Permission modes
Choose the permission mode beside the desktop composer, or pass --permission-mode to wuu exec. The same labels are available across engines, but the built-in Wuu engine and external programs enforce them differently.
The three modes
Section titled “The three modes”For the Wuu engine:
| Mode | Dedicated tools | Commands |
|---|---|---|
Standard standard | Read and write within registered file roots, subject to sensitive-path guards | Filesystem sandbox permits writes within execution roots and a private temporary directory |
Read only read_only | Same read scope; mutating calls are refused | Allowed commands run with filesystem writes restricted |
Unconfined unconfined | Removes the normal path boundary; dedicated sensitive-path guards remain | Removes Wuu’s filesystem process sandbox |
The normal file scope includes the agent’s scoped home, Wuu home (~/.wuu or $WUU_HOME), registered user workspaces, and the system temporary directory. Non-credential files under Wuu home, including configuration and runtime records, follow the ordinary file boundary rather than a directory-wide sensitive-path ban. Standard commands also receive Wuu home as a writable root. Commands do not receive the whole shared temporary directory as a writable root: they get a private temporary directory instead.
On macOS, both confined modes also permit writes to the current user’s Module Directory Services (mds) cache, which Keychain reads require. This exception does not grant direct filesystem writes to keychain stores or other user caches.
Use Read only for investigation and Standard for ordinary changes. Unconfined gives commands the local authority of the user running Wuu. Choose it only when you understand why the task needs that access.
System permissions and isolation
Section titled “System permissions and isolation”The process sandbox restricts file-content writes and filesystem creation/removal, not all reads, network access, process visibility, or inherited environment variables. Linux Landlock does not restrict all metadata operations, such as changing file modes or timestamps. In particular, read-only does not mean that commands cannot disclose data. Dedicated file-tool boundaries and subprocess confinement are separate protections.
The built-in backend uses Seatbelt on macOS and Landlock on Linux (ABI 3 or later). Linux kernels without Landlock fail closed. On other platforms, or when that backend cannot run, confined commands require a configured sandbox.process@1 extension. A missing, failed, or partially enforcing backend causes execution to fail; Wuu does not silently retry unconfined.
This is not a sandbox for all installed code. Plugins, hooks, MCP servers, external engines, and commands typed manually into the desktop terminal have their own execution paths. Use an isolated environment or separate OS account for untrusted repositories and dependencies. See the security model.
Approve for me
Section titled “Approve for me”Approve for me is a desktop option for the Wuu engine in Standard mode. It adds model review before selected native tool calls; it does not create a fourth mode or expand the workspace boundary.
All shell execution goes through review, including commands classified as read-only. Other destructive or high-risk calls, and applicable Git, process, browser, and MCP actions, are also reviewed. Ordinary low-risk reads do not require it. Review uses the active conversation’s model and can add model requests, cost, and latency.
Review is a one-shot, text-only request with a 90-second deadline, also bounded by the owning execution. It preserves the active model’s sampling, reasoning, transport compatibility, and configured output-token policy. Provider options cannot replace the review evidence, select another model, or add tools. The host still owns the review policy and the decision to execute a tool.
The reviewer can allow the call, deny it, or leave it unresolved so the agent can explain the proposed action and seek informed user approval in conversation. A timeout, cancellation, or review failure leaves the action unexecuted; it is not permission to bypass review. The option cannot elevate the session to Unconfined or override dedicated credential and sensitive-write guards.
wuu exec does not expose this option. Its native permission checks allow or deny calls without opening an interactive approval dialog.
Sensitive paths
Section titled “Sensitive paths”Dedicated file tools refuse writes to known sensitive paths such as environment files, credential stores, and SSH private keys, including in Unconfined mode. A source file is not treated as a credential store only because its name contains credential or secret; credentials.go can be edited, while credentials.json cannot. Chat approval does not lift these guards. Wuu credential files such as auth.json, credentials.json, remote.json, and phone.json under Wuu’s home remain blocked for direct reads and writes. Structured Git tools also guard sensitive staging and commits.
Tool output redaction recognizes common secret patterns, but cannot recognize every secret or encoding. These guards do not guarantee secrecy across arbitrary shell programs, third-party code, or network requests.
External engines
Section titled “External engines”The adapters pass the selected mode to the external program:
| Wuu selection | Codex | Claude Code | ACP agents |
|---|---|---|---|
| Standard | workspace-write, approvals on-request | dontAsk | advertised prompting mode (agent, ask, default, …); otherwise the host approval bridge |
| Read only | read-only, approvals never | plan | advertised plan / read-only when the agent publishes one; otherwise refused |
| Unconfined | danger-full-access, approvals never | bypassPermissions | advertised no-prompts mode (bypassPermissions, agent-full-access, bypass, …); otherwise one-shot auto-accept |
These are adapter settings, not a claim that the engines provide identical protection. Claude Code’s headless transport has no permission-prompt bridge; Standard uses dontAsk so permission requests are denied rather than waiting indefinitely. ACP engines advertise a category=mode config option; the composer shows those native labels and applies the matching id through session/set_config_option. External program versions and configuration determine their native behavior.
CLI examples
Section titled “CLI examples”wuu exec --permission-mode read_only "Explain the repository without changing files"wuu exec --permission-mode standard "Fix the failing test and run the relevant checks"Normal project configuration cannot silently replace the user’s permission mode. Explicit automation configuration has separate trust rules; see configuration.