Command approval

Every command the AI wants to run appears in full and waits. Three buttons end that wait, and the middle one changes more than this one call.

What happens to one commandThe AI asks to run a command. The chat's setting decides: with Never ask or Auto-accept edits it runs without a question; with Allowlisted commands only it runs if every part of the command is on your list; otherwise it is shown in full and waits. You can approve once, approve and switch the chat to Auto-accept edits, approve and add the pattern to your allowlist, or deny. With no answer in five minutes the request expires. A command that runs keeps its exit code and output in the chat.Never ask, Auto-accept editsAllowlisted: every part is onyour listAsk every time, or not on thelistApprove, Always in this chat,Always allowDenyno answer in 5 min1. The AI asks to run acommand2. The chat's setting decides3. Shown in full,waits for you4. The command runsexit code and outputstay in the chatDeniedthe model gets[denied by user]Request expiresthe assistant stopsand sums up
A command only waits for you when the chat's setting and your allowlist do not already allow it.
Diagram as text
  1. The AI asks to run a command.
  2. The chat's setting decides what happens next: Ask every time, Allowlisted commands only, Auto-accept edits or Never ask.
  3. With Never ask or Auto-accept edits, the command runs without a question.
  4. With Allowlisted commands only, it runs if every part of the command is on your list. Commands with $(...), backticks, redirection or a backslash always ask.
  5. Otherwise the command appears in full and waits. Approve runs it once, as you typed it if you edited the text.
  6. Always in this chat runs it and switches the chat to Auto-accept edits. Always allow runs it and adds a pattern to your allowlist.
  7. Deny refuses and returns [denied by user] to the model. With no answer in 5 minutes the request expires and the assistant stops and sums up what is left.
  8. A command that runs keeps its exit code and output in the chat.

What you see when it stops

waits here

the command, in full

When the command can be edited, that box is a text field. Change the text, press Approve, and what runs is what you typed.

Approve Always in this chat Deny

A line here says what Always in this chat does: it ends the questions for the whole chat. A chat has four settings: Ask every time, Allowlisted commands only, Auto-accept edits and Never ask.

Approve
Runs it once.
does more than this callAlways in this chat
Switches the whole chat to Auto-accept edits, so every later tool runs without asking. Change it back under the chat's settings.
Deny
Refuses and returns [denied by user] to the model.
Deny is not next to Approve, so a destructive command is never one mis-tap away.

fewer questions

The command allowlist

Set a chat to Allowlisted commands only and commands on your list run without asking. Everything else still waits for you. When a command asks, Always allow approves it and adds a pattern to the list. Edit the list under Settings, Command allowlist; it applies to all your chats.

how a pattern matches

  • npm test allows exactly that command
  • npm run:* allows that start with any arguments
  • in a chained command (; && || |), every part must be on the list
  • $(…), backticks, redirection and \ always ask

if you do not respond

The request expires

After five minutes, the pending request expires. The assistant stops and reports what remains undone.

after it runs

In the chat

A command that runs keeps its exit code and output in the chat.

a command card holds

  • the command
  • its exit code
  • its output