Working with the agent
Act and Plan modes
Plan mode makes the agent read-only. Start there if you are letting an agent into a repository you care about.
Snaga runs in one of two modes. Act is the default and gives the agent its full tool set. Plan is read-only: the agent can look at anything and change nothing.
Stop the agent from writing anything
> /mode plan
In Plan mode the agent can read files, search the codebase, inspect git history and browse the web — and every tool that writes a file or runs a command is refused before it executes. It is not a promise the model makes to itself; the refusal happens in the dispatcher, below the model, so a model that decides to edit a file anyway simply gets an error back.
This is the mode to use when you are:
- pointing the agent at unfamiliar code and want an explanation, not a patch;
- letting it plan a change you intend to review before anything happens;
- trying the tool for the first time on a repository that matters.
Switch back when you want work done:
> /mode act
What is allowed in Plan mode
Read-only tools: read_file, list_dir, glob, grep, git_status,
git_diff, git_log, web_search, scrape, read_pdf and the per-language
syntax checkers.
Tools from connected MCP servers are allowed only when the verb in their name
is read-only: search_, read_, get_, list_, describe_, fetch_,
query_, show_, find_, lookup_, head_, info_. An MCP tool named
anything else is refused in Plan mode, regardless of what it actually does —
the name is the only thing the gate can judge before running it.
Refused: write_file, edit_file, shell, and everything else that mutates
the workspace or the host.
Plan mode is not the same as a plan branch
Two different things share the word:
/mode plan | read-only mode — the agent cannot write |
/plan | plan branches — a git worktree per plan, so the agent can write, but into an isolated branch |
/plan is for exploring two approaches in parallel without them touching each
other. /mode plan is for not touching anything at all. If you want the second,
do not type the first.
What Plan mode does not protect
Plan mode gates tools. It is not a sandbox and not a permission system:
- Sandboxing confines what a command can reach on your machine, and is on by default in every mode — see Permissions and safety.
- Approvals ask a human before a dangerous action. Those apply in Act mode, where dangerous actions are possible.
Plan mode is the coarsest and most reliable of the three, which is exactly why it is a good place to start.