions guide](docs/MODES.md) for the details.
 

crates/app-server/src/acp_server.rs

@@ -749,7 +749,7 @@ impl AcpServer {
                 MessageId::ConfigChoiceNever,
                 MessageId::PermissionsPostureNever,
             ),
-            ApprovalMode::Suggest => (
+            ApprovalMode::Suggest | ApprovalMode::AcceptEdits => (
                 "ask",
                 MessageId::ConfigChoiceAsk,
                 MessageId::PermissionsPostureAsk,
@@ -896,7 +896,7 @@ fn acp_permission_value(config: &Config) -> &'static str {
         ApprovalMode::Bypass => "full-access",
         ApprovalMode::Auto => "auto-review",
         ApprovalMode::Never => "never",
-        ApprovalMode::Suggest => "ask",
+        ApprovalMode::Suggest | ApprovalMode::AcceptEdits => "ask",
     }
 }
 
@@ -939,11 +939,15 @@ fn acp_approval_mode(config: &Config) -> ApprovalMode {
     if config.yolo.unwrap_or(false) && !config.approval_policy_is_requirements_managed() {
         ApprovalMode::Bypass
     } else {
-        config
+        match config
             .approval_policy
             .as_deref()
             .and_then(ApprovalMode::from_config_value)
             .unwrap_or_default()
+        {
+            ApprovalMode::AcceptEdits => ApprovalMode::Suggest,
+            mode => mode,
+        }
     }
 }
 

crates/command-contract/src/types.rs

@@ -60,6 +60,7 @@ pub enum CommandApprovalMode {
     Bypass,
     #[default]
     Suggest,
+    AcceptEdits,
     Never,
 }
 

crates/config/src/project_config.rs

@@ -11,9 +11,16 @@ use std::path::{Path, PathBuf};
 
 /// Values config.toml's root `approval_policy` accepts, compared trimmed and
 /// case-insensitively. settings.toml's `approval_policy` is a different
-/// vocabulary (`use-tui-default`, `ask`, `auto-review`, `full-access`).
-pub const CONFIG_TOML_APPROVAL_POLICIES: &[&str] =
-    &["on-request", "untrusted", "never", "auto", "suggest"];
+/// vocabulary (`use-tui-default`, `ask`, `accept-edits`, `auto-review`,
+/// `full-access`).
+pub const CONFIG_TOML_APPROVAL_POLICIES: &[&str] = &[
+    "on-request",
+    "untrusted",
+    "never",
+    "auto",
+    "suggest",
+    "accept-edits",
+];
 
 /// Values config.toml's root `sandbox_mode` accepts.
 pub const CONFIG_TOML_SANDBOX_MODES: &[&str] = &[
@@ -68,7 +75,7 @@ pub fn project_approval_policy_is_allowed(current: Option<&str>, project: &str)
     };
     match current.and_then(approval_policy_rank) {
         Some(current_rank) => project_rank >= current_rank,
-        None => project_rank >= 2,
+        None => project_rank >= 3,
     }
 }
 
@@ -93,8 +100,9 @@ pub fn project_sandbox_mode_is_allowed(current: Option<&str>, project: &str) ->
 pub(crate) fn approval_policy_rank(value: &str) -> Option<u8> {
     match value.trim().to_ascii_lowercase().as_str() {
         "auto" => Some(0),
-        "suggest" | "suggested" | "on-request" | "untrusted" => Some(1),
-        "never" | "deny" | "denied" => Some(2),
+        "accept-edits" | "accept_edits" | "acceptedits" | "edits" => Some(1),
+        "suggest" | "suggested" | "on-request" | "untrusted" => Some(2),
+        "never" | "deny" | "denied" => Some(3),
         _ => None,
     }
 }

crates/config/src/settings_schema.rs

@@ -228,6 +228,11 @@ const THINKING_HIGHLIGHT: &[SettingOption] = &[
 
 const PERMISSION_POSTURE: &[SettingOption] = &[
     SettingOption::new("ask", "ConfigChoiceAsk", "ConfigChoiceDetailAsk"),
+    SettingOption::new(
+        "accept-edits",
+        "ConfigChoiceAcceptEdits",
+        "ConfigChoiceDetailAcceptEdits",
+    ),
     SettingOption::new(
         "auto-review",
         "ConfigChoiceAutoReview",
@@ -242,6 +247,11 @@ const PERMISSION_POSTURE: &[SettingOption] = &[
 
 const APPROVAL_MODE: &[SettingOption] = &[
     SettingOption::new("ask", "ConfigChoiceAsk", "ConfigChoiceDetailAsk"),
+    SettingOption::new(
+        "accept-edits",
+        "ConfigChoiceAcceptEdits",
+        "ConfigChoiceDetailAcceptEdits",
+    ),
     SettingOption::new(
         "auto-review",
         "ConfigChoiceAutoReview",
@@ -261,6 +271,11 @@ const APPROVAL_POLICY: &[SettingOption] = &[
         "ConfigChoiceDetailUseTuiDefault",
     ),
     SettingOption::new("ask", "ConfigChoiceAsk", "ConfigChoiceDetailAsk"),
+    SettingOption::new(
+        "accept-edits",
+        "ConfigChoiceAcceptEdits",
+        "ConfigChoiceDetailAcceptEdits",
+    ),
     SettingOption::new(
         "auto-review",
         "ConfigChoiceAutoReview",

crates/engine/src/core/authority.rs

@@ -263,11 +263,18 @@ pub fn effective_input_policy(
     if !provenance_can_inherit_standing_auto_authority(provenance) {
         let from_mode = mode;
         let from_approval = approval_mode;
-        let had_auto_authority =
-            trust_mode || auto_approve || matches!(approval_mode, ApprovalMode::Bypass);
+        let had_auto_authority = trust_mode
+            || auto_approve
+            || matches!(
+                approval_mode,
+                ApprovalMode::Bypass | ApprovalMode::AcceptEdits
+            );
         trust_mode = false;
         auto_approve = false;
-        if matches!(approval_mode, ApprovalMode::Auto | ApprovalMode::Bypass) {
+        if matches!(
+            approval_mode,
+            ApprovalMode::Auto | ApprovalMode::Bypass | ApprovalMode::AcceptEdits
+        ) {
             approval_mode = ApprovalMode::Suggest;
         }
         if had_auto_authority {
@@ -485,12 +492,12 @@ pub fn resolve_tool_permission(
 }
 
 /// Whether the session posture is the one the in-workspace write carve-out
-/// (#5185) relaxes: the default Ask posture (`Suggest` approvals, no
-/// auto-approve) in an Agent-family mode.
+/// (#5185) relaxes: Accept Edits (no auto-approve) in an Agent-family mode.
 ///
-/// Every other posture keeps its exact prior meaning: Full Access already
-/// runs these calls, `Never` still denies them, Auto-Review still fails
-/// unresolved holds closed, and Plan is read-only by mode.
+/// Every other posture keeps its exact meaning: Ask asks before every edit,
+/// Full Access already runs these calls, `Never` still denies them,
+/// Auto-Review still fails unresolved holds closed, and Plan is read-only by
+/// mode.
 #[must_use]
 pub fn write_carve_out_posture(
     mode: AppMode,
@@ -499,7 +506,7 @@ pub fn write_carve_out_posture(
 ) -> bool {
     !auto_approve
         && matches!(mode, AppMode::Agent | AppMode::Operate)
-        && approval_mode == ApprovalMode::Suggest
+        && approval_mode == ApprovalMode::AcceptEdits
 }
 
 /// Whether every target path of a file-write call qualifies for the
@@ -844,6 +851,7 @@ pub fn permission_label_for(
     }
     match approval {
         ApprovalMode::Suggest => tr(locale, MessageId::ChipPermissionAsk),
+        ApprovalMode::AcceptEdits => tr(locale, MessageId::ChipPermissionAcceptEdits),
         ApprovalMode::Auto => tr(locale, MessageId::ChipPermissionAuto),
         ApprovalMode::Bypass => tr(locale, MessageId::ChipPermissionFullAccess),
         ApprovalMode::Never => tr(locale, MessageId::ChipPermissionNever),
@@ -859,14 +867,19 @@ mod tests {
     }
 
     #[test]
-    fn write_carve_out_posture_is_exactly_the_default_ask_posture() {
+    fn write_carve_out_posture_is_exactly_accept_edits() {
         assert!(write_carve_out_posture(
             AppMode::Agent,
-            ApprovalMode::Suggest,
+            ApprovalMode::AcceptEdits,
             false
         ));
         assert!(write_carve_out_posture(
             AppMode::Operate,
+            ApprovalMode::AcceptEdits,
+            false
+        ));
+        assert!(!write_carve_out_posture(
+            AppMode::Agent,
             ApprovalMode::Suggest,
             false
         ));
@@ -891,7 +904,7 @@ mod tests {
         ));
         assert!(!write_carve_out_posture(
             AppMode::Plan,
-            ApprovalMode::Suggest,
+            ApprovalMode::AcceptEdits,
             false
         ));
     }
@@ -905,10 +918,15 @@ mod tests {
             file_write_asks_without_git(mode, approval_mode, workspace, tool, &edit)
         };
 
-        // The lesson-1 case: default Ask posture, plain folder, a file edit.
+        // The lesson-1 case: Accept Edits, plain folder, a file edit.
         for tool in ["edit_file", "write_file", "apply_patch"] {
             assert!(
-                asks(AppMode::Agent, ApprovalMode::Suggest, plain.path(), tool),
+                asks(
+                    AppMode::Agent,
+                    ApprovalMode::AcceptEdits,
+                    plain.path(),
+                    tool
+                ),
                 "{tool}"
             );
         }
@@ -916,7 +934,7 @@ mod tests {
         // does open there is asking for some other reason.
         assert!(!asks(
             AppMode::Agent,
-            ApprovalMode::Suggest,
+            ApprovalMode::AcceptEdits,
             repo.path(),
             "edit_file"
         ));
@@ -929,22 +947,24 @@ mod tests {
             &["notes.txt".to_string()]
         ));
         // Postures the carve-out never relaxes ask with or without git.
-        assert!(!asks(
-            AppMode::Agent,
-            ApprovalMode::Auto,
-            plain.path(),
-            "edit_file"
-        ));
+        for approval_mode in [ApprovalMode::Suggest, ApprovalMode::Auto] {
+            assert!(!asks(
+                AppMode::Agent,
+                approval_mode,
+                plain.path(),
+                "edit_file"
+            ));
+        }
         assert!(!asks(
             AppMode::Plan,
-            ApprovalMode::Suggest,
+            ApprovalMode::AcceptEdits,
             plain.path(),
             "edit_file"
         ));
         // Git presence never changes whether a command asks.
         assert!(!asks(
             AppMode::Agent,
-            ApprovalMode::Suggest,
+            ApprovalMode::AcceptEdits,
             plain.path(),
             "exec_shell"
         ));

crates/engine/src/core/engine.rs

@@ -1299,8 +1299,9 @@ impl LiveRuntimeAuthority {
             match mode {
                 ApprovalMode::Never => 0,
                 ApprovalMode::Suggest => 1,
-                ApprovalMode::Auto => 2,
-                ApprovalMode::Bypass => 3,
+                ApprovalMode::AcceptEdits => 2,
+                ApprovalMode::Auto => 3,
+                ApprovalMode::Bypass => 4,
             }
         }
         fn sandbox_rank(mode: Option<&str>) -> Option<u8> {
@@ -10732,9 +10733,10 @@ fn tool_ask_rule_decision_for_context(
     let cwd = workspace.to_string_lossy();
     let ask_for_approval = match approval_mode {
         ApprovalMode::Never => AskForApproval::Never,
-        ApprovalMode::Auto | ApprovalMode::Bypass | ApprovalMode::Suggest => {
-            AskForApproval::OnFailure
-        }
+        ApprovalMode::Auto
+        | ApprovalMode::Bypass
+        | ApprovalMode::Suggest
+        | ApprovalMode::AcceptEdits => AskForApproval::OnFailure,
     };
     let decision = exec_policy_engine
         .check(ExecPolicyContext {

crates/engine/src/core/engine/tests/test_cases_09.rs

@@ -153,14 +153,14 @@ fn generic_required_tools_keep_auto_approve_behavior() {
 }
 
 #[test]
-fn workspace_write_carve_out_covers_the_default_ask_posture_only() {
-    // #5185: an in-workspace edit under the default posture does not prompt;
+fn workspace_write_carve_out_covers_accept_edits_only() {
+    // #5185: an in-workspace edit under Accept Edits does not prompt;
     // out-of-tree, sensitive, and `.git` targets keep the modal; shell and
     // non-write tools never qualify.
     let tmp = tempdir().expect("tempdir");
     std::fs::create_dir(tmp.path().join(".git")).expect("git marker");
     let workspace = tmp.path();
-    let ask = (AppMode::Agent, ApprovalMode::Suggest, false);
+    let ask = (AppMode::Agent, ApprovalMode::AcceptEdits, false);
     let carve_out = |tool: &str, input: &serde_json::Value| {
         workspace_write_carve_out_applies(
             ask.0,
@@ -198,12 +198,14 @@ fn workspace_write_carve_out_covers_the_default_ask_posture_only() {
         &json!({"action": "read", "path": "src/main.rs"})
     ));
 
-    // Full Access, Auto-Review, Never, and Plan are untouched by the carve-out.
+    // Ask, Full Access, Auto-Review, Never, and Plan are untouched by the
+    // carve-out.
     for (mode, approval_mode, auto_approve) in [
+        (AppMode::Agent, ApprovalMode::Suggest, false),
         (AppMode::Agent, ApprovalMode::Bypass, true),
         (AppMode::Agent, ApprovalMode::Auto, false),
         (AppMode::Agent, ApprovalMode::Never, false),
-        (AppMode::Plan, ApprovalMode::Suggest, false),
+        (AppMode::Plan, ApprovalMode::AcceptEdits, false),
     ] {
         assert!(
             !workspace_write_carve_out_applies(

crates/engine/src/core/engine/tool_preparation.rs

@@ -89,7 +89,7 @@ pub(super) fn prepare_tool_call(
                 (context.auto_approve, context.approval_mode)
             });
             let can_ask = posture.is_none_or(|(auto_approve, approval_mode)| {
-                approval_mode == ApprovalMode::Suggest
+                approval_mode.is_ask_family()
                     || auto_approve
                     || approval_mode == ApprovalMode::Bypass
             });

crates/engine/src/core/engine/turn_loop.rs

@@ -519,7 +519,7 @@ pub(super) fn registered_tool_approval_required(
 
 /// The engine-side half of the in-workspace write carve-out (#5185): true
 /// when a `Suggest`-tier call is a canonical file-write tool whose targets
-/// all qualify under the default Ask posture. Callers still honor
+/// all qualify under the Accept Edits posture. Callers still honor
 /// `approval_force_prompt`, typed ask-rules, the built-in safety floor, and
 /// repo law after this answer.
 #[must_use]
@@ -564,13 +564,14 @@ pub(super) fn call_forces_prompt(
         || crate::tools::approval_cache::computer_use_user_gate(tool_name, input).is_some()
 }
 
-/// Repo-law `ask` rules require a human decision. Only Ask posture can open
-/// that decision; every autonomous or no-prompt posture must fail closed.
+/// Repo-law `ask` rules require a human decision. Only Ask and Accept Edits
+/// can open that decision; every autonomous or no-prompt posture must fail
+/// closed.
 pub(super) fn repo_law_must_block_without_prompt(
     approval_mode: ApprovalMode,
     auto_approve: bool,
 ) -> bool {
-    auto_approve || approval_mode != ApprovalMode::Suggest
+    auto_approve || !approval_mode.is_ask_family()
 }
 
 pub(super) fn requested_sandbox_escalation(
@@ -2160,7 +2161,7 @@ impl Engine {
                 tool_input = prepared.call.input;
                 resources = prepared.call.resources;
 
-                // #5185: in the default Ask posture, a file write whose
+                // #5185: in Accept Edits, a file write whose
                 // every target stays inside the workspace git work tree —
                 // off `.git` internals, runtime state, and sensitive files
                 // — runs without a modal. Everything evaluated after this
@@ -2532,9 +2533,7 @@ impl Engine {
                             "sandbox escalation requires an effective tool context",
                         ));
                     }
-                    Ok(Some((_policy, justification)))
-                        if batch_approval_mode == ApprovalMode::Suggest =>
-                    {
+                    Ok(Some((_policy, justification))) if batch_approval_mode.is_ask_family() => {
                         let escalation_description = format!(
                             "Sandbox escalation to '{}' for this exact call: {justification}",
                             tool_input["sandbox_permissions"]
@@ -2572,7 +2571,7 @@ impl Engine {
             {
                 if matches!(
                     batch_approval_mode,
-                    ApprovalMode::Suggest | ApprovalMode::Bypass
+                    ApprovalMode::Suggest | ApprovalMode::AcceptEdits | ApprovalMode::Bypass
                 ) {
                     approval_required = true;
                     approval_force_prompt = true;

crates/engine/src/core/protocol_parity.rs

@@ -79,6 +79,7 @@ pub fn approval_mode_str(mode: ApprovalMode) -> &'static str {
         ApprovalMode::Auto => "auto",
         ApprovalMode::Bypass => "bypass",
         ApprovalMode::Suggest => "suggest",
+        ApprovalMode::AcceptEdits => "accept_edits",
         ApprovalMode::Never => "never",
     }
 }
@@ -1868,6 +1869,7 @@ mod tests {
             ApprovalMode::Auto,
             ApprovalMode::Bypass,
             ApprovalMode::Suggest,
+            ApprovalMode::AcceptEdits,
             ApprovalMode::Never,
         ] {
             assert_eq!(

crates/execpolicy/src/approval_mode.rs

@@ -1,6 +1,6 @@
-//! The user-facing approval posture (`Ask` / `Auto-Review` / `Full Access` /
-//! `Never`). Lives beside `AskForApproval` so policy code and the TUI share
-//! one definition; the TUI adds only presentation on top.
+//! The user-facing approval posture (`Ask` / `Accept Edits` / `Auto-Review` /
+//! `Full Access` / `Never`). Lives beside `AskForApproval` so policy code and
+//! the TUI share one definition; the TUI adds only presentation on top.
 
 /// Determines when tool executions require user approval
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
@@ -12,6 +12,7 @@ pub enum ApprovalMode {
     /// Suggest approval for non-safe tools (non-YOLO modes)
     #[default]
     Suggest,
+    AcceptEdits,
     /// Never execute tools requiring approval
     Never,
 }
@@ -25,14 +26,21 @@ impl ApprovalMode {
         }
     }
 
-    /// Shift+Tab permission cycle order (#0.8.68 M2).
-    pub const PERMISSION_CYCLE: [Self; 3] = [Self::Suggest, Self::Auto, Self::Bypass];
+    /// Shift+Tab permission cycle order (#0.8.68 M2), narrowest first.
+    pub const PERMISSION_CYCLE: [Self; 4] =
+        [Self::Suggest, Self::AcceptEdits, Self::Auto, Self::Bypass];
+
+    #[must_use]
+    pub fn is_ask_family(self) -> bool {
+        matches!(self, Self::Suggest | Self::AcceptEdits)
+    }
 
     pub fn label(self) -> &'static str {
         match self {
             ApprovalMode::Auto => "AUTO",
             ApprovalMode::Bypass => "BYPASS",
             ApprovalMode::Suggest => "SUGGEST",
+            ApprovalMode::AcceptEdits => "ACCEPT_EDITS",
             ApprovalMode::Never => "NEVER",
         }
     }
@@ -47,6 +55,9 @@ impl ApprovalMode {
             "suggest" | "suggested" | "on-request" | "untrusted" | "ask" => {
                 Some(ApprovalMode::Suggest)
             }
+            "accept-edits" | "accept_edits" | "acceptedits" | "edits" => {
+                Some(ApprovalMode::AcceptEdits)
+            }
             "never" | "deny" | "denied" => Some(ApprovalMode::Never),
             _ => None,
         }
@@ -56,7 +67,7 @@ impl ApprovalMode {
     pub fn agent_baseline_sandbox_mode(self) -> &'static str {
         match self {
             Self::Bypass => "danger-full-access",
-            Self::Auto | Self::Suggest | Self::Never => "workspace-write",
+            Self::Auto | Self::Suggest | Self::AcceptEdits | Self::Never => "workspace-write",
         }
     }
 
@@ -72,6 +83,7 @@ impl ApprovalMode {
     pub fn permission_chip_label(self) -> &'static str {
         match self {
             Self::Suggest => "Ask",
+            Self::AcceptEdits => "Accept Edits",
             Self::Auto => "Auto-Review",
             Self::Bypass => "Full Access",
             Self::Never => "Never",
@@ -117,12 +129,17 @@ mod tests {
             ApprovalMode::PERMISSION_CYCLE,
             [
                 ApprovalMode::Suggest,
+                ApprovalMode::AcceptEdits,
                 ApprovalMode::Auto,
                 ApprovalMode::Bypass
             ]
         );
         assert_eq!(
             ApprovalMode::Suggest.cycle_permission_next(),
+            ApprovalMode::AcceptEdits
+        );
+        assert_eq!(
+            ApprovalMode::AcceptEdits.cycle_permission_next(),
             ApprovalMode::Auto
         );
         assert_eq!(

crates/localization/locales/ca.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "Torna enrere fins a un missatge anterior de l'usuari (Esquerra/Dreta per anar pas a pas, Enter per rebobinar)",
   "KbCompleteCycleModes": "Completa /command o canvia de mode quan el redactor és buit (Plan → Work → Operate)",
   "KbCycleThinking": "Canvia l'esforç de raonament del proveïdor actiu (Ctrl+T)",
-  "KbCyclePermissions": "Canvia l'accés: Pregunta → Revisió automàtica → Accés complet (Maj+Tab)",
+  "KbCyclePermissions": "Canvia l'accés: Pregunta → Accepta edicions → Revisió automàtica → Accés complet (Maj+Tab)",
   "KbJumpPlanAgentYolo": "Activa les ranures de la Hotbar",
   "KbAltJumpPlanAgentYolo": "Salta a Plan / Work o demana Full Access (àlies heretat)",
   "KbFocusSidebar": "Enfoca el panell de la barra de treball Tasks / Agents / Context / Pinned",
@@ -997,7 +997,7 @@
   "HomeModeTips": "Consells de mode",
   "HomeAgentModeTip": "Work — treball directe a la sessió actual amb eines",
   "HomeAgentModeReviewTip": "  /mode plan per investigar i presentar un pla primer",
-  "HomeAgentModeYoloTip": "  Shift+Tab canvia el permís: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab canvia el permís: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — les eines s'executen sense demanar aprovació",
   "HomeYoloModeCaution": "  Les operacions destructives poden executar-se a l'instant; prefereix Ask si tens dubtes",
   "HomePlanModeTip": "Plan — investiga i dissenya abans d'implementar",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "només lectura",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "mai",
   "PermissionsChangedReceipt": "Permisos canviats a {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "espai de treball",
   "StatusApprovalAsk": "preguntar",
   "StatusApprovalAuto": "revisió automàtica",
+  "StatusApprovalAcceptEdits": "accepta edicions",
   "StatusApprovalFullAccess": "accés total",
   "StatusApprovalNever": "mai",
   "StatusMcpConfigured": "{count} configurats",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} de nou per enviar ara · {steer} dirigeix",
   "PermissionsPostureHeader": "Accés ara: {posture}",
   "PermissionsPostureAsk": "Ask: les crides a tool que canvien autoritat, cost, abast o resultat obren un avís; les crides de només lectura provadament segures s'executen sense. Les regles ask de dalt sempre forcen un avís.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: les edicions de fitxers amb tots els destins dins del repositori git d'aquesta carpeta s'executen sense avís (mai .git, .codewhale, .env ni fitxers de credencials); les ordres, la xarxa, les aplicacions connectades i la resta obren un avís com a Ask. Les regles ask de dalt sempre forcen un avís.",
   "PermissionsPostureAuto": "Auto-Review: mai obre un avís. Una política determinista permet crides provadament segures i bloqueja de manera estricta feina de publicació o destructiva en segon pla; les crides que no pot provar segures van a un guardià del model d'una sola passada, que permet o denega amb un motiu declarat (el risc alt o crític mai s'executa automàticament; una revisió fallida denega, fail closed). Les retencions que requereixen una persona es deneguen, no s'amaguen. Cada decisió d'aquestes s'escriu a la transcripció com a nota i al registre d'auditoria.",
   "PermissionsPostureBypass": "Full Access: les crides a tool ordinàries s'executen sense avisos. Les retencions no evitables de seguretat, llei del repositori i política gestionada fan fail closed com a bloquejos estrictes en lloc de preguntar.",
   "PermissionsPostureNever": "never: només s'executen les tools considerades segures/de només lectura; tota la resta es bloqueja sense avís.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Desactivat",
   "ConfigValueProviderDefault": "Predeterminat del proveïdor",
   "ConfigChoiceAsk": "Pregunta",
+  "ConfigChoiceAcceptEdits": "Accepta edicions",
   "ConfigChoiceAutoReview": "Revisió automàtica",
   "ConfigChoiceUseTuiDefault": "Usa el permís predeterminat de la TUI",
   "ConfigChoiceFullAccess": "Accés total",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Punts animats",
   "ConfigChoiceDiffFull": "Diff complet",
   "ConfigChoiceDiffSummary": "Resum",
-  "ConfigChoiceDetailAsk": "Pregunta abans d'eines que poden fer canvis importants.",
+  "ConfigChoiceDetailAsk": "Pregunta abans de cada edició de fitxer i cada ordre.",
+  "ConfigChoiceDetailAcceptEdits": "Les edicions dins d'aquest repositori git s'executen sense preguntar; les ordres continuen preguntant.",
   "ConfigChoiceDetailAutoReview": "Revisa el risc de les eines automàticament i pregunta quan una decisió et necessita.",
   "ConfigChoiceDetailUseTuiDefault": "Treu la sobreescriptura del config arrel i usa la tria de permís desada a la TUI.",
   "ConfigChoiceDetailFullAccess": "Executa eines sense demanar aprovació; les regles de l'espai de treball continuen aplicant-se.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Com vols continuar?",
   "PlanHandoffWorkAsk": "Work (Pregunta)",
   "PlanHandoffWorkAskDetail": "Comença amb el pla. Les edicions i les ordres et demanen permís abans.",
+  "PlanHandoffWorkAcceptEdits": "Work (Accepta edicions)",
+  "PlanHandoffWorkAcceptEditsDetail": "Comença amb el pla. Les edicions d'aquest repositori s'executen sense preguntar; les ordres et demanen permís abans.",
   "PlanHandoffWorkAuto": "Work (Revisió automàtica)",
   "PlanHandoffWorkAutoDetail": "Comença amb el pla. Les accions de risc es revisen automàticament i encara et poden preguntar.",
   "PlanHandoffKeepPlanning": "Continua planificant",

crates/localization/locales/de.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "Zu einer früheren Benutzernachricht zurückspringen (Links/Rechts schrittweise, Enter zum Zurückspulen)",
   "KbCompleteCycleModes": "/Befehl vervollständigen oder Modi wechseln, wenn der Composer leer ist (Plan → Work → Operate)",
   "KbCycleThinking": "Reasoning-Stufe des aktiven Providers wechseln (Ctrl+T)",
-  "KbCyclePermissions": "Zugriff wechseln: Nachfragen → Auto-Review → Voller Zugriff (Umschalt+Tab)",
+  "KbCyclePermissions": "Zugriff wechseln: Nachfragen → Änderungen annehmen → Auto-Review → Voller Zugriff (Umschalt+Tab)",
   "KbJumpPlanAgentYolo": "Hotbar-Slots auslösen",
   "KbAltJumpPlanAgentYolo": "Zu Plan / Work springen oder Full Access anfordern (Legacy-Alias)",
   "KbFocusSidebar": "Leisten-Panel Tasks / Agents / Context / Pinned fokussieren",
@@ -997,7 +997,7 @@
   "HomeModeTips": "Modus-Tipps",
   "HomeAgentModeTip": "Work — direkte Arbeit in der aktuellen Sitzung mit Tools",
   "HomeAgentModeReviewTip": "  /mode plan, um zuerst zu recherchieren und einen Plan vorzulegen",
-  "HomeAgentModeYoloTip": "  Shift+Tab wechselt Berechtigung: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab wechselt Berechtigung: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — Tools laufen ohne Freigabeaufforderungen",
   "HomeYoloModeCaution": "  Destruktive Operationen können sofort laufen; im Zweifel Ask bevorzugen",
   "HomePlanModeTip": "Plan — recherchieren und entwerfen vor dem Implementieren",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "nur lesen",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "nie",
   "PermissionsChangedReceipt": "Berechtigungen geändert auf {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "Arbeitsbereich",
   "StatusApprovalAsk": "nachfragen",
   "StatusApprovalAuto": "Auto-Prüfung",
+  "StatusApprovalAcceptEdits": "Änderungen annehmen",
   "StatusApprovalFullAccess": "Vollzugriff",
   "StatusApprovalNever": "nie",
   "StatusMcpConfigured": "{count} konfiguriert",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} erneut zum Sofortsenden · {steer} steuert",
   "PermissionsPostureHeader": "Zugriff jetzt: {posture}",
   "PermissionsPostureAsk": "Ask: Tool-Aufrufe, die Befugnis, Kosten, Umfang oder Ergebnis ändern, öffnen eine Abfrage; nachweislich sichere Nur-Lese-Aufrufe laufen ohne. Die ask-Regeln oben erzwingen immer eine Abfrage.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: Dateiänderungen, deren Ziele alle innerhalb des git-Repositorys dieses Ordners liegen, laufen ohne Abfrage (nie .git, .codewhale, .env oder Zugangsdaten-Dateien); Befehle, Netzwerk, verbundene Apps und alles andere lösen wie bei Ask eine Abfrage aus. Die ask-Regeln oben erzwingen immer eine Abfrage.",
   "PermissionsPostureAuto": "Auto-Review: öffnet nie eine Abfrage. Eine deterministische Richtlinie erlaubt nachweislich sichere Aufrufe und blockiert veröffentlichungsartige oder destruktive Hintergrundarbeit hart; Aufrufe, die sie nicht als sicher beweisen kann, gehen an einen einmaligen Modell-Guardian, der mit Begründung erlaubt oder ablehnt (hohes oder kritisches Risiko läuft nie automatisch; eine fehlgeschlagene Prüfung lehnt ab, fail closed). Zurückhaltungen, die eine Person erfordern, werden abgelehnt, nicht versteckt. Jede solche Entscheidung wird als Notiz ins Transkript und ins Audit-Log geschrieben.",
   "PermissionsPostureBypass": "Full Access: gewöhnliche Tool-Aufrufe laufen ohne Abfragen. Nicht umgehbare Zurückhaltungen aus Sicherheit, Repository-Recht und verwalteter Richtlinie schlagen als harte Blockaden fail closed fehl, statt zu fragen.",
   "PermissionsPostureNever": "never: nur als sicher/nur-lesend eingestufte Tools laufen; alles andere wird ohne Abfrage blockiert.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Aus",
   "ConfigValueProviderDefault": "Anbieter-Standard",
   "ConfigChoiceAsk": "Nachfragen",
+  "ConfigChoiceAcceptEdits": "Änderungen annehmen",
   "ConfigChoiceAutoReview": "Automatische Prüfung",
   "ConfigChoiceUseTuiDefault": "TUI-Berechtigungsstandard verwenden",
   "ConfigChoiceFullAccess": "Vollzugriff",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Animierte Punkte",
   "ConfigChoiceDiffFull": "Vollständiger Diff",
   "ConfigChoiceDiffSummary": "Zusammenfassung",
-  "ConfigChoiceDetailAsk": "Fragt vor Werkzeugen nach, die folgenreiche Änderungen machen können.",
+  "ConfigChoiceDetailAsk": "Fragt vor jeder Dateiänderung und jedem Befehl nach.",
+  "ConfigChoiceDetailAcceptEdits": "Änderungen in diesem git-Repository laufen ohne Nachfrage; Befehle fragen weiterhin nach.",
   "ConfigChoiceDetailAutoReview": "Prüft das Werkzeugrisiko automatisch und fragt, wenn eine Entscheidung dich braucht.",
   "ConfigChoiceDetailUseTuiDefault": "Entfernt den Override der Root-Konfiguration und nutzt die gespeicherte TUI-Berechtigungswahl.",
   "ConfigChoiceDetailFullAccess": "Führt Werkzeuge ohne Freigabeabfragen aus; Arbeitsbereichsregeln gelten weiterhin.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Wie möchtest du fortfahren?",
   "PlanHandoffWorkAsk": "Work (Nachfragen)",
   "PlanHandoffWorkAskDetail": "Mit dem Plan beginnen. Änderungen und Befehle fragen vorher nach.",
+  "PlanHandoffWorkAcceptEdits": "Work (Änderungen annehmen)",
+  "PlanHandoffWorkAcceptEditsDetail": "Mit dem Plan beginnen. Änderungen in diesem Repository laufen ohne Nachfrage; Befehle fragen vorher nach.",
   "PlanHandoffWorkAuto": "Work (Auto-Review)",
   "PlanHandoffWorkAutoDetail": "Mit dem Plan beginnen. Riskante Aktionen werden automatisch geprüft und können trotzdem nachfragen.",
   "PlanHandoffKeepPlanning": "Weiter planen",

