docs: document CLI tool permissions and headless mode behavior

- Add info callouts explaining tool permission levels (allow/ask/exclude)
- Document differences between TUI and headless mode tool availability
- Clarify that 'ask' permission tools are excluded in headless mode
- Provide guidance on choosing between TUI and headless modes
- Reference PR #8416 implementation

Fixes CON-4622

Generated with [Continue](https://continue.dev)

Co-Authored-By: Continue <noreply@continue.dev>
Co-authored-by: Username <nate@continue.dev>

Author: 3 people

docs/cli/overview.mdx

@@ -77,6 +77,21 @@ cn -p "Update documentation based on recent code changes"
 - **CI/CD and pipeline integration**
 - **Git hooks and automated workflows**
 
+<Info>
+  **Tool Permissions in TUI vs Headless Mode**
+
+  Continue CLI tools have three permission levels:
+  - **allow**: Executes automatically without confirmation
+  - **ask**: Prompts for user confirmation before execution (e.g., `writeFile`, `runTerminalCommand`)
+  - **exclude**: Tool is not available to the AI
+
+  **In headless mode**, tools with "ask" permission are automatically excluded to prevent the AI from seeing tools it cannot call. This ensures reliable automation without user intervention.
+
+  **In TUI mode**, tools with "ask" permission are available and will prompt for confirmation when the AI attempts to use them.
+
+  💡 **Tip**: If your workflow requires tools that need confirmation (like file writes or terminal commands), use TUI mode. For fully automated workflows with read-only operations, use headless mode.
+</Info>
+
 ### Development Workflow: TUI → Headless
 
 <Tip>

docs/cli/quick-start.mdx

@@ -121,6 +121,16 @@ cn -p "Update version numbers and create release branch"
 ✅ **Git hooks** for automated checks  
 ✅ **Scheduled tasks** that run unattended
 
+<Info>
+  **Tool Permission Differences Between Modes**
+
+  Tools requiring user confirmation ("ask" permission) like `writeFile` and `runTerminalCommand` are:
+  - **Available in TUI mode** - AI can use them with your approval
+  - **Excluded in headless mode** - AI cannot see or call them
+
+  This prevents the AI from attempting operations that require user interaction when running in automated environments. Choose TUI mode if your workflow needs tools that modify files or run commands.
+</Info>
+
 ### Available Slash Commands
 
 Common slash commands available in CLI: