Models, runtimes, and permissions.

Every launch answers four questions: which provider runs it, which model it starts on, how much it may do without asking you, and which of your tools it can see. Model and runtime are set globally, narrowed per launch kind, overridden per run, and pinned per agent inside a flow. Permission mode stops at the run, and the tool list is decided when the session starts.

01Runtimes and modes

Most launches pick a Runtime and a Mode. The Runtime is the provider. The Mode is Chat, the structured in-process lane, or CLI, the terminal lane.

Runtime rowClaude and Codex on a default install. OMP is a third, opt-in provider you install yourself

Mode rowChat or CLI, hidden when the selected provider has no CLI lane on that surface

Runtime labelsClaude SDK · Claude Interactive (CLI) · Codex SDK · Codex (CLI) · OMP · OMP (CLI)

Starting modeFlow runs start on Chat. New quick sessions start on the interactive CLI

A flow launch accepts every provider’s Chat lane plus Claude’s CLI lane. The other terminal lanes are quick-session only, so a Codex flow run shows no Mode row.

Ultracode and design sessions carry no picker: Ultracode always runs on Claude’s interactive CLI, and design sessions are pinned to the Claude SDK.

The Claude SDK runtime needs nothing on your PATH: the Agent SDK binary ships inside the app.
Claude Interactive (CLI) spawns the real claude binary. Cyboflow uses a configured executable path if you set one at Settings → General → Advanced Options → Custom Claude Installation, and otherwise looks on your PATH.
Codex is bundled too, and needs a ChatGPT sign-in before its card reports ready.
Pause and Resume are Chat-only. On a CLI run the Pause button renders disabled.

Each provider has an on/off switch at Settings → Integrations → Agent providers, with rows for Claude Code, Codex, and OMP. Turning one off removes its runtimes from every picker and makes launches that ask for it fail. The last one standing cannot be switched off.

Note Design sessions and visual verification always run on Claude, so turning Claude off turns both of them off with it.

Settings → AI → Feature controls → CLI Runtime decides whether the Chat lane exists at all. Allow SDK is the default and lets you pick per run. Interactive CLI only pins every new run and quick session to Claude Interactive (CLI): the whole runtime picker collapses into a read-only locked row, and Pause and Resume become unavailable.

02Picking a model

The Claude picker carries five pinned rows.

Fable 5.1 · 1MFrontier, most capable

Opus 5 · 1MMore capable. The default for both quick sessions and flow runs

Sonnet 5 · 1MBalanced

Haiku 4.5 · 200KFastest

AutoLet Claude pick the model

Below them sits an Other models group, headed “Also available to your Claude Code login” and fetched live from the bundled SDK.

The composer’s Model pill sets a quick session’s model, and is a live picker only while the session is idle and on Chat.
The launch wizard sets a flow run’s default model, which per-agent pins beat.
Settings → AI → Session settings → Default Launch Model seeds both.
Ultracode launches are the exception: they start on Fable when your account has it.

Fable is the only availability-guarded model. When your account cannot use it the picker grays it out and marks it unavailable, and any run pinned to it falls back to Opus.

That includes mid-run: the pill swaps and a toast says so. No other model is guarded.

Codex and OMP model lists are discovered from the runtime on your machine, so the rows depend on what that CLI reports. Codex adds an Auto/default row whatever it reports, so a Codex session whose catalog comes back empty is left with that one row. OMP has no such row: leaving the model unset is what starts it on its own default.

03Reasoning effort

Reasoning effort sits beside the model, as an Effort pill on an idle quick Chat session and as a Reasoning effort select on the launch wizard’s quick-session card. Both are quick-session controls. A flow launch has no run-level effort setting.

The select needs a runtime that carries the effort flag. The terminal lanes of Codex and OMP do not, and Ultracode pins its own effort, so neither shows it.

Claude’s scale runs low, medium, high, xhigh, and max.
Codex adds none and minimal below those and stops at xhigh.
A flow’s agents get their own reasoning effort field in the workflow step inspector, on programmatic runs only.

04Fast mode

The Fast pill asks for faster Opus output. It does not swap you down to a smaller model.

It is off by default, applies from your next message, and persists on that chat panel rather than on the session, so two chat panels carry the opt-in separately. The composer pill appears only on an idle quick Chat session running Claude with Opus selected.

The launch wizard carries its own Fast mode row for a quick session on either Claude runtime, the interactive CLI included. A flow launch has neither.

Turning it on records a request the CLI can decline, because your account lacks the entitlement or is in a rate-limit cooldown. The pill then shows a warning triangle naming the reason, and a toast says the turn ran at standard speed.

05Where a launch gets its settings

Four rungs decide what a new run starts on. The higher rung wins.

Your pick in the launch wizard
What you change on the Configure step governs that run.
Session type overrides
At Settings → AI → Session settings → Session type overrides, each launch kind can carry its own model, Substrate (the Chat or CLI lane from section 01, Claude only), agent runtime, and permission mode. Reasoning effort is offered on the quick-session row only. A type with no override reads Following defaults.
Global defaults
Directly above that list: Global Instructions, Agent Permission Mode, Default Agent Runtime, Default Launch Model, Workflow Orchestration, Sprint Batch Size, Quick Sessions (own worktree or in place), Quick Session Runtime, and Code Review Eval.
The built-in floor
What ships: Opus, Ask before edits, Chat for flow runs, and the interactive CLI for quick sessions.