crates/localization/locales/en.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "Rewind to an earlier message (Left/Right steps, Enter rewinds)",
   "KbCompleteCycleModes": "Complete commands, or cycle modes on empty input (Plan → Work → Operate)",
   "KbCycleThinking": "Cycle reasoning effort (Ctrl+T)",
-  "KbCyclePermissions": "Cycle Access: Ask → Auto-Review → Full Access (Shift+Tab)",
+  "KbCyclePermissions": "Cycle Access: Ask → Accept Edits → Auto-Review → Full Access (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Trigger hotbar slots",
   "KbAltJumpPlanAgentYolo": "Jump to Plan/Work, or request Full Access (legacy alias)",
   "KbFocusSidebar": "Focus the Tasks / Agents / Context / Pinned workbar panel",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "Mode Tips",
   "HomeAgentModeTip": "Work — makes the changes you ask for, with tools",
   "HomeAgentModeReviewTip": "  /mode plan to research and present a plan first",
-  "HomeAgentModeYoloTip": "  Shift+Tab cycles permission: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab cycles permission: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — tools run without asking first",
   "HomeYoloModeCaution": "  Destructive operations can run immediately; prefer Ask when unsure",
   "HomePlanModeTip": "Plan — research and design first",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "read only",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "Permissions changed to {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "workspace",
   "StatusApprovalAsk": "ask",
   "StatusApprovalAuto": "auto-review",
+  "StatusApprovalAcceptEdits": "accept edits",
   "StatusApprovalFullAccess": "full access",
   "StatusApprovalNever": "never",
   "StatusMcpConfigured": "{count} configured",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} again to send now · {steer} steers",
   "PermissionsPostureHeader": "Access now: {posture}",
   "PermissionsPostureAsk": "Ask: tool calls that change authority, cost, scope, or outcome open a prompt; proven-safe read-only calls run without one. Ask rules above always force a prompt.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: file edits whose every target stays inside this folder's git repository run without a prompt (never .git, .codewhale, .env or credential files); commands, network, connected apps and everything else prompt as in Ask. Ask rules above always force a prompt.",
   "PermissionsPostureAuto": "Auto-Review: never opens a prompt. A deterministic policy allows proven-safe calls and hard-blocks publish-like or destructive background work; calls it cannot prove safe go to a one-shot model guardian that allows or denies with a stated reason (high or critical risk never auto-runs; a failed review denies, fail closed). Holds that require a person are denied, not hidden. Each such decision is written to the transcript as a note and to the audit log.",
   "PermissionsPostureBypass": "Full Access: ordinary tool calls run without prompts. Non-bypassable registered holds auto-approve. Repository-law and managed-policy holds fail closed as hard blocks instead of prompting.",
   "PermissionsPostureNever": "never: only tools considered safe/read-only run; everything else is blocked without a prompt.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Off",
   "ConfigValueProviderDefault": "Provider default",
   "ConfigChoiceAsk": "Ask",
+  "ConfigChoiceAcceptEdits": "Accept Edits",
   "ConfigChoiceAutoReview": "Auto-Review",
   "ConfigChoiceUseTuiDefault": "Use TUI permission default",
   "ConfigChoiceFullAccess": "Full Access",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Animated dots",
   "ConfigChoiceDiffFull": "Full diff",
   "ConfigChoiceDiffSummary": "Summary",
-  "ConfigChoiceDetailAsk": "Ask before tools that can make consequential changes.",
+  "ConfigChoiceDetailAsk": "Asks before every file edit and every command.",
+  "ConfigChoiceDetailAcceptEdits": "Edits inside this git repository run without asking; commands still ask.",
   "ConfigChoiceDetailAutoReview": "Review tool risk automatically and ask when a decision needs you.",
   "ConfigChoiceDetailUseTuiDefault": "Drop the raw config override; use the saved choice.",
   "ConfigChoiceDetailFullAccess": "Run tools without approval prompts; workspace rules still apply.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "How do you want to continue?",
   "PlanHandoffWorkAsk": "Work (Ask)",
   "PlanHandoffWorkAskDetail": "Start on the plan. Edits and commands ask you first.",
+  "PlanHandoffWorkAcceptEdits": "Work (Accept Edits)",
+  "PlanHandoffWorkAcceptEditsDetail": "Start on the plan. Edits in this repository run without asking; commands ask you first.",
   "PlanHandoffWorkAuto": "Work (Auto-Review)",
   "PlanHandoffWorkAutoDetail": "Start on the plan. Risky actions are reviewed automatically and may still ask you.",
   "PlanHandoffKeepPlanning": "Keep planning",

crates/localization/locales/es-419.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "Retroceder al mensaje anterior del usuario (izquierda/derecha, Enter para rebobinar)",
   "KbCompleteCycleModes": "Completar /command o ciclar modos cuando el compositor está vacío (Plan → Work → Operate)",
   "KbCycleThinking": "Alternar el esfuerzo de razonamiento del proveedor activo (Ctrl+T)",
-  "KbCyclePermissions": "Cambiar acceso: Preguntar → Revisión automática → Acceso total (Shift+Tab)",
+  "KbCyclePermissions": "Cambiar acceso: Preguntar → Aceptar ediciones → Revisión automática → Acceso total (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Activar ranuras de la hotbar",
   "KbAltJumpPlanAgentYolo": "Saltar a Plan / Work o solicitar acceso total (alias heredado)",
   "KbFocusSidebar": "Enfocar el panel de la barra de trabajo Tasks / Agents / Context / Pinned",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "Tips de Modo",
   "HomeAgentModeTip": "Work — trabajo directo en la sesión actual con herramientas",
   "HomeAgentModeReviewTip": "  /mode plan para investigar y presentar un plan primero",
-  "HomeAgentModeYoloTip": "  Shift+Tab cicla permiso: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab cicla permiso: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + acceso total — herramientas sin pedir aprobación",
   "HomeYoloModeCaution": "  Las operaciones destructivas pueden correr al instante; usa Ask si dudas",
   "HomePlanModeTip": "Plan — investiga y diseña antes de implementar",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "solo lectura",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "Permisos cambiados a {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "espacio de trabajo",
   "StatusApprovalAsk": "preguntar",
   "StatusApprovalAuto": "revisión automática",
+  "StatusApprovalAcceptEdits": "aceptar ediciones",
   "StatusApprovalFullAccess": "acceso total",
   "StatusApprovalNever": "nunca",
   "StatusMcpConfigured": "{count} configurados",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} de nuevo para enviar ahora · {steer} dirige",
   "PermissionsPostureHeader": "Acceso ahora: {posture}",
   "PermissionsPostureAsk": "Ask: las llamadas a tool que cambian autoridad, costo, alcance o resultado abren un aviso; las llamadas de solo lectura comprobadamente seguras corren sin él. Las reglas ask de arriba siempre fuerzan un aviso.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: las ediciones de archivos cuyos destinos están todos dentro del repositorio git de esta carpeta corren sin aviso (nunca .git, .codewhale, .env ni archivos de credenciales); los comandos, la red, las apps conectadas y todo lo demás piden aviso como en Ask. Las reglas ask de arriba siempre fuerzan un aviso.",
   "PermissionsPostureAuto": "Auto-Review: nunca abre un aviso. Una política determinista permite llamadas comprobadamente seguras y bloquea de forma estricta trabajo de publicación o destructivo en segundo plano; las llamadas que no puede probar seguras van a un guardián de modelo de una sola pasada, que permite o deniega con un motivo declarado (riesgo alto o crítico nunca se ejecuta automáticamente; una revisión fallida deniega, fail closed). Las retenciones que requieren una persona se deniegan, no se ocultan. Cada decisión así se escribe en la transcripción como nota y en el registro de auditoría.",
   "PermissionsPostureBypass": "Full Access: las llamadas a tool comunes corren sin avisos. Las retenciones no eludibles de seguridad, ley del repositorio y política administrada hacen fail closed como bloqueos estrictos en lugar de preguntar.",
   "PermissionsPostureNever": "never: solo corren las tools consideradas seguras/solo lectura; todo lo demás se bloquea sin aviso.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Desactivado",
   "ConfigValueProviderDefault": "Predeterminado del proveedor",
   "ConfigChoiceAsk": "Preguntar",
+  "ConfigChoiceAcceptEdits": "Aceptar ediciones",
   "ConfigChoiceAutoReview": "Revisión automática",
   "ConfigChoiceUseTuiDefault": "Usar el permiso predeterminado de la TUI",
   "ConfigChoiceFullAccess": "Acceso total",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Puntos animados",
   "ConfigChoiceDiffFull": "Diff completo",
   "ConfigChoiceDiffSummary": "Resumen",
-  "ConfigChoiceDetailAsk": "Pregunta antes de herramientas que pueden hacer cambios importantes.",
+  "ConfigChoiceDetailAsk": "Pregunta antes de cada edición de archivo y cada comando.",
+  "ConfigChoiceDetailAcceptEdits": "Las ediciones dentro de este repositorio git se ejecutan sin preguntar; los comandos siguen preguntando.",
   "ConfigChoiceDetailAutoReview": "Revisa el riesgo de las herramientas automáticamente y pregunta cuando una decisión te necesita.",
   "ConfigChoiceDetailUseTuiDefault": "Quita la anulación del config raíz y usa la elección de permiso guardada en la TUI.",
   "ConfigChoiceDetailFullAccess": "Ejecuta herramientas sin pedir aprobación; las reglas del workspace siguen aplicando.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "¿Cómo quieres continuar?",
   "PlanHandoffWorkAsk": "Work (Preguntar)",
   "PlanHandoffWorkAskDetail": "Empieza con el plan. Las ediciones y los comandos te piden permiso antes.",
+  "PlanHandoffWorkAcceptEdits": "Work (Aceptar ediciones)",
+  "PlanHandoffWorkAcceptEditsDetail": "Empieza con el plan. Las ediciones de este repositorio corren sin preguntar; los comandos te piden permiso antes.",
   "PlanHandoffWorkAuto": "Work (Revisión automática)",
   "PlanHandoffWorkAutoDetail": "Empieza con el plan. Las acciones riesgosas se revisan automáticamente y aún pueden preguntarte.",
   "PlanHandoffKeepPlanning": "Seguir planificando",

crates/localization/locales/fr.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "Revenir à un message utilisateur précédent (Gauche/Droite pour naviguer, Enter pour rembobiner)",
   "KbCompleteCycleModes": "Compléter une /commande ou cycler les modes quand le composer est vide (Plan → Work → Operate)",
   "KbCycleThinking": "Cycler l'effort de raisonnement du fournisseur actif (Ctrl+T)",
-  "KbCyclePermissions": "Changer l'accès : Demander → Revue auto → Accès complet (Maj+Tab)",
+  "KbCyclePermissions": "Changer l'accès : Demander → Accepter les modifications → Revue auto → Accès complet (Maj+Tab)",
   "KbJumpPlanAgentYolo": "Déclencher les slots de la hotbar",
   "KbAltJumpPlanAgentYolo": "Aller à Plan / Work ou demander Full Access (alias hérité)",
   "KbFocusSidebar": "Cibler le panneau de la barre de travail Tasks / Agents / Context / Pinned",
@@ -997,7 +997,7 @@
   "HomeModeTips": "Conseils de mode",
   "HomeAgentModeTip": "Work — travail direct dans la session en cours avec les outils",
   "HomeAgentModeReviewTip": "  /mode plan pour d'abord rechercher et présenter un plan",
-  "HomeAgentModeYoloTip": "  Shift+Tab cycle la permission : Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab cycle la permission : Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — les outils s'exécutent sans demande d'approbation",
   "HomeYoloModeCaution": "  Les opérations destructives peuvent s'exécuter immédiatement ; préférez Ask en cas de doute",
   "HomePlanModeTip": "Plan — recherche et conception avant l'implémentation",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "lecture seule",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "jamais",
   "PermissionsChangedReceipt": "Permissions changées en {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "espace de travail",
   "StatusApprovalAsk": "demander",
   "StatusApprovalAuto": "examen automatique",
+  "StatusApprovalAcceptEdits": "accepter les modifications",
   "StatusApprovalFullAccess": "accès total",
   "StatusApprovalNever": "jamais",
   "StatusMcpConfigured": "{count} configurés",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} à nouveau pour envoyer maintenant · {steer} pilote",
   "PermissionsPostureHeader": "Accès actuel : {posture}",
   "PermissionsPostureAsk": "Ask : les appels de tool qui modifient l'autorité, le coût, la portée ou le résultat ouvrent une invite ; les appels en lecture seule prouvés sûrs s'exécutent sans. Les règles ask ci-dessus forcent toujours une invite.",
+  "PermissionsPostureAcceptEdits": "Accept Edits : les modifications de fichiers dont toutes les cibles restent dans le dépôt git de ce dossier s'exécutent sans invite (jamais .git, .codewhale, .env ni fichiers d'identifiants) ; les commandes, le réseau, les apps connectées et tout le reste ouvrent une invite comme dans Ask. Les règles ask ci-dessus forcent toujours une invite.",
   "PermissionsPostureAuto": "Auto-Review : n'ouvre jamais d'invite. Une politique déterministe autorise les appels prouvés sûrs et bloque fermement les travaux de publication ou destructifs en arrière-plan ; les appels qu'elle ne peut prouver sûrs vont à un gardien de modèle en une passe, qui autorise ou refuse avec un motif (un risque élevé ou critique ne s'exécute jamais automatiquement ; un examen échoué refuse, fail closed). Les retenues exigeant une personne sont refusées, pas cachées. Chaque décision est écrite dans la transcription sous forme de note et dans le journal d'audit.",
   "PermissionsPostureBypass": "Full Access : les appels de tool ordinaires s'exécutent sans invite. Les retenues non contournables de sécurité, de loi du dépôt et de politique gérée échouent fermées comme blocages durs au lieu de demander.",
   "PermissionsPostureNever": "never : seuls les tools jugés sûrs/en lecture seule s'exécutent ; tout le reste est bloqué sans invite.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Désactivé",
   "ConfigValueProviderDefault": "Valeur par défaut du fournisseur",
   "ConfigChoiceAsk": "Demander",
+  "ConfigChoiceAcceptEdits": "Accepter les modifications",
   "ConfigChoiceAutoReview": "Revue automatique",
   "ConfigChoiceUseTuiDefault": "Utiliser la permission par défaut de la TUI",
   "ConfigChoiceFullAccess": "Accès complet",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Points animés",
   "ConfigChoiceDiffFull": "Diff complet",
   "ConfigChoiceDiffSummary": "Résumé",
-  "ConfigChoiceDetailAsk": "Demande avant les outils qui peuvent faire des changements importants.",
+  "ConfigChoiceDetailAsk": "Demande avant chaque modification de fichier et chaque commande.",
+  "ConfigChoiceDetailAcceptEdits": "Les modifications dans ce dépôt git s'exécutent sans demander ; les commandes demandent toujours.",
   "ConfigChoiceDetailAutoReview": "Évalue automatiquement le risque des outils et demande quand une décision vous revient.",
   "ConfigChoiceDetailUseTuiDefault": "Retire la surcharge de la config racine et utilise le choix de permission enregistré dans la TUI.",
   "ConfigChoiceDetailFullAccess": "Exécute les outils sans demande d'approbation ; les règles de l'espace de travail s'appliquent toujours.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Comment voulez-vous continuer ?",
   "PlanHandoffWorkAsk": "Work (Demander)",
   "PlanHandoffWorkAskDetail": "Commencer le plan. Les modifications et les commandes demandent votre accord avant.",
+  "PlanHandoffWorkAcceptEdits": "Work (Accepter les modifications)",
+  "PlanHandoffWorkAcceptEditsDetail": "Commencer le plan. Les modifications dans ce dépôt s'exécutent sans demander ; les commandes demandent votre accord avant.",
   "PlanHandoffWorkAuto": "Work (Revue auto)",
   "PlanHandoffWorkAutoDetail": "Commencer le plan. Les actions risquées sont examinées automatiquement et peuvent encore demander votre accord.",
   "PlanHandoffKeepPlanning": "Continuer à planifier",

crates/localization/locales/hi.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "पिछले उपयोगकर्ता संदेश पर वापस जाएँ (Left/Right कदम, रिवाइंड के लिए Enter)",
   "KbCompleteCycleModes": "कम्पोज़र खाली होने पर /command पूरा करें या मोड बदलें (Plan → Work → Operate)",
   "KbCycleThinking": "सक्रिय प्रोवाइडर के लिए रीज़निंग स्तर बदलें (Ctrl+T)",
-  "KbCyclePermissions": "एक्सेस बदलें: पूछें → स्वतः समीक्षा → पूर्ण एक्सेस (Shift+Tab)",
+  "KbCyclePermissions": "एक्सेस बदलें: पूछें → बदलाव स्वीकारें → स्वतः समीक्षा → पूर्ण एक्सेस (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Hotbar स्लॉट ट्रिगर करें",
   "KbAltJumpPlanAgentYolo": "Plan / Work पर जाएँ या Full Access का अनुरोध करें (लेगेसी उपनाम)",
   "KbFocusSidebar": "Tasks / Agents / Context / Pinned वर्क बार पैनल फ़ोकस करें",
@@ -997,7 +997,7 @@
   "HomeModeTips": "मोड सुझाव",
   "HomeAgentModeTip": "Work — वर्तमान सत्र में टूल के साथ सीधा काम",
   "HomeAgentModeReviewTip": "  /mode plan से पहले शोध कर योजना प्रस्तुत करें",
-  "HomeAgentModeYoloTip": "  Shift+Tab अनुमति बदलता है: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab अनुमति बदलता है: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — टूल बिना अनुमति प्रॉम्प्ट के चलते हैं",
   "HomeYoloModeCaution": "  विनाशकारी कार्रवाइयाँ तुरंत चल सकती हैं; संदेह हो तो Ask चुनें",
   "HomePlanModeTip": "Plan — कार्यान्वयन से पहले शोध और डिज़ाइन",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "केवल पठन",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "कभी नहीं",
   "PermissionsChangedReceipt": "अनुमतियाँ बदलकर {label} हुईं",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "वर्कस्पेस",
   "StatusApprovalAsk": "पूछें",
   "StatusApprovalAuto": "स्वतः समीक्षा",
+  "StatusApprovalAcceptEdits": "बदलाव स्वीकारें",
   "StatusApprovalFullAccess": "पूर्ण एक्सेस",
   "StatusApprovalNever": "कभी नहीं",
   "StatusMcpConfigured": "{count} कॉन्फ़िगर",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "अभी भेजने के लिए {enter} फिर दबाएँ · {steer} निर्देशित करता है",
   "PermissionsPostureHeader": "वर्तमान एक्सेस: {posture}",
   "PermissionsPostureAsk": "Ask: अधिकार, लागत, दायरा या परिणाम बदलने वाली tool कॉल प्रॉम्प्ट खोलती हैं; सिद्ध-सुरक्षित केवल-पढ़ने वाली कॉल बिना प्रॉम्प्ट चलती हैं। ऊपर के ask नियम हमेशा प्रॉम्प्ट लागू करते हैं।",
+  "PermissionsPostureAcceptEdits": "Accept Edits: जिन फ़ाइल बदलावों के सभी लक्ष्य इस फ़ोल्डर की git रिपॉज़िटरी के भीतर रहते हैं वे बिना प्रॉम्प्ट चलते हैं (.git, .codewhale, .env या क्रेडेंशियल फ़ाइलें कभी नहीं); कमांड, नेटवर्क, जुड़े ऐप और बाकी सब कुछ Ask की तरह प्रॉम्प्ट करता है। ऊपर के ask नियम हमेशा प्रॉम्प्ट लागू करते हैं।",
   "PermissionsPostureAuto": "Auto-Review: कभी प्रॉम्प्ट नहीं खोलता। नियतात्मक नीति सिद्ध-सुरक्षित कॉल की अनुमति देती है और प्रकाशन-जैसे या विनाशकारी पृष्ठभूमि कार्य को कड़ाई से अवरुद्ध करती है; जिन कॉल को सुरक्षित सिद्ध नहीं किया जा सकता वे एक-बार के मॉडल गार्जियन के पास जाती हैं जो कारण बताकर अनुमति देता या अस्वीकार करता है (उच्च या गंभीर जोखिम कभी स्वतः नहीं चलता; असफल समीक्षा fail closed के तहत अस्वीकार करती है)। जिन रोकों के लिए व्यक्ति चाहिए वे छिपाई नहीं जातीं, अस्वीकार की जाती हैं। ऐसा हर निर्णय ट्रांसक्रिप्ट में नोट के रूप में और ऑडिट लॉग में लिखा जाता है।",
   "PermissionsPostureBypass": "Full Access: सामान्य tool कॉल बिना प्रॉम्प्ट चलती हैं। जिन्हें दरकिनार नहीं किया जा सकता ऐसी सुरक्षा, रिपॉजिटरी-कानून और प्रबंधित-नीति की रोकें पूछने के बजाय कड़े अवरोध के रूप में fail closed होती हैं।",
   "PermissionsPostureNever": "never: केवल सुरक्षित/केवल-पढ़ने वाली मानी गई tool चलती हैं; बाकी सब बिना प्रॉम्प्ट अवरुद्ध होता है।",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "बंद",
   "ConfigValueProviderDefault": "प्रदाता का डिफ़ॉल्ट",
   "ConfigChoiceAsk": "पूछें",
+  "ConfigChoiceAcceptEdits": "बदलाव स्वीकारें",
   "ConfigChoiceAutoReview": "स्वचालित समीक्षा",
   "ConfigChoiceUseTuiDefault": "TUI की डिफ़ॉल्ट अनुमति उपयोग करें",
   "ConfigChoiceFullAccess": "पूर्ण पहुँच",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "चलते बिंदु",
   "ConfigChoiceDiffFull": "पूरा diff",
   "ConfigChoiceDiffSummary": "सारांश",
-  "ConfigChoiceDetailAsk": "ऐसे टूल से पहले पूछता है जो बड़े बदलाव कर सकते हैं।",
+  "ConfigChoiceDetailAsk": "हर फ़ाइल बदलाव और हर कमांड से पहले पूछता है।",
+  "ConfigChoiceDetailAcceptEdits": "इस git रिपॉज़िटरी के भीतर के बदलाव बिना पूछे चलते हैं; कमांड अब भी पूछते हैं।",
   "ConfigChoiceDetailAutoReview": "टूल के जोखिम की स्वतः समीक्षा करता है और निर्णय आपकी ज़रूरत होने पर पूछता है।",
   "ConfigChoiceDetailUseTuiDefault": "रूट config का अधिभाव हटाकर TUI में सहेजी गई अनुमति का विकल्प उपयोग करता है।",
   "ConfigChoiceDetailFullAccess": "अनुमोदन के संकेत के बिना टूल चलाता है; कार्यक्षेत्र के नियम फिर भी लागू रहते हैं।",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "आप आगे कैसे बढ़ना चाहते हैं?",
   "PlanHandoffWorkAsk": "Work (पूछें)",
   "PlanHandoffWorkAskDetail": "योजना पर काम शुरू करें। बदलाव और कमांड पहले आपसे पूछते हैं।",
+  "PlanHandoffWorkAcceptEdits": "Work (बदलाव स्वीकारें)",
+  "PlanHandoffWorkAcceptEditsDetail": "योजना पर काम शुरू करें। इस रिपॉज़िटरी के बदलाव बिना पूछे चलते हैं; कमांड पहले आपसे पूछते हैं।",
   "PlanHandoffWorkAuto": "Work (स्वतः समीक्षा)",
   "PlanHandoffWorkAutoDetail": "योजना पर काम शुरू करें। जोखिम वाले कामों की स्वतः समीक्षा होती है और वे फिर भी आपसे पूछ सकते हैं।",
   "PlanHandoffKeepPlanning": "योजना बनाना जारी रखें",

crates/localization/locales/id.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "Mundur ke pesan pengguna sebelumnya (Left/Right berpindah, Enter untuk memutar balik)",
   "KbCompleteCycleModes": "Lengkapi /command atau ganti mode saat komposer kosong (Plan → Work → Operate)",
   "KbCycleThinking": "Ganti upaya penalaran untuk penyedia aktif (Ctrl+T)",
-  "KbCyclePermissions": "Ubah akses: Tanya → Tinjauan otomatis → Akses penuh (Shift+Tab)",
+  "KbCyclePermissions": "Ubah akses: Tanya → Terima suntingan → Tinjauan otomatis → Akses penuh (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Picu slot hotbar",
   "KbAltJumpPlanAgentYolo": "Lompat ke Plan / Work atau minta akses penuh (alias lama)",
   "KbFocusSidebar": "Fokuskan panel bilah kerja Tasks / Agents / Context / Pinned",
@@ -997,7 +997,7 @@
   "HomeModeTips": "Kiat Mode",
   "HomeAgentModeTip": "Work — kerja langsung di sesi saat ini dengan alat",
   "HomeAgentModeReviewTip": "  /mode plan untuk meneliti dan menyajikan rencana dulu",
-  "HomeAgentModeYoloTip": "  Shift+Tab mengganti izin: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab mengganti izin: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — alat berjalan tanpa prompt persetujuan",
   "HomeYoloModeCaution": "  Operasi destruktif dapat langsung berjalan; pilih Ask bila ragu",
   "HomePlanModeTip": "Plan — teliti dan rancang sebelum mengimplementasikan",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "baca saja",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "Izin diubah ke {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "ruang kerja",
   "StatusApprovalAsk": "tanya",
   "StatusApprovalAuto": "tinjauan otomatis",
+  "StatusApprovalAcceptEdits": "terima suntingan",
   "StatusApprovalFullAccess": "akses penuh",
   "StatusApprovalNever": "jangan pernah",
   "StatusMcpConfigured": "{count} dikonfigurasi",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} lagi untuk kirim sekarang · {steer} mengarahkan",
   "PermissionsPostureHeader": "Akses saat ini: {posture}",
   "PermissionsPostureAsk": "Ask: panggilan tool yang mengubah wewenang, biaya, cakupan, atau hasil membuka prompt; panggilan hanya-baca yang terbukti aman berjalan tanpa prompt. Aturan ask di atas selalu memaksa prompt.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: suntingan file yang semua targetnya tetap di dalam repositori git folder ini berjalan tanpa prompt (tidak pernah .git, .codewhale, .env, atau file kredensial); perintah, jaringan, aplikasi terhubung, dan hal lainnya memunculkan prompt seperti di Ask. Aturan ask di atas selalu memaksa prompt.",
   "PermissionsPostureAuto": "Auto-Review: tidak pernah membuka prompt. Kebijakan deterministik mengizinkan panggilan yang terbukti aman dan memblokir keras pekerjaan latar belakang yang bersifat publikasi atau destruktif; panggilan yang tidak dapat dibuktikan aman diteruskan ke penjaga model sekali jalan yang mengizinkan atau menolak dengan alasan (risiko tinggi atau kritis tidak pernah berjalan otomatis; tinjauan gagal berarti ditolak, fail closed). Penahanan yang memerlukan manusia ditolak, bukan disembunyikan. Setiap keputusan seperti itu ditulis ke transkrip sebagai catatan dan ke log audit.",
   "PermissionsPostureBypass": "Full Access: panggilan tool biasa berjalan tanpa prompt. Penahanan keamanan, hukum repositori, dan kebijakan terkelola yang tidak dapat dilewati fail closed sebagai blokir keras alih-alih bertanya.",
   "PermissionsPostureNever": "never: hanya tool yang dianggap aman/hanya-baca yang berjalan; selebihnya diblokir tanpa prompt.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Nonaktif",
   "ConfigValueProviderDefault": "Bawaan penyedia",
   "ConfigChoiceAsk": "Tanya",
+  "ConfigChoiceAcceptEdits": "Terima suntingan",
   "ConfigChoiceAutoReview": "Tinjauan otomatis",
   "ConfigChoiceUseTuiDefault": "Gunakan izin bawaan TUI",
   "ConfigChoiceFullAccess": "Akses penuh",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Titik animasi",
   "ConfigChoiceDiffFull": "Diff lengkap",
   "ConfigChoiceDiffSummary": "Ringkasan",
-  "ConfigChoiceDetailAsk": "Bertanya sebelum alat yang dapat membuat perubahan besar.",
+  "ConfigChoiceDetailAsk": "Bertanya sebelum setiap suntingan file dan setiap perintah.",
+  "ConfigChoiceDetailAcceptEdits": "Suntingan di dalam repositori git ini berjalan tanpa bertanya; perintah tetap bertanya.",
   "ConfigChoiceDetailAutoReview": "Meninjau risiko alat secara otomatis dan bertanya saat keputusan membutuhkan Anda.",
   "ConfigChoiceDetailUseTuiDefault": "Menghapus penimpaan config akar dan memakai pilihan izin TUI yang tersimpan.",
   "ConfigChoiceDetailFullAccess": "Menjalankan alat tanpa permintaan persetujuan; aturan ruang kerja tetap berlaku.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Bagaimana Anda ingin melanjutkan?",
   "PlanHandoffWorkAsk": "Work (Tanya)",
   "PlanHandoffWorkAskDetail": "Mulai kerjakan rencana. Suntingan dan perintah meminta izin Anda dulu.",
+  "PlanHandoffWorkAcceptEdits": "Work (Terima suntingan)",
+  "PlanHandoffWorkAcceptEditsDetail": "Mulai kerjakan rencana. Suntingan di repositori ini berjalan tanpa bertanya; perintah meminta izin Anda dulu.",
   "PlanHandoffWorkAuto": "Work (Tinjauan otomatis)",
   "PlanHandoffWorkAutoDetail": "Mulai kerjakan rencana. Tindakan berisiko ditinjau otomatis dan masih bisa bertanya kepada Anda.",
   "PlanHandoffKeepPlanning": "Lanjutkan merencanakan",

crates/localization/locales/ja.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "前のユーザーメッセージに戻る（左右でステップ、Enter で巻き戻し）",
   "KbCompleteCycleModes": "/command を補完、または入力欄が空のときモードを切り替え（Plan → Work → Operate）",
   "KbCycleThinking": "現在のプロバイダーの推論強度を順に切り替え (Ctrl+T)",
-  "KbCyclePermissions": "アクセスを切り替え：確認 → 自動レビュー → フルアクセス（Shift+Tab）",
+  "KbCyclePermissions": "アクセスを切り替え：確認 → 編集を承認 → 自動レビュー → フルアクセス（Shift+Tab）",
   "KbJumpPlanAgentYolo": "ホットバースロットを起動",
   "KbAltJumpPlanAgentYolo": "Plan / Work へ移動、またはフルアクセスを要求（旧エイリアス）",
   "KbFocusSidebar": "Tasks / Agents / Context / Pinned ワークバーパネルにフォーカス",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "モードヒント",
   "HomeAgentModeTip": "Work — 現在のセッションでツールを使って直接作業",
   "HomeAgentModeReviewTip": "  先に計画するなら /mode plan",
-  "HomeAgentModeYoloTip": "  Shift+Tab で権限: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab で権限: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + フルアクセス — 承認なしでツール実行",
   "HomeYoloModeCaution": "  破壊的操作が即実行されることがあります。迷ったら Ask を",
   "HomePlanModeTip": "Plan — 実装前に調査と設計",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "読み取り専用",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "権限を {label} に変更しました",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "ワークスペース",
   "StatusApprovalAsk": "確認",
   "StatusApprovalAuto": "自動レビュー",
+  "StatusApprovalAcceptEdits": "編集を承認",
   "StatusApprovalFullAccess": "フルアクセス",
   "StatusApprovalNever": "常に拒否",
   "StatusMcpConfigured": "{count} 件設定済み",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "もう一度 {enter} で今すぐ送信 · {steer} で割り込み",
   "PermissionsPostureHeader": "現在のアクセス: {posture}",
   "PermissionsPostureAsk": "Ask: 権限・コスト・範囲・結果を変える tool 呼び出しはプロンプトを開きます。安全と証明された読み取り専用の呼び出しはプロンプトなしで実行されます。上記の ask ルールは常にプロンプトを強制します。",
+  "PermissionsPostureAcceptEdits": "Accept Edits: 対象がすべてこのフォルダーの git リポジトリ内に収まるファイル編集は、プロンプトなしで実行されます（.git、.codewhale、.env、認証情報ファイルは対象外）。コマンド、ネットワーク、接続済みアプリ、その他はすべて Ask と同様にプロンプトを開きます。上記の ask ルールは常にプロンプトを強制します。",
   "PermissionsPostureAuto": "Auto-Review: プロンプトは開きません。決定論的ポリシーが安全と証明された呼び出しを許可し、公開系や破壊的なバックグラウンド作業をハードブロックします。安全と証明できない呼び出しは一回限りのモデルガーディアンに送られ、理由付きで許可または拒否されます（高・重大リスクは自動実行されません。審査失敗はフェイルクローズで拒否）。人の判断が必要な保留は隠されず拒否されます。各判断はトランスクリプトのノートと監査ログに記録されます。",
   "PermissionsPostureBypass": "Full Access: 通常の tool 呼び出しはプロンプトなしで実行されます。回避不能な安全・リポジトリ法・管理ポリシーの保留は、プロンプトの代わりにハードブロックとしてフェイルクローズします。",
   "PermissionsPostureNever": "never: 安全・読み取り専用とみなされる tool のみ実行され、それ以外はプロンプトなしでブロックされます。",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "オフ",
   "ConfigValueProviderDefault": "プロバイダーの既定",
   "ConfigChoiceAsk": "確認する",
+  "ConfigChoiceAcceptEdits": "編集を承認",
   "ConfigChoiceAutoReview": "自動レビュー",
   "ConfigChoiceUseTuiDefault": "TUI の権限既定を使う",
   "ConfigChoiceFullAccess": "フルアクセス",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "アニメーションのドット",
   "ConfigChoiceDiffFull": "完全な差分",
   "ConfigChoiceDiffSummary": "要約",
-  "ConfigChoiceDetailAsk": "重大な変更を行えるツールの前に確認します。",
+  "ConfigChoiceDetailAsk": "ファイルの編集とコマンドの前に毎回確認します。",
+  "ConfigChoiceDetailAcceptEdits": "この git リポジトリ内の編集は確認なしで実行します。コマンドは引き続き確認します。",
   "ConfigChoiceDetailAutoReview": "ツールのリスクを自動で確認し、判断が必要なときだけ尋ねます。",
   "ConfigChoiceDetailUseTuiDefault": "ルート設定の上書きを外し、保存済みの TUI 権限設定を使います。",
   "ConfigChoiceDetailFullAccess": "承認プロンプトなしでツールを実行します。ワークスペースのルールは引き続き適用されます。",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "どのように進めますか？",
   "PlanHandoffWorkAsk": "Work（確認）",
   "PlanHandoffWorkAskDetail": "計画に着手します。編集やコマンドは事前に確認します。",
+  "PlanHandoffWorkAcceptEdits": "Work（編集を承認）",
+  "PlanHandoffWorkAcceptEditsDetail": "計画に着手します。このリポジトリ内の編集は確認なしで実行し、コマンドは事前に確認します。",
   "PlanHandoffWorkAuto": "Work（自動レビュー）",
   "PlanHandoffWorkAutoDetail": "計画に着手します。リスクのある操作は自動でレビューされ、確認を求めることもあります。",
   "PlanHandoffKeepPlanning": "計画を続ける",

