Staying in Control

min-agent asks for confirmation before risky actions by default. File edits are auto-approved unless you change this.

min-agent permission                 # Show current setting
min-agent --permission ask           # Confirm before risky actions
min-agent --permission accept-edits  # Auto-approve file edits only (default)
min-agent --permission allow-all     # Auto-approve everything — use with care

You can also limit what it's allowed to touch on your machine:

min-agent sandbox            # Show current restriction level
min-agent sandbox off        # No restriction (default)
min-agent sandbox workspace  # Only allow changes inside the current folder
min-agent sandbox strict     # Only allow changes inside the current folder and deny risky commands

Network access is allowed by default; you can restrict it separately:

min-agent sandbox network          # Show the current network policy
min-agent sandbox network deny     # Deny network access (writes config)
min-agent sandbox network allow    # Allow network access (writes config)

Or use the session-level --network flag:

min-agent --network deny           # Deny for this run; standalone use writes config and exits

Per-run overrides

Standalone --permission / --sandbox / --network write config and exit. If combined with a message or session flags (--resume / --model / --provider / a prompt), they apply to this run only and do not touch config.

• --yes / -y: auto-approve everything for this run only, does not write config
• --project: write the config to this project's .min-agent/config.json (requires min-agent init first)
• --global: write the config to the global ~/.min-agent/config.json