DEV Community

Bellows AI
Bellows AI

Posted on

Qwen Code edits your files without asking. Here's the one-line fix.

#ai #programming #productivity #tutorial

If you've installed Qwen Code recently, it's probably running in Auto mode.

That's the out-of-the-box default now. Unless you pass a flag or set it in your settings, every new session starts in Auto. In the source, it's the mode a normal session falls through to when nothing else is set.

Auto is a reasonable idea. It's also worth knowing exactly what it does before you point it at a repo you care about.

What Auto actually approves

Qwen Code's own docs describe three layers:

  1. File edits inside your project are approved straight away. They don't even reach the safety check. The exceptions are Qwen's own config, .git/, package.json, CI workflows and a few similar files, which do get checked.
  2. Read-only tools are approved straight away: reading files, search, listing, and read-only shell commands like ls, cat and git log.
  3. Everything else goes to a classifier, which is a call to a language model (your configured fast model, or your main model if you haven't set one). That covers other shell commands, web fetches, sub-agents, MCP tools and edits outside the project. If the classifier says it's safe, it runs.

So in Auto, the agent can rewrite any source file in your project without a prompt, and whether a shell command runs is decided by a model. If your model is a small free one, that's the model making the call.

For a long unattended task in a throwaway branch, that may be exactly what you want. For anything else, you probably want it to ask.

The modes

Mode Edits Shell commands
plan Not made: read-only analysis Not run
default (shown as Ask Permissions) You approve each one You approve each one
auto-edit Approved You approve each one
auto (the default) Approved inside the project A classifier decides
yolo Approved Approved

The mode called default isn't the default any more. Its label in the app is now Ask Permissions, but the value you type is still default.

Make it ask: for this session

Press Shift+Tab (Tab on Windows) to cycle modes; the status bar shows where you are. Or type:

/approval-mode default
Enter fullscreen mode Exit fullscreen mode

That lasts until you quit. The next session starts in Auto again.

Make it ask: every time

Put this in ~/.qwen/settings.json for every project, or .qwen/settings.json in one project:

{
  "tools": {
    "approvalMode": "default"
  }
}
Enter fullscreen mode Exit fullscreen mode

Or pass it when you start:

qwen --approval-mode default
Enter fullscreen mode Exit fullscreen mode

The flag wins over the setting, so you can keep default in your settings and still start a one-off session with --approval-mode auto-edit when you want speed.

If you run Qwen Code in an editor or app

When Qwen Code runs inside another app over the Agent Client Protocol (Zed, JetBrains, and other ACP clients), the same rule applies: each new session starts in Auto unless the app or your settings change it. The app can switch the mode, and many show a picker. If yours doesn't, put --approval-mode default in the agent's arguments, or use the settings file above. Both work over ACP; I checked.

I work on Bellows, a free desktop app that runs Qwen Code, Claude, Codex, Gemini CLI and other ACP agents. I found all this while adding Qwen Code to it. Bellows switches Qwen Code to Ask Permissions when it starts a session, shows each edit and command as a card to allow, and keeps every change as a diff you can put back.

Top comments (0)