crates/localization/locales/ko.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "이전 사용자 메시지로 되돌아가기 (Left/Right로 이동, Enter로 되감기)",
   "KbCompleteCycleModes": "/명령 완성 또는 입력창이 비어 있을 때 모드 순환 (계획 → 실행 → 운영)",
   "KbCycleThinking": "현재 프로바이더의 추론 강도 순환 전환 (Ctrl+T)",
-  "KbCyclePermissions": "액세스 전환: 확인 → 자동 검토 → 전체 액세스 (Shift+Tab)",
+  "KbCyclePermissions": "액세스 전환: 확인 → 편집 수락 → 자동 검토 → 전체 액세스 (Shift+Tab)",
   "KbJumpPlanAgentYolo": "핫바 슬롯 실행",
   "KbAltJumpPlanAgentYolo": "계획 / 실행 모드로 이동하거나 전체 권한 요청 (레거시 별칭)",
   "KbFocusSidebar": "Tasks / Agents / Context / Pinned 작업 바 패널에 포커스",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "모드 팁",
   "HomeAgentModeTip": "실행 — 도구를 사용해 현재 세션에서 바로 작업",
   "HomeAgentModeReviewTip": "  /mode plan으로 먼저 조사하고 계획을 제시",
-  "HomeAgentModeYoloTip": "  Shift+Tab으로 권한 순환: 확인 → 자동 검토 → 전체 권한",
+  "HomeAgentModeYoloTip": "  Shift+Tab으로 권한 순환: 확인 → 편집 수락 → 자동 검토 → 전체 권한",
   "HomeYoloModeTip": "실행 + 전체 권한 — 승인 없이 도구 실행",
   "HomeYoloModeCaution": "  파괴적인 작업이 즉시 실행될 수 있습니다. 확실하지 않으면 확인 모드를 사용하세요",
   "HomePlanModeTip": "계획 — 구현 전에 조사하고 설계",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "읽기 전용",
   "ChipPermissionAsk": "확인",
   "ChipPermissionAuto": "자동",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "허용 안 함",
   "PermissionsChangedReceipt": "권한이 {label}(으)로 변경되었습니다",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "작업 공간",
   "StatusApprovalAsk": "물어보기",
   "StatusApprovalAuto": "자동 검토",
+  "StatusApprovalAcceptEdits": "편집 수락",
   "StatusApprovalFullAccess": "전체 접근",
   "StatusApprovalNever": "허용 안 함",
   "StatusMcpConfigured": "{count}개 구성됨",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} 한 번 더로 지금 보내기 · {steer}는 방향 지시",
   "PermissionsPostureHeader": "현재 액세스: {posture}",
   "PermissionsPostureAsk": "Ask: 권한, 비용, 범위 또는 결과를 바꾸는 tool 호출은 프롬프트를 엽니다. 안전이 입증된 읽기 전용 호출은 프롬프트 없이 실행됩니다. 위의 ask 규칙은 항상 프롬프트를 강제합니다.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: 모든 대상이 이 폴더의 git 저장소 안에 있는 파일 편집은 프롬프트 없이 실행됩니다(.git, .codewhale, .env, 자격 증명 파일은 제외). 명령, 네트워크, 연결된 앱, 그 밖의 모든 것은 Ask처럼 프롬프트를 엽니다. 위의 ask 규칙은 항상 프롬프트를 강제합니다.",
   "PermissionsPostureAuto": "Auto-Review: 프롬프트를 열지 않습니다. 결정적 정책이 안전이 입증된 호출을 허용하고 게시성 또는 파괴적 백그라운드 작업을 강제 차단합니다. 안전을 입증할 수 없는 호출은 1회성 모델 가디언에게 넘어가 사유와 함께 허용 또는 거부됩니다(높음 또는 치명적 위험은 절대 자동 실행되지 않으며, 검토 실패 시 페일 클로즈로 거부). 사람이 필요한 보류는 숨기지 않고 거부합니다. 이런 결정은 모두 대화 기록에 노트로, 감사 로그에 기록됩니다.",
   "PermissionsPostureBypass": "Full Access: 일반 tool 호출은 프롬프트 없이 실행됩니다. 우회할 수 없는 안전, 저장소 규칙, 관리 정책 보류는 프롬프트 대신 강제 차단으로 페일 클로즈됩니다.",
   "PermissionsPostureNever": "never: 안전/읽기 전용으로 간주되는 tool만 실행되며, 나머지는 프롬프트 없이 차단됩니다.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "끔",
   "ConfigValueProviderDefault": "제공자 기본값",
   "ConfigChoiceAsk": "확인",
+  "ConfigChoiceAcceptEdits": "편집 수락",
   "ConfigChoiceAutoReview": "자동 검토",
   "ConfigChoiceUseTuiDefault": "TUI 권한 기본값 사용",
   "ConfigChoiceFullAccess": "전체 접근",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "움직이는 점",
   "ConfigChoiceDiffFull": "전체 diff",
   "ConfigChoiceDiffSummary": "요약",
-  "ConfigChoiceDetailAsk": "중대한 변경을 할 수 있는 도구 전에 확인합니다.",
+  "ConfigChoiceDetailAsk": "모든 파일 편집과 모든 명령 전에 확인합니다.",
+  "ConfigChoiceDetailAcceptEdits": "이 git 저장소 안의 편집은 묻지 않고 실행되며, 명령은 계속 확인합니다.",
   "ConfigChoiceDetailAutoReview": "도구 위험을 자동으로 검토하고 결정이 필요할 때만 묻습니다.",
   "ConfigChoiceDetailUseTuiDefault": "루트 설정 재정의를 제거하고 저장된 TUI 권한 선택을 사용합니다.",
   "ConfigChoiceDetailFullAccess": "승인 프롬프트 없이 도구를 실행합니다. 작업 공간 규칙은 계속 적용됩니다.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "어떻게 진행할까요?",
   "PlanHandoffWorkAsk": "Work (확인)",
   "PlanHandoffWorkAskDetail": "계획을 시작합니다. 편집과 명령은 먼저 확인을 요청합니다.",
+  "PlanHandoffWorkAcceptEdits": "Work (편집 수락)",
+  "PlanHandoffWorkAcceptEditsDetail": "계획을 시작합니다. 이 저장소의 편집은 묻지 않고 실행되며, 명령은 먼저 확인을 요청합니다.",
   "PlanHandoffWorkAuto": "Work (자동 검토)",
   "PlanHandoffWorkAutoDetail": "계획을 시작합니다. 위험한 작업은 자동으로 검토되며 확인을 요청할 수도 있습니다.",
   "PlanHandoffKeepPlanning": "계속 계획하기",

crates/localization/locales/pt-BR.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "Retroceder para mensagem anterior do usuário (esquerda/direita, Enter para rebobinar)",
   "KbCompleteCycleModes": "Completar /command ou ciclar modos quando o compositor estiver vazio (Plan → Work → Operate)",
   "KbCycleThinking": "Alternar o esforço de raciocínio do provedor ativo (Ctrl+T)",
-  "KbCyclePermissions": "Alternar acesso: Perguntar → Revisão automática → Acesso total (Shift+Tab)",
+  "KbCyclePermissions": "Alternar acesso: Perguntar → Aceitar edições → Revisão automática → Acesso total (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Acionar slots da hotbar",
   "KbAltJumpPlanAgentYolo": "Ir para Plan / Work ou solicitar acesso total (apelido herdado)",
   "KbFocusSidebar": "Focar o painel da barra de trabalho Tasks / Agents / Context / Pinned",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "Dicas de Modo",
   "HomeAgentModeTip": "Work — trabalho direto na sessão atual com ferramentas",
   "HomeAgentModeReviewTip": "  /mode plan para pesquisar e apresentar um plano primeiro",
-  "HomeAgentModeYoloTip": "  Shift+Tab cicla permissão: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab cicla permissão: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + acesso total — ferramentas sem pedidos de aprovação",
   "HomeYoloModeCaution": "  Operações destrutivas podem rodar na hora; prefira Ask se duvidar",
   "HomePlanModeTip": "Plan — pesquise e desenhe antes de implementar",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "só leitura",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "nunca",
   "PermissionsChangedReceipt": "Permissões alteradas para {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "espaço de trabalho",
   "StatusApprovalAsk": "perguntar",
   "StatusApprovalAuto": "revisão automática",
+  "StatusApprovalAcceptEdits": "aceitar edições",
   "StatusApprovalFullAccess": "acesso total",
   "StatusApprovalNever": "nunca",
   "StatusMcpConfigured": "{count} configurados",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} de novo para enviar agora · {steer} direciona",
   "PermissionsPostureHeader": "Acesso agora: {posture}",
   "PermissionsPostureAsk": "Ask: chamadas de tool que alteram autoridade, custo, escopo ou resultado abrem um prompt; chamadas somente leitura comprovadamente seguras rodam sem ele. As regras ask acima sempre forçam um prompt.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: edições de arquivos cujos destinos ficam todos dentro do repositório git desta pasta rodam sem prompt (nunca .git, .codewhale, .env ou arquivos de credenciais); comandos, rede, apps conectados e todo o resto abrem um prompt como em Ask. As regras ask acima sempre forçam um prompt.",
   "PermissionsPostureAuto": "Auto-Review: nunca abre um prompt. Uma política determinística permite chamadas comprovadamente seguras e bloqueia de forma rígida trabalho de publicação ou destrutivo em segundo plano; chamadas que não consegue provar seguras vão a um guardião de modelo de uma única rodada, que permite ou nega com um motivo declarado (risco alto ou crítico nunca roda automaticamente; uma revisão falha nega, fail closed). Retenções que exigem uma pessoa são negadas, não ocultadas. Cada decisão dessas é escrita na transcrição como nota e no log de auditoria.",
   "PermissionsPostureBypass": "Full Access: chamadas de tool comuns rodam sem prompts. Retenções não contornáveis de segurança, lei do repositório e política gerenciada fazem fail closed como bloqueios rígidos em vez de perguntar.",
   "PermissionsPostureNever": "never: só rodam tools consideradas seguras/somente leitura; todo o resto é bloqueado sem prompt.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Desligado",
   "ConfigValueProviderDefault": "Padrão do provedor",
   "ConfigChoiceAsk": "Perguntar",
+  "ConfigChoiceAcceptEdits": "Aceitar edições",
   "ConfigChoiceAutoReview": "Revisão automática",
   "ConfigChoiceUseTuiDefault": "Usar o padrão de permissão da TUI",
   "ConfigChoiceFullAccess": "Acesso total",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Pontos animados",
   "ConfigChoiceDiffFull": "Diff completo",
   "ConfigChoiceDiffSummary": "Resumo",
-  "ConfigChoiceDetailAsk": "Pergunta antes de ferramentas que podem fazer mudanças relevantes.",
+  "ConfigChoiceDetailAsk": "Pergunta antes de cada edição de arquivo e de cada comando.",
+  "ConfigChoiceDetailAcceptEdits": "Edições dentro deste repositório git rodam sem perguntar; comandos continuam perguntando.",
   "ConfigChoiceDetailAutoReview": "Revisa o risco das ferramentas automaticamente e pergunta quando uma decisão precisa de você.",
   "ConfigChoiceDetailUseTuiDefault": "Remove a sobreposição do config raiz e usa a escolha de permissão salva na TUI.",
   "ConfigChoiceDetailFullAccess": "Executa ferramentas sem pedir aprovação; as regras do workspace continuam valendo.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Como você quer continuar?",
   "PlanHandoffWorkAsk": "Work (Perguntar)",
   "PlanHandoffWorkAskDetail": "Começar pelo plano. Edições e comandos pedem sua permissão antes.",
+  "PlanHandoffWorkAcceptEdits": "Work (Aceitar edições)",
+  "PlanHandoffWorkAcceptEditsDetail": "Começar pelo plano. Edições neste repositório rodam sem perguntar; comandos pedem sua permissão antes.",
   "PlanHandoffWorkAuto": "Work (Revisão automática)",
   "PlanHandoffWorkAutoDetail": "Começar pelo plano. Ações arriscadas são revisadas automaticamente e ainda podem perguntar a você.",
   "PlanHandoffKeepPlanning": "Continuar planejando",

crates/localization/locales/ru.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "Вернуться к предыдущему сообщению пользователя (Left/Right — шаг, Enter — откат)",
   "KbCompleteCycleModes": "Дополнить /command или переключить режим при пустом поле ввода (Plan → Work → Operate)",
   "KbCycleThinking": "Перебор уровня рассуждений активного провайдера (Ctrl+T)",
-  "KbCyclePermissions": "Сменить доступ: Спрашивать → Авто-проверка → Полный доступ (Shift+Tab)",
+  "KbCyclePermissions": "Сменить доступ: Спрашивать → Принимать правки → Авто-проверка → Полный доступ (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Активировать слоты Hotbar",
   "KbAltJumpPlanAgentYolo": "Переход к Plan / Work или запрос Full Access (устаревший псевдоним)",
   "KbFocusSidebar": "Фокус на рабочей панели Tasks / Agents / Context / Pinned",
@@ -997,7 +997,7 @@
   "HomeModeTips": "Советы по режимам",
   "HomeAgentModeTip": "Work — прямая работа в текущей сессии с инструментами",
   "HomeAgentModeReviewTip": "  /mode plan — сначала исследовать и представить план",
-  "HomeAgentModeYoloTip": "  Shift+Tab переключает разрешения: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab переключает разрешения: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — инструменты работают без запросов на одобрение",
   "HomeYoloModeCaution": "  Деструктивные операции могут выполниться сразу; если сомневаетесь, выбирайте Ask",
   "HomePlanModeTip": "Plan — исследование и проектирование до реализации",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "только чтение",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "никогда",
   "PermissionsChangedReceipt": "Разрешения изменены: {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "рабочая область",
   "StatusApprovalAsk": "спрашивать",
   "StatusApprovalAuto": "автопроверка",
+  "StatusApprovalAcceptEdits": "принимать правки",
   "StatusApprovalFullAccess": "полный доступ",
   "StatusApprovalNever": "никогда",
   "StatusMcpConfigured": "настроено: {count}",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} ещё раз — отправить сейчас · {steer} направляет",
   "PermissionsPostureHeader": "Доступ сейчас: {posture}",
   "PermissionsPostureAsk": "Ask: вызовы tool, меняющие полномочия, стоимость, охват или результат, открывают запрос; доказанно безопасные вызовы только для чтения выполняются без него. Правила ask выше всегда принудительно показывают запрос.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: правки файлов, все цели которых остаются внутри git-репозитория этой папки, выполняются без запроса (никогда .git, .codewhale, .env и файлы учётных данных); команды, сеть, подключённые приложения и всё остальное открывают запрос, как в Ask. Правила ask выше всегда принудительно показывают запрос.",
   "PermissionsPostureAuto": "Auto-Review: никогда не открывает запрос. Детерминированная политика разрешает доказанно безопасные вызовы и жёстко блокирует публикационную или разрушительную фоновую работу; вызовы, безопасность которых доказать нельзя, отправляются одноразовому модельному стражу, который разрешает или отклоняет с указанием причины (высокий или критический риск никогда не выполняется автоматически; неудачная проверка отклоняет по принципу fail closed). Удержания, требующие человека, отклоняются, а не скрываются. Каждое такое решение записывается заметкой в транскрипт и в журнал аудита.",
   "PermissionsPostureBypass": "Full Access: обычные вызовы tool выполняются без запросов. Необходимые удержания безопасности, правил репозитория и управляемой политики завершаются fail closed как жёсткие блокировки вместо запроса.",
   "PermissionsPostureNever": "never: выполняются только tool, считающиеся безопасными/только для чтения; всё остальное блокируется без запроса.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Выкл",
   "ConfigValueProviderDefault": "По умолчанию провайдера",
   "ConfigChoiceAsk": "Спрашивать",
+  "ConfigChoiceAcceptEdits": "Принимать правки",
   "ConfigChoiceAutoReview": "Автопроверка",
   "ConfigChoiceUseTuiDefault": "Использовать разрешение TUI по умолчанию",
   "ConfigChoiceFullAccess": "Полный доступ",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Анимированные точки",
   "ConfigChoiceDiffFull": "Полный diff",
   "ConfigChoiceDiffSummary": "Сводка",
-  "ConfigChoiceDetailAsk": "Спрашивает перед инструментами, которые могут внести существенные изменения.",
+  "ConfigChoiceDetailAsk": "Спрашивает перед каждой правкой файла и каждой командой.",
+  "ConfigChoiceDetailAcceptEdits": "Правки внутри этого git-репозитория выполняются без вопросов; команды по-прежнему спрашивают.",
   "ConfigChoiceDetailAutoReview": "Автоматически оценивает риск инструментов и спрашивает, когда решение за вами.",
   "ConfigChoiceDetailUseTuiDefault": "Снимает переопределение корневого config и использует сохранённый выбор разрешения TUI.",
   "ConfigChoiceDetailFullAccess": "Запускает инструменты без запросов на одобрение; правила рабочей области по-прежнему действуют.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Как вы хотите продолжить?",
   "PlanHandoffWorkAsk": "Work (Спрашивать)",
   "PlanHandoffWorkAskDetail": "Начать работу по плану. Правки и команды сначала спрашивают вас.",
+  "PlanHandoffWorkAcceptEdits": "Work (Принимать правки)",
+  "PlanHandoffWorkAcceptEditsDetail": "Начать работу по плану. Правки в этом репозитории выполняются без вопросов; команды сначала спрашивают вас.",
   "PlanHandoffWorkAuto": "Work (Авто-проверка)",
   "PlanHandoffWorkAutoDetail": "Начать работу по плану. Рискованные действия проверяются автоматически и всё же могут спросить вас.",
   "PlanHandoffKeepPlanning": "Продолжить планирование",

crates/localization/locales/uk.json

@@ -864,7 +864,7 @@
   "KbBacktrackMessage": "Повернутися до попереднього повідомлення користувача (Left/Right — крок, Enter — перемотати)",
   "KbCompleteCycleModes": "Доповнити /command або перемикати режими, коли композер порожній (Plan → Work → Operate)",
   "KbCycleThinking": "Перемикати рівень міркувань для активного провайдера (Ctrl+T)",
-  "KbCyclePermissions": "Змінити доступ: Питати → Автоогляд → Повний доступ (Shift+Tab)",
+  "KbCyclePermissions": "Змінити доступ: Питати → Приймати правки → Автоогляд → Повний доступ (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Активувати слоти Hotbar",
   "KbAltJumpPlanAgentYolo": "Перехід до Plan / Work або запит Full Access (застарілий псевдонім)",
   "KbFocusSidebar": "Фокус на робочій панелі Tasks / Agents / Context / Pinned",
@@ -997,7 +997,7 @@
   "HomeModeTips": "Поради щодо режимів",
   "HomeAgentModeTip": "Work — безпосередня робота в поточному сеансі з інструментами",
   "HomeAgentModeReviewTip": "  /mode plan, щоб спершу дослідити й подати план",
-  "HomeAgentModeYoloTip": "  Shift+Tab перемикає дозволи: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab перемикає дозволи: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + Full Access — інструменти виконуються без запитів на схвалення",
   "HomeYoloModeCaution": "  Руйнівні операції можуть виконатися одразу; якщо сумніваєтеся — використовуйте Ask",
   "HomePlanModeTip": "Plan — дослідження та проєктування перед реалізацією",
@@ -1682,6 +1682,7 @@
   "ChipPermissionReadOnly": "лише читання",
   "ChipPermissionAsk": "питати",
   "ChipPermissionAuto": "авто",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "ніколи",
   "PermissionsChangedReceipt": "Дозволи змінено: {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "робоча область",
   "StatusApprovalAsk": "запитувати",
   "StatusApprovalAuto": "автоперевірка",
+  "StatusApprovalAcceptEdits": "приймати правки",
   "StatusApprovalFullAccess": "повний доступ",
   "StatusApprovalNever": "ніколи",
   "StatusMcpConfigured": "налаштовано: {count}",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} ще раз — надіслати зараз · {steer} спрямовує",
   "PermissionsPostureHeader": "Доступ зараз: {posture}",
   "PermissionsPostureAsk": "Ask: виклики tool, що змінюють повноваження, вартість, обсяг або результат, відкривають запит; доведено безпечні виклики лише для читання виконуються без нього. Правила ask вище завжди примусово показують запит.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: правки файлів, усі цілі яких лишаються всередині git-репозиторію цієї теки, виконуються без запиту (ніколи .git, .codewhale, .env і файли облікових даних); команди, мережа, підключені застосунки та все інше відкривають запит, як в Ask. Правила ask вище завжди примусово показують запит.",
   "PermissionsPostureAuto": "Auto-Review: ніколи не відкриває запит. Детермінована політика дозволяє доведено безпечні виклики та жорстко блокує публікаційну або руйнівну фонову роботу; виклики, безпечність яких довести не можна, передаються одноразовому модельному вартовому, який дозволяє або відхиляє з указанням причини (високий або критичний ризик ніколи не виконується автоматично; невдала перевірка відхиляє за принципом fail closed). Утримання, що потребують людини, відхиляються, а не приховуються. Кожне таке рішення записується нотаткою в транскрипт і в журнал аудиту.",
   "PermissionsPostureBypass": "Full Access: звичайні виклики tool виконуються без запитів. Необхідні утримання безпеки, правил репозиторію та керованої політики завершуються fail closed як жорсткі блокування замість запиту.",
   "PermissionsPostureNever": "never: виконуються лише tool, що вважаються безпечними/лише для читання; усе інше блокується без запиту.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Вимк",
   "ConfigValueProviderDefault": "Типове для провайдера",
   "ConfigChoiceAsk": "Запитувати",
+  "ConfigChoiceAcceptEdits": "Приймати правки",
   "ConfigChoiceAutoReview": "Автоперевірка",
   "ConfigChoiceUseTuiDefault": "Використовувати типовий дозвіл TUI",
   "ConfigChoiceFullAccess": "Повний доступ",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Анімовані крапки",
   "ConfigChoiceDiffFull": "Повний diff",
   "ConfigChoiceDiffSummary": "Зведення",
-  "ConfigChoiceDetailAsk": "Запитує перед інструментами, які можуть внести суттєві зміни.",
+  "ConfigChoiceDetailAsk": "Запитує перед кожною правкою файлу та кожною командою.",
+  "ConfigChoiceDetailAcceptEdits": "Правки всередині цього git-репозиторію виконуються без запитань; команди й надалі запитують.",
   "ConfigChoiceDetailAutoReview": "Автоматично оцінює ризик інструментів і запитує, коли рішення за вами.",
   "ConfigChoiceDetailUseTuiDefault": "Знімає перевизначення кореневого config і використовує збережений вибір дозволу TUI.",
   "ConfigChoiceDetailFullAccess": "Запускає інструменти без запитів на схвалення; правила робочого простору й далі діють.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Як ви хочете продовжити?",
   "PlanHandoffWorkAsk": "Work (Питати)",
   "PlanHandoffWorkAskDetail": "Почати роботу за планом. Правки й команди спершу питають вас.",
+  "PlanHandoffWorkAcceptEdits": "Work (Приймати правки)",
+  "PlanHandoffWorkAcceptEditsDetail": "Почати роботу за планом. Правки в цьому репозиторії виконуються без запитань; команди спершу питають вас.",
   "PlanHandoffWorkAuto": "Work (Автоогляд)",
   "PlanHandoffWorkAutoDetail": "Почати роботу за планом. Ризиковані дії перевіряються автоматично й усе одно можуть запитати вас.",
   "PlanHandoffKeepPlanning": "Планувати далі",

crates/localization/locales/vi.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "Quay lại tin nhắn trước đó của người dùng (nhấn Trái/Phải để chuyển bước, Enter để lùi lại)",
   "KbCompleteCycleModes": "Hoàn thành /command hoặc chuyển chế độ khi khung soạn thảo trống (Plan → Work → Operate)",
   "KbCycleThinking": "Luân phiên mức suy luận của nhà cung cấp đang hoạt động (Ctrl+T)",
-  "KbCyclePermissions": "Chuyển quyền truy cập: Hỏi → Tự động xem lại → Toàn quyền (Shift+Tab)",
+  "KbCyclePermissions": "Chuyển quyền truy cập: Hỏi → Chấp nhận chỉnh sửa → Tự động xem lại → Toàn quyền (Shift+Tab)",
   "KbJumpPlanAgentYolo": "Kích hoạt các ô hotbar",
   "KbAltJumpPlanAgentYolo": "Nhảy sang Plan / Work hoặc yêu cầu toàn quyền (bí danh cũ)",
   "KbFocusSidebar": "Focus vào bảng thanh làm việc Tasks / Agents / Context / Pinned",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "Mẹo về Chế độ",
   "HomeAgentModeTip": "Work — làm việc trực tiếp trong phiên với công cụ",
   "HomeAgentModeReviewTip": "  /mode plan để nghiên cứu và trình kế hoạch trước",
-  "HomeAgentModeYoloTip": "  Shift+Tab xoay quyền: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab xoay quyền: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + toàn quyền — công cụ chạy không cần phê duyệt",
   "HomeYoloModeCaution": "  Thao tác phá hủy có thể chạy ngay; dùng Ask khi không chắc",
   "HomePlanModeTip": "Plan — nghiên cứu và thiết kế trước khi triển khai",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "chỉ đọc",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "Quyền đã đổi thành {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "không gian làm việc",
   "StatusApprovalAsk": "hỏi",
   "StatusApprovalAuto": "tự động duyệt",
+  "StatusApprovalAcceptEdits": "chấp nhận chỉnh sửa",
   "StatusApprovalFullAccess": "toàn quyền",
   "StatusApprovalNever": "không bao giờ",
   "StatusMcpConfigured": "đã cấu hình {count}",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "{enter} lần nữa để gửi ngay · {steer} điều hướng",
   "PermissionsPostureHeader": "Quyền truy cập hiện tại: {posture}",
   "PermissionsPostureAsk": "Ask: các lệnh gọi tool làm thay đổi thẩm quyền, chi phí, phạm vi hoặc kết quả sẽ mở lời nhắc; các lệnh chỉ đọc đã được chứng minh an toàn chạy mà không cần lời nhắc. Các quy tắc ask ở trên luôn buộc phải nhắc.",
+  "PermissionsPostureAcceptEdits": "Accept Edits: các chỉnh sửa tệp mà mọi đích đều nằm trong kho git của thư mục này chạy không cần lời nhắc (không bao giờ gồm .git, .codewhale, .env hay tệp thông tin xác thực); lệnh, mạng, ứng dụng đã kết nối và mọi thứ khác sẽ mở lời nhắc như trong Ask. Các quy tắc ask ở trên luôn buộc phải nhắc.",
   "PermissionsPostureAuto": "Auto-Review: không bao giờ mở lời nhắc. Chính sách tất định cho phép các lệnh đã được chứng minh an toàn và chặn cứng công việc nền mang tính xuất bản hoặc phá hủy; các lệnh không thể chứng minh an toàn được chuyển đến bộ giám hộ mô hình một lần, cho phép hoặc từ chối kèm lý do (rủi ro cao hoặc nghiêm trọng không bao giờ tự chạy; xem xét thất bại sẽ từ chối, fail closed). Các lệnh cần người quyết định bị từ chối chứ không bị ẩn. Mỗi quyết định như vậy được ghi vào bản ghi dưới dạng ghi chú và vào nhật ký kiểm toán.",
   "PermissionsPostureBypass": "Full Access: các lệnh gọi tool thông thường chạy không cần lời nhắc. Các lệnh giữ không thể bỏ qua về an toàn, luật kho lưu trữ và chính sách quản lý sẽ fail closed dưới dạng chặn cứng thay vì hỏi.",
   "PermissionsPostureNever": "never: chỉ các tool được coi là an toàn/chỉ đọc mới chạy; mọi thứ khác bị chặn mà không nhắc.",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "Tắt",
   "ConfigValueProviderDefault": "Mặc định của nhà cung cấp",
   "ConfigChoiceAsk": "Hỏi",
+  "ConfigChoiceAcceptEdits": "Chấp nhận chỉnh sửa",
   "ConfigChoiceAutoReview": "Tự động xem xét",
   "ConfigChoiceUseTuiDefault": "Dùng quyền mặc định của TUI",
   "ConfigChoiceFullAccess": "Toàn quyền",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "Dấu chấm động",
   "ConfigChoiceDiffFull": "Diff đầy đủ",
   "ConfigChoiceDiffSummary": "Tóm tắt",
-  "ConfigChoiceDetailAsk": "Hỏi trước khi chạy công cụ có thể gây thay đổi đáng kể.",
+  "ConfigChoiceDetailAsk": "Hỏi trước mỗi lần chỉnh sửa tệp và mỗi lệnh.",
+  "ConfigChoiceDetailAcceptEdits": "Chỉnh sửa trong kho git này chạy mà không cần hỏi; lệnh vẫn hỏi.",
   "ConfigChoiceDetailAutoReview": "Tự động xem xét rủi ro của công cụ và chỉ hỏi khi cần bạn quyết định.",
   "ConfigChoiceDetailUseTuiDefault": "Bỏ ghi đè của config gốc và dùng lựa chọn quyền đã lưu trong TUI.",
   "ConfigChoiceDetailFullAccess": "Chạy công cụ mà không hỏi phê duyệt; quy tắc của workspace vẫn áp dụng.",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "Bạn muốn tiếp tục thế nào?",
   "PlanHandoffWorkAsk": "Work (Hỏi)",
   "PlanHandoffWorkAskDetail": "Bắt đầu làm theo kế hoạch. Chỉnh sửa và lệnh sẽ hỏi bạn trước.",
+  "PlanHandoffWorkAcceptEdits": "Work (Chấp nhận chỉnh sửa)",
+  "PlanHandoffWorkAcceptEditsDetail": "Bắt đầu làm theo kế hoạch. Chỉnh sửa trong kho này chạy không cần hỏi; lệnh sẽ hỏi bạn trước.",
   "PlanHandoffWorkAuto": "Work (Tự động xem lại)",
   "PlanHandoffWorkAutoDetail": "Bắt đầu làm theo kế hoạch. Thao tác rủi ro được tự động xem lại và vẫn có thể hỏi bạn.",
   "PlanHandoffKeepPlanning": "Tiếp tục lập kế hoạch",

