Sandbox & approvals

Working safely¶

/mode selects Ask, Plan, or Work. /safety controls which operations need approval; /permissions controls how approval requests are handled. Every command still runs inside the platform sandbox. Commands classified as inspection run with read-only filesystem access even in Work mode. /help lists TUI controls and commands.

The transcript shows messages and tool activity, with a session sidebar shown automatically on wide terminals. Ctrl+B opens or closes the sidebar. Tables align styled text by display columns and separate records with a blank row. Lists and tool entries keep their body indentation when wrapping; long commands and output stay compact, with complete details available through Ctrl+T. Both views cache their layout so scrolling and returning from large outputs reuse the rendered rows. Tool markers blink yellow every 400ms while waiting for completion, then stay green on success or red on failure. Activity indicators in the sidebar and above the input use blue dots aligned with tool rows. The input box keeps room for multiline editing, and the startup screen uses a small Latch title. Mouse capture is enabled by default so the wheel scrolls the composer and transcript instead of recalling input history, including under tmux and Zellij. In terminals that support it, hold Shift while dragging to select text. Set LATCH_MOUSE_CAPTURE=0 before starting Latch to disable capture and restore native mouse selection; terminals or multiplexers may then translate the wheel into history-navigation keys. PageUp/PageDown and Shift+PageUp/Down remain available for scrolling.

On Windows, scoped file brokers let commands list, read and write ordinary workspace files without changing source ACLs or requiring WRITE_DAC. Runtime bootstrap and scratch grants still use durable recovery. Sensitive files with broad package permissions require recoverable sealing or fail closed. A whole live home directory remains unqualified. For a local clone, git clone --no-hardlinks avoids links to files outside the workspace. See the Windows boundary status and open issues for current limits. With explicit Network authorization, sandboxed Windows tools can access loopback services and start local TCP/UDP listeners without firewall or loopback exemption changes. PowerShell extensions require PowerShell 7; fixed headless calls use a staged runtime and default to MTA inside AppContainer.

Working history rotates at 64,000 conversation tokens by default (context.recent_tokens), subject to the model request budget. Rotation preserves durable history; see the continuity design.