The office asks before it acts.
Agents don't get silent yeses here. Permission asks stack into one queue you answer on your terms, boss questions open as small wizards instead of modal essays, and a concierge takes the message when the boss is mid-turn.
Asks stack as 1 of N. None of them steals the screen.
When the boss or a worker wants to run a command, write a path, or touch a host, the ask joins a queue instead of hijacking the terminal. The front of the queue shows where you stand — 1 of N — with a clickable menu: allow once, allow always, reject.
The keys say the same thing: y allows this ask once, a allows the pattern always, n rejects it, and esc parks the float without answering — the rest of the office keeps working either way. Parked is not lost: /perm re-opens an esc'd prompt.
What allow-always does not cover: it answers one tool pattern, and that is all. It never pre-answers the boss's questions — those are decisions, not permissions — and asks for anything you have not already blessed still stack into the queue as 1 of N. Press a only on a pattern you can say out loud.
/bypass is the deliberate escape hatch.
Some rooms don't need a bouncer: a throwaway repo, a sandboxed environment, a demo you'll reset in an hour. /bypass toggles a session-scoped bypass-permissions mode for exactly those rooms. Enabling asks for an explicit confirm first — agents will run tools and browser actions without asking, this office session only — so the loud path is never the accidental one. Disabling is instant.
While it's on, two ask surfaces go quiet. Backend tool asks stop entirely — claude spawns with --dangerously-skip-permissions, and the office-owned opencode child gets an ephemeral OPENCODE_CONFIG_CONTENT permission allow-all — and the office's own browser-action prompt (click, fill, eval) is skipped too. Anything that still slips an ask through is auto-approved, with a dim log row in the transcript so the record stays honest. Toggling respawns the backend so the mode actually reaches the agent; on claude, your session context resumes across the respawn.
session only
Every boot starts with bypass OFF. The toggle lives in memory and the badge dies with the office session — brain.json never gains a key.
confirm on enable
Turning it on is a two-step: the office’s question modal makes you confirm that agents will run tools and browser actions without asking. Turning it off is instant.
loud indicator
While it’s on, every tab’s topbar carries a ⚠ BYPASS segment. The mode never hides, and neither does the dim log row each auto-approved ask leaves in the transcript.
what lands on disk
Nothing. Claude receives its command-line flag; the office-owned opencode child receives an ephemeral OPENCODE_CONFIG_CONTENT allow-all override. brain.json, .opencode/opencode.json, and the parent process environment remain byte-identical, and every boot starts OFF.
Boss questions open as small wizards, not modal essays.
When the boss needs a decision mid-dispatch, the ask opens as popover pages, classified automatically into four kinds:
text
A free-answer field. The boss gets your sentence back verbatim — names, flags, judgment calls. A multi-line paste lands in the field verbatim too, newlines and all.
radio
Pick one. Mutually exclusive options, one choice.
checkbox
Pick several. Zero or more options stick.
confirm
Yes or no. The smallest possible fork.
esc defers the whole wizard into a lane of its own — the chat stays usable underneath — and /question re-opens the deferred page when you have an answer. There is no allow-always on a question: each one is a decision the office refuses to make for you.
Send mid-turn and the concierge picks up.
enter while the boss works never blocks: the prompt free-sends into the backlog and the status line reads busy · N queued. The queue is a backlog the office manages, not a tunnel — flush goes out as one [BATCH DISPATCH] the boss decomposes into parallel sub-agents, and /route forces it early. The board side of that story lives in queue, board, and memory.
If the boss is mid-task, the office concierge answers instantly as a real conversation turn, noted in chat as office routed: boss busy → concierge. If the concierge is unavailable, a notice says so and the prompt rides the backlog instead — no silent drop, no fake reply.
What this doesn't do yet.
parked is not answered
esc gets an ask out of your face, not out of the world. Nothing answers it for you later — /perm or /question re-opens it when you are ready.
the concierge lane
The concierge answers the message; it does not drain the backlog. Queued sends still flush on the office’s schedule (or /route) — and if the concierge itself is unavailable, a notice says so and your prompt rides the queue.
a wedged turn
Two silent minutes on a busy turn earns one wedge note — status bar and activity log, never the transcript. It is a note, not a rescue: /stop is the lever that actually aborts boss and workers.
an idle floor
Two quiet minutes after the floor empties, if the last real chat was yours, the office asks the boss to recap the shift in a few lines. It does not start new work. A late boss or concierge wrap skips the recap.
the click path
The queue’s menu is clickable, but the office never answers on your behalf — allow-once, always, and reject all wait for an explicit key or click. There is no silent default.
next
Queue, board, and memory
Where parked sends and flushed batches land — the backlog the concierge defers to.
related
Chat and work threads
The transcript these floats sit on top of — streaming replies, threads, and diffs.
reference
Keys and slash commands
y / a / n / esc, /perm, /question, /queue, /route, /stop — the whole table.
related
Backends
The same queue discipline on opencode or Claude Code — the answers map onto each transport’s own permission replies.