crates/localization/locales/zh-Hans.json

@@ -881,7 +881,7 @@
   "KbBacktrackMessage": "回退到之前的用户消息（左右键步进，Enter 回退）",
   "KbCompleteCycleModes": "补全 /command，或在输入框为空时切换模式（Plan → Work → Operate）",
   "KbCycleThinking": "轮换当前提供商的思考强度 (Ctrl+T)",
-  "KbCyclePermissions": "切换访问级别：询问 → 自动审核 → 完全访问（Shift+Tab）",
+  "KbCyclePermissions": "切换访问级别：询问 → 接受编辑 → 自动审核 → 完全访问（Shift+Tab）",
   "KbJumpPlanAgentYolo": "触发快捷栏槽位",
   "KbAltJumpPlanAgentYolo": "跳转到 Plan / Work，或请求 Full Access（旧版别名）",
   "KbFocusSidebar": "聚焦 Tasks / Agents / Context / Pinned 任务面板",
@@ -1014,7 +1014,7 @@
   "HomeModeTips": "模式提示",
   "HomeAgentModeTip": "Work — 使用工具完成你要求的更改",
   "HomeAgentModeReviewTip": "  用 /mode plan 先调研并提出计划",
-  "HomeAgentModeYoloTip": "  Shift+Tab 循环权限: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab 循环权限: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + 完全访问 — 工具无需先询问即可运行",
   "HomeYoloModeCaution": "  破坏性操作可能立即执行；不确定时用 Ask",
   "HomePlanModeTip": "Plan — 实现前先调研与设计",
@@ -1705,6 +1705,7 @@
   "ChipPermissionReadOnly": "只读",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "权限已更改为 {label}",
@@ -2214,6 +2215,7 @@
   "StatusWorkspace": "工作区",
   "StatusApprovalAsk": "询问",
   "StatusApprovalAuto": "自动审核",
+  "StatusApprovalAcceptEdits": "接受编辑",
   "StatusApprovalFullAccess": "完全访问",
   "StatusApprovalNever": "从不允许",
   "StatusMcpConfigured": "已配置 {count} 个",
@@ -2258,6 +2260,7 @@
   "PostureHintEnterAgain": "再按 {enter} 立即发送 · {steer} 引导",
   "PermissionsPostureHeader": "当前访问级别：{posture}",
   "PermissionsPostureAsk": "Ask：会改变权限、成本、范围或结果的 tool 调用会弹出提示；已证明安全的只读调用无需提示即可运行。上面的 ask 规则始终强制提示。",
+  "PermissionsPostureAcceptEdits": "Accept Edits：所有目标都在此文件夹 git 仓库内的文件编辑无需提示即可运行（绝不包括 .git、.codewhale、.env 或凭据文件）；命令、网络、已连接的应用及其他一切都像 Ask 一样弹出提示。上面的 ask 规则始终强制提示。",
   "PermissionsPostureAuto": "Auto-Review：从不弹出提示。确定性策略允许已证明安全的调用，并硬性阻止类似发布或破坏性的后台工作；无法证明安全的调用交给一次性模型守护者，其给出理由后允许或拒绝（高或严重风险绝不自动运行；审查失败即拒绝，故障关闭）。需要人工决定的搁置会被拒绝而非隐藏。每个此类决定都会作为备注写入对话记录和审计日志。",
   "PermissionsPostureBypass": "Full Access：普通 tool 调用无需提示即可运行。不可绕过的安全、仓库规则和托管策略搁置会作为硬性阻止故障关闭，而不是弹出提示。",
   "PermissionsPostureNever": "never：仅运行被视为安全/只读的 tool；其他一切均在不提示的情况下被阻止。",
@@ -2380,6 +2383,7 @@
   "ConfigValueOff": "关",
   "ConfigValueProviderDefault": "提供商默认",
   "ConfigChoiceAsk": "询问",
+  "ConfigChoiceAcceptEdits": "接受编辑",
   "ConfigChoiceAutoReview": "自动审核",
   "ConfigChoiceUseTuiDefault": "使用 TUI 权限默认值",
   "ConfigChoiceFullAccess": "完全访问",
@@ -2398,7 +2402,8 @@
   "ConfigChoiceStatusDots": "动画圆点",
   "ConfigChoiceDiffFull": "完整差异",
   "ConfigChoiceDiffSummary": "摘要",
-  "ConfigChoiceDetailAsk": "在可能造成重大更改的工具运行前询问。",
+  "ConfigChoiceDetailAsk": "每次文件编辑和每条命令前都会询问。",
+  "ConfigChoiceDetailAcceptEdits": "此 git 仓库内的编辑无需询问即可运行；命令仍会询问。",
   "ConfigChoiceDetailAutoReview": "自动审核工具风险，需要你决定时才询问。",
   "ConfigChoiceDetailUseTuiDefault": "移除根配置覆盖，使用已保存的 TUI 权限选择。",
   "ConfigChoiceDetailFullAccess": "无需审批提示即可运行工具；工作区规则仍然适用。",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "你想如何继续？",
   "PlanHandoffWorkAsk": "Work（询问）",
   "PlanHandoffWorkAskDetail": "开始执行计划。编辑和命令会先征求你的同意。",
+  "PlanHandoffWorkAcceptEdits": "Work（接受编辑）",
+  "PlanHandoffWorkAcceptEditsDetail": "开始执行计划。此仓库内的编辑无需询问即可运行；命令会先征求你的同意。",
   "PlanHandoffWorkAuto": "Work（自动审核）",
   "PlanHandoffWorkAutoDetail": "开始执行计划。有风险的操作会自动审核，仍可能向你确认。",
   "PlanHandoffKeepPlanning": "继续规划",

crates/localization/locales/zh-Hant.json

@@ -879,7 +879,7 @@
   "KbBacktrackMessage": "回退到之前的使用者訊息（左右鍵步進，Enter 回退）",
   "KbCompleteCycleModes": "補全 /command，或在輸入框為空時切換模式（Plan → Work → Operate）",
   "KbCycleThinking": "輪換目前供應商的思考強度 (Ctrl+T)",
-  "KbCyclePermissions": "切換存取層級：詢問 → 自動審核 → 完整存取（Shift+Tab）",
+  "KbCyclePermissions": "切換存取層級：詢問 → 接受編輯 → 自動審核 → 完整存取（Shift+Tab）",
   "KbJumpPlanAgentYolo": "觸發 Hotbar 槽位",
   "KbAltJumpPlanAgentYolo": "跳轉到 Plan / Work，或請求 Full Access（舊版別名）",
   "KbFocusSidebar": "聚焦 Tasks / Agents / Context / Pinned 任務面板",
@@ -1012,7 +1012,7 @@
   "HomeModeTips": "模式提示",
   "HomeAgentModeTip": "Work — 使用工具完成你要求的變更",
   "HomeAgentModeReviewTip": "  用 /mode plan 先調研並提出計畫",
-  "HomeAgentModeYoloTip": "  Shift+Tab 循環權限: Ask → Auto-Review → Full Access",
+  "HomeAgentModeYoloTip": "  Shift+Tab 循環權限: Ask → Accept Edits → Auto-Review → Full Access",
   "HomeYoloModeTip": "Work + 完整存取 — 工具無需先詢問即可執行",
   "HomeYoloModeCaution": "  破壞性操作可能立即執行；不確定時用 Ask",
   "HomePlanModeTip": "Plan — 實現前先調研與設計",
@@ -1703,6 +1703,7 @@
   "ChipPermissionReadOnly": "唯讀",
   "ChipPermissionAsk": "ask",
   "ChipPermissionAuto": "auto",
+  "ChipPermissionAcceptEdits": "accept edits",
   "ChipPermissionFullAccess": "Full Access",
   "ChipPermissionNever": "never",
   "PermissionsChangedReceipt": "權限已變更為 {label}",
@@ -2212,6 +2213,7 @@
   "StatusWorkspace": "工作區",
   "StatusApprovalAsk": "詢問",
   "StatusApprovalAuto": "自動審核",
+  "StatusApprovalAcceptEdits": "接受編輯",
   "StatusApprovalFullAccess": "完整存取",
   "StatusApprovalNever": "永不允許",
   "StatusMcpConfigured": "已設定 {count} 個",
@@ -2256,6 +2258,7 @@
   "PostureHintEnterAgain": "再按 {enter} 立即傳送 · {steer} 引導",
   "PermissionsPostureHeader": "目前存取層級：{posture}",
   "PermissionsPostureAsk": "Ask：會改變權限、成本、範圍或結果的 tool 呼叫會開啟提示；已證明安全的唯讀呼叫無需提示即可執行。上面的 ask 規則始終強制提示。",
+  "PermissionsPostureAcceptEdits": "Accept Edits：所有目標都在此資料夾 git 儲存庫內的檔案編輯無需提示即可執行（絕不包括 .git、.codewhale、.env 或憑證檔案）；指令、網路、已連線的應用程式及其他一切都像 Ask 一樣開啟提示。上面的 ask 規則始終強制提示。",
   "PermissionsPostureAuto": "Auto-Review：從不開啟提示。確定性策略允許已證明安全的呼叫，並硬性封鎖類似發佈或破壞性的背景工作；無法證明安全的呼叫交給一次性模型守護者，其給出理由後允許或拒絕（高或嚴重風險絕不自動執行；審查失敗即拒絕，故障關閉）。需要人工決定的擱置會被拒絕而非隱藏。每個此類決定都會作為備註寫入對話記錄和稽核日誌。",
   "PermissionsPostureBypass": "Full Access：普通 tool 呼叫無需提示即可執行。不可繞過的安全、儲存庫規則和託管策略擱置會作為硬性封鎖故障關閉，而不是開啟提示。",
   "PermissionsPostureNever": "never：僅執行被視為安全/唯讀的 tool；其他一切均在不提示的情況下被封鎖。",
@@ -2378,6 +2381,7 @@
   "ConfigValueOff": "關",
   "ConfigValueProviderDefault": "供應商預設",
   "ConfigChoiceAsk": "詢問",
+  "ConfigChoiceAcceptEdits": "接受編輯",
   "ConfigChoiceAutoReview": "自動審核",
   "ConfigChoiceUseTuiDefault": "使用 TUI 權限預設值",
   "ConfigChoiceFullAccess": "完整存取",
@@ -2396,7 +2400,8 @@
   "ConfigChoiceStatusDots": "動畫圓點",
   "ConfigChoiceDiffFull": "完整差異",
   "ConfigChoiceDiffSummary": "摘要",
-  "ConfigChoiceDetailAsk": "在可能造成重大變更的工具執行前詢問。",
+  "ConfigChoiceDetailAsk": "每次檔案編輯和每個指令前都會詢問。",
+  "ConfigChoiceDetailAcceptEdits": "此 git 儲存庫內的編輯無需詢問即可執行；指令仍會詢問。",
   "ConfigChoiceDetailAutoReview": "自動審核工具風險，需要你決定時才詢問。",
   "ConfigChoiceDetailUseTuiDefault": "移除根設定覆寫，使用已儲存的 TUI 權限選擇。",
   "ConfigChoiceDetailFullAccess": "不經核准提示即可執行工具；工作區規則仍然適用。",
@@ -2663,6 +2668,8 @@
   "PlanHandoffQuestion": "你想如何繼續？",
   "PlanHandoffWorkAsk": "Work（詢問）",
   "PlanHandoffWorkAskDetail": "開始執行計畫。編輯與指令會先徵求你的同意。",
+  "PlanHandoffWorkAcceptEdits": "Work（接受編輯）",
+  "PlanHandoffWorkAcceptEditsDetail": "開始執行計畫。此儲存庫內的編輯無需詢問即可執行；指令會先徵求你的同意。",
   "PlanHandoffWorkAuto": "Work（自動審核）",
   "PlanHandoffWorkAutoDetail": "開始執行計畫。有風險的操作會自動審核，仍可能向你確認。",
   "PlanHandoffKeepPlanning": "繼續規劃",

crates/localization/src/lib.rs

@@ -556,6 +556,7 @@ pub enum MessageId {
     PostureHintEnterAgain,
     PermissionsPostureHeader,
     PermissionsPostureAsk,
+    PermissionsPostureAcceptEdits,
     PermissionsPostureAuto,
     PermissionsPostureBypass,
     PermissionsPostureNever,
@@ -2066,6 +2067,7 @@ pub enum MessageId {
     ChipPermissionReadOnly,
     ChipPermissionAsk,
     ChipPermissionAuto,
+    ChipPermissionAcceptEdits,
     ChipPermissionFullAccess,
     ChipPermissionNever,
     PermissionsChangedReceipt,
@@ -2128,6 +2130,7 @@ pub enum MessageId {
     StatusWorkspace,
     StatusApprovalAsk,
     StatusApprovalAuto,
+    StatusApprovalAcceptEdits,
     StatusApprovalFullAccess,
     StatusApprovalNever,
     StatusMcpConfigured,
@@ -2834,6 +2837,7 @@ pub enum MessageId {
     ConfigValueOff,
     ConfigValueProviderDefault,
     ConfigChoiceAsk,
+    ConfigChoiceAcceptEdits,
     ConfigChoiceAutoReview,
     ConfigChoiceUseTuiDefault,
     ConfigChoiceFullAccess,
@@ -2853,6 +2857,7 @@ pub enum MessageId {
     ConfigChoiceDiffFull,
     ConfigChoiceDiffSummary,
     ConfigChoiceDetailAsk,
+    ConfigChoiceDetailAcceptEdits,
     ConfigChoiceDetailAutoReview,
     ConfigChoiceDetailUseTuiDefault,
     ConfigChoiceDetailFullAccess,
@@ -2969,6 +2974,8 @@ pub enum MessageId {
     PlanHandoffQuestion,
     PlanHandoffWorkAsk,
     PlanHandoffWorkAskDetail,
+    PlanHandoffWorkAcceptEdits,
+    PlanHandoffWorkAcceptEditsDetail,
     PlanHandoffWorkAuto,
     PlanHandoffWorkAutoDetail,
     PlanHandoffKeepPlanning,
@@ -3485,6 +3492,7 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[
     MessageId::PostureHintEnterAgain,
     MessageId::PermissionsPostureHeader,
     MessageId::PermissionsPostureAsk,
+    MessageId::PermissionsPostureAcceptEdits,
     MessageId::PermissionsPostureAuto,
     MessageId::PermissionsPostureBypass,
     MessageId::PermissionsPostureNever,
@@ -4929,6 +4937,7 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[
     MessageId::ChipPermissionReadOnly,
     MessageId::ChipPermissionAsk,
     MessageId::ChipPermissionAuto,
+    MessageId::ChipPermissionAcceptEdits,
     MessageId::ChipPermissionFullAccess,
     MessageId::ChipPermissionNever,
     MessageId::PermissionsChangedReceipt,
@@ -4988,6 +4997,7 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[
     MessageId::StatusWorkspace,
     MessageId::StatusApprovalAsk,
     MessageId::StatusApprovalAuto,
+    MessageId::StatusApprovalAcceptEdits,
     MessageId::StatusApprovalFullAccess,
     MessageId::StatusApprovalNever,
     MessageId::StatusMcpConfigured,
@@ -5658,6 +5668,7 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[
     MessageId::ConfigValueOff,
     MessageId::ConfigValueProviderDefault,
     MessageId::ConfigChoiceAsk,
+    MessageId::ConfigChoiceAcceptEdits,
     MessageId::ConfigChoiceAutoReview,
     MessageId::ConfigChoiceUseTuiDefault,
     MessageId::ConfigChoiceFullAccess,
@@ -5677,6 +5688,7 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[
     MessageId::ConfigChoiceDiffFull,
     MessageId::ConfigChoiceDiffSummary,
     MessageId::ConfigChoiceDetailAsk,
+    MessageId::ConfigChoiceDetailAcceptEdits,
     MessageId::ConfigChoiceDetailAutoReview,
     MessageId::ConfigChoiceDetailUseTuiDefault,
     MessageId::ConfigChoiceDetailFullAccess,
@@ -5789,6 +5801,8 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[
     MessageId::PlanHandoffQuestion,
     MessageId::PlanHandoffWorkAsk,
     MessageId::PlanHandoffWorkAskDetail,
+    MessageId::PlanHandoffWorkAcceptEdits,
+    MessageId::PlanHandoffWorkAcceptEditsDetail,
     MessageId::PlanHandoffWorkAuto,
     MessageId::PlanHandoffWorkAutoDetail,
     MessageId::PlanHandoffKeepPlanning,

crates/runtime/src/config.rs

@@ -3280,6 +3280,7 @@ pub fn approval_policy_baseline_from_permission_posture(
     posture.and_then(
         |posture| match posture.trim().to_ascii_lowercase().as_str() {
             "ask" | "suggest" | "on-request" | "untrusted" => Some("on-request"),
+            "accept-edits" | "accept_edits" | "acceptedits" | "edits" => Some("accept-edits"),
             "auto" | "auto-review" | "auto_review" => Some("auto"),
             "full" | "full-access" | "full_access" | "bypass" => Some("auto"),
             _ => None,

crates/runtime/src/runtime_policy.rs

@@ -3,7 +3,7 @@
 //! Older clients can still send mode aliases and the legacy `auto_approve`
 //! bit. New callers send a named posture. Keep those inputs readable, but
 //! persist and execute one contract: Plan / Act / Operate plus Ask /
-//! Auto-Review / Full Access.
+//! Accept Edits / Auto-Review / Full Access.
 
 use anyhow::{Result, bail};
 
@@ -27,6 +27,7 @@ pub fn approval_wire(mode: ApprovalMode) -> &'static str {
     match mode {
         ApprovalMode::Auto => "auto_review",
         ApprovalMode::Bypass => "full_access",
+        ApprovalMode::AcceptEdits => "accept_edits",
         ApprovalMode::Suggest | ApprovalMode::Never => "ask",
     }
 }
@@ -70,7 +71,7 @@ impl RuntimePolicyProjection {
         let permission = match permission_posture {
             Some(value) => ApprovalMode::from_config_value(value).ok_or_else(|| {
                 anyhow::anyhow!(
-                    "unsupported permission posture {value:?}; expected ask, auto-review, or full-access"
+                    "unsupported permission posture {value:?}; expected ask, accept-edits, auto-review, or full-access"
                 )
             })?,
             None if AppMode::is_legacy_bypass_alias(mode) || auto_approve.unwrap_or(false) => ApprovalMode::Bypass,

crates/runtime/src/settings.rs

@@ -2822,6 +2822,9 @@ fn normalize_default_model(value: &str) -> Option<String> {
 fn normalize_permission_posture(value: &str) -> Option<String> {
     match value.trim().to_ascii_lowercase().as_str() {
         "ask" | "suggest" | "on-request" | "untrusted" => Some("ask".to_string()),
+        "accept-edits" | "accept_edits" | "acceptedits" | "edits" => {
+            Some("accept-edits".to_string())
+        }
         "auto" | "auto-review" | "auto_review" => Some("auto-review".to_string()),
         "full" | "full-access" | "full_access" | "bypass" => Some("full-access".to_string()),
         _ => None,

crates/tui/CHANGELOG.md

@@ -209,6 +209,19 @@ until the matching tag, packages, checksums, and release assets exist.
 - **Bundled skill `goals` is now `personal-goals`.** It tracks personal resolutions in `goals.md` and no longer collides with goal mode; `goals` still resolves to it. An untouched installed `goals` copy becomes `personal-goals` on upgrade; an edited one stays as `goals`.
 - **Each sub-agent is told its name, its scope and that its final answer is delivered to the parent automatically.**
 - **Thread-owned terminals (Runtime API, breaking):** Engine terminal shells now belong to the conversation that started them, so two conversations using `term-1` in one folder get separate shells instead of sharing cwd, running command and output. Clients list a thread's shells at `GET /v1/threads/{id}/terminals` and drive one at `/v1/threads/{id}/terminals/{terminal_id}/output|input|resize|kill`; a reset shell, another thread's or workspace's shell, or one from before an Engine restart answers 404 instead of attaching to a same-named shell. The name-addressed `/v1/terminal/{name}/*` routes now answer 410, and `/v1/runtime/info` advertises `thread_scoped_terminals` in place of the four `terminal_*` flags. Client input meets the thread's shell consent and sandbox-reuse guard, and a lone Ctrl-C uses the dock's confirmed interrupt. In the TUI, a new conversation starts its own `term-1` rather than reusing the previous conversation's shell, which the dock still lists.
+- **Ask asks before every edit; new Accept Edits posture:** Ask now opens a
+  card for file edits inside the workspace too, as its name and the Plan
+  handoff ("Edits and commands ask you first") promise. The in-repository edit
+  rule moved to a new posture, **Accept Edits** (Claude Code's `acceptEdits`):
+  an edit whose every target stays inside the workspace git work tree runs
+  without a card, while `.git`, `.codewhale`, `.env*`, credential and key
+  files, folders without git, commands, network and connected apps still ask.
+  Shift+Tab cycles Ask → Accept Edits → Auto-Review → Full Access, so one
+  press restores the previous Ask behaviour. `/permissions`, `/status`,
+  `/config` and the Plan handoff offer it; the Runtime wire spells it
+  `permission_posture: "accept_edits"`, settings and `config.toml`
+  `accept-edits`. Project config may tighten Accept Edits to Ask but never
+  loosen Ask to it. ACP sessions run it as Ask.
 - **Brighter terminal working states:** the Ocean palette has stronger accents,
   and active work uses a restrained left-to-right text sweep. Quiet and
   reduced-motion settings keep stable working indicators. The shared

crates/tui/src/commands/config_main_host.rs

@@ -564,6 +564,7 @@ fn approval_mode_config_value(mode: ApprovalMode) -> &'static str {
         ApprovalMode::Auto => "auto",
         ApprovalMode::Bypass => "bypass",
         ApprovalMode::Suggest => "on-request",
+        ApprovalMode::AcceptEdits => "accept-edits",
         ApprovalMode::Never => "never",
     }
 }

crates/tui/src/commands/contract.rs

@@ -141,6 +141,7 @@ pub(crate) fn to_command_approval(mode: ApprovalMode) -> CommandApprovalMode {
         ApprovalMode::Auto => CommandApprovalMode::Auto,
         ApprovalMode::Bypass => CommandApprovalMode::Bypass,
         ApprovalMode::Suggest => CommandApprovalMode::Suggest,
+        ApprovalMode::AcceptEdits => CommandApprovalMode::AcceptEdits,
         ApprovalMode::Never => CommandApprovalMode::Never,
     }
 }

crates/tui/src/commands/contract/config_policy_messages.rs

@@ -19,6 +19,7 @@ pub(super) fn resolve(key: &str) -> Option<MessageId> {
         "permissions_no_rules" => MessageId::PermissionsNoRules,
         "permissions_operation_failed" => MessageId::PermissionsOperationFailed,
         "permissions_posture_ask" => MessageId::PermissionsPostureAsk,
+        "permissions_posture_accept_edits" => MessageId::PermissionsPostureAcceptEdits,
         "permissions_posture_auto" => MessageId::PermissionsPostureAuto,
         "permissions_posture_bypass" => MessageId::PermissionsPostureBypass,
         "permissions_posture_header" => MessageId::PermissionsPostureHeader,
@@ -48,6 +49,7 @@ pub(super) fn resolve(key: &str) -> Option<MessageId> {
         "snapshots_failing" => MessageId::SnapshotsFailing,
         "snapshots_history_repaired" => MessageId::SnapshotsHistoryRepaired,
         "status_approval_ask" => MessageId::StatusApprovalAsk,
+        "status_approval_accept_edits" => MessageId::StatusApprovalAcceptEdits,
         "status_approval_auto" => MessageId::StatusApprovalAuto,
         "status_approval_full_access" => MessageId::StatusApprovalFullAccess,
         "status_approval_never" => MessageId::StatusApprovalNever,

crates/tui/src/commands/groups/config/import_claude.rs

@@ -12,7 +12,7 @@ use std::fmt::Write as _;
 /// recommendation (report text only; nothing is applied).
 pub(crate) fn approval_posture_recommendation(mode: Option<&str>) -> &'static str {
     match mode {
-        Some("acceptEdits") => "auto-review posture (/permissions) matches acceptEdits",
+        Some("acceptEdits") => "Accept Edits posture (/permissions) matches acceptEdits",
         Some("plan") => "plan mode matches Claude's plan default",
         Some("bypassPermissions") => {
             "Full Access (yolo) matches bypassPermissions — confirm you want it"
@@ -202,7 +202,7 @@ mod tests {
 
     #[test]
     fn posture_recommendations_cover_the_four_claude_modes() {
-        assert!(approval_posture_recommendation(Some("acceptEdits")).contains("auto-review"));
+        assert!(approval_posture_recommendation(Some("acceptEdits")).contains("Accept Edits"));
         assert!(approval_posture_recommendation(Some("plan")).contains("plan"));
         assert!(approval_posture_recommendation(Some("bypassPermissions")).contains("Full Access"));
         assert!(approval_posture_recommendation(None).contains("Ask"));

crates/tui/src/commands/groups/config/permissions.rs

@@ -141,6 +141,7 @@ fn format_snapshot(m: &Messages, view: &PermissionsView) -> String {
     output.push_str("\n\n");
     let (label, explanation) = match view.approval_mode {
         CommandApprovalMode::Suggest => ("Ask", Text::PostureAsk),
+        CommandApprovalMode::AcceptEdits => ("Accept Edits", Text::PostureAcceptEdits),
         CommandApprovalMode::Auto => ("Auto-Review", Text::PostureAuto),
         CommandApprovalMode::Bypass => ("Full Access", Text::PostureBypass),
         CommandApprovalMode::Never => ("Never", Text::PostureNever),

crates/tui/src/commands/groups/config/policy_messages.rs

@@ -17,6 +17,7 @@ pub enum PermissionsText {
     NoRules,
     OperationFailed,
     PostureAsk,
+    PostureAcceptEdits,
     PostureAuto,
     PostureBypass,
     PostureHeader,
@@ -45,6 +46,7 @@ pub struct PermissionsMessages {
     permissions_no_rules: String,
     permissions_operation_failed: String,
     permissions_posture_ask: String,
+    permissions_posture_accept_edits: String,
     permissions_posture_auto: String,
     permissions_posture_bypass: String,
     permissions_posture_header: String,
@@ -91,6 +93,8 @@ impl PermissionsMessages {
             permissions_operation_failed: presentation
                 .translate("permissions_operation_failed", &[("error", "{error}")])?,
             permissions_posture_ask: presentation.translate("permissions_posture_ask", &[])?,
+            permissions_posture_accept_edits: presentation
+                .translate("permissions_posture_accept_edits", &[])?,
             permissions_posture_auto: presentation.translate("permissions_posture_auto", &[])?,
             permissions_posture_bypass: presentation
                 .translate("permissions_posture_bypass", &[])?,
@@ -152,6 +156,7 @@ impl PermissionsMessages {
                 PermissionsText::NoRules => &self.permissions_no_rules,
                 PermissionsText::OperationFailed => &self.permissions_operation_failed,
                 PermissionsText::PostureAsk => &self.permissions_posture_ask,
+                PermissionsText::PostureAcceptEdits => &self.permissions_posture_accept_edits,
                 PermissionsText::PostureAuto => &self.permissions_posture_auto,
                 PermissionsText::PostureBypass => &self.permissions_posture_bypass,
                 PermissionsText::PostureHeader => &self.permissions_posture_header,
@@ -192,6 +197,7 @@ pub enum StatusText {
     SnapshotsFailing,
     SnapshotsHistoryRepaired,
     StatusApprovalAsk,
+    StatusApprovalAcceptEdits,
     StatusApprovalAuto,
     StatusApprovalFullAccess,
     StatusApprovalNever,
@@ -274,6 +280,7 @@ pub struct StatusMessages {
     snapshots_failing: String,
     snapshots_history_repaired: String,
     status_approval_ask: String,
+    status_approval_accept_edits: String,
     status_approval_auto: String,
     status_approval_full_access: String,
     status_approval_never: String,
@@ -379,6 +386,8 @@ impl StatusMessages {
                 &[("workspace", "{workspace}")],
             )?,
             status_approval_ask: presentation.translate("status_approval_ask", &[])?,
+            status_approval_accept_edits: presentation
+                .translate("status_approval_accept_edits", &[])?,
             status_approval_auto: presentation.translate("status_approval_auto", &[])?,
             status_approval_full_access: presentation
                 .translate("status_approval_full_access", &[])?,
@@ -544,6 +553,7 @@ impl StatusMessages {
                 StatusText::SnapshotsFailing => &self.snapshots_failing,
                 StatusText::SnapshotsHistoryRepaired => &self.snapshots_history_repaired,
                 StatusText::StatusApprovalAsk => &self.status_approval_ask,
+                StatusText::StatusApprovalAcceptEdits => &self.status_approval_accept_edits,
                 StatusText::StatusApprovalAuto => &self.status_approval_auto,
                 StatusText::StatusApprovalFullAccess => &self.status_approval_full_access,
                 StatusText::StatusApprovalNever => &self.status_approval_never,

crates/tui/src/commands/groups/config/status.rs

@@ -322,6 +322,7 @@ fn approval_summary(mode: CommandApprovalMode, locale: &Messages) -> Cow<'static
         locale,
         match mode {
             CommandApprovalMode::Suggest => MessageId::StatusApprovalAsk,
+            CommandApprovalMode::AcceptEdits => MessageId::StatusApprovalAcceptEdits,
             CommandApprovalMode::Auto => MessageId::StatusApprovalAuto,
             CommandApprovalMode::Bypass => MessageId::StatusApprovalFullAccess,
             CommandApprovalMode::Never => MessageId::StatusApprovalNever,

crates/tui/src/conformance/events.rs

@@ -193,6 +193,7 @@ fn app_mode(case: &Value) -> AppMode {
 fn approval_mode(case: &Value) -> ApprovalMode {
     match case["approval_mode"].as_str().unwrap_or("suggest") {
         "suggest" => ApprovalMode::Suggest,
+        "accept_edits" => ApprovalMode::AcceptEdits,
         "auto" => ApprovalMode::Auto,
         "bypass" => ApprovalMode::Bypass,
         "never" => ApprovalMode::Never,

crates/tui/src/tui/app.rs

@@ -3947,7 +3947,8 @@ impl App {
         self.needs_redraw = true;
     }
 
-    /// Cycle the durable Agent permission posture: Ask → Auto-Review → Bypass.
+    /// Cycle the durable Agent permission posture: Ask → Accept Edits →
+    /// Auto-Review → Full Access.
     pub fn cycle_approval_posture(&mut self) -> bool {
         let Some(next) = self.next_approval_posture(false) else {
             return false;
@@ -4096,6 +4097,7 @@ impl App {
     fn approval_posture_setting(mode: ApprovalMode) -> &'static str {
         match mode {
             ApprovalMode::Suggest => "ask",
+            ApprovalMode::AcceptEdits => "accept-edits",
             ApprovalMode::Auto => "auto-review",
             ApprovalMode::Bypass => "full-access",
             ApprovalMode::Never => "never",

crates/tui/src/tui/app/tests.rs

@@ -4069,6 +4069,9 @@ fn cycle_approval_scenario() {
         let mut app = App::new(options, &Config::default());
         app.approval_mode = ApprovalMode::Suggest;
 
+        assert!(app.cycle_approval_posture());
+        assert_eq!(app.approval_mode, ApprovalMode::AcceptEdits);
+
         assert!(app.cycle_approval_posture());
         assert_eq!(app.approval_mode, ApprovalMode::Auto);
 
