Differences Between Plan, Agent, and YOLO Modes in DeepSeek-TUI: Security and Execution Models

Plan mode provides read-only investigation with all side effects blocked, Agent mode enables multi-step tool use with explicit user approval for destructive operations, and YOLO mode grants full autonomy by auto-approving every tool call and lifting workspace restrictions.

DeepSeek-TUI, part of the deepseek-ai/awesome-deepseek-agent repository, implements a Codex-style architecture written in Rust that governs AI-assisted development through three distinct security policies. Understanding the differences between Plan, Agent, and YOLO modes is essential for controlling tool execution, filesystem access, and shell command permissions when using the terminal interface.

Plan Mode: Read-Only Investigation

Plan mode operates as a strictly read-only sandbox where the TUI may query models and display results but never writes files, executes shell commands, or calls tools with side effects.

According to the source code in src/tools/sandbox.rs, this mode disables all I/O-affecting APIs. The planner runs inside a sandbox process that filters out any attempt to invoke side-effectful tools before they reach the tool-execution layer. This architecture ensures absolute workspace protection during initial exploration or when reviewing code without modification intent.

Agent Mode: Approved Tool Execution

Agent mode enables multi-step tool sequences while maintaining security through explicit user approval. When the TUI invokes tools that may cause side effects, the agent layer forwards requests to the tool-execution subsystem, which wraps each call with an approval prompt.

As implemented in src/tui/mod.rs, this mode adds a runtime checkpoint that displays [Approve] [Reject] options for destructive operations. Approved calls execute inside the sandbox with workspace boundaries enforced, while unapproved calls are rejected. This creates a balanced workflow where the AI can perform complex tasks while the user retains veto power over dangerous operations.

YOLO Mode: Full Autonomy

YOLO mode removes all restrictions by automatically approving every tool call and lifting workspace-boundary restrictions, granting the agent unrestricted access to the filesystem and external commands. In this mode, the sandbox is effectively disabled and the tool-execution pipeline bypasses the approval gate entirely.

This mode is intended exclusively for trusted environments where full autonomy is required. According to the documentation in docs/deepseek-tui.md, YOLO mode allows operations like rm -rf commands without prompts, making it suitable only when you completely trust the AI agent and your environment isolation.

How to Switch Between Modes

DeepSeek-TUI allows runtime mode switching via the Tab key, cycling through Plan → Agent → YOLO sequentially. The current mode appears in the status line at the bottom of the interface.

# Start DeepSeek-TUI

$ deepseek-tui

# Cycle through modes by pressing <Tab>

# Status line shows: "Plan" → "Agent" → "YOLO"

For programmatic control or scripting, specify the mode directly using the --mode flag:

# Start directly in Agent mode

deepseek-tui --mode=agent

# Start directly in YOLO mode

deepseek-tui --mode=yolo

Implementation Architecture

The mode system relies on a policy-based security architecture where src/tui/mod.rs handles the <Tab> key events and injects the appropriate policy object into the sandbox process. The src/tools/sandbox.rs file implements the enforcement layer that interprets these policies:

• Plan policies block all write operations at the syscall level
• Agent policies intercept tool calls to trigger the approval UI
• YOLO policies pass through all requests without validation

This separation between the TUI logic and sandbox enforcement ensures that security rules cannot be bypassed by the AI model itself, as the sandbox runs as a separate process with hardware-enforced boundaries.

Summary

• Plan mode creates a read-only sandbox perfect for safe investigation without side effects
• Agent mode balances automation with safety through explicit approval workflows for destructive tools
• YOLO mode provides maximum velocity by auto-approving all actions, suitable only for isolated or fully trusted environments
• Modes toggle via the Tab key at runtime or the --mode flag at startup
• Security enforcement occurs in src/tools/sandbox.rs through policy objects passed from src/tui/mod.rs

Frequently Asked Questions

How do I switch between Plan, Agent, and YOLO modes while using DeepSeek-TUI?

Press the Tab key to cycle through the modes sequentially from Plan to Agent to YOLO. The current mode displays in the status line at the bottom of the terminal interface. You can also launch directly into a specific mode using the --mode flag with values plan, agent, or yolo.

What happens if an AI tries to delete files while in Plan mode?

In Plan mode, the sandbox layer in src/tools/sandbox.rs intercepts and blocks all file modification attempts before execution. The operation is filtered out at the API level, meaning the tool call never reaches the filesystem, and the TUI continues operating without making changes.

Is YOLO mode safe for production environments?

YOLO mode is not recommended for production or any environment containing valuable data. This mode disables the approval gate and removes workspace boundaries, allowing the AI to execute destructive commands like rm -rf without confirmation. Reserve YOLO mode for disposable containers or fully isolated development environments where data loss is acceptable.

Can I restrict specific tools rather than using these three preset modes?

The current DeepSeek-TUI architecture implements security through the three coarse-grained modes defined in docs/deepseek-tui.md. The system does not provide per-tool granularity within these presets; instead, the Agent mode serves as the middle ground where you can approve or reject specific invocations on a case-by-case basis as they occur.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}