# Differences Between Plan, Agent, and YOLO Modes in DeepSeek-TUI: Security and Execution Models

> Understand DeepSeek-TUI modes: Plan for safe read-only exploration, Agent for controlled tool use, and YOLO for full autonomy. Learn their security and execution differences.

- Repository: [DeepSeek/awesome-deepseek-agent](https://github.com/deepseek-ai/awesome-deepseek-agent)
- Tags: deep-dive
- Published: 2026-08-15

---

**Plan mode provides read-only investigation with all side effects blocked, Agent mode enables multi-step tool use with explicit user approval for destructive operations, and YOLO mode grants full autonomy by auto-approving every tool call and lifting workspace restrictions.**

DeepSeek-TUI, part of the `deepseek-ai/awesome-deepseek-agent` repository, implements a Codex-style architecture written in Rust that governs AI-assisted development through three distinct security policies. Understanding the differences between Plan, Agent, and YOLO modes is essential for controlling tool execution, filesystem access, and shell command permissions when using the terminal interface.

## Plan Mode: Read-Only Investigation

**Plan mode** operates as a strictly read-only sandbox where the TUI may query models and display results but **never writes files, executes shell commands, or calls tools with side effects**.

According to the source code in [`src/tools/sandbox.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tools/sandbox.rs), this mode disables all I/O-affecting APIs. The planner runs inside a sandbox process that filters out any attempt to invoke side-effectful tools before they reach the tool-execution layer. This architecture ensures absolute workspace protection during initial exploration or when reviewing code without modification intent.

## Agent Mode: Approved Tool Execution

**Agent mode** enables multi-step tool sequences while maintaining security through **explicit user approval**. When the TUI invokes tools that may cause side effects, the agent layer forwards requests to the tool-execution subsystem, which wraps each call with an approval prompt.

As implemented in [`src/tui/mod.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tui/mod.rs), this mode adds a runtime checkpoint that displays `[Approve] [Reject]` options for destructive operations. Approved calls execute inside the sandbox with workspace boundaries enforced, while unapproved calls are rejected. This creates a balanced workflow where the AI can perform complex tasks while the user retains veto power over dangerous operations.

## YOLO Mode: Full Autonomy

**YOLO mode** removes all restrictions by **automatically approving every tool call** and **lifting workspace-boundary restrictions**, granting the agent unrestricted access to the filesystem and external commands. In this mode, the sandbox is effectively disabled and the tool-execution pipeline bypasses the approval gate entirely.

This mode is intended exclusively for trusted environments where full autonomy is required. According to the documentation in [`docs/deepseek-tui.md`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/docs/deepseek-tui.md), YOLO mode allows operations like `rm -rf` commands without prompts, making it suitable only when you completely trust the AI agent and your environment isolation.

## How to Switch Between Modes

DeepSeek-TUI allows runtime mode switching via the **Tab** key, cycling through **Plan → Agent → YOLO** sequentially. The current mode appears in the status line at the bottom of the interface.

```bash

# Start DeepSeek-TUI

$ deepseek-tui

# Cycle through modes by pressing <Tab>

# Status line shows: "Plan" → "Agent" → "YOLO"

```

For programmatic control or scripting, specify the mode directly using the `--mode` flag:

```bash

# Start directly in Agent mode

deepseek-tui --mode=agent

# Start directly in YOLO mode

deepseek-tui --mode=yolo

```

## Implementation Architecture

The mode system relies on a policy-based security architecture where [`src/tui/mod.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tui/mod.rs) handles the `<Tab>` key events and injects the appropriate policy object into the sandbox process. The [`src/tools/sandbox.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tools/sandbox.rs) file implements the enforcement layer that interprets these policies:

- **Plan policies** block all write operations at the syscall level
- **Agent policies** intercept tool calls to trigger the approval UI
- **YOLO policies** pass through all requests without validation

This separation between the TUI logic and sandbox enforcement ensures that security rules cannot be bypassed by the AI model itself, as the sandbox runs as a separate process with hardware-enforced boundaries.

## Summary

- **Plan mode** creates a read-only sandbox perfect for safe investigation without side effects
- **Agent mode** balances automation with safety through explicit approval workflows for destructive tools
- **YOLO mode** provides maximum velocity by auto-approving all actions, suitable only for isolated or fully trusted environments
- Modes toggle via the **Tab** key at runtime or the `--mode` flag at startup
- Security enforcement occurs in [`src/tools/sandbox.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tools/sandbox.rs) through policy objects passed from [`src/tui/mod.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tui/mod.rs)

## Frequently Asked Questions

### How do I switch between Plan, Agent, and YOLO modes while using DeepSeek-TUI?

Press the **Tab** key to cycle through the modes sequentially from Plan to Agent to YOLO. The current mode displays in the status line at the bottom of the terminal interface. You can also launch directly into a specific mode using the `--mode` flag with values `plan`, `agent`, or `yolo`.

### What happens if an AI tries to delete files while in Plan mode?

In Plan mode, the sandbox layer in [`src/tools/sandbox.rs`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/src/tools/sandbox.rs) intercepts and blocks all file modification attempts before execution. The operation is filtered out at the API level, meaning the tool call never reaches the filesystem, and the TUI continues operating without making changes.

### Is YOLO mode safe for production environments?

YOLO mode is **not recommended for production** or any environment containing valuable data. This mode disables the approval gate and removes workspace boundaries, allowing the AI to execute destructive commands like `rm -rf` without confirmation. Reserve YOLO mode for disposable containers or fully isolated development environments where data loss is acceptable.

### Can I restrict specific tools rather than using these three preset modes?

The current DeepSeek-TUI architecture implements security through the three coarse-grained modes defined in [`docs/deepseek-tui.md`](https://github.com/deepseek-ai/awesome-deepseek-agent/blob/main/docs/deepseek-tui.md). The system does not provide per-tool granularity within these presets; instead, the **Agent** mode serves as the middle ground where you can approve or reject specific invocations on a case-by-case basis as they occur.