@@ -4196,9 +4199,10 @@ fn busy_permission_cycle_moves_the_live_posture() {
 fn permission_postures_persist_across_restart() {
     let _env_lock = lock_test_env();
     for (cycles, expected) in [
-        (1, ApprovalMode::Auto),
-        (2, ApprovalMode::Bypass),
-        (3, ApprovalMode::Suggest),
+        (1, ApprovalMode::AcceptEdits),
+        (2, ApprovalMode::Auto),
+        (3, ApprovalMode::Bypass),
+        (4, ApprovalMode::Suggest),
     ] {
         let tmp = tempfile::tempdir().expect("tempdir");
         let path = tmp.path().join("config.toml");
@@ -4243,18 +4247,18 @@ fn shift_tab_migrates_user_root_policy_to_durable_tui_posture() {
     assert!(app.approval_policy_locked());
 
     assert!(app.cycle_root_approval_posture());
-    assert_eq!(app.approval_mode, ApprovalMode::Auto);
+    assert_eq!(app.approval_mode, ApprovalMode::AcceptEdits);
     assert!(!app.approval_policy_locked());
     let saved_config = std::fs::read_to_string(&config_path).expect("saved config");
     assert!(saved_config.contains("# keep"));
     assert!(!saved_config.contains("approval_policy"));
     let saved_settings = std::fs::read_to_string(&settings_path).expect("saved settings");
-    assert!(saved_settings.contains("permission_posture = \"auto-review\""));
+    assert!(saved_settings.contains("permission_posture = \"accept-edits\""));
 
     let restarted_config =
         codewhale_plugins::providers::load_config(Some(config_path), None).expect("reload config");
     let restarted = App::new(options, &restarted_config);
-    assert_eq!(restarted.approval_mode, ApprovalMode::Auto);
+    assert_eq!(restarted.approval_mode, ApprovalMode::AcceptEdits);
     assert!(!restarted.approval_policy_locked());
 }
 

crates/tui/src/tui/plan_handoff.rs

@@ -79,6 +79,10 @@ pub(crate) fn request(locale: Locale) -> UserInputRequest {
                     MessageId::PlanHandoffWorkAsk,
                     MessageId::PlanHandoffWorkAskDetail,
                 ),
+                option(
+                    MessageId::PlanHandoffWorkAcceptEdits,
+                    MessageId::PlanHandoffWorkAcceptEditsDetail,
+                ),
                 option(
                     MessageId::PlanHandoffWorkAuto,
                     MessageId::PlanHandoffWorkAutoDetail,
@@ -104,6 +108,8 @@ pub(crate) fn choice(locale: Locale, response: &UserInputResponse) -> PlanHandof
     let picked = |id: MessageId| answer.label == tr(locale, id);
     if picked(MessageId::PlanHandoffWorkAsk) {
         PlanHandoffChoice::Work(ApprovalMode::Suggest)
+    } else if picked(MessageId::PlanHandoffWorkAcceptEdits) {
+        PlanHandoffChoice::Work(ApprovalMode::AcceptEdits)
     } else if picked(MessageId::PlanHandoffWorkAuto) {
         PlanHandoffChoice::Work(ApprovalMode::Auto)
     } else if picked(MessageId::PlanHandoffKeepPlanning) {
@@ -171,6 +177,7 @@ mod tests {
                 .collect();
             let expected = [
                 PlanHandoffChoice::Work(ApprovalMode::Suggest),
+                PlanHandoffChoice::Work(ApprovalMode::AcceptEdits),
                 PlanHandoffChoice::Work(ApprovalMode::Auto),
                 PlanHandoffChoice::KeepPlanning,
             ];

crates/tui/src/tui/ui/tests.rs

@@ -8807,7 +8807,7 @@ fn file_edit_card_says_when_it_asks_for_lack_of_a_git_repository() {
     ] {
         let mut app = create_test_app();
         app.mode = AppMode::Agent;
-        app.approval_mode = ApprovalMode::Suggest;
+        app.approval_mode = ApprovalMode::AcceptEdits;
         app.workspace = workspace.to_path_buf();
         push_approval_request_view(
             &mut app,

crates/tui/src/tui/underwater.rs

@@ -702,7 +702,9 @@ pub(crate) fn header_mode_ink(mode: AppMode) -> ChromeInk {
 
 pub(crate) fn header_permission_ink(mode: ApprovalMode) -> ChromeInk {
     match mode {
-        ApprovalMode::Suggest | ApprovalMode::Never => ChromeInk::PermissionAsk,
+        ApprovalMode::Suggest | ApprovalMode::AcceptEdits | ApprovalMode::Never => {
+            ChromeInk::PermissionAsk
+        }
         ApprovalMode::Auto => ChromeInk::PermissionAutoReview,
         ApprovalMode::Bypass => ChromeInk::PermissionFullAccess,
     }

crates/tui/src/tui/views/mod.rs

@@ -4086,12 +4086,14 @@ fn canonical_config_choice(key: &str, value: &str) -> String {
         },
         "approval_mode" | "permission_posture" => match normalized.as_str() {
             "ask" | "suggest" | "on-request" | "untrusted" => "ask".to_string(),
+            "accept-edits" | "acceptedits" | "edits" => "accept-edits".to_string(),
             "auto" | "auto-review" => "auto-review".to_string(),
             "full" | "full-access" | "bypass" | "yolo" => "full-access".to_string(),
             _ => normalized,
         },
         "approval_policy" => match normalized.as_str() {
             "ask" | "suggest" | "on-request" | "untrusted" => "ask".to_string(),
+            "accept-edits" | "acceptedits" | "edits" => "accept-edits".to_string(),
             "auto" | "auto-review" => "auto-review".to_string(),
             "full" | "full-access" | "bypass" | "yolo" => "full-access".to_string(),
             "never" | "deny" => "never".to_string(),

docs/CONFIGURATION.md

@@ -2437,7 +2437,7 @@ reasoning contract, and all four membership ids omit generic sampling fields.
   keep the conservative omitted-field default and require `allow_shell = true`
   to expose shell. Plan mode always hides shell; Full Access enables shell and
   auto-approval.
-- `approval_policy` (string, optional): `on-request`, `untrusted`, or `never`. Runtime `approval_mode` editing in `/config` also accepts `on-request` and `untrusted` aliases.
+- `approval_policy` (string, optional): `on-request`, `untrusted`, `accept-edits`, or `never`. Runtime `approval_mode` editing in `/config` also accepts `on-request` and `untrusted` aliases. A project file may set only a value that tightens the user's posture; the order from loosest is `auto`, `accept-edits`, `on-request`, `never`.
 - `[approval] default_selection` (string, optional): which option an approval
   card highlights when it first appears — `deny` (default) or `allow_once`.
   `deny` means a reflexive Enter on a card you have not read refuses the call.
@@ -2464,7 +2464,7 @@ reasoning contract, and all four membership ids omit generic sampling fields.
   ```
 - `sandbox_mode` (string, optional): `read-only`, `workspace-write`, `danger-full-access`, `external-sandbox`.
   The value can only narrow the sandbox the permission mode picks (Full
-  Access: no wrapper; Ask and Auto-Review: `workspace-write`; Plan:
+  Access: no wrapper; Ask, Accept Edits and Auto-Review: `workspace-write`; Plan:
   `read-only`), so `danger-full-access` and `external-sandbox` take effect
   only in Full Access (`yolo`).
   Platform support is not identical. macOS uses Seatbelt when its runtime

docs/GUIDE.md

@@ -333,9 +333,9 @@ Or switch directly:
 Plan mode is the safest place to start in an unfamiliar repository. It is for
 inspection and decision-making, not file edits.
 When a Plan turn successfully finishes a nonempty response, Codewhale asks
-how to continue, including when the plan is plain text. **Work (Ask)** and
-**Work (Auto-Review)** switch to Work with that permission and send the exact
-approved response as the next message. Existing To-dos from that turn are
+how to continue, including when the plan is plain text. **Work (Ask)**,
+**Work (Accept Edits)** and **Work (Auto-Review)** switch to Work with that
+permission and send the exact approved response as the next message. Existing To-dos from that turn are
 preserved; a prose-only plan adds one pending item without replacing unrelated
 work. If Codewhale cannot prepare the work state, it stays in Plan without
 starting the task. **Keep planning**, or `Esc`, stays in Plan. You can also

docs/INSTALL.md

@@ -4,10 +4,11 @@
 
 Codewhale is an open-source coding agent that runs in your terminal. You give
 it a task ("fix the failing test", "add a CLI flag"). It reads your repository,
-edits files and runs commands. In the default **Ask** posture it applies file
-edits inside the workspace immediately (and shows you the diff), but asks before
-running shell commands, so commit or stash anything you care about first. It
-works with many model providers. **DeepSeek** is the default.
+edits files and runs commands. In the default **Ask** posture it asks before
+each file edit and each shell command; **Accept Edits** (one `Shift+Tab`)
+applies file edits inside the repository immediately and shows you the diff,
+so commit or stash anything you care about first. It works with many model
+providers. **DeepSeek** is the default.
 
 The command is `codewhale`. `codew` is a shorter alias for the same program.
 
@@ -921,11 +922,13 @@ codewhale
 
 * The composer is at the bottom. The footer shows the permission posture
   (`ask`), the mode (`work`) and the model (`DeepSeek · deepseek-flash`).
-* **Shift+Tab** cycles the permission posture: Ask → Auto-Review → Full Access.
-  **Tab** (with an empty composer) cycles the mode: Plan → Work → Operate.
-* In **Ask**, file edits in the workspace are applied and shown as a diff.
-  Shell commands stop at an **APPROVAL** prompt: `y` allow once, `a` allow for
-  this session, `n` deny, `Esc` abort the turn.
+* **Shift+Tab** cycles the permission posture: Ask → Accept Edits →
+  Auto-Review → Full Access. **Tab** (with an empty composer) cycles the
+  mode: Plan → Work → Operate.
+* In **Ask**, file edits and shell commands stop at an **APPROVAL** prompt:
+  `y` allow once, `a` allow for this session, `n` deny, `Esc` abort the turn.
+  In **Accept Edits**, file edits in the repository are applied and shown as a
+  diff, and shell commands still prompt.
 * Useful keys: **F1** help (or `/help`), **Ctrl-K** command palette, **F3**
   provider/model picker, **Ctrl-R** resume a past session, **Ctrl-U** clear the
   input (**Ctrl-Z** restores it), **Ctrl-C** cancel, clear the draft, or quit, **Ctrl-D** quit

docs/KEYBINDINGS.md

@@ -18,7 +18,7 @@ Global key chords are not yet user-configurable — tracked for a future release
 | `Ctrl-B`             | Release the current shell wait so the turn can continue; foreground commands move into `/jobs`, and background tasks keep running. Use `/jobs` or `Bash` with `action: "wait"` to inspect output |
 | `Ctrl-D`             | Quit (only when the composer is empty)                         |
 | `Tab`                | When the composer is empty, cycle TUI mode: Plan → Work → Operate → Plan. Works while a turn is running: the change applies at the agent's next step in the same turn, and the status line says so until it does |
-| `Shift+Tab`          | Cycle permission posture: Ask → Auto-Review → Full Access. Live regardless of composer contents or whether a turn is running (suppressed only while a modal other than Config is open). During a turn the change applies at the agent's next step; a call you already approved runs only if the new posture is equal or broader. Model, thinking level and provider stay locked until the turn ends |
+| `Shift+Tab`          | Cycle permission posture: Ask → Accept Edits → Auto-Review → Full Access. Live regardless of composer contents or whether a turn is running (suppressed only while a modal other than Config is open). During a turn the change applies at the agent's next step; a call you already approved runs only if the new posture is equal or broader. Model, thinking level and provider stay locked until the turn ends |
 | `Ctrl-T`             | Cycle reasoning effort for the active model. Walks the same ladder as `/model` and `/effort` (catalog or documented route dialect). Always-thinking models omit `off`; Grok 4.6 includes `xhigh`. |
 | `Ctrl-Shift-T`       | Toggle live transcript overlay (sticky-tail auto-scroll)                       |
 | `Ctrl-R`             | Open the resume-session picker                                 |

docs/MODES.md

@@ -27,14 +27,15 @@ the saved `role`/`profile` assignment. An Exact Fleet fixes each member's route.
 Press `Tab` to complete composer menus or cycle through the visible modes
 when the composer is empty: **Plan → Work → Operate → Plan**. `Tab` never sends
 or queues composer text; use `Enter` to send or queue it.
-Press `Shift+Tab` to cycle permission posture (Ask → Auto-Review → Full Access).
+Press `Shift+Tab` to cycle permission posture (Ask → Accept Edits →
+Auto-Review → Full Access).
 Every change of effective permission writes a `Permissions changed to …` line
 in the transcript.
 Press `Ctrl+T` to cycle reasoning effort.
 Run `/mode` to open the mode picker, or switch directly with `/mode work`,
 `/mode plan`, or `/mode operate`.
 
-- **Plan**: design-first prompting. The stable primitive names remain familiar, but the runtime centrally refuses file mutation and shell execution. Read-only inspection and policy-allowed research, including deferred Web search/fetch, remain available. When a Plan turn successfully finishes a nonempty response, including a prose-only plan, the TUI asks how to continue: Work (Ask), Work (Auto-Review), or keep planning. Work sends the exact approved response as a normal follow-up and preserves that turn's existing To-dos, or adds one pending plan item without replacing unrelated work.
+- **Plan**: design-first prompting. The stable primitive names remain familiar, but the runtime centrally refuses file mutation and shell execution. Read-only inspection and policy-allowed research, including deferred Web search/fetch, remain available. When a Plan turn successfully finishes a nonempty response, including a prose-only plan, the TUI asks how to continue: Work (Ask), Work (Accept Edits), Work (Auto-Review), or keep planning. Work sends the exact approved response as a normal follow-up and preserves that turn's existing To-dos, or adds one pending plan item without replacing unrelated work.
 - **Work** (internally `agent`): ordinary multi-step execution. The first-turn toolbox includes `read`, `write`, `edit`, `file_search`, `bash`, `agent`, `workflow`, `todo_write`, and `load_skill`, plus `create_goal`, `get_goal`, `update_goal`, and `task_shell_wait` so goal and background-shell controls are available without discovery. The agent calls `create_goal` when a request is a durable objective; the host never infers a goal from wording, and the contract must not tell the model otherwise. Approval, sandbox, repository law, and managed policy decide what may execute.
 - **Operate**: Work at full strength, the "ultra" mode. Same tools and authority as Work; the difference is how they are used. Each substantive request becomes a goal (`create_goal`), the plan stays visible (`todo_write`), multi-part work runs through `workflow` and parallel `agent` workers, non-trivial changes get an independent reviewer before they are called done, long commands keep running in the background, and recurring or watch-type work is offered as an `automation` (created after approval). It keeps going until the goal is verified, blocked on you, or paused.
 
@@ -195,14 +196,24 @@ at runtime:
 
