Codex and Command Approvals

Before certain higher-risk shell commands run — whether you typed them yourself or an agent like Codex proposed them — Deputy Shell can require your explicit approval first.

What triggers an approval

By default, Deputy Shell flags patterns like package installs (npm install, pip install), piping a downloaded script straight into a shell, git clone, making a file executable, running scripts, editing sensitive configuration files, and commands that could expose credentials. Deputy Shell also always blocks attempts to modify its own curated runtime tools directly (for example, trying to upgrade the bundled Node.js or Codex version from inside the terminal) — that only happens through app updates.

Where approval prompts appear

Approval prompts appear inside the active Deputy Shell session, where you