Ultracode approvals and status line

Ultracode agents follow the permissions of your chat, and a status line shows their work. An agent runs only what the approval level of the chat would allow.

Diagram as text

1. An agent of an Ultracode run wants to run a command.
2. The approval level of the chat decides: ask every time, ask unless the command is on your list, run without asking, or bypass.
3. With run without asking, or when every part of the command is on your list, it runs.
4. Protected commands ask on every level except bypass: recursive delete outside the work scope, hard resets and git clean, force-push, and anything touching /vault.
5. A request appears in the status line with the full command. While it waits, no model is called and Stop still works.
6. Allow runs the command once. Allow for this run remembers the tool for the rest of the run, also after a worker restart.
7. Deny or no answer within five minutes refuses it, and the agent is told.

Approvals

• The four approval settings of the chat apply: Ask every time, Allowlisted commands only, Auto-accept edits and Never ask (the bypass level). One function decides for the chat and for the workers. See Command approval.
• A request appears in the status line with the full command and three buttons: Allow, Deny and Allow for this run. The last one remembers the tool for the rest of the run, also after a worker restart.
• Unanswered after five minutes, a request counts as denied. While it waits, no model is called, and Stop still works. Only the owner of the run can answer.
• A short list of protected commands asks on every setting except Never ask: recursive delete outside the work scope, hard resets and git clean, force-push, and anything touching /vault.
• Background /goal runs go through the same gate and ask like the chat does.

The status line

• One fixed line above the message box, with one count, for example 2 of 6 agents active. Closed, it reads like 3 agents · Implementing · 1m 07s · $0.012.
• Open, it lists the agents with their live log. The log shows each command in full, up to 2,000 characters, with secrets and vault values blacked out (blackout). It renders Markdown, without HTML and without external images.
• Errors stay visible when the line is closed, for example a missing checking model with the attempt number.

The list of protected commands is a safety net, not a sandbox. The container and the network broker stay in place.

More on the run itself: /ultracode. Checking models: helper and checking models.