 ```text
 /config
-# edit the approval_mode row to: suggest | auto | never
+# edit the permission_posture row to: ask | accept-edits | auto-review | full-access
 ```
 
 Legacy note: `/set approval_mode ...` was retired in favor of `/config`.
 
-- `suggest` (**Ask**, default): tool approvals may interrupt, and Codewhale asks
-  when an unresolved user choice materially changes authority, cost, scope, or
-  outcome.
+- `ask` (**Ask**, default; internally `suggest`): tool approvals may interrupt,
+  and Codewhale asks when an unresolved user choice materially changes
+  authority, cost, scope, or outcome. Every file edit and every command asks,
+  including edits inside the workspace.
+- `accept-edits` (**Accept Edits**, wire `accept_edits`): Ask, except that a
+  file edit whose every target stays inside the workspace's git work tree runs
+  without a card. Edits to `.git` internals, `.codewhale`, `.env*`, credential
+  and key files always ask, and so does every edit in a folder without git
+  (the card says the folder has no repository). Commands, network, MCP actions
+  and anything outside the folder ask exactly as in Ask; ask rules, hooks,
+  repository law and the safety floor still force a card. This is Claude
+  Code's `acceptEdits`. ACP sessions run it as Ask, because ACP turns never
+  apply the in-folder edit rule.
 - `auto` (**Auto-Review**): reviews tool calls automatically. Deliberate user
   questions remain available in interactive sessions through `request_user_input`;
   a question parks the turn until answered, canceled, or its configured timeout
@@ -292,7 +303,7 @@ auto-approve bit:
   is hard-blocked) and, for holds it cannot prove safe, the same one-shot
   model guardian using the child's own session client. No prompt is ever
   opened for a child; an unavailable guardian denies, fail closed.
-- **Ask**: a call the role may delegate runs. A held call is raised as an
+- **Ask** and **Accept Edits**: a call the role may delegate runs. A held call is raised as an
   approval prompt in the parent's UI (`agent:<id>:approval:<n>`) when the
   host is an interactive TUI; the worker waits visibly (`waiting for user`)
   and the person's answer is routed back to it, whether the parent turn is

docs/features.toml

@@ -328,7 +328,7 @@ owner = "crates/config/src/app_mode.rs"
 [[feature]]
 id = "permission-postures"
 name = "Permission postures"
-summary = "Ask, Auto-Review and Full Access govern approvals; cards default to Deny and preview saved grants."
+summary = "Ask, Accept Edits, Auto-Review and Full Access govern approvals; cards default to Deny and preview saved grants."
 status = "stable"
 surfaces = { tui = "stable", api = "stable" }
 docs = "docs/MODES.md#permission-posture"

docs/i18n/README.ar.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -71,7 +71,7 @@ cargo install codewhale-cli --locked  # crates.io; can trail GitHub Releases
 ## البدء السريع
 
 1. احفظ عملك بعمل commit أو stash، ثم شغّل `codewhale` من جذر مستودع git.
-   افتراضيًا يطبّق تعديلات الملفات هناك دون أن يسأل، ويعرض لك الفروقات (diff).
+   افتراضيًا يسأل قبل كل تعديل على ملف وقبل كل أمر؛ اضغط `Shift+Tab` مرة واحدة لتفعيل **Accept Edits** كي يعدّل الملفات في المستودع دون أن يسأل.
 2. شغّل `/provider` (أو اضغط `F3`)، واختر مزوّدًا، والصق مفتاح API الخاص به، ثم
    اختر نموذجًا. DeepSeek هو المزوّد الافتراضي. إن لم يكن لديك مفتاح، فاختر بيئة
    تشغيل محلية بدلًا من ذلك. وإذا لم يكن أي مزوّد مُعدًّا وكان Ollama يقدّم نموذج
@@ -104,7 +104,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | التبديل عبر | الخيارات |
 | --- | --- | --- |
 | الوضع (Mode) | `Tab` (عندما يكون حقل الإدخال فارغًا) أو `/mode` | في **Plan** يقرأ ويبحث لكنه لا يغيّر شيئًا. وفي **Work** يعدّل الملفات ويشغّل الأوامر. أما **Operate** فله صلاحيات Work نفسها، ويعامل طلبك على أنه هدف، ويواصل العمل حتى يُتحقَّق من الهدف أو يحتاج إلى مُدخل منك. |
-| الإذن (Permission) | `Shift+Tab` | مع **Ask** تُطبَّق تعديلات الملفات في مستودعك دون سؤال، ويسأل قبل أوامر الصدفة التي ليست للقراءة فقط. ومع **Auto-Review** تعتمد القواعد ونموذج مراجِع الاستدعاءات الروتينية، ويرفض هذا الإذن الاستدعاءات عالية الخطورة؛ انتقل إلى Ask لتوافق عليها بنفسك. أما **Full Access** فلا يسأل أبدًا ويوقف صندوق حماية Codewhale؛ وتظل قواعد المستودع والسياسة المُدارة سارية. |
+| الإذن (Permission) | `Shift+Tab` | مع **Ask** يسأل قبل كل تعديل على ملف وقبل كل أمر صدفة ليس للقراءة فقط. ومع **Accept Edits** تُطبَّق تعديلات الملفات في مستودع git دون سؤال، ويظل يسأل قبل الأوامر. ومع **Auto-Review** تعتمد القواعد ونموذج مراجِع الاستدعاءات الروتينية، ويرفض هذا الإذن الاستدعاءات عالية الخطورة؛ انتقل إلى Ask لتوافق عليها بنفسك. أما **Full Access** فلا يسأل أبدًا ويوقف صندوق حماية Codewhale؛ وتظل قواعد المستودع والسياسة المُدارة سارية. |
 
 راجع [دليل الأوضاع والأذونات](../MODES.md) للتفاصيل.
 

docs/i18n/README.ca.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -76,8 +76,8 @@ primer.
 ## Inici ràpid
 
 1. Fes un commit o un stash de la teva feina i després executa `codewhale` des
-   de l’arrel d’un repositori git. Per defecte, hi aplica les edicions de
-   fitxers sense preguntar i et mostra el diff.
+   de l’arrel d’un repositori git. Per defecte, pregunta abans de cada
+   edició de fitxer i de cada ordre; prem `Shift+Tab` un cop per a **Accept Edits** i deixar-li editar fitxers al repositori sense preguntar.
 2. Executa `/provider` (o prem `F3`), tria un proveïdor, enganxa’n la clau API
    i escull un model. DeepSeek és el proveïdor per defecte. Si no tens cap
    clau, tria un entorn local. Si no hi ha cap proveïdor configurat i Ollama ja
@@ -112,7 +112,7 @@ Una instal·lació nova comença en mode Work amb el permís Ask.
 | | Es canvia amb | Opcions |
 | --- | --- | --- |
 | Mode | `Tab` (amb l’entrada buida) o `/mode` | **Plan** llegeix i cerca però no canvia res. **Work** edita fitxers i executa ordres. **Operate** té el mateix accés que Work, tracta la teva petició com un objectiu i continua fins que l’objectiu està verificat o necessita alguna resposta teva. |
-| Permís | `Shift+Tab` | **Ask** aplica les edicions de fitxers al teu repositori sense preguntar i pregunta abans de les ordres de shell que no són de només lectura. **Auto-Review** deixa que unes regles i un model revisor aprovin les crides rutinàries i rebutja les d’alt risc; canvia a Ask per aprovar-les tu mateix. **Full Access** no pregunta mai i desactiva el sandbox de Codewhale; les regles del repositori i la política gestionada continuen aplicant-se. |
+| Permís | `Shift+Tab` | **Ask** pregunta abans de cada edició de fitxer i de cada ordre de shell que no és de només lectura. **Accept Edits** aplica les edicions de fitxers al teu repositori git sense preguntar i continua preguntant abans de les ordres. **Auto-Review** deixa que unes regles i un model revisor aprovin les crides rutinàries i rebutja les d’alt risc; canvia a Ask per aprovar-les tu mateix. **Full Access** no pregunta mai i desactiva el sandbox de Codewhale; les regles del repositori i la política gestionada continuen aplicant-se. |
 
 Consulta la [guia de modes i permisos](../MODES.md) per als detalls.
 

docs/i18n/README.de.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -77,8 +77,8 @@ die zuerst kommt.
 ## Schnellstart
 
 1. Committe oder stashe deine Arbeit und starte dann `codewhale` im
-   Wurzelverzeichnis eines Git-Repositorys. Standardmäßig wendet es dort
-   Dateiänderungen an, ohne zu fragen, und zeigt dir den Diff.
+   Wurzelverzeichnis eines Git-Repositorys. Standardmäßig fragt es vor jeder
+   Dateiänderung und jedem Befehl; drücke einmal `Shift+Tab` für **Accept Edits**, damit es Dateien im Repository ohne Nachfrage ändert.
 2. Führe `/provider` aus (oder drücke `F3`), wähle einen Anbieter, füge seinen
    API-Schlüssel ein und wähle ein Modell. DeepSeek ist der Standardanbieter.
    Ohne Schlüssel wählst du stattdessen eine lokale Runtime. Ist kein Anbieter
@@ -116,7 +116,7 @@ Eine neue Installation startet im Work-Modus mit der Berechtigung Ask.
 | | Wechseln mit | Optionen |
 | --- | --- | --- |
 | Modus | `Tab` (bei leerer Eingabe) oder `/mode` | **Plan** liest und durchsucht, ändert aber nichts. **Work** bearbeitet Dateien und führt Befehle aus. **Operate** hat dieselben Zugriffsrechte wie Work, behandelt deine Anfrage als Ziel und arbeitet weiter, bis das Ziel überprüft ist oder es eine Eingabe von dir braucht. |
-| Berechtigung | `Shift+Tab` | **Ask** wendet Dateiänderungen in deinem Repository an, ohne zu fragen, und fragt vor Shell-Befehlen, die nicht nur lesen. **Auto-Review** lässt Regeln und ein Prüfmodell Routineaufrufe freigeben und lehnt Aufrufe mit hohem Risiko ab; wechsle zu Ask, um diese selbst freizugeben. **Full Access** fragt nie und schaltet die Sandbox von Codewhale ab; Repository-Regeln und verwaltete Richtlinien gelten weiterhin. |
+| Berechtigung | `Shift+Tab` | **Ask** fragt vor jeder Dateiänderung und vor jedem Shell-Befehl, der nicht nur liest. **Accept Edits** wendet Dateiänderungen in deinem Git-Repository an, ohne zu fragen, und fragt weiterhin vor Befehlen. **Auto-Review** lässt Regeln und ein Prüfmodell Routineaufrufe freigeben und lehnt Aufrufe mit hohem Risiko ab; wechsle zu Ask, um diese selbst freizugeben. **Full Access** fragt nie und schaltet die Sandbox von Codewhale ab; Repository-Regeln und verwaltete Richtlinien gelten weiterhin. |
 
 Details stehen in der [Anleitung zu Modi und Berechtigungen](../MODES.md).
 

docs/i18n/README.es-419.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -75,8 +75,8 @@ contrario, terminas con dos copias en el `PATH` y gana la que aparezca primero.
 ## Inicio rápido
 
 1. Haz commit de tu trabajo o guárdalo con stash, y luego ejecuta `codewhale`
-   desde la raíz de un repositorio git. De forma predeterminada, ahí aplica las
-   ediciones de archivos sin preguntar y te muestra el diff.
+   desde la raíz de un repositorio git. De forma predeterminada, pregunta antes de cada
+   edición de archivos y de cada comando; presiona `Shift+Tab` una vez para **Accept Edits** y dejar que edite archivos del repositorio sin preguntar.
 2. Ejecuta `/provider` (o presiona `F3`), elige un proveedor, pega su clave API
    y selecciona un modelo. DeepSeek es el proveedor predeterminado. Si no tienes
    clave, elige un entorno local. Si no hay ningún proveedor configurado y
@@ -112,7 +112,7 @@ Una instalación nueva arranca en el modo Work con el permiso Ask.
 | | Se cambia con | Opciones |
 | --- | --- | --- |
 | Modo | `Tab` (cuando la entrada está vacía) o `/mode` | **Plan** lee y busca, pero no cambia nada. **Work** edita archivos y ejecuta comandos. **Operate** tiene el mismo acceso que Work, trata tu solicitud como una meta y sigue hasta que la meta queda verificada o necesita una respuesta tuya. |
-| Permiso | `Shift+Tab` | **Ask** aplica las ediciones de archivos en tu repositorio sin preguntar y pregunta antes de los comandos de shell que no son de solo lectura. **Auto-Review** deja que unas reglas y un modelo revisor aprueben las llamadas rutinarias y rechaza las de alto riesgo; cambia a Ask para aprobar esas tú mismo. **Full Access** nunca pregunta y desactiva el sandbox de Codewhale; las reglas del repositorio y la política administrada siguen aplicándose. |
+| Permiso | `Shift+Tab` | **Ask** pregunta antes de cada edición de archivos y de cada comando de shell que no sea de solo lectura. **Accept Edits** aplica las ediciones de archivos en tu repositorio git sin preguntar y sigue preguntando antes de los comandos. **Auto-Review** deja que unas reglas y un modelo revisor aprueben las llamadas rutinarias y rechaza las de alto riesgo; cambia a Ask para aprobar esas tú mismo. **Full Access** nunca pregunta y desactiva el sandbox de Codewhale; las reglas del repositorio y la política administrada siguen aplicándose. |
 
 Consulta la [guía de modos y permisos](../MODES.md) para ver los detalles.
 

docs/i18n/README.fr.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -78,8 +78,8 @@ trouvée qui l’emporte.
 ## Démarrage rapide
 
 1. Commitez ou mettez de côté (stash) votre travail, puis lancez `codewhale` à
-   la racine d’un dépôt git. Par défaut, il y applique les modifications de
-   fichiers sans demander et vous montre le diff.
+   la racine d’un dépôt git. Par défaut, il demande avant chaque modification de
+   fichier et chaque commande ; appuyez une fois sur `Shift+Tab` pour **Accept Edits** afin qu’il modifie les fichiers du dépôt sans demander.
 2. Lancez `/provider` (ou appuyez sur `F3`), choisissez un fournisseur, collez
    sa clé API et choisissez un modèle. DeepSeek est le fournisseur par défaut.
    Sans clé, choisissez plutôt un runtime local. Si aucun fournisseur n’est
@@ -116,7 +116,7 @@ Une nouvelle installation démarre en mode Work avec la permission Ask.
 | | Changer avec | Options |
 | --- | --- | --- |
 | Mode | `Tab` (quand la saisie est vide) ou `/mode` | **Plan** lit et effectue des recherches, mais ne modifie rien. **Work** modifie des fichiers et exécute des commandes. **Operate** a les mêmes accès que Work, traite votre demande comme un objectif et continue jusqu’à ce que l’objectif soit vérifié ou qu’il ait besoin d’une réponse de votre part. |
-| Permission | `Shift+Tab` | **Ask** applique sans demander les modifications de fichiers dans votre dépôt et demande avant les commandes shell qui ne sont pas en lecture seule. **Auto-Review** laisse des règles et un modèle de revue approuver les appels courants et refuse ceux à haut risque ; passez en Ask pour les approuver vous-même. **Full Access** ne demande jamais et désactive le bac à sable de Codewhale ; les règles du dépôt et la politique gérée s’appliquent toujours. |
+| Permission | `Shift+Tab` | **Ask** demande avant chaque modification de fichier et chaque commande shell qui n’est pas en lecture seule. **Accept Edits** applique sans demander les modifications de fichiers dans votre dépôt git et demande toujours avant les commandes. **Auto-Review** laisse des règles et un modèle de revue approuver les appels courants et refuse ceux à haut risque ; passez en Ask pour les approuver vous-même. **Full Access** ne demande jamais et désactive le bac à sable de Codewhale ; les règles du dépôt et la politique gérée s’appliquent toujours. |
 
 Le [guide des modes et des permissions](../MODES.md) donne les détails.
 

docs/i18n/README.hi.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -73,7 +73,7 @@ Linux पर Homebrew, Android/Termux (प्रीव्यू) और मै
 ## क्विकस्टार्ट
 
 1. अपना काम commit या stash करें, फिर किसी git रिपॉज़िटरी के रूट से `codewhale` चलाएँ।
-   डिफ़ॉल्ट रूप से यह वहाँ फ़ाइल संपादन बिना पूछे लागू करता है और आपको diff दिखाता है।
+   डिफ़ॉल्ट रूप से यह हर फ़ाइल संपादन और हर कमांड से पहले पूछता है; रिपॉज़िटरी में फ़ाइलें बिना पूछे संपादित करवाने के लिए `Shift+Tab` एक बार दबाकर **Accept Edits** चुनें।
 2. `/provider` चलाएँ (या `F3` दबाएँ), कोई प्रोवाइडर चुनें, उसकी API कुंजी पेस्ट करें और
    एक मॉडल चुनें। DeepSeek डिफ़ॉल्ट प्रोवाइडर है। अगर कुंजी नहीं है, तो इसके बजाय कोई
    लोकल रनटाइम चुनें। अगर कोई प्रोवाइडर कॉन्फ़िगर नहीं है और Ollama पहले से कोई चैट
@@ -108,7 +108,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | कैसे बदलें | विकल्प |
 | --- | --- | --- |
 | मोड | `Tab` (जब इनपुट खाली हो) या `/mode` | **Plan** पढ़ता और खोजता है, पर कुछ नहीं बदलता। **Work** फ़ाइलें संपादित करता है और कमांड चलाता है। **Operate** के पास Work जितना ही एक्सेस है; यह आपके अनुरोध को एक लक्ष्य मानता है और तब तक चलता रहता है जब तक लक्ष्य सत्यापित न हो जाए या उसे आपसे इनपुट की ज़रूरत न पड़े। |
-| अनुमति | `Shift+Tab` | **Ask** आपकी रिपॉज़िटरी में फ़ाइल संपादन बिना पूछे लागू करता है और जो शेल कमांड read-only नहीं हैं, उनसे पहले पूछता है। **Auto-Review** नियमों और एक समीक्षक मॉडल को सामान्य कॉल मंज़ूर करने देता है और उच्च जोखिम वाली कॉल मना कर देता है; उन्हें खुद मंज़ूर करने के लिए Ask पर जाएँ। **Full Access** कभी नहीं पूछता और Codewhale का सैंडबॉक्स बंद कर देता है; रिपॉज़िटरी के नियम और प्रबंधित नीति (managed policy) फिर भी लागू रहते हैं। |
+| अनुमति | `Shift+Tab` | **Ask** हर फ़ाइल संपादन से पहले और हर उस शेल कमांड से पहले पूछता है जो read-only नहीं है। **Accept Edits** आपकी git रिपॉज़िटरी में फ़ाइल संपादन बिना पूछे लागू करता है और कमांड से पहले अब भी पूछता है। **Auto-Review** नियमों और एक समीक्षक मॉडल को सामान्य कॉल मंज़ूर करने देता है और उच्च जोखिम वाली कॉल मना कर देता है; उन्हें खुद मंज़ूर करने के लिए Ask पर जाएँ। **Full Access** कभी नहीं पूछता और Codewhale का सैंडबॉक्स बंद कर देता है; रिपॉज़िटरी के नियम और प्रबंधित नीति (managed policy) फिर भी लागू रहते हैं। |
 
 विवरण के लिए [मोड और अनुमतियों की गाइड](../MODES.md) देखें।
 

docs/i18n/README.id.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -76,8 +76,8 @@ salinan akan ada di `PATH` dan yang muncul lebih dulu yang dipakai.
 ## Mulai cepat
 
 1. Commit atau stash pekerjaan Anda, lalu jalankan `codewhale` dari root
-   repositori git. Secara default, Codewhale menerapkan edit berkas di sana
-   tanpa bertanya dan menampilkan diff-nya kepada Anda.
+   repositori git. Secara default, Codewhale bertanya sebelum setiap edit berkas
+   dan perintah; tekan `Shift+Tab` sekali untuk **Terima suntingan** (Accept Edits) agar ia mengedit berkas di repositori tanpa bertanya.
 2. Jalankan `/provider` (atau tekan `F3`), pilih penyedia, tempel kunci API-nya,
    lalu pilih model. DeepSeek adalah penyedia default. Jika tidak punya kunci,
    pilih runtime lokal. Jika belum ada penyedia yang dikonfigurasi dan Ollama
@@ -112,7 +112,7 @@ Instalasi baru dimulai dalam mode Work dengan izin Tanya.
 | | Ganti dengan | Opsi |
 | --- | --- | --- |
 | Mode | `Tab` (saat input kosong) atau `/mode` | **Plan** membaca dan mencari tetapi tidak mengubah apa pun. **Work** mengedit berkas dan menjalankan perintah. **Operate** memiliki akses yang sama dengan Work, memperlakukan permintaan Anda sebagai tujuan, dan terus berjalan sampai tujuan itu terverifikasi atau ia memerlukan masukan dari Anda. |
-| Izin | `Shift+Tab` | **Tanya** (Ask) menerapkan edit berkas di repositori Anda tanpa bertanya dan bertanya sebelum perintah shell yang bukan baca-saja. **Tinjauan otomatis** (Auto-Review) membiarkan aturan dan model peninjau menyetujui panggilan rutin dan menolak panggilan berisiko tinggi; beralihlah ke Tanya untuk menyetujuinya sendiri. **Akses penuh** (Full Access) tidak pernah bertanya dan menonaktifkan sandbox Codewhale; aturan repositori dan kebijakan terkelola tetap berlaku. |
+| Izin | `Shift+Tab` | **Tanya** (Ask) bertanya sebelum setiap edit berkas dan setiap perintah shell yang bukan baca-saja. **Terima suntingan** (Accept Edits) menerapkan edit berkas di repositori git Anda tanpa bertanya dan tetap bertanya sebelum perintah. **Tinjauan otomatis** (Auto-Review) membiarkan aturan dan model peninjau menyetujui panggilan rutin dan menolak panggilan berisiko tinggi; beralihlah ke Tanya untuk menyetujuinya sendiri. **Akses penuh** (Full Access) tidak pernah bertanya dan menonaktifkan sandbox Codewhale; aturan repositori dan kebijakan terkelola tetap berlaku. |
 
 Lihat [panduan mode dan izin](../MODES.md) untuk detailnya.
 

docs/i18n/README.it.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -75,8 +75,8 @@ altrimenti nel `PATH` finiscono due copie e vince quella che compare per prima.
 ## Avvio rapido
 
 1. Fai commit o stash del tuo lavoro, poi esegui `codewhale` dalla radice di un
-   repository git. Per impostazione predefinita lì applica le modifiche ai file
-   senza chiedere e ti mostra il diff.
+   repository git. Per impostazione predefinita chiede prima di ogni modifica ai file
+   e di ogni comando; premi `Shift+Tab` una volta per **Accept Edits** e lasciargli modificare i file nel repository senza chiedere.
 2. Esegui `/provider` (o premi `F3`), scegli un provider, incolla la sua chiave
    API e scegli un modello. DeepSeek è il provider predefinito. Se non hai una
    chiave, scegli invece un runtime locale. Se non è configurato alcun provider
@@ -112,7 +112,7 @@ Una nuova installazione parte in modalità Work con il permesso Ask.
 | | Si cambia con | Opzioni |
 | --- | --- | --- |
 | Modalità | `Tab` (quando l’input è vuoto) o `/mode` | **Plan** legge e cerca, ma non modifica nulla. **Work** modifica file ed esegue comandi. **Operate** ha gli stessi accessi di Work, tratta la tua richiesta come un obiettivo e va avanti finché l’obiettivo non è verificato o finché non ha bisogno di un tuo input. |
-| Permesso | `Shift+Tab` | **Ask** applica senza chiedere le modifiche ai file nel tuo repository e chiede prima dei comandi di shell che non sono in sola lettura. **Auto-Review** lascia che regole e un modello revisore approvino le chiamate di routine e rifiuta quelle ad alto rischio; passa ad Ask per approvarle tu stesso. **Full Access** non chiede mai e disattiva la sandbox di Codewhale; le regole del repository e le policy gestite restano comunque valide. |
+| Permesso | `Shift+Tab` | **Ask** chiede prima di ogni modifica ai file e di ogni comando di shell che non sia in sola lettura. **Accept Edits** applica senza chiedere le modifiche ai file nel tuo repository git e continua a chiedere prima dei comandi. **Auto-Review** lascia che regole e un modello revisore approvino le chiamate di routine e rifiuta quelle ad alto rischio; passa ad Ask per approvarle tu stesso. **Full Access** non chiede mai e disattiva la sandbox di Codewhale; le regole del repository e le policy gestite restano comunque valide. |
 
 I dettagli sono nella [guida a modalità e permessi](../MODES.md).
 

docs/i18n/README.ja-JP.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -69,7 +69,7 @@ Nix、Linux 上の Homebrew、Android/Termux（プレビュー）、手動ダウ
 ## クイックスタート
 
 1. 作業中の変更をコミットまたは stash してから、git リポジトリのルートで `codewhale` を実行します。
-   既定では、そこでのファイル編集を確認なしで適用し、差分を表示します。
+   既定では、ファイル編集とコマンド実行のたびに確認します。`Shift+Tab` を 1 回押して**編集を承認**（Accept Edits）にすると、リポジトリ内のファイル編集を確認なしで適用します。
 2. `/provider` を実行（または `F3` を押す）し、プロバイダーを選んで API キーを貼り付け、モデルを選びます。
    既定のプロバイダーは DeepSeek です。
    キーがない場合は、代わりにローカルランタイムを選びます。
@@ -102,7 +102,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | 切り替え方法 | 選択肢 |
 | --- | --- | --- |
 | モード | `Tab`（入力欄が空のとき）または `/mode` | **Plan** は読み取りと検索を行いますが、何も変更しません。**Work** はファイルを編集し、コマンドを実行します。**Operate** は Work と同じアクセス権を持ち、リクエストを目標として扱い、目標が検証されるか、あなたの入力が必要になるまで作業を続けます。 |
-| 権限 | `Shift+Tab` | **確認**（Ask）では、リポジトリ内のファイル編集は確認なしで適用され、読み取り専用ではないシェルコマンドの前に確認が入ります。**自動レビュー**（Auto-Review）では、ルールとレビュー担当のモデルが定型的な呼び出しを承認し、高リスクの呼び出しは拒否します。それらを自分で承認するには「確認」に切り替えてください。**フルアクセス**（Full Access）は一切確認せず、Codewhale のサンドボックスを無効にします。リポジトリのルールと管理ポリシーは引き続き適用されます。 |
+| 権限 | `Shift+Tab` | **確認**（Ask）では、すべてのファイル編集と、読み取り専用ではないすべてのシェルコマンドの前に確認が入ります。**編集を承認**（Accept Edits）では、git リポジトリ内のファイル編集は確認なしで適用され、コマンドの前には引き続き確認が入ります。**自動レビュー**（Auto-Review）では、ルールとレビュー担当のモデルが定型的な呼び出しを承認し、高リスクの呼び出しは拒否します。それらを自分で承認するには「確認」に切り替えてください。**フルアクセス**（Full Access）は一切確認せず、Codewhale のサンドボックスを無効にします。リポジトリのルールと管理ポリシーは引き続き適用されます。 |
 
 詳しくは[モードと権限のガイド](../MODES.md)を参照してください。
 

docs/i18n/README.ko-KR.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -74,8 +74,8 @@ Linux의 Homebrew, Android/Termux(프리뷰), 수동 다운로드는
 ## 빠른 시작
 
 1. 작업 중인 변경을 커밋하거나 stash한 다음, git 저장소의 루트에서
-   `codewhale`을 실행합니다. 기본 설정에서는 그 저장소의 파일 편집을 묻지 않고
-   적용하고 diff를 보여 줍니다.
+   `codewhale`을 실행합니다. 기본 설정에서는 파일 편집과 명령을 실행하기 전에
+   매번 묻습니다. `Shift+Tab`을 한 번 눌러 **편집 수락**(Accept Edits)으로 바꾸면 저장소의 파일 편집을 묻지 않고 적용합니다.
 2. `/provider`를 실행하거나 `F3`을 눌러 제공업체를 고르고, API 키를 붙여 넣은
    뒤 모델을 선택합니다. 기본 제공업체는 DeepSeek입니다. 키가 없으면 대신 로컬
    런타임을 고르세요. 설정된 제공업체가 없고 Ollama가 이미 채팅 모델을 제공하고
@@ -110,7 +110,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | 전환 방법 | 옵션 |
 | --- | --- | --- |
 | 모드 | `Tab`(입력란이 비어 있을 때) 또는 `/mode` | **계획**(Plan)은 읽고 검색하지만 아무것도 바꾸지 않습니다. **실행**(Work)은 파일을 편집하고 명령을 실행합니다. **운영**(Operate)은 실행과 같은 접근 권한을 가지며, 요청을 목표로 다루고 목표가 검증되거나 사용자의 입력이 필요할 때까지 계속 진행합니다. |
-| 권한 | `Shift+Tab` | **확인**(Ask)은 저장소 안의 파일 편집은 묻지 않고 적용하고, 읽기 전용이 아닌 셸 명령은 실행 전에 묻습니다. **자동 검토**(Auto-Review)는 규칙과 리뷰어 모델이 일상적인 호출을 승인하게 하고 위험도가 높은 호출은 거부합니다. 그런 호출을 직접 승인하려면 확인으로 전환하세요. **전체 접근**(Full Access)은 전혀 묻지 않으며 Codewhale의 샌드박스를 끕니다. 저장소 규칙과 관리 정책은 계속 적용됩니다. |
+| 권한 | `Shift+Tab` | **확인**(Ask)은 모든 파일 편집과 읽기 전용이 아닌 모든 셸 명령을 실행 전에 묻습니다. **편집 수락**(Accept Edits)은 git 저장소 안의 파일 편집은 묻지 않고 적용하고, 명령은 여전히 실행 전에 묻습니다. **자동 검토**(Auto-Review)는 규칙과 리뷰어 모델이 일상적인 호출을 승인하게 하고 위험도가 높은 호출은 거부합니다. 그런 호출을 직접 승인하려면 확인으로 전환하세요. **전체 접근**(Full Access)은 전혀 묻지 않으며 Codewhale의 샌드박스를 끕니다. 저장소 규칙과 관리 정책은 계속 적용됩니다. |
 
 자세한 내용은 [모드와 권한 안내서](../MODES.md)를 참고하세요.
 

docs/i18n/README.pl.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -75,8 +75,8 @@ inaczej w `PATH` znajdą się dwie kopie i zadziała ta, która jest pierwsza.
 ## Szybki start
 
 1. Zrób commit lub stash swoich zmian, a następnie uruchom `codewhale` w
-   katalogu głównym repozytorium git. Domyślnie wprowadza tam zmiany w plikach
-   bez pytania i pokazuje Ci diff.
+   katalogu głównym repozytorium git. Domyślnie pyta przed każdą zmianą w pliku
+   i każdym poleceniem; naciśnij raz `Shift+Tab`, aby włączyć **Accept Edits** i pozwolić mu zmieniać pliki w repozytorium bez pytania.
 2. Uruchom `/provider` (lub naciśnij `F3`), wybierz dostawcę, wklej jego klucz
    API i wybierz model. Domyślnym dostawcą jest DeepSeek. Jeśli nie masz
    klucza, wybierz zamiast tego lokalne środowisko. Jeśli żaden dostawca nie
@@ -112,7 +112,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | Przełączanie | Opcje |
 | --- | --- | --- |
 | Tryb | `Tab` (gdy pole wprowadzania jest puste) lub `/mode` | **Plan** czyta i przeszukuje, ale niczego nie zmienia. **Work** edytuje pliki i uruchamia polecenia. **Operate** ma ten sam dostęp co Work, traktuje Twoje zlecenie jako cel i działa dalej, dopóki cel nie zostanie zweryfikowany albo nie będzie potrzebował informacji od Ciebie. |
-| Uprawnienie | `Shift+Tab` | **Ask** wprowadza zmiany w plikach Twojego repozytorium bez pytania i pyta przed poleceniami powłoki, które nie są tylko do odczytu. **Auto-Review** pozwala regułom i modelowi recenzującemu zatwierdzać rutynowe wywołania, a wywołania wysokiego ryzyka odrzuca; aby zatwierdzać je samodzielnie, przełącz na Ask. **Full Access** nigdy nie pyta i wyłącza piaskownicę Codewhale; reguły repozytorium i polityka zarządzana nadal obowiązują. |
+| Uprawnienie | `Shift+Tab` | **Ask** pyta przed każdą zmianą w pliku i przed każdym poleceniem powłoki, które nie jest tylko do odczytu. **Accept Edits** wprowadza zmiany w plikach Twojego repozytorium git bez pytania i nadal pyta przed poleceniami. **Auto-Review** pozwala regułom i modelowi recenzującemu zatwierdzać rutynowe wywołania, a wywołania wysokiego ryzyka odrzuca; aby zatwierdzać je samodzielnie, przełącz na Ask. **Full Access** nigdy nie pyta i wyłącza piaskownicę Codewhale; reguły repozytorium i polityka zarządzana nadal obowiązują. |
 
 Szczegóły opisuje [przewodnik po trybach i uprawnieniach](../MODES.md).
 

docs/i18n/README.pt-BR.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -74,8 +74,8 @@ contrário, duas cópias acabam no `PATH` e vale a que vier primeiro.
 ## Início rápido
 
 1. Faça commit ou stash do seu trabalho e execute `codewhale` na raiz de um
-   repositório git. Por padrão, ele aplica as edições de arquivos ali sem
-   perguntar e mostra o diff.
+   repositório git. Por padrão, ele pergunta antes de cada edição de arquivo
+   e de cada comando; pressione `Shift+Tab` uma vez para **Aceitar edições** (Accept Edits) e deixá-lo editar arquivos no repositório sem perguntar.
 2. Execute `/provider` (ou pressione `F3`), escolha um provedor, cole a chave
    de API dele e escolha um modelo. DeepSeek é o provedor padrão. Sem uma
    chave, escolha um runtime local. Se nenhum provedor estiver configurado e o
@@ -112,7 +112,7 @@ Uma instalação nova começa no modo Work com a permissão Perguntar.
 | | Alterne com | Opções |
 | --- | --- | --- |
 | Modo | `Tab` (com o campo de entrada vazio) ou `/mode` | **Plan** lê e pesquisa, mas não altera nada. **Work** edita arquivos e executa comandos. **Operate** tem o mesmo acesso que o Work, trata seu pedido como um objetivo e continua até o objetivo ser verificado ou precisar de uma resposta sua. |
-| Permissão | `Shift+Tab` | **Perguntar** (Ask) aplica edições de arquivos no seu repositório sem perguntar e pergunta antes de comandos de shell que não sejam somente leitura. **Revisão automática** (Auto-Review) deixa regras e um modelo revisor aprovarem chamadas rotineiras e recusa as de alto risco; mude para Perguntar para aprová-las você mesmo. **Acesso total** (Full Access) nunca pergunta e desliga o sandbox do Codewhale; as regras do repositório e a política gerenciada continuam valendo. |
+| Permissão | `Shift+Tab` | **Perguntar** (Ask) pergunta antes de toda edição de arquivo e de todo comando de shell que não seja somente leitura. **Aceitar edições** (Accept Edits) aplica edições de arquivos no seu repositório git sem perguntar e continua perguntando antes de comandos. **Revisão automática** (Auto-Review) deixa regras e um modelo revisor aprovarem chamadas rotineiras e recusa as de alto risco; mude para Perguntar para aprová-las você mesmo. **Acesso total** (Full Access) nunca pergunta e desliga o sandbox do Codewhale; as regras do repositório e a política gerenciada continuam valendo. |
 
 Os detalhes estão no [guia de modos e permissões](../MODES.md).
 

docs/i18n/README.ru.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -76,8 +76,8 @@ Homebrew в Linux, Android/Termux (предварительная версия)
 ## Быстрый старт
 
 1. Закоммитьте свои изменения или уберите их в stash, затем запустите
-   `codewhale` из корня git-репозитория. По умолчанию он применяет там правки
-   файлов без запроса и показывает вам diff.
+   `codewhale` из корня git-репозитория. По умолчанию он спрашивает перед каждой правкой
+   файла и каждой командой; нажмите `Shift+Tab` один раз для **Accept Edits**, чтобы он правил файлы в репозитории без запроса.
 2. Выполните `/provider` (или нажмите `F3`), выберите провайдера, вставьте его
    ключ API и выберите модель. Провайдер по умолчанию — DeepSeek. Если ключа
    нет, выберите вместо этого локальный рантайм. Если ни один провайдер не
@@ -113,7 +113,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | Переключение | Варианты |
 | --- | --- | --- |
 | Режим | `Tab` (когда поле ввода пустое) или `/mode` | **Plan** читает и ищет, но ничего не меняет. **Work** редактирует файлы и выполняет команды. **Operate** имеет тот же доступ, что и Work, воспринимает ваш запрос как цель и продолжает работу, пока цель не будет проверена или ему не понадобится ваш ответ. |
-| Разрешение | `Shift+Tab` | **Ask** применяет правки файлов в вашем репозитории без запроса и спрашивает перед командами оболочки, кроме команд только для чтения. **Auto-Review** позволяет правилам и модели-рецензенту одобрять рутинные вызовы и отклоняет вызовы с высоким риском; чтобы одобрять их самостоятельно, переключитесь на Ask. **Full Access** никогда не спрашивает и отключает песочницу Codewhale; правила репозитория и управляемая политика продолжают действовать. |
+| Разрешение | `Shift+Tab` | **Ask** спрашивает перед каждой правкой файла и перед каждой командой оболочки, кроме команд только для чтения. **Accept Edits** применяет правки файлов в вашем git-репозитории без запроса и по-прежнему спрашивает перед командами. **Auto-Review** позволяет правилам и модели-рецензенту одобрять рутинные вызовы и отклоняет вызовы с высоким риском; чтобы одобрять их самостоятельно, переключитесь на Ask. **Full Access** никогда не спрашивает и отключает песочницу Codewhale; правила репозитория и управляемая политика продолжают действовать. |
 
 Подробности — в [руководстве по режимам и разрешениям](../MODES.md).
 

docs/i18n/README.tr.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -75,8 +75,8 @@ sayfasında anlatılır. Her makinede tek bir kurulum yöntemi kullanın; aksi h
 ## Hızlı başlangıç
 
 1. Çalışmanızı commit edin veya stash'leyin, ardından bir git deposunun kök
-   dizininde `codewhale` çalıştırın. Varsayılan olarak orada dosya düzenlemelerini
-   sormadan uygular ve size diff'i gösterir.
+   dizininde `codewhale` çalıştırın. Varsayılan olarak her dosya düzenlemesinden
+   ve her komuttan önce sorar; depodaki dosyaları sormadan düzenlemesi için `Shift+Tab` tuşuna bir kez basarak **Accept Edits** modunu seçin.
 2. `/provider` çalıştırın (veya `F3` tuşuna basın), bir sağlayıcı seçin, onun API
    anahtarını yapıştırın ve bir model seçin. Varsayılan sağlayıcı DeepSeek'tir.
    Anahtarınız yoksa bunun yerine yerel bir çalışma ortamı seçin. Hiçbir sağlayıcı
@@ -113,7 +113,7 @@ Yeni bir kurulum Work modunda ve Ask izniyle başlar.
 | | Nasıl değiştirilir | Seçenekler |
 | --- | --- | --- |
 | Mod | `Tab` (giriş alanı boşken) veya `/mode` | **Plan** okur ve arar ama hiçbir şeyi değiştirmez. **Work** dosyaları düzenler ve komutları çalıştırır. **Operate** Work ile aynı erişime sahiptir, isteğinizi bir hedef olarak ele alır ve hedef doğrulanana ya da sizden girdi gerekene kadar devam eder. |
-| İzin | `Shift+Tab` | **Ask** deponuzdaki dosya düzenlemelerini sormadan uygular, salt okunur olmayan kabuk komutlarından önce sorar. **Auto-Review** rutin çağrıların kurallar ve bir inceleyici model tarafından onaylanmasına izin verir, yüksek riskli olanları reddeder; bunları kendiniz onaylamak için Ask iznine geçin. **Full Access** hiç sormaz ve Codewhale'in korumalı alanını kapatır; depo kuralları ve yönetilen politika yine de geçerlidir. |
+| İzin | `Shift+Tab` | **Ask** her dosya düzenlemesinden ve salt okunur olmayan her kabuk komutundan önce sorar. **Accept Edits** git deponuzdaki dosya düzenlemelerini sormadan uygular, komutlardan önce yine sorar. **Auto-Review** rutin çağrıların kurallar ve bir inceleyici model tarafından onaylanmasına izin verir, yüksek riskli olanları reddeder; bunları kendiniz onaylamak için Ask iznine geçin. **Full Access** hiç sormaz ve Codewhale'in korumalı alanını kapatır; depo kuralları ve yönetilen politika yine de geçerlidir. |
 
 Ayrıntılar için [modlar ve izinler kılavuzuna](../MODES.md) bakın.
 

docs/i18n/README.uk.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -77,8 +77,8 @@ Homebrew у Linux, Android/Termux (попередня версія) і ручн
 ## Швидкий старт
 
 1. Закомітьте або відкладіть у stash свою роботу, потім запустіть `codewhale`
-   з кореня git-репозиторію. За замовчуванням він застосовує там зміни у файлах
-   без запиту й показує вам diff.
+   з кореня git-репозиторію. За замовчуванням він питає перед кожною зміною файлу
+   і кожною командою; натисніть `Shift+Tab` один раз для **Приймати правки** (Accept Edits), щоб він змінював файли в репозиторії без запиту.
 2. Виконайте `/provider` (або натисніть `F3`), виберіть провайдера, вставте
    його ключ API і виберіть модель. Провайдер за замовчуванням — DeepSeek. Якщо
    ключа немає, виберіть натомість локальний рантайм. Якщо жодного провайдера
@@ -116,7 +116,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | Як перемкнути | Варіанти |
 | --- | --- | --- |
 | Режим | `Tab` (коли поле введення порожнє) або `/mode` | **Plan** читає й шукає, але нічого не змінює. **Work** редагує файли й виконує команди. **Operate** має той самий доступ, що й Work, сприймає ваш запит як ціль і продовжує роботу, доки досягнення цілі не буде перевірено або йому не знадобиться щось від вас. |
-| Дозвіл | `Shift+Tab` | **Запитувати** (Ask) застосовує зміни у файлах вашого репозиторію без запиту й питає перед командами оболонки, які не є лише для читання. **Автоперевірка** (Auto-Review) дає правилам і моделі-рецензенту схвалювати рутинні виклики й відхиляє виклики з високим ризиком; щоб схвалювати їх самостійно, перейдіть на «Запитувати». **Повний доступ** (Full Access) ніколи не питає й вимикає пісочницю Codewhale; правила репозиторію та керована політика й далі діють. |
+| Дозвіл | `Shift+Tab` | **Запитувати** (Ask) питає перед кожною зміною файлу та перед кожною командою оболонки, яка не є лише для читання. **Приймати правки** (Accept Edits) застосовує зміни у файлах вашого git-репозиторію без запиту й надалі питає перед командами. **Автоперевірка** (Auto-Review) дає правилам і моделі-рецензенту схвалювати рутинні виклики й відхиляє виклики з високим ризиком; щоб схвалювати їх самостійно, перейдіть на «Запитувати». **Повний доступ** (Full Access) ніколи не питає й вимикає пісочницю Codewhale; правила репозиторію та керована політика й далі діють. |
 
 Докладніше — у [посібнику з режимів і дозволів](../MODES.md).
 

docs/i18n/README.vi.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -74,8 +74,8 @@ bản sẽ cùng nằm trên `PATH` và bản nào đứng trước sẽ đượ
 ## Bắt đầu nhanh
 
 1. Commit hoặc stash công việc của bạn, rồi chạy `codewhale` từ thư mục gốc của
-   một kho git. Theo mặc định, nó áp dụng các chỉnh sửa tệp ở đó mà không hỏi
-   và hiển thị diff cho bạn.
+   một kho git. Theo mặc định, nó hỏi trước mỗi lần chỉnh sửa tệp
+   và mỗi lệnh; nhấn `Shift+Tab` một lần để chọn **Accept Edits** và cho phép nó chỉnh sửa tệp trong kho mà không hỏi.
 2. Chạy `/provider` (hoặc nhấn `F3`), chọn một nhà cung cấp, dán khóa API của
    nhà cung cấp đó và chọn một mô hình. DeepSeek là nhà cung cấp mặc định. Nếu
    không có khóa, hãy chọn một runtime cục bộ. Nếu chưa cấu hình nhà cung cấp
@@ -112,7 +112,7 @@ Bản cài đặt mới khởi động ở chế độ Work với quyền Ask.
 | | Chuyển bằng | Tùy chọn |
 | --- | --- | --- |
 | Chế độ | `Tab` (khi ô nhập trống) hoặc `/mode` | **Plan** đọc và tìm kiếm nhưng không thay đổi gì. **Work** chỉnh sửa tệp và chạy lệnh. **Operate** có cùng quyền truy cập như Work, coi yêu cầu của bạn là một mục tiêu và tiếp tục làm cho đến khi mục tiêu được xác minh hoặc cần bạn cung cấp thêm thông tin. |
-| Quyền | `Shift+Tab` | **Ask** áp dụng các chỉnh sửa tệp trong kho mã của bạn mà không hỏi, và hỏi trước khi chạy các lệnh shell không phải chỉ đọc. **Auto-Review** để các quy tắc và một mô hình đánh giá phê duyệt các lệnh gọi thông thường, và từ chối các lệnh gọi rủi ro cao; hãy chuyển sang Ask để tự phê duyệt những lệnh gọi đó. **Full Access** không bao giờ hỏi và tắt sandbox của Codewhale; các quy tắc của kho mã và chính sách được quản lý vẫn được áp dụng. |
+| Quyền | `Shift+Tab` | **Ask** hỏi trước mỗi chỉnh sửa tệp và trước mọi lệnh shell không phải chỉ đọc. **Accept Edits** áp dụng các chỉnh sửa tệp trong kho git của bạn mà không hỏi và vẫn hỏi trước khi chạy lệnh. **Auto-Review** để các quy tắc và một mô hình đánh giá phê duyệt các lệnh gọi thông thường, và từ chối các lệnh gọi rủi ro cao; hãy chuyển sang Ask để tự phê duyệt những lệnh gọi đó. **Full Access** không bao giờ hỏi và tắt sandbox của Codewhale; các quy tắc của kho mã và chính sách được quản lý vẫn được áp dụng. |
 
 Xem chi tiết trong [hướng dẫn về chế độ và quyền](../MODES.md).
 

docs/i18n/README.zh-CN.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -68,7 +68,7 @@ Homebrew、Android/Termux（预览版）以及手动下载见[安装指南](../I
 ## 快速开始
 
 1. 先提交或 stash 你的改动，然后在 git 仓库的根目录运行 `codewhale`。默认情况下，
-   它会直接在这里应用文件编辑而不询问，并向你展示 diff。
+   它会在每次文件编辑和每条命令之前询问；按一次 `Shift+Tab` 切换到**接受编辑**（Accept Edits），即可让它在仓库中直接编辑文件而不询问。
 2. 运行 `/provider`（或按 `F3`），选择一个提供商，粘贴它的 API 密钥，然后选择模型。
    默认提供商是 DeepSeek。没有密钥时，可以改选本地运行时。如果尚未配置任何提供商，
    而 Ollama 已经在提供聊天模型，Codewhale 会自动使用它；
@@ -99,7 +99,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | 切换方式 | 选项 |
 | --- | --- | --- |
 | 模式 | `Tab`（输入框为空时）或 `/mode` | **Plan** 只读取和搜索，不做任何改动。**Work** 编辑文件并运行命令。**Operate** 拥有与 Work 相同的访问权限，把你的请求当作一个目标，并持续推进，直到目标得到验证或需要你提供输入为止。 |
-| 权限 | `Shift+Tab` | **询问**（Ask）在你的仓库中直接应用文件编辑而不询问，并在运行非只读的 shell 命令之前先询问。**自动审核**（Auto-Review）让规则和一个审查模型批准常规调用，并拒绝高风险调用；如需亲自批准这些调用，请切换到“询问”。**完全访问**（Full Access）从不询问，并关闭 Codewhale 的沙箱；仓库规则和受管策略仍然适用。 |
+| 权限 | `Shift+Tab` | **询问**（Ask）在每次文件编辑和每条非只读的 shell 命令之前都会询问。**接受编辑**（Accept Edits）在你的 git 仓库中直接应用文件编辑而不询问，并仍会在运行命令之前先询问。**自动审核**（Auto-Review）让规则和一个审查模型批准常规调用，并拒绝高风险调用；如需亲自批准这些调用，请切换到“询问”。**完全访问**（Full Access）从不询问，并关闭 Codewhale 的沙箱；仓库规则和受管策略仍然适用。 |
 
 详情见[模式与权限指南](../MODES.md)。
 

docs/i18n/README.zh-TW.md

@@ -1,4 +1,4 @@
-<!-- source: README.md sha256:0430d94f3d47 -->
+<!-- source: README.md sha256:20d0bb7c0784 -->
 <div align="center">
 
 <picture>
@@ -68,7 +68,7 @@ Homebrew、Android/Termux（預覽版）與手動下載請見[安裝指南](../I
 ## 快速入門
 
 1. 先提交（commit）或暫存（stash）你的工作，然後在 git 儲存庫的根目錄執行 `codewhale`。
-   預設情況下，它在該儲存庫中會直接套用檔案編輯、不先詢問，並向你顯示差異（diff）。
+   預設情況下，它會在每次檔案編輯與每個指令之前詢問；按一次 `Shift+Tab` 切換到**接受編輯**（Accept Edits），即可讓它在儲存庫中直接編輯檔案、不先詢問。
 2. 執行 `/provider`（或按 `F3`），選擇供應商、貼上它的 API 金鑰，再選擇模型。預設供應商是
    DeepSeek。如果沒有金鑰，請改選本機執行階段（local runtime）。若尚未設定任何供應商，而 Ollama 已在提供
    聊天模型，Codewhale 會自動使用它；從 0.10.2 起，它會在你送出第一則訊息時提議使用它。
@@ -98,7 +98,7 @@ codewhale exec --auto --sandbox workspace-write "fix the failing tests and expla
 | | 切換方式 | 選項 |
 | --- | --- | --- |
 | 模式 | `Tab`（輸入框為空時）或 `/mode` | **Plan** 會讀取與搜尋，但不做任何變更。**Work** 會編輯檔案並執行指令。**Operate** 擁有與 Work 相同的存取權限，會把你的請求當作目標，持續推進，直到目標通過驗證或需要你提供輸入為止。 |
-| 權限 | `Shift+Tab` | **詢問**（Ask）會在你的儲存庫中直接套用檔案編輯、不先詢問，並在執行非唯讀的 shell 指令前先詢問。**自動審核**（Auto-Review）讓規則與審核模型核准例行呼叫，並拒絕高風險呼叫；若要自行核准這些呼叫，請切換到「詢問」。**完整存取**（Full Access）從不詢問，並關閉 Codewhale 的沙箱；儲存庫規則與受管理的政策仍然適用。 |
+| 權限 | `Shift+Tab` | **詢問**（Ask）會在每次檔案編輯與每個非唯讀的 shell 指令之前先詢問。**接受編輯**（Accept Edits）會在你的 git 儲存庫中直接套用檔案編輯、不先詢問，並仍會在執行指令前先詢問。**自動審核**（Auto-Review）讓規則與審核模型核准例行呼叫，並拒絕高風險呼叫；若要自行核准這些呼叫，請切換到「詢問」。**完整存取**（Full Access）從不詢問，並關閉 Codewhale 的沙箱；儲存庫規則與受管理的政策仍然適用。 |
 
 詳情請參閱[模式與權限指南](../MODES.md)。
 

docs/zh_hans/INSTALL.md

@@ -3,7 +3,7 @@
 > 英文原文：[INSTALL.md](../INSTALL.md)。
 > 最后与英文同步日期（last synced with English revision）：2026-10-19。按当前英文源码复核；下文 v0.10.0 安装记录与附录的原始测试范围保留，不能当作 v0.10.1 发布安装回执。
 
-Codewhale 是一个在终端里运行的开源编码智能体（coding agent）。你交给它一个任务（"修复失败的测试"、"加一个 CLI 参数"），它会读取你的仓库、编辑文件并运行命令。在默认的 **Ask**（询问）权限级别下，它会立即应用工作区内的文件编辑（并给你看 diff），但运行 shell 命令之前会先询问，所以请先提交或暂存你在意的改动。它支持多家模型提供商，默认是 **DeepSeek**。
+Codewhale 是一个在终端里运行的开源编码智能体（coding agent）。你交给它一个任务（"修复失败的测试"、"加一个 CLI 参数"），它会读取你的仓库、编辑文件并运行命令。在默认的 **Ask**（询问）权限级别下，它在每次文件编辑和每条 shell 命令之前都会询问；按一次 `Shift+Tab` 切到 **Accept Edits**（接受编辑）后，它会立即应用仓库内的文件编辑（并给你看 diff），所以请先提交或暂存你在意的改动。它支持多家模型提供商，默认是 **DeepSeek**。
 
 命令是 `codewhale`。`codew` 是同一个程序的较短别名。
 
@@ -599,8 +599,8 @@ codewhale
 ```
 
 * 输入框（composer）在底部。页脚显示权限级别（`ask`）、模式（`work`）和模型（`DeepSeek · deepseek-flash`）。
-* **Shift+Tab** 循环切换权限级别：Ask → Auto-Review（自动审核）→ Full Access（完全访问）。（输入框为空时）**Tab** 循环切换模式：Plan → Work → Operate。
-* 在 **Ask** 下，工作区内的文件编辑会被直接应用并以 diff 显示。shell 命令会停在 **APPROVAL** 提示：`y` 允许本次，`a` 在本次会话中允许，`n` 拒绝，`Esc` 中止当前回合。
+* **Shift+Tab** 循环切换权限级别：Ask → Accept Edits（接受编辑）→ Auto-Review（自动审核）→ Full Access（完全访问）。（输入框为空时）**Tab** 循环切换模式：Plan → Work → Operate。
+* 在 **Ask** 下，文件编辑和 shell 命令都会停在 **APPROVAL** 提示：`y` 允许本次，`a` 在本次会话中允许，`n` 拒绝，`Esc` 中止当前回合。在 **Accept Edits** 下，仓库内的文件编辑会被直接应用并以 diff 显示，shell 命令仍会提示。
 * 常用按键：**F1** 帮助（或 `/help`），**Ctrl-K** 命令面板，**F3** 提供商/模型选择器，**Ctrl-R** 恢复过去的会话，**Ctrl-U** 清空输入（**Ctrl-Z** 可恢复），**Ctrl-C** 取消或退出，**Ctrl-D** 在输入为空时退出。完整列表见 [KEYBINDINGS.md](./KEYBINDINGS.md)。
 * 退出时它会打印 `To resume this session, run codewhale resume <id>`。
 

docs/zh_hans/KEYBINDINGS.md

@@ -20,7 +20,7 @@
 | `Ctrl-B` | 结束当前 shell 等待，使回合继续；前台命令转入 `/jobs`，后台任务继续运行。可用 `/jobs` 或 `action: "wait"` 的 `Bash` 查看输出 |
 | `Ctrl-D` | 退出（仅当输入框为空时） |
 | `Tab` | 当输入框为空时，循环切换 TUI 模式：Plan → Work → Operate → Plan |
-| `Shift+Tab` | 循环切换权限级别：Ask → Auto-Review → Full Access（完全访问）。无论输入框内容如何、回合是否在运行都即时生效（仅在打开设置以外的模态框时被抑制） |
+| `Shift+Tab` | 循环切换权限级别：Ask → Accept Edits → Auto-Review → Full Access（完全访问）。无论输入框内容如何、回合是否在运行都即时生效（仅在打开设置以外的模态框时被抑制） |
 | `Ctrl-T` | 循环切换当前模型的思考强度。走与 `/model` 和 `/effort` 相同的阶梯（模型目录，或已文档化的路由方言）。始终思考的模型省略 `off`；Grok 4.6 包含 `xhigh`。 |
 | `Ctrl-Shift-T` | 切换实时对话记录浮层（粘性尾部自动滚动） |
 | `Ctrl-R` | 打开恢复会话选择器 |

docs/zh_hans/MODES.md

@@ -17,9 +17,9 @@ Workflow 通过同一个子智能体运行时执行命名步骤；Fleet 管理
 
 ## TUI 模式
 
-按 `Tab` 补全输入框（composer）菜单，或在输入框为空时循环切换可见模式：**Plan → Work → Operate → Plan**。`Tab` 从不发送或排队输入框中的文本；用 `Enter` 发送或排队。按 `Shift+Tab` 循环切换权限姿态（Ask → Auto-Review → Full Access）。按 `Ctrl+T` 循环切换思考强度。运行 `/mode` 打开模式选择器，或直接用 `/mode work`、`/mode plan`、`/mode operate` 切换。
+按 `Tab` 补全输入框（composer）菜单，或在输入框为空时循环切换可见模式：**Plan → Work → Operate → Plan**。`Tab` 从不发送或排队输入框中的文本；用 `Enter` 发送或排队。按 `Shift+Tab` 循环切换权限姿态（Ask → Accept Edits → Auto-Review → Full Access）。按 `Ctrl+T` 循环切换思考强度。运行 `/mode` 打开模式选择器，或直接用 `/mode work`、`/mode plan`、`/mode operate` 切换。
 
-- **Plan**：设计优先的提示方式。原语（primitive）名称保持不变，仍是大家熟悉的那些，但运行时会集中拒绝文件修改和 shell 执行。只读检查与策略允许的研究（包括延迟加载的 Web 搜索/抓取）仍然可用。当一个 Plan 回合成功结束并给出非空回复（包括纯文字计划）时，TUI 会询问如何继续：Work（Ask）、Work（Auto-Review），或继续规划。选择 Work 会把已批准的原文作为普通后续消息发送，并保留该回合已有的 To-dos，或追加一个待办的计划项而不替换无关的工作。
+- **Plan**：设计优先的提示方式。原语（primitive）名称保持不变，仍是大家熟悉的那些，但运行时会集中拒绝文件修改和 shell 执行。只读检查与策略允许的研究（包括延迟加载的 Web 搜索/抓取）仍然可用。当一个 Plan 回合成功结束并给出非空回复（包括纯文字计划）时，TUI 会询问如何继续：Work（Ask）、Work（Accept Edits）、Work（Auto-Review），或继续规划。选择 Work 会把已批准的原文作为普通后续消息发送，并保留该回合已有的 To-dos，或追加一个待办的计划项而不替换无关的工作。
 - **Work**（内部为 `agent`）：普通的多步执行。第一回合的工具箱包含 `read`、`write`、`edit`、`file_search`、`bash`、`agent`、`workflow`、`todo_write` 和 `load_skill`，以及无需先搜索即可使用的目标与后台 shell 控制工具 `create_goal`、`get_goal`、`update_goal` 和 `task_shell_wait`。当请求属于一个持久的目标时，智能体会调用 `create_goal`；宿主从不根据措辞去推断目标，契约也不得告诉模型相反的内容。审批、沙箱、仓库规则（repository law）和托管策略决定什么可以执行。
 - **Operate**：以全力运行的 Work，即“ultra”模式。工具与权限和 Work 相同，区别在于如何使用它们。每个实质性请求都会成为一个目标（`create_goal`），计划保持可见（`todo_write`），多部分工作通过 `workflow` 和并行的 `agent` 工作者执行，非平凡的改动在宣布完成前先交给独立的审查者，长时间运行的命令继续在后台运行，循环或监视类工作则作为 `automation` 提出（获批后创建）。它会一直进行，直到目标被验证、被你阻塞或被暂停。
 
@@ -102,12 +102,13 @@ Codewhale 在跨进程的锁下写入 `settings.toml`，并以原子方式替换
 
 ```text
 /config
-# 把 approval_mode 行编辑为: suggest | auto | never
+# 把 permission_posture 行编辑为: ask | accept-edits | auto-review | full-access
 ```
 
 遗留说明：`/set approval_mode ...` 已被 `/config` 取代。
 
-- `suggest`（**Ask**，默认）：工具审批可能打断你；当一个尚未解决的用户选择会实质性改变权限、成本、范围或结果时，Codewhale 会询问你。
+- `ask`（**Ask**，默认；内部为 `suggest`）：工具审批可能打断你；当一个尚未解决的用户选择会实质性改变权限、成本、范围或结果时，Codewhale 会询问你。每次文件编辑和每条命令都会询问，包括工作区内的编辑。
+- `accept-edits`（**Accept Edits**，线上值 `accept_edits`）：与 Ask 相同，但所有目标都在工作区 git 工作树内的文件编辑无需卡片即可运行。对 `.git` 内部、`.codewhale`、`.env*`、凭据和密钥文件的编辑始终询问；在没有 git 的文件夹里，每次编辑也都询问（卡片会说明该文件夹没有仓库）。命令、网络、MCP 操作和文件夹外的任何操作都与 Ask 一样询问；ask 规则、hook、仓库规则和安全底线仍会强制弹出卡片。这对应 Claude Code 的 `acceptEdits`。ACP 会话按 Ask 运行它，因为 ACP 回合从不应用文件夹内编辑规则。
 - `auto`（**Auto-Review**）：自动审查工具调用。在交互式会话中，模型仍可通过 `request_user_input` 有意向用户提问；问题会挂起回合，直到用户回答、取消，或配置的超时到期。无头 `exec` 没有应答方，因此不提供这个工具。工具安全拦截与向用户提问是分开的。审批由两层决定。**确定性底线**（配置的阻断规则加内置安全底线）放行已证明安全的调用，并对发布类操作和破坏性的后台/无头工作直接硬阻断；这一层从不由模型审查。回退拦截——确定性引擎无法证明安全的调用——会升级给一次性的**模型守护者**（v0.9.8），由它返回风险级别、允许/拒绝和理由。守护者在各自独立的 JSON 字段中看到被拦截的确切调用和确定性观察；对话历史、技能指令、附件和展开的模型上下文都被排除在外。它不推断用户意图，也不计算通用的用户意图分数。高风险或严重风险即使模型判定允许，也不能自动运行。它没有工具，不记规则，遇到过大的确切调用会拒绝而不是截断。恰好只发出一次审查请求；输出不完整或格式错误、超时、取消或提供商失败，都会失败关闭（fail closed）。同一回合内，守护者连续拒绝三次，或在本回合最近五十次审查中拒绝达到十次，回合就会以“已中断”结束并显示一条状态行；同一批次中剩余的调用不再审查，直接拒绝。只有明确的拒绝才计数（超时或失败不算），一次放行会让连续拒绝重新计数，每个回合从零开始计数，子智能体按它自己的回合计数。无头适配器只使用确定性层。明确要求由人来决定的仓库规则拦截，在 Auto-Review 中直接阻断，而不是弹出一个隐藏的审批弹窗。
 
 LLM 审查器最接近 OpenAI Codex 的实验性 Auto-Review，对应提交 [`6fc6b9d6d2580d62622fc9884b5f5707f6505a5e`](https://github.com/openai/codex/tree/6fc6b9d6d2580d62622fc9884b5f5707f6505a5e)。Codex 的 [guardian 入口点](https://github.com/openai/codex/blob/6fc6b9d6d2580d62622fc9884b5f5707f6505a5e/codex-rs/core/src/guardian/mod.rs)重建对话上下文并运行专门的审查会话。Codewhale 有意只采用其中四点：针对确切动作的结构化决策、90 秒截止时间、失败关闭的结果，以及按回合计数的拒绝熔断。它不复制 Codex 的对话记录重建、用户授权分数、审查器工具、重试、持久审查会话或拒绝台账。
@@ -125,7 +126,7 @@ Kimi Code 在提交 [`1414d4602898f406e540b23342cb18db23ff9efc`](https://github.
 子智能体会如实继承会话的姿态，而不是只继承一个简单的自动批准标志位：
 
 - **Auto-Review**：worker 被拦截的调用走同一套确定性策略（已证明安全的调用运行；发布类和破坏性的后台工作被硬阻断）；对于无法证明安全的拦截，则使用该子智能体自己的会话客户端，交给同一个一次性的模型守护者。绝不会为子智能体弹出提示；守护者不可用时拒绝，即失败关闭。
-- **Ask**：该角色可以委托的调用直接运行。被拦截的调用，在宿主是交互式 TUI 时，会作为审批提示在父会话的界面中提出（`agent:<id>:approval:<n>`）；worker 会明显地处于等待状态（`waiting for user`），用户的回答会被路由回它——无论父回合当时是空闲还是自己也在等待审批。无法弹出提示的宿主会拒绝，并说明原因。
+- **Ask** 和 **Accept Edits**：该角色可以委托的调用直接运行。被拦截的调用，在宿主是交互式 TUI 时，会作为审批提示在父会话的界面中提出（`agent:<id>:approval:<n>`）；worker 会明显地处于等待状态（`waiting for user`），用户的回答会被路由回它——无论父回合当时是空闲还是自己也在等待审批。无法弹出提示的宿主会拒绝，并说明原因。
 - **Full Access**：调用会运行，包括破坏性的分离式工作——Auto-Review 底线与父回合一样被跳过。执行包络仍然生效，且永远不会放宽。
 
 角色姿态和执行边界在这道关卡之前和之后都会被检查，且绝不会被放宽。凡是人没有在提示处亲自做出的决定，都会写入审计日志和子智能体的对话记录，作为一行说明（`Auto-Review allowed 'bash' (low risk, model guardian): …`），在聚焦该 worker 时可见。

docs/zh_hans/WINDOWS_BEGINNER.md

@@ -315,11 +315,12 @@ Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
 
 ## 6. 权限与安全（小白最重要的保护）
 
-按 `Shift+Tab` 循环切换三种权限姿态（permission posture）：
+按 `Shift+Tab` 循环切换四种权限姿态（permission posture）：
 
 | 姿态 | 行为 | 建议 |
 |---|---|---|
-| **Ask** | 需要审批的调用会先询问；工作区内的普通文件编辑可以直接执行 | 默认档位；先保留重要文件的备份 |
+| **Ask** | 每次文件编辑和需要审批的调用都会先询问 | 默认档位 |
+| Accept Edits（接受编辑） | git 仓库内的普通文件编辑直接执行；命令仍会先询问 | 先保留重要文件的备份 |
 | Auto-Review | 自动审查工具调用；确定性规则判定安全的操作直接放行，其余可审查的拦截交给一次性模型复核，高风险仍会被拦下。模型仍可为需要你决定的事项提问 | 熟悉后可用 |
 | Full Access（完全访问） | 普通工具调用不再弹审批（仓库规则等硬性拦截仍然生效） | 只用于完全信任的文件夹 |
 
@@ -422,7 +423,7 @@ default_text_model = "deepseek-v4-pro"
 | 按键 | 作用 |
 |---|---|
 | `Tab` | 输入框为空时循环模式 Plan → Work → Operate |
-| `Shift+Tab` | 循环权限姿态 Ask → Auto-Review → Full Access |
+| `Shift+Tab` | 循环权限姿态 Ask → Accept Edits → Auto-Review → Full Access |
 | `Ctrl+T` | 循环思考强度 |
 | `Ctrl+Alt+O` | 打开 Turn Inspector（查看每回合用了哪个模型、为什么） |
 