The launch wizard’s Save as default stores the current configuration as that launch kind’s default, and the confirmation toast carries an Undo.

06Per-agent pins

Inside a flow, an agent can pin its own runtime and model in the agent editor. Pin the runtime first. Left on inherits run runtime, the editor says the agent inherits the run model and shows no model list at all.

The Runtime select offers the runtimes a flow can launch on, for the providers you turned on: on a default install, Claude SDK, Claude Interactive (CLI), and Codex SDK.
Pinning Claude gives you Fable 5.1, Opus 5, Sonnet 5, and Haiku 4.5, plus inherits run model. A pin beats the run model for that agent and no other.
A non-Claude pin applies to programmatic runs only, since an orchestrated run shares one runtime for the whole flow. Launch any flow whose steps route to Codex while the run is orchestrated and Cyboflow stops, then offers Switch & launch to rerun it as programmatic.
An explicit pin also outranks the flow’s runtime mix.

Every built-in flow’s tuning level already pins models per agent: at Standard, Sonnet runs implement and write tests while Opus runs code review, verify, and the sprint reviews. Thorough moves implement up to Opus and the sprint review to Fable.

07Permission modes

The permission mode decides what an agent may do without a trip through your review queue.

Ask before editsPrompt for each edit

Allow editsAuto-allow edits, safe reads & git

AutoNative Claude classifier

Don’t askNo prompts · skip permissions

Allow edits covers three edit tools, Edit, Write, and MultiEdit, plus Read, Glob, Grep, LS, NotebookRead, and TodoWrite, which either read files or update the agent’s own task list. A Bash call joins them when every segment is provably read-only, or when it matches an allow rule in your own ~/.claude/settings.json (see project trust and repo rules below).

A newline, a redirection, a background &, or a command substitution sends the call to you instead. Each segment of a compound command has to pass on its own, so git status && rm -rf . still asks.

On Claude, Auto hands the decision to the provider’s own classifier rather than making Cyboflow lenient. On the Chat lane a verdict of ask still arrives as a blocking request in your review queue. On the interactive CLI, Cyboflow installs no gate in Auto, so the CLI asks you in the terminal.

On a model with no classifier, which includes any Haiku, Auto falls back to prompting. Cyboflow’s own tools are allowed in Auto without reaching the classifier.

On the Chat lane the agent’s own questions reach you in every mode, Don’t ask included: a question is content, not a permission prompt. On a CLI session you answer it in the terminal.

Ask before edits is the shipped floor, but onboarding pre-selects Auto and tags it Recommended, and your answer is written into the global default. Check or change yours at Settings → AI → Session settings → Global defaults → Agent Permission Mode.

Override it per run in the launch wizard under Session permission, or live from the composer’s permission pill, which applies on your next message and, on a quick CLI session, when the terminal restarts. A flow run on the interactive CLI carries no pill, so change it in the wizard before you launch.

Limit For flow runs and worktree-backed sessions, worktree isolation is the backstop: the agent works in its own checkout, and what it writes there reaches your default branch only when you merge. A quick session started in place is the exception: it works in your checkout, so there the mode is the only limit.

08What the modes mean per provider

The four labels are shared, but the hints under them, and what they enforce, change with the provider.

Codex, ChatAsk before edits: read-only, asks to write · Allow edits: workspace writes, asks when needed · Auto: adds Codex auto-review · Don’t ask: full access, approvals off

Codex, CLIThe same, except Auto reads “Currently same as Allow edits”

OMP, ChatAuto is “Allow unless risky · asks for hazards”, and Don’t ask hands the decision to OMP, which runs approval-free

Where the prompts land matters more than the wording. Claude SDK, Claude Interactive (CLI), Codex SDK, and OMP on Chat route approvals into the Cyboflow review queue. The exception is the interactive CLI in Auto, where Cyboflow installs no gate and the terminal asks. The Codex and OMP terminal lanes keep their prompts in their own terminal.

09Project trust and repo rules

The first time you add or activate a project whose .claude/settings.json or settings.local.json carries permission allow rules, a dialog headed Trust project permission rules? asks what to do with them. The buttons are Trust This Project and Don’t Trust, and Don’t Trust is both the default and what Escape picks.

Until a project is trusted, its allow rules grant nothing. Only your own ~/.claude/settings.json can auto-approve anything. A repo can still narrow what runs: deny and ask rules are honoured either way.

Change the answer later in project settings under Project permission rules, which offers Undecided (ask next time), Trusted, and Untrusted. Undecided puts the dialog back on your next activation.

10MCP servers and plugins

Which MCP servers and plugins a session loads is a start-time decision. Both live in the launch wizard’s Advanced section, on Claude quick and Ultracode launches, as the rows MCP servers, headed “Disable servers this session should not load”, and Plugins.

Every discovered MCP server starts on. Plugins start in whatever state your own Claude Code config has them.

The first-party cyboflow server cannot be turned off. It is how agents read the backlog, file findings, open human gates, publish artifacts, and request verifications, and it is injected into every Chat session, quick chats included.

Cyboflow reads your MCP servers and plugins from your own CLI config and never edits them. The Workflows gallery lists both, read-only.