Repository navigation
Modes: manual — execute, but ask before every change - #392
Merged
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.
Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.
A third mode next to auto and plan, as in Claude Code: the agent works, but every change stops for a yes — any shell command, every file write, append, edit and mkdir, mutating git, sub-agent spawns and MCP — even where /permissions or an allow rule would have let it through. Reads stay free, an 'a' at a prompt still covers its kind for the session, and the deny floor holds in every mode. It rides on the call gate the risk check already uses, so sub-agents and background jobs follow it too. shift+tab cycles auto → plan → manual (a single press still means plan), /manual sets it, and the /config mode row steps through all three. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A call whose value landed in the action field ("touch x" as run's
action) was scored, plan-checked and gated as nothing, then recovered
inside Dispatch and run — manual mode, the risk check and plan mode all
missed it. Registry.Normalize applies Dispatch's recovery up front, and
execOne judges the call as it will run.
- The gate reads params as the tools do: a numeric path is a path.
- Accepting a plan ran it in auto even after shift+tab had chosen manual;
it now keeps manual, and m at PLAN READY runs a plan in manual from auto.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rromenskyi
force-pushed
the
manual-mode
branch
from
October 20, 2026 01:06
498ede3 to
986ba0d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A third mode next to auto and plan, modelled on Claude Code. Requested by a user.
manual: the agent executes, but every change stops for a yes. That covers any shell command, every file write, append, edit and mkdir, mutating git, sub-agent spawns, and MCP. It asks even where
/permissionsor an allow rule would let the call through. Reads and searches stay free. Anaat a prompt still covers its kind for the session. The deny floor holds in every mode.How it works:
app.manual(anatomic.Bool) plus a smallmodetype: auto, plan, manual.manualStopshooks into the call gate the risk check already uses (riskGate). Calls the policy would allow without asking (run, and the file write/append/edit/mkdir actions) are asked about. Sub-agents and jobs get the same gate, so they follow manual too.spawn.default=allow. Git mutations, MCP and external agents already always asked./manualsets the mode directly. The/configmode row steps through all three, the indicator shows "✋ manual mode on", and the help text and README are updated.Tests:
cmd/agent/manual_mode_test.go, plus the shift+tab deferral test updated for three modes. A sabotage pass made 12 mutations: manual never stops, run not stopped, mkdir not stopped, reads stopped, risk wording on a manual refusal, spawn ignoring manual, setMode dropping manual, cycle skipping manual, indicator, config row, preview, and shift+tab target. Every one failed a test.🤖 Generated with Claude Code