web/data/agent-docs.generated.json

@@ -5,8 +5,8 @@
     "sources": [
       {
         "path": "docs/INSTALL.md",
-        "sha256": "ff4aa6d802e28c5ac6d8f5cbeab7935c6c4e35e0ea24375c11b5c6bc0a2d959c",
-        "content": "# Installing Codewhale\n\n> 阅读简体中文版：[zh_hans/INSTALL.md](zh_hans/INSTALL.md)\n\nCodewhale is an open-source coding agent that runs in your terminal. You give\nit a task (\"fix the failing test\", \"add a CLI flag\"). It reads your repository,\nedits files and runs commands. In the default **Ask** posture it applies file\nedits inside the workspace immediately (and shows you the diff), but asks before\nrunning shell commands, so commit or stash anything you care about first. It\nworks with many model providers. **DeepSeek** is the default.\n\nThe command is `codewhale`. `codew` is a shorter alias for the same program.\n\nThe installation paths were first checked with **v0.10.0** (released 2026-09-22) on a\nfresh **Ubuntu 24.04 x86_64** machine. The dated\n[install receipts](https://github.com/codewhale-hq/Codewhale/blob/37ecdfcc49bc68a9b0d058b97c3946e62c34bd31/docs/install-report/v0.10.0-2026-09-23/RECEIPTS.md) record the commands and output checked at that time. Steps that\ncould not be run on that machine are marked **(untested on this VM: reason)**.\nmacOS, Windows and Android are out of scope, apart from a few notes. A second\npass re-ran the installer, manual-download, archive and npm paths, the no-key\nchecks and zsh completion on **macOS 26.1 (Apple silicon)**; see\n[macOS notes](#macos-notes). Steps that need a model call were not re-run\nthere.\n\nInstall commands that use `latest` resolve to the latest **published** GitHub\nRelease or package. Between releases, `main` may already describe the next\nversion (for example a v0.10.3 source candidate before its tag). A\nprebuilt candidate is available through the official installer only after its\ntag, checksums and release assets exist. Contributors can build `main` now.\n\n## No account needed\n\nCodewhale needs no account. Keys you save with `/provider` or\n`codewhale auth set` stay on your machine; see\n[API keys and providers](#8-api-keys-and-providers). New Codewhale accounts\nare not open, so this guide does not cover account key storage.\n\n## Test and contribute to current source\n\n`latest` selects the latest published release. To test unreleased repairs,\nbuild canonical GitHub `main`, or CNB `main` after verifying its commit matches.\nThe source version number alone does not establish a published package.\n\n```bash\ngit clone --branch main https://github.com/codewhale-hq/CodeWhale.git\ncd CodeWhale\ncargo build --release --locked -p codewhale-cli\ntarget/release/codewhale --version\n```\n\nSee the Cargo section for build prerequisites; use the repository's stable Rust\nselection (declared minimum 1.89). Windows uses `target/release/codewhale.exe`\nand needs MSVC. A development build is separate from a signed release package.\nFor mainland-China downloads and source validation, see [CNB mirror](CNB_MIRROR.md).\nThe [Tencent Lighthouse bootstrap](../scripts/tencent-lighthouse/README.md) is\nbilingual. An npm registry mirror serves the wrapper; native binary downloads\nstill need an available release asset source.\n\n---\n\n## 60-second quickstart (Linux or macOS)\n\n```bash\n# 1. Install. Downloads two checksum-verified binaries into ~/.local/bin (no sudo).\ncurl -fsSL https://codewhale.net/install.sh | sh\n\n# 2. Make sure ~/.local/bin is on your PATH, now and in future terminals.\nprintf '%s\\n' '# >>> codewhale PATH >>>' 'export PATH=\"$HOME/.local/bin:$PATH\"' '# <<< codewhale PATH <<<' >> ~/.bashrc    # zsh: use ~/.zshrc\nexport PATH=\"$HOME/.local/bin:$PATH\"\ncodewhale --version          # -> codewhale 0.10.0 (1be1a703b975)\n\n# 3. Give it a DeepSeek API key (from https://platform.deepseek.com/api_keys).\ncodewhale auth set --provider deepseek    # prompts for the key; nothing is echoed\ncodewhale auth status --provider deepseek # \"active source: secret store\"\n\n# 4. Run your first task inside a git repository.\ncd ~/your-project\ncodewhale\n```\n\nIn the TUI, type something concrete:\n\n```text\ncreate a Python file primes.py that prints the first 10 primes, run it, and show me the output\n```\n\nCodewhale writes the file, shows you a diff, then asks **APPROVAL: bash\npython3 primes.py – Do you want to proceed?** Press `y` to allow it once. It\nruns the command and reports the output. Press `Ctrl-D` (with an empty input\nbox) to quit. It prints the command to resume the session later.\n\n> **If nothing happens after you send your first message,** you have no key\n> configured. v0.10.0 doesn't warn you in that case. Press **F3**. If DeepSeek\n> shows `missing key`, press Enter, paste the key, then pick a model and\n> confirm.\n\n---\n\n## Contents\n\n1. [Before you start](#1-before-you-start)\n2. [Install: recommended installer](#2-recommended-installer-curl--sh)\n3. [Install: manual download from GitHub Releases](#3-manual-download-from-github-releases)\n4. [Install: npm](#4-npm)\n5. [Install: Cargo / build from source](#5-cargo-and-building-from-source)\n6. [Install: Homebrew (Linux) and Nix]Line truncated
+        "sha256": "91d51f2e93b099e0f88c21b94f79e3024beceaac528134f12b5b8652b8a1bf38",
+        "content": "# Installing Codewhale\n\n> 阅读简体中文版：[zh_hans/INSTALL.md](zh_hans/INSTALL.md)\n\nCodewhale is an open-source coding agent that runs in your terminal. You give\nit a task (\"fix the failing test\", \"add a CLI flag\"). It reads your repository,\nedits files and runs commands. In the default **Ask** posture it asks before\neach file edit and each shell command; **Accept Edits** (one `Shift+Tab`)\napplies file edits inside the repository immediately and shows you the diff,\nso commit or stash anything you care about first. It works with many model\nproviders. **DeepSeek** is the default.\n\nThe command is `codewhale`. `codew` is a shorter alias for the same program.\n\nThe installation paths were first checked with **v0.10.0** (released 2026-09-22) on a\nfresh **Ubuntu 24.04 x86_64** machine. The dated\n[install receipts](https://github.com/codewhale-hq/Codewhale/blob/37ecdfcc49bc68a9b0d058b97c3946e62c34bd31/docs/install-report/v0.10.0-2026-09-23/RECEIPTS.md) record the commands and output checked at that time. Steps that\ncould not be run on that machine are marked **(untested on this VM: reason)**.\nmacOS, Windows and Android are out of scope, apart from a few notes. A second\npass re-ran the installer, manual-download, archive and npm paths, the no-key\nchecks and zsh completion on **macOS 26.1 (Apple silicon)**; see\n[macOS notes](#macos-notes). Steps that need a model call were not re-run\nthere.\n\nInstall commands that use `latest` resolve to the latest **published** GitHub\nRelease or package. Between releases, `main` may already describe the next\nversion (for example a v0.10.3 source candidate before its tag). A\nprebuilt candidate is available through the official installer only after its\ntag, checksums and release assets exist. Contributors can build `main` now.\n\n## No account needed\n\nCodewhale needs no account. Keys you save with `/provider` or\n`codewhale auth set` stay on your machine; see\n[API keys and providers](#8-api-keys-and-providers). New Codewhale accounts\nare not open, so this guide does not cover account key storage.\n\n## Test and contribute to current source\n\n`latest` selects the latest published release. To test unreleased repairs,\nbuild canonical GitHub `main`, or CNB `main` after verifying its commit matches.\nThe source version number alone does not establish a published package.\n\n```bash\ngit clone --branch main https://github.com/codewhale-hq/CodeWhale.git\ncd CodeWhale\ncargo build --release --locked -p codewhale-cli\ntarget/release/codewhale --version\n```\n\nSee the Cargo section for build prerequisites; use the repository's stable Rust\nselection (declared minimum 1.89). Windows uses `target/release/codewhale.exe`\nand needs MSVC. A development build is separate from a signed release package.\nFor mainland-China downloads and source validation, see [CNB mirror](CNB_MIRROR.md).\nThe [Tencent Lighthouse bootstrap](../scripts/tencent-lighthouse/README.md) is\nbilingual. An npm registry mirror serves the wrapper; native binary downloads\nstill need an available release asset source.\n\n---\n\n## 60-second quickstart (Linux or macOS)\n\n```bash\n# 1. Install. Downloads two checksum-verified binaries into ~/.local/bin (no sudo).\ncurl -fsSL https://codewhale.net/install.sh | sh\n\n# 2. Make sure ~/.local/bin is on your PATH, now and in future terminals.\nprintf '%s\\n' '# >>> codewhale PATH >>>' 'export PATH=\"$HOME/.local/bin:$PATH\"' '# <<< codewhale PATH <<<' >> ~/.bashrc    # zsh: use ~/.zshrc\nexport PATH=\"$HOME/.local/bin:$PATH\"\ncodewhale --version          # -> codewhale 0.10.0 (1be1a703b975)\n\n# 3. Give it a DeepSeek API key (from https://platform.deepseek.com/api_keys).\ncodewhale auth set --provider deepseek    # prompts for the key; nothing is echoed\ncodewhale auth status --provider deepseek # \"active source: secret store\"\n\n# 4. Run your first task inside a git repository.\ncd ~/your-project\ncodewhale\n```\n\nIn the TUI, type something concrete:\n\n```text\ncreate a Python file primes.py that prints the first 10 primes, run it, and show me the output\n```\n\nCodewhale writes the file, shows you a diff, then asks **APPROVAL: bash\npython3 primes.py – Do you want to proceed?** Press `y` to allow it once. It\nruns the command and reports the output. Press `Ctrl-D` (with an empty input\nbox) to quit. It prints the command to resume the session later.\n\n> **If nothing happens after you send your first message,** you have no key\n> configured. v0.10.0 doesn't warn you in that case. Press **F3**. If DeepSeek\n> shows `missing key`, press Enter, paste the key, then pick a model and\n> confirm.\n\n---\n\n## Contents\n\n1. [Before you start](#1-before-you-start)\n2. [Install: recommended installer](#2-recommended-installer-curl--sh)\n3. [Install: manual download from GitHub Releases](#3-manual-download-from-github-releases)\n4. [Install: npm](#4-npm)\n5. [Install: Cargo / build from source](#5-cargo-and-building-from-sLine truncated
       }
     ]
   },
@@ -16,13 +16,13 @@
     "sources": [
       {
         "path": "docs/GUIDE.md",
-        "sha256": "7e2ac75c89723e95ef6c2d4ebd00368e1c82a78193a3258ffa969ea8214cd5f6",
-        "content": "# Codewhale User Guide\n\nThis guide is for your first hour with Codewhale. It explains the main\nworkflow, the important safety controls, and where to go next when you need a\ncomplete reference.\n\nCodewhale has deeper reference documents for installation, configuration,\nproviders, modes, keybindings, tools, and operations. Use this page as a guided\nwalkthrough, then follow the \"Next\" links when you need every option.\n\n## 1. Welcome to Codewhale\n\nCodewhale is a terminal coding agent. You run it from a workspace, give it a\ntask, and it can use structured tools to inspect files, run commands, edit\ncode, and report back with evidence.\n\nThe important difference from a normal chat model is that Codewhale is built\naround a harness:\n\n- It keeps the active workspace and session visible.\n- It routes each turn through explicit modes and approval rules.\n- It shows tool calls in the transcript instead of hiding the work.\n- It can preserve sessions, fork conversations, and continue later.\n- It can run sub-agents for focused background work.\n\nYou can use Codewhale for small questions:\n\n```text\nExplain the authentication flow in this repository.\n```\n\nYou can also use it for multi-step work:\n\n```text\nFind the failing validation path, propose a fix, and wait for my approval\nbefore editing files.\n```\n\nFor a new repository, start conservatively. Ask Codewhale to explore and plan\nbefore asking it to change files. That gives you a reviewable path and makes it\neasier to catch wrong assumptions early.\n\nNext: [ARCHITECTURE.md](ARCHITECTURE.md) explains the internal harness and\nruntime model.\n\n## 2. First Launch\n\nFor a new macOS or Linux installation, use the official GitHub release.\nThe installer verifies the release checksums and provides the same runtime\nunder the `codewhale` and `codew` command names:\n\n```bash\ncurl -fsSL https://codewhale.net/install.sh | sh\n```\n\nWindows users should choose the matching installer or archive from\n[GitHub Releases](https://github.com/codewhale-hq/CodeWhale/releases/latest).\nFor an existing direct install, use `codewhale update --check`, then\n`codewhale update`. npm and Cargo remain secondary packaging routes; Cargo\nalso supports source builds where a compatible prebuilt is unavailable.\nFor occupied directories, package-managed installs, and PATH setup, follow\n[the installation and migration guide](INSTALL.md#recommended-official-github-releases).\nAndroid/Termux uses its own [preview archive or source-build path](INSTALL.md#android--termux-arm64).\n\nDocker is also available when you want an isolated runtime. The published\nimage is currently 0.10.0; to test current `main`, [build it from source](DOCKER.md#building-locally).\n\n```bash\ndocker volume create codewhale-home\ndocker run --rm -it \\\n  -e DEEPSEEK_API_KEY=\"$DEEPSEEK_API_KEY\" \\\n  -v codewhale-home:/home/codewhale/.codewhale \\\n  -v \"$PWD:/workspace\" \\\n  -w /workspace \\\n  ghcr.io/hmbown/codewhale:latest\n```\n\nOnce the install directory is on PATH, launch Codewhale from the repository or\ndirectory you want it to work in:\n\n```bash\ncodewhale\n```\n\nFor the default GitHub installer destination, you can use\n`\"$HOME/.local/bin/codewhale\"` until that directory is on PATH.\n\nOn first launch, Codewhale opens the composer, even with no key or route.\nWith no key or route, workspace trust is asked once a provider is connected;\notherwise only when the folder requires a decision. A provider is asked for\nwhen you send your first message: the message stays in the box while you sign\nin or use your own key, and a local model is offered only when a local Ollama\nserver answers. The provider step also has an explicit offline route.\n\nEverything optional stays available after that. Use `/setup` for the\nprogressive setup and repair guide, `/settings` for the full typed editor, and\n`/constitution` when you want your own constitution on top of the bundled one.\nThe localized telemetry choice appears only after the workspace is ready and\ndoes not block the composer.\n\nDeepSeek is the default provider. If you want to configure its key before or\nafter the first launch, the most direct setup path is:\n\n```bash\ncodewhale auth set --provider deepseek\n```\n\nYou can also provide a key through the environment:\n\n```bash\nexport DEEPSEEK_API_KEY=\"your-key\"\ncodewhale\n```\n\nNew Codewhale config is stored under `~/.codewhale/config.toml`. Legacy\n`~/.deepseek/config.toml` files are still supported for users migrating from\nthe old name.\n\nUse `/constitution` to review or change standing guidance. After setup, run a\ndoctor check:\n\n```bash\ncodewhale doctor\n```\n\nUse the JSON form when you need a machine-readable report for an issue:\n\n```bash\ncodewhale doctor --json\n```\n\nBoth forms are offline by default. They report structural configuration and\nliteral unknown/not-probed credential states without loading workspace `.env`\ncredentials, openiLine truncated
+        "sha256": "9d035b23e8a1e62e9edfffa18eb0a20ebbe59e2e6b39accb93850012867cf932",
+        "content": "# Codewhale User Guide\n\nThis guide is for your first hour with Codewhale. It explains the main\nworkflow, the important safety controls, and where to go next when you need a\ncomplete reference.\n\nCodewhale has deeper reference documents for installation, configuration,\nproviders, modes, keybindings, tools, and operations. Use this page as a guided\nwalkthrough, then follow the \"Next\" links when you need every option.\n\n## 1. Welcome to Codewhale\n\nCodewhale is a terminal coding agent. You run it from a workspace, give it a\ntask, and it can use structured tools to inspect files, run commands, edit\ncode, and report back with evidence.\n\nThe important difference from a normal chat model is that Codewhale is built\naround a harness:\n\n- It keeps the active workspace and session visible.\n- It routes each turn through explicit modes and approval rules.\n- It shows tool calls in the transcript instead of hiding the work.\n- It can preserve sessions, fork conversations, and continue later.\n- It can run sub-agents for focused background work.\n\nYou can use Codewhale for small questions:\n\n```text\nExplain the authentication flow in this repository.\n```\n\nYou can also use it for multi-step work:\n\n```text\nFind the failing validation path, propose a fix, and wait for my approval\nbefore editing files.\n```\n\nFor a new repository, start conservatively. Ask Codewhale to explore and plan\nbefore asking it to change files. That gives you a reviewable path and makes it\neasier to catch wrong assumptions early.\n\nNext: [ARCHITECTURE.md](ARCHITECTURE.md) explains the internal harness and\nruntime model.\n\n## 2. First Launch\n\nFor a new macOS or Linux installation, use the official GitHub release.\nThe installer verifies the release checksums and provides the same runtime\nunder the `codewhale` and `codew` command names:\n\n```bash\ncurl -fsSL https://codewhale.net/install.sh | sh\n```\n\nWindows users should choose the matching installer or archive from\n[GitHub Releases](https://github.com/codewhale-hq/CodeWhale/releases/latest).\nFor an existing direct install, use `codewhale update --check`, then\n`codewhale update`. npm and Cargo remain secondary packaging routes; Cargo\nalso supports source builds where a compatible prebuilt is unavailable.\nFor occupied directories, package-managed installs, and PATH setup, follow\n[the installation and migration guide](INSTALL.md#recommended-official-github-releases).\nAndroid/Termux uses its own [preview archive or source-build path](INSTALL.md#android--termux-arm64).\n\nDocker is also available when you want an isolated runtime. The published\nimage is currently 0.10.0; to test current `main`, [build it from source](DOCKER.md#building-locally).\n\n```bash\ndocker volume create codewhale-home\ndocker run --rm -it \\\n  -e DEEPSEEK_API_KEY=\"$DEEPSEEK_API_KEY\" \\\n  -v codewhale-home:/home/codewhale/.codewhale \\\n  -v \"$PWD:/workspace\" \\\n  -w /workspace \\\n  ghcr.io/hmbown/codewhale:latest\n```\n\nOnce the install directory is on PATH, launch Codewhale from the repository or\ndirectory you want it to work in:\n\n```bash\ncodewhale\n```\n\nFor the default GitHub installer destination, you can use\n`\"$HOME/.local/bin/codewhale\"` until that directory is on PATH.\n\nOn first launch, Codewhale opens the composer, even with no key or route.\nWith no key or route, workspace trust is asked once a provider is connected;\notherwise only when the folder requires a decision. A provider is asked for\nwhen you send your first message: the message stays in the box while you sign\nin or use your own key, and a local model is offered only when a local Ollama\nserver answers. The provider step also has an explicit offline route.\n\nEverything optional stays available after that. Use `/setup` for the\nprogressive setup and repair guide, `/settings` for the full typed editor, and\n`/constitution` when you want your own constitution on top of the bundled one.\nThe localized telemetry choice appears only after the workspace is ready and\ndoes not block the composer.\n\nDeepSeek is the default provider. If you want to configure its key before or\nafter the first launch, the most direct setup path is:\n\n```bash\ncodewhale auth set --provider deepseek\n```\n\nYou can also provide a key through the environment:\n\n```bash\nexport DEEPSEEK_API_KEY=\"your-key\"\ncodewhale\n```\n\nNew Codewhale config is stored under `~/.codewhale/config.toml`. Legacy\n`~/.deepseek/config.toml` files are still supported for users migrating from\nthe old name.\n\nUse `/constitution` to review or change standing guidance. After setup, run a\ndoctor check:\n\n```bash\ncodewhale doctor\n```\n\nUse the JSON form when you need a machine-readable report for an issue:\n\n```bash\ncodewhale doctor --json\n```\n\nBoth forms are offline by default. They report structural configuration and\nliteral unknown/not-probed credential states without loading workspace `.env`\ncredentials, openiLine truncated
       },
       {
         "path": "docs/KEYBINDINGS.md",
-        "sha256": "72a081c68ffba992e80c288141b1b82f5e5a767145f60cdabc71f2f92fba48e9",
-        "content": "# Keybindings\n\n> 阅读简体中文版：[zh_hans/KEYBINDINGS.md](zh_hans/KEYBINDINGS.md)\n\nThis is the source-of-truth catalog of every keyboard shortcut the TUI recognizes. Bindings are grouped by **context** — the focus or modal state they fire in. A binding listed under \"Composer\" only takes effect when the composer is focused; one under \"Transcript\" only when the transcript has focus; and so on.\n\nGlobal key chords are not yet user-configurable — tracked for a future release (#436, #437). Hotbar slot actions are configurable with `[[hotbar]]` and `/hotbar`; the Hotbar activation chord remains `Alt-1` through `Alt-8`.\n\n## Global (any context)\n\n| Chord                | Action                                                        |\n|----------------------|---------------------------------------------------------------|\n| `/help`, `F1` or `Ctrl-/` | Toggle the help overlay. `/help` is what the chrome advertises: it is the one route every terminal delivers, where `F1` is eaten by tmux and some emulators and `Ctrl-/` encoding varies |\n| `F2`                 | Toggle the typed Settings editor                              |\n| `F3`                 | Open the provider/model picker (same as `/provider`)          |\n| `Ctrl-K`             | Open the command palette (slash-command finder)                |\n| `Ctrl-C`             | Cancel current turn / dismiss modal / clear a non-empty draft (recoverable — see `Ctrl-Z`) / arm-then-confirm quit |\n| `Ctrl-B`             | Release the current shell wait so the turn can continue; foreground commands move into `/jobs`, and background tasks keep running. Use `/jobs` or `Bash` with `action: \"wait\"` to inspect output |\n| `Ctrl-D`             | Quit (only when the composer is empty)                         |\n| `Tab`                | When the composer is empty, cycle TUI mode: Plan → Work → Operate → Plan. Works while a turn is running: the change applies at the agent's next step in the same turn, and the status line says so until it does |\n| `Shift+Tab`          | Cycle permission posture: Ask → Auto-Review → Full Access. Live regardless of composer contents or whether a turn is running (suppressed only while a modal other than Config is open). During a turn the change applies at the agent's next step; a call you already approved runs only if the new posture is equal or broader. Model, thinking level and provider stay locked until the turn ends |\n| `Ctrl-T`             | Cycle reasoning effort for the active model. Walks the same ladder as `/model` and `/effort` (catalog or documented route dialect). Always-thinking models omit `off`; Grok 4.6 includes `xhigh`. |\n| `Ctrl-Shift-T`       | Toggle live transcript overlay (sticky-tail auto-scroll)                       |\n| `Ctrl-R`             | Open the resume-session picker                                 |\n| `Ctrl-L`             | Compact the conversation context (status line shows progress; no-op while a compaction is already running) |\n| `Ctrl-O`             | Open the reasoning detail for the selected or current turn, regardless of composer contents |\n| `Ctrl-Alt-O`         | Open the whole-turn Turn Inspector, regardless of composer contents |\n| `Alt-V` / `Option-V` (macOS) | Open the details pager for the selected tool/sub-agent card; with nothing selected, the newest visible error, else the first visible card with details, else the most recent one. Click a card first to keep Alt-V on it while newer cards arrive. Terminals that emit the legacy Option-V glyph are also handled |\n| `Ctrl-Shift-E` / `Cmd-Shift-E` | Toggle the file tree in the workbar                   |\n| `Ctrl-]` or `Ctrl-Tab` | Cycle the pet view while the pet main view is showing; otherwise cycle the work dock: TODO → Agents → Jobs → Background. `Ctrl-]` is portable; `Ctrl-Tab` requires the kitty keyboard protocol. Terminal.app uses it to switch terminal tabs |\n| `Ctrl-Shift-Tab`     | Cycle the pet view or work dock backwards where the terminal sends the kitty keyboard chord. Terminal.app uses it to switch terminal tabs |\n| `Alt-G` / `Alt-Shift-G` | Scroll transcript to top / bottom when the composer is empty |\n| `Alt-1`-`Alt-8`      | Dispatch Hotbar slots 1-8 when no modal or inline picker is open |\n| `Alt-!` / `Alt-@` / `Alt-#` / `Alt-$` | Select the workbar panel: Tasks / Agents / Context / Files |\n| `Ctrl-Alt-0`         | Toggle the workbar off / back to the bottom placement          |\n| `Alt-L`              | Open the pager for the last message (composer empty)             |\n| `Alt-P` / `Alt-A` / `Alt-Y` | Jump to Plan / Work, or request Full Access (`Alt-Y` is the legacy permission channel — Work + Full Access — not a separate mode; it honors a locked approval policy) |\n| `Ctrl-X` (Activity workbar) | Cancel all running background shell jobs                  |\n| `Esc`                | Close topmost modal · cancel slash menu · dismiss toast. During a compact Line truncated
+        "sha256": "761abce2655dc58a1c86165afc6dc6fb3364f4352cc130ec0f662558132a63d4",
+        "content": "# Keybindings\n\n> 阅读简体中文版：[zh_hans/KEYBINDINGS.md](zh_hans/KEYBINDINGS.md)\n\nThis is the source-of-truth catalog of every keyboard shortcut the TUI recognizes. Bindings are grouped by **context** — the focus or modal state they fire in. A binding listed under \"Composer\" only takes effect when the composer is focused; one under \"Transcript\" only when the transcript has focus; and so on.\n\nGlobal key chords are not yet user-configurable — tracked for a future release (#436, #437). Hotbar slot actions are configurable with `[[hotbar]]` and `/hotbar`; the Hotbar activation chord remains `Alt-1` through `Alt-8`.\n\n## Global (any context)\n\n| Chord                | Action                                                        |\n|----------------------|---------------------------------------------------------------|\n| `/help`, `F1` or `Ctrl-/` | Toggle the help overlay. `/help` is what the chrome advertises: it is the one route every terminal delivers, where `F1` is eaten by tmux and some emulators and `Ctrl-/` encoding varies |\n| `F2`                 | Toggle the typed Settings editor                              |\n| `F3`                 | Open the provider/model picker (same as `/provider`)          |\n| `Ctrl-K`             | Open the command palette (slash-command finder)                |\n| `Ctrl-C`             | Cancel current turn / dismiss modal / clear a non-empty draft (recoverable — see `Ctrl-Z`) / arm-then-confirm quit |\n| `Ctrl-B`             | Release the current shell wait so the turn can continue; foreground commands move into `/jobs`, and background tasks keep running. Use `/jobs` or `Bash` with `action: \"wait\"` to inspect output |\n| `Ctrl-D`             | Quit (only when the composer is empty)                         |\n| `Tab`                | When the composer is empty, cycle TUI mode: Plan → Work → Operate → Plan. Works while a turn is running: the change applies at the agent's next step in the same turn, and the status line says so until it does |\n| `Shift+Tab`          | Cycle permission posture: Ask → Accept Edits → Auto-Review → Full Access. Live regardless of composer contents or whether a turn is running (suppressed only while a modal other than Config is open). During a turn the change applies at the agent's next step; a call you already approved runs only if the new posture is equal or broader. Model, thinking level and provider stay locked until the turn ends |\n| `Ctrl-T`             | Cycle reasoning effort for the active model. Walks the same ladder as `/model` and `/effort` (catalog or documented route dialect). Always-thinking models omit `off`; Grok 4.6 includes `xhigh`. |\n| `Ctrl-Shift-T`       | Toggle live transcript overlay (sticky-tail auto-scroll)                       |\n| `Ctrl-R`             | Open the resume-session picker                                 |\n| `Ctrl-L`             | Compact the conversation context (status line shows progress; no-op while a compaction is already running) |\n| `Ctrl-O`             | Open the reasoning detail for the selected or current turn, regardless of composer contents |\n| `Ctrl-Alt-O`         | Open the whole-turn Turn Inspector, regardless of composer contents |\n| `Alt-V` / `Option-V` (macOS) | Open the details pager for the selected tool/sub-agent card; with nothing selected, the newest visible error, else the first visible card with details, else the most recent one. Click a card first to keep Alt-V on it while newer cards arrive. Terminals that emit the legacy Option-V glyph are also handled |\n| `Ctrl-Shift-E` / `Cmd-Shift-E` | Toggle the file tree in the workbar                   |\n| `Ctrl-]` or `Ctrl-Tab` | Cycle the pet view while the pet main view is showing; otherwise cycle the work dock: TODO → Agents → Jobs → Background. `Ctrl-]` is portable; `Ctrl-Tab` requires the kitty keyboard protocol. Terminal.app uses it to switch terminal tabs |\n| `Ctrl-Shift-Tab`     | Cycle the pet view or work dock backwards where the terminal sends the kitty keyboard chord. Terminal.app uses it to switch terminal tabs |\n| `Alt-G` / `Alt-Shift-G` | Scroll transcript to top / bottom when the composer is empty |\n| `Alt-1`-`Alt-8`      | Dispatch Hotbar slots 1-8 when no modal or inline picker is open |\n| `Alt-!` / `Alt-@` / `Alt-#` / `Alt-$` | Select the workbar panel: Tasks / Agents / Context / Files |\n| `Ctrl-Alt-0`         | Toggle the workbar off / back to the bottom placement          |\n| `Alt-L`              | Open the pager for the last message (composer empty)             |\n| `Alt-P` / `Alt-A` / `Alt-Y` | Jump to Plan / Work, or request Full Access (`Alt-Y` is the legacy permission channel — Work + Full Access — not a separate mode; it honors a locked approval policy) |\n| `Ctrl-X` (Activity workbar) | Cancel all running background shell jobs                  |\n| `Esc`                | Close topmost modal · cancel slash menu · dismiss toast. Line truncated
       }
     ]
   },
@@ -32,8 +32,8 @@
     "sources": [
       {
         "path": "docs/CONFIGURATION.md",
-        "sha256": "052344476641ae8cc9f99e28677fcddc4170d597ce075515d0ae7c7fbcde061a",
-        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
+        "sha256": "7d05af7716237c5c28edbb5de4c869963affce9844a75c2230edf58f76a1c0a7",
+        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
       },
       {
         "path": "docs/CODEWHALE_AGENT.md",
@@ -64,8 +64,8 @@
     "sources": [
       {
         "path": "docs/CONFIGURATION.md",
-        "sha256": "052344476641ae8cc9f99e28677fcddc4170d597ce075515d0ae7c7fbcde061a",
-        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
+        "sha256": "7d05af7716237c5c28edbb5de4c869963affce9844a75c2230edf58f76a1c0a7",
+        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
       },
       {
         "path": "docs/LEGACY_PATHS.md",
@@ -80,8 +80,8 @@
     "sources": [
       {
         "path": "docs/MODES.md",
-        "sha256": "f07a2fce8d2ef02692fdc9298911ebc99dbd7940af6a3b88d396c039dc7e4608",
-        "content": "# Modes and Permission Postures\n\n> 阅读简体中文版：[zh_hans/MODES.md](zh_hans/MODES.md)\n\nCodewhale has three related concepts:\n\n- **TUI mode**: what kind of visible interaction you're in (Plan/Work/Operate).\n- **Permission posture**: how aggressively the UI asks before executing tools.\n- **Workflow**: named steps that coordinate sub-agents, with dependencies and\n  results, available in any TUI mode.\n\nModel selection is separate. `--model auto` and `/model auto` route each turn to\na concrete model and thinking level; they are not TUI modes and are not part of\nthe `Tab` cycle.\n\nWorkflow runs named steps through the same sub-agent runtime; Fleet manages\ntheir saved roles and model assignments. A workflow adds ordering, result\nhandoffs, gates and a progress view. The active mode and permission posture\nstill control what each step may execute.\n\nBefore assigning steps, query `agent(action=\"roster\")` for the saved Fleet\nmodels and roles. A plan child can select a listed model with `model`, or use\nthe saved `role`/`profile` assignment. An Exact Fleet fixes each member's route.\n\n## TUI Modes\n\nPress `Tab` to complete composer menus or cycle through the visible modes\nwhen the composer is empty: **Plan → Work → Operate → Plan**. `Tab` never sends\nor queues composer text; use `Enter` to send or queue it.\nPress `Shift+Tab` to cycle permission posture (Ask → Auto-Review → Full Access).\nEvery change of effective permission writes a `Permissions changed to …` line\nin the transcript.\nPress `Ctrl+T` to cycle reasoning effort.\nRun `/mode` to open the mode picker, or switch directly with `/mode work`,\n`/mode plan`, or `/mode operate`.\n\n- **Plan**: design-first prompting. The stable primitive names remain familiar, but the runtime centrally refuses file mutation and shell execution. Read-only inspection and policy-allowed research, including deferred Web search/fetch, remain available. When a Plan turn successfully finishes a nonempty response, including a prose-only plan, the TUI asks how to continue: Work (Ask), Work (Auto-Review), or keep planning. Work sends the exact approved response as a normal follow-up and preserves that turn's existing To-dos, or adds one pending plan item without replacing unrelated work.\n- **Work** (internally `agent`): ordinary multi-step execution. The first-turn toolbox includes `read`, `write`, `edit`, `file_search`, `bash`, `agent`, `workflow`, `todo_write`, and `load_skill`, plus `create_goal`, `get_goal`, `update_goal`, and `task_shell_wait` so goal and background-shell controls are available without discovery. The agent calls `create_goal` when a request is a durable objective; the host never infers a goal from wording, and the contract must not tell the model otherwise. Approval, sandbox, repository law, and managed policy decide what may execute.\n- **Operate**: Work at full strength, the \"ultra\" mode. Same tools and authority as Work; the difference is how they are used. Each substantive request becomes a goal (`create_goal`), the plan stays visible (`todo_write`), multi-part work runs through `workflow` and parallel `agent` workers, non-trivial changes get an independent reviewer before they are called done, long commands keep running in the background, and recurring or watch-type work is offered as an `automation` (created after approval). It keeps going until the goal is verified, blocked on you, or paused.\n\n`Act` and `/mode act` remain compatibility aliases for Work. Saved settings\nstill normalize to the internal value `agent`.\n\n### Tool availability by mode\n\n| Tool family | Plan | Work | Operate |\n|:---|:---:|:---:|:---:|\n| `read` and policy-allowed deferred research tools | yes | yes | yes |\n| `write` and `edit` | visible names; execution denied | approval- and policy-gated | same as Work |\n| `bash` | visible name; execution denied | approval- and policy-gated | same as Work; delegation is preferred when parallelism or isolation helps |\n| `agent` | yes, subject to child-depth authority | yes, subject to child-depth authority | yes, subject to child-depth authority |\n| Deferred native, MCP, and plugin tools | discoverable through `tool_search` when policy permits | same | same |\n| Paid or external-service tools | follows permission posture | follows permission posture | follows permission posture |\n| Access outside the workspace root | explicit trusted paths only | only through trusted paths or trust mode | same trusted-path/trust policy as Work; fleet profiles never widen it |\n\nOperate changes scheduling emphasis, not authority. It neither adds a\nmode-specific tool denial nor bypasses the active approval, sandbox, shell,\nask-rule, repository-law, or managed-policy boundary. Plan remains the\nmode-specific execution boundary for shell and write-capable tools; that\nauthority difference does not require a different primitive vocabulary.\n\n### Operate loop (one screen)\n\n```text\nUser Line truncated
+        "sha256": "0a8284ae22715d43aa08227d0771441c199268c4f035dcb9a3048779cb4351e0",
+        "content": "# Modes and Permission Postures\n\n> 阅读简体中文版：[zh_hans/MODES.md](zh_hans/MODES.md)\n\nCodewhale has three related concepts:\n\n- **TUI mode**: what kind of visible interaction you're in (Plan/Work/Operate).\n- **Permission posture**: how aggressively the UI asks before executing tools.\n- **Workflow**: named steps that coordinate sub-agents, with dependencies and\n  results, available in any TUI mode.\n\nModel selection is separate. `--model auto` and `/model auto` route each turn to\na concrete model and thinking level; they are not TUI modes and are not part of\nthe `Tab` cycle.\n\nWorkflow runs named steps through the same sub-agent runtime; Fleet manages\ntheir saved roles and model assignments. A workflow adds ordering, result\nhandoffs, gates and a progress view. The active mode and permission posture\nstill control what each step may execute.\n\nBefore assigning steps, query `agent(action=\"roster\")` for the saved Fleet\nmodels and roles. A plan child can select a listed model with `model`, or use\nthe saved `role`/`profile` assignment. An Exact Fleet fixes each member's route.\n\n## TUI Modes\n\nPress `Tab` to complete composer menus or cycle through the visible modes\nwhen the composer is empty: **Plan → Work → Operate → Plan**. `Tab` never sends\nor queues composer text; use `Enter` to send or queue it.\nPress `Shift+Tab` to cycle permission posture (Ask → Accept Edits →\nAuto-Review → Full Access).\nEvery change of effective permission writes a `Permissions changed to …` line\nin the transcript.\nPress `Ctrl+T` to cycle reasoning effort.\nRun `/mode` to open the mode picker, or switch directly with `/mode work`,\n`/mode plan`, or `/mode operate`.\n\n- **Plan**: design-first prompting. The stable primitive names remain familiar, but the runtime centrally refuses file mutation and shell execution. Read-only inspection and policy-allowed research, including deferred Web search/fetch, remain available. When a Plan turn successfully finishes a nonempty response, including a prose-only plan, the TUI asks how to continue: Work (Ask), Work (Accept Edits), Work (Auto-Review), or keep planning. Work sends the exact approved response as a normal follow-up and preserves that turn's existing To-dos, or adds one pending plan item without replacing unrelated work.\n- **Work** (internally `agent`): ordinary multi-step execution. The first-turn toolbox includes `read`, `write`, `edit`, `file_search`, `bash`, `agent`, `workflow`, `todo_write`, and `load_skill`, plus `create_goal`, `get_goal`, `update_goal`, and `task_shell_wait` so goal and background-shell controls are available without discovery. The agent calls `create_goal` when a request is a durable objective; the host never infers a goal from wording, and the contract must not tell the model otherwise. Approval, sandbox, repository law, and managed policy decide what may execute.\n- **Operate**: Work at full strength, the \"ultra\" mode. Same tools and authority as Work; the difference is how they are used. Each substantive request becomes a goal (`create_goal`), the plan stays visible (`todo_write`), multi-part work runs through `workflow` and parallel `agent` workers, non-trivial changes get an independent reviewer before they are called done, long commands keep running in the background, and recurring or watch-type work is offered as an `automation` (created after approval). It keeps going until the goal is verified, blocked on you, or paused.\n\n`Act` and `/mode act` remain compatibility aliases for Work. Saved settings\nstill normalize to the internal value `agent`.\n\n### Tool availability by mode\n\n| Tool family | Plan | Work | Operate |\n|:---|:---:|:---:|:---:|\n| `read` and policy-allowed deferred research tools | yes | yes | yes |\n| `write` and `edit` | visible names; execution denied | approval- and policy-gated | same as Work |\n| `bash` | visible name; execution denied | approval- and policy-gated | same as Work; delegation is preferred when parallelism or isolation helps |\n| `agent` | yes, subject to child-depth authority | yes, subject to child-depth authority | yes, subject to child-depth authority |\n| Deferred native, MCP, and plugin tools | discoverable through `tool_search` when policy permits | same | same |\n| Paid or external-service tools | follows permission posture | follows permission posture | follows permission posture |\n| Access outside the workspace root | explicit trusted paths only | only through trusted paths or trust mode | same trusted-path/trust policy as Work; fleet profiles never widen it |\n\nOperate changes scheduling emphasis, not authority. It neither adds a\nmode-specific tool denial nor bypasses the active approval, sandbox, shell,\nask-rule, repository-law, or managed-policy boundary. Plan remains the\nmode-specific execution boundary for shell and write-capable tools; that\nauthority difference does not require a different primitive vocabulary.\n\n### OperLine truncated
       }
     ]
   },
@@ -96,8 +96,8 @@
       },
       {
         "path": "docs/CONFIGURATION.md",
-        "sha256": "052344476641ae8cc9f99e28677fcddc4170d597ce075515d0ae7c7fbcde061a",
-        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
+        "sha256": "7d05af7716237c5c28edbb5de4c869963affce9844a75c2230edf58f76a1c0a7",
+        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
       }
     ]
   },
@@ -224,8 +224,8 @@
       },
       {
         "path": "docs/CONFIGURATION.md",
-        "sha256": "052344476641ae8cc9f99e28677fcddc4170d597ce075515d0ae7c7fbcde061a",
-        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
+        "sha256": "7d05af7716237c5c28edbb5de4c869963affce9844a75c2230edf58f76a1c0a7",
+        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
       }
     ]
   },
@@ -256,8 +256,8 @@
       },
       {
         "path": "docs/CONFIGURATION.md",
-        "sha256": "052344476641ae8cc9f99e28677fcddc4170d597ce075515d0ae7c7fbcde061a",
-        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
+        "sha256": "7d05af7716237c5c28edbb5de4c869963affce9844a75c2230edf58f76a1c0a7",
+        "content": "# Configuration\n\ncodewhale reads configuration from a TOML file plus environment variables.\nAt process startup it may also load literal built-in-provider credentials from\na workspace-local `.env` file. Use the tracked `.env.example` as the template;\ncopy it to `.env`, then add only credential values.\n\nA workspace is not configuration authority. Codewhale therefore ignores\nconfig/profile/home paths, provider/model/base-URL routing, MCP/plugin state,\napproval/sandbox/shell posture, executable paths, runtime settings, and every\nother non-credential `.env` entry. Variable expansion is rejected so a\nrepository cannot substitute an ambient secret into a credential value. Use\n`config.toml`, CLI flags, or values exported by the launching shell for those\nexplicit control-plane settings. `.env` is read from a stable regular-file\nhandle, is capped at 1 MiB, and symbolic links, reparse points, and multiply\nlinked files are rejected.\n\n## Reading and checking configuration from the CLI\n\n`codewhale config get <key>` reads scalar keys, whole tables such as `tools`,\nand nested paths such as `tools.user_input_timeout_seconds`. Displayed tables\nand nested values apply the same recursive credential redaction as `config dump`.\n\n`config set` supports its named scalar keys and the provider, route, and\nnotification commands. It refuses a key that nothing reads and suggests the\nnearest real key (`config set calm_mod on` names `calm_mode`). A settings.toml\nkey such as `calm_mode` or `tool_collapse` is validated and written to the\nuser-global settings.toml, not config.toml; `config get` reads it back from\nthere even when an old config.toml copy (which nothing reads) is still present,\nand names that copy so you can `config unset` it. Settings keys have no project\nscope, so `--project` refuses them. A config.toml key is checked against the\ntype its reader expects and stored as a TOML boolean or number where the\nreader needs one (`yolo = true`, `max_subagents = 4`); `reasoning_effort`\naccepts the same aliases as `/effort` (#6563). Other dotted writes fail before\nmodifying the file and name the TOML table to edit. For example, set a tools\ntimeout in the file as:\n\n```toml\n[tools]\nuser_input_timeout_seconds = 0\n```\n\n`codewhale config doctor` checks credential presence and endpoint shape, and\nwarns about each config.toml root key that nothing reads: a settings.toml key\nleft in config.toml is named as misplaced, and any other unread key gets a\ndid-you-mean. Keys read by any runtime reader are not reported. The warnings do\nnot fail the check, and a clean result does not validate every runtime setting's\nvalue (#6083, #6563).\n\n## Usage and execution statistics\n\n`codewhale stats` is an alias of `codewhale metrics`; both use the same local,\nread-only backend. Use `--json` for the structured `stats` report. For example:\n\n```sh\ncodewhale stats --days 7 --models 10 --tools 20 --roles 10\ncodewhale metrics --project /path/to/workspace --json\n```\n\n`--days N` accepts a positive number of days and conflicts with `--since`.\n`--since 24h` and the existing duration syntax remain available. `--models N`,\n`--tools N` and `--roles N` select the top positive N rows by known tokens,\nidentified tool executions and recorded Fleet tasks respectively. These limits\nonly shorten the display; they do not remove stored receipts.\n\nThe report separates saved-document and Runtime views, frozen native-source\nmoney and token subtotals by actual model, retained tool-result history\nestimates and outcomes, completed compaction observations, and recorded Fleet\nroles. USD and CNY stay separate. A cumulative correction replaces its proven\npredecessor; copied Session/Runtime receipts and inherited Runtime fork rows\nare not added as new provider work. Conflicting source versions are shown\nseparately and excluded from the subtotal. Saved legacy display totals remain\nvisible as document projections without being charged again globally.\n\nCoverage is explicit. A missing quote, usage receipt, tool outcome, output\nshape or recovery link is unknown, not zero. Empty scalar usage from older\ntransport records cannot prove a reported zero. Token counts describe known\nreported data; tool history tokens are estimates of retained text, not bytes\nproven to have been replayed on a provider request. Latest prepared-request\ncomponents and source-linked compaction/role economics are unavailable where\nthey were not captured. The report does not infer provider invoices or prove\ncomplete historical coverage.\n\n`--project WORKSPACE` filters current saved/thread/Fleet views. Original source\nworkspace is not yet captured, so native money and model subtotals are\nunavailable for that filter; mutable current metadata is not used to assign a\ncharge. Older receipt projections without reliable workspace scope are also\nunavailable under this filter. Without it, those legacy receipt views remain\nseparate fromLine truncated
       }
     ]
   },
@@ -362,8 +362,8 @@
       },
       {
         "path": "docs/MODES.md",
-        "sha256": "f07a2fce8d2ef02692fdc9298911ebc99dbd7940af6a3b88d396c039dc7e4608",
-        "content": "# Modes and Permission Postures\n\n> 阅读简体中文版：[zh_hans/MODES.md](zh_hans/MODES.md)\n\nCodewhale has three related concepts:\n\n- **TUI mode**: what kind of visible interaction you're in (Plan/Work/Operate).\n- **Permission posture**: how aggressively the UI asks before executing tools.\n- **Workflow**: named steps that coordinate sub-agents, with dependencies and\n  results, available in any TUI mode.\n\nModel selection is separate. `--model auto` and `/model auto` route each turn to\na concrete model and thinking level; they are not TUI modes and are not part of\nthe `Tab` cycle.\n\nWorkflow runs named steps through the same sub-agent runtime; Fleet manages\ntheir saved roles and model assignments. A workflow adds ordering, result\nhandoffs, gates and a progress view. The active mode and permission posture\nstill control what each step may execute.\n\nBefore assigning steps, query `agent(action=\"roster\")` for the saved Fleet\nmodels and roles. A plan child can select a listed model with `model`, or use\nthe saved `role`/`profile` assignment. An Exact Fleet fixes each member's route.\n\n## TUI Modes\n\nPress `Tab` to complete composer menus or cycle through the visible modes\nwhen the composer is empty: **Plan → Work → Operate → Plan**. `Tab` never sends\nor queues composer text; use `Enter` to send or queue it.\nPress `Shift+Tab` to cycle permission posture (Ask → Auto-Review → Full Access).\nEvery change of effective permission writes a `Permissions changed to …` line\nin the transcript.\nPress `Ctrl+T` to cycle reasoning effort.\nRun `/mode` to open the mode picker, or switch directly with `/mode work`,\n`/mode plan`, or `/mode operate`.\n\n- **Plan**: design-first prompting. The stable primitive names remain familiar, but the runtime centrally refuses file mutation and shell execution. Read-only inspection and policy-allowed research, including deferred Web search/fetch, remain available. When a Plan turn successfully finishes a nonempty response, including a prose-only plan, the TUI asks how to continue: Work (Ask), Work (Auto-Review), or keep planning. Work sends the exact approved response as a normal follow-up and preserves that turn's existing To-dos, or adds one pending plan item without replacing unrelated work.\n- **Work** (internally `agent`): ordinary multi-step execution. The first-turn toolbox includes `read`, `write`, `edit`, `file_search`, `bash`, `agent`, `workflow`, `todo_write`, and `load_skill`, plus `create_goal`, `get_goal`, `update_goal`, and `task_shell_wait` so goal and background-shell controls are available without discovery. The agent calls `create_goal` when a request is a durable objective; the host never infers a goal from wording, and the contract must not tell the model otherwise. Approval, sandbox, repository law, and managed policy decide what may execute.\n- **Operate**: Work at full strength, the \"ultra\" mode. Same tools and authority as Work; the difference is how they are used. Each substantive request becomes a goal (`create_goal`), the plan stays visible (`todo_write`), multi-part work runs through `workflow` and parallel `agent` workers, non-trivial changes get an independent reviewer before they are called done, long commands keep running in the background, and recurring or watch-type work is offered as an `automation` (created after approval). It keeps going until the goal is verified, blocked on you, or paused.\n\n`Act` and `/mode act` remain compatibility aliases for Work. Saved settings\nstill normalize to the internal value `agent`.\n\n### Tool availability by mode\n\n| Tool family | Plan | Work | Operate |\n|:---|:---:|:---:|:---:|\n| `read` and policy-allowed deferred research tools | yes | yes | yes |\n| `write` and `edit` | visible names; execution denied | approval- and policy-gated | same as Work |\n| `bash` | visible name; execution denied | approval- and policy-gated | same as Work; delegation is preferred when parallelism or isolation helps |\n| `agent` | yes, subject to child-depth authority | yes, subject to child-depth authority | yes, subject to child-depth authority |\n| Deferred native, MCP, and plugin tools | discoverable through `tool_search` when policy permits | same | same |\n| Paid or external-service tools | follows permission posture | follows permission posture | follows permission posture |\n| Access outside the workspace root | explicit trusted paths only | only through trusted paths or trust mode | same trusted-path/trust policy as Work; fleet profiles never widen it |\n\nOperate changes scheduling emphasis, not authority. It neither adds a\nmode-specific tool denial nor bypasses the active approval, sandbox, shell,\nask-rule, repository-law, or managed-policy boundary. Plan remains the\nmode-specific execution boundary for shell and write-capable tools; that\nauthority difference does not require a different primitive vocabulary.\n\n### Operate loop (one screen)\n\n```text\nUser Line truncated
+        "sha256": "0a8284ae22715d43aa08227d0771441c199268c4f035dcb9a3048779cb4351e0",
+        "content": "# Modes and Permission Postures\n\n> 阅读简体中文版：[zh_hans/MODES.md](zh_hans/MODES.md)\n\nCodewhale has three related concepts:\n\n- **TUI mode**: what kind of visible interaction you're in (Plan/Work/Operate).\n- **Permission posture**: how aggressively the UI asks before executing tools.\n- **Workflow**: named steps that coordinate sub-agents, with dependencies and\n  results, available in any TUI mode.\n\nModel selection is separate. `--model auto` and `/model auto` route each turn to\na concrete model and thinking level; they are not TUI modes and are not part of\nthe `Tab` cycle.\n\nWorkflow runs named steps through the same sub-agent runtime; Fleet manages\ntheir saved roles and model assignments. A workflow adds ordering, result\nhandoffs, gates and a progress view. The active mode and permission posture\nstill control what each step may execute.\n\nBefore assigning steps, query `agent(action=\"roster\")` for the saved Fleet\nmodels and roles. A plan child can select a listed model with `model`, or use\nthe saved `role`/`profile` assignment. An Exact Fleet fixes each member's route.\n\n## TUI Modes\n\nPress `Tab` to complete composer menus or cycle through the visible modes\nwhen the composer is empty: **Plan → Work → Operate → Plan**. `Tab` never sends\nor queues composer text; use `Enter` to send or queue it.\nPress `Shift+Tab` to cycle permission posture (Ask → Accept Edits →\nAuto-Review → Full Access).\nEvery change of effective permission writes a `Permissions changed to …` line\nin the transcript.\nPress `Ctrl+T` to cycle reasoning effort.\nRun `/mode` to open the mode picker, or switch directly with `/mode work`,\n`/mode plan`, or `/mode operate`.\n\n- **Plan**: design-first prompting. The stable primitive names remain familiar, but the runtime centrally refuses file mutation and shell execution. Read-only inspection and policy-allowed research, including deferred Web search/fetch, remain available. When a Plan turn successfully finishes a nonempty response, including a prose-only plan, the TUI asks how to continue: Work (Ask), Work (Accept Edits), Work (Auto-Review), or keep planning. Work sends the exact approved response as a normal follow-up and preserves that turn's existing To-dos, or adds one pending plan item without replacing unrelated work.\n- **Work** (internally `agent`): ordinary multi-step execution. The first-turn toolbox includes `read`, `write`, `edit`, `file_search`, `bash`, `agent`, `workflow`, `todo_write`, and `load_skill`, plus `create_goal`, `get_goal`, `update_goal`, and `task_shell_wait` so goal and background-shell controls are available without discovery. The agent calls `create_goal` when a request is a durable objective; the host never infers a goal from wording, and the contract must not tell the model otherwise. Approval, sandbox, repository law, and managed policy decide what may execute.\n- **Operate**: Work at full strength, the \"ultra\" mode. Same tools and authority as Work; the difference is how they are used. Each substantive request becomes a goal (`create_goal`), the plan stays visible (`todo_write`), multi-part work runs through `workflow` and parallel `agent` workers, non-trivial changes get an independent reviewer before they are called done, long commands keep running in the background, and recurring or watch-type work is offered as an `automation` (created after approval). It keeps going until the goal is verified, blocked on you, or paused.\n\n`Act` and `/mode act` remain compatibility aliases for Work. Saved settings\nstill normalize to the internal value `agent`.\n\n### Tool availability by mode\n\n| Tool family | Plan | Work | Operate |\n|:---|:---:|:---:|:---:|\n| `read` and policy-allowed deferred research tools | yes | yes | yes |\n| `write` and `edit` | visible names; execution denied | approval- and policy-gated | same as Work |\n| `bash` | visible name; execution denied | approval- and policy-gated | same as Work; delegation is preferred when parallelism or isolation helps |\n| `agent` | yes, subject to child-depth authority | yes, subject to child-depth authority | yes, subject to child-depth authority |\n| Deferred native, MCP, and plugin tools | discoverable through `tool_search` when policy permits | same | same |\n| Paid or external-service tools | follows permission posture | follows permission posture | follows permission posture |\n| Access outside the workspace root | explicit trusted paths only | only through trusted paths or trust mode | same trusted-path/trust policy as Work; fleet profiles never widen it |\n\nOperate changes scheduling emphasis, not authority. It neither adds a\nmode-specific tool denial nor bypasses the active approval, sandbox, shell,\nask-rule, repository-law, or managed-policy boundary. Plan remains the\nmode-specific execution boundary for shell and write-capable tools; that\nauthority difference does not require a different primitive vocabulary.\n\n### OperLine truncated
       },
       {
         "path": "docs/public-surface-facts.json",