Fast local agent work still needs clear safety boundaries.
Polystro is designed for a local desktop environment, but that does not mean every action should run silently. Permission modes, local-only services, runtime scoping, and URL restrictions are part of how the app stays practical without becoming reckless.
Permission Modes
Sessions can run in supervised mode or, where supported, a looser skip-permissions style mode. Supervised mode exists for the moments where the agent needs confirmation before continuing.
Supervised mode
Prompt for approval when the session reaches a gated action instead of letting it continue silently.
Inline resolution
Permission requests appear in the session flow so you can answer without losing context.
Per-session control
Permission mode is chosen in the session context rather than being a one-time global toggle only.
Fail-closed bias
The product favors explicit denial on timeout or loss of the relevant session context rather than assuming approval.
Prompt and Response Flow
The agent flow is normalized so permission requests and user questions can stay visible in the transcript. That lets the desktop shell act as the coordination point instead of forcing every interruption into a separate out-of-band tool.
Desktop Boundaries
Polystro is deliberately scoped to the local machine and known workstream roots. Filesystem access is repo-aware, external URL opening is restricted, and local runtime surfaces are built around the desktop host rather than around arbitrary public exposure.
What users should understand
Why This Is Local-First
The deeper theme is that Polystro is local-first. Routes, terminals, worktrees, services, and viewer sessions all originate from the desktop runtime. Permission and safety features make that local-first model usable for real parallel agent work without turning the app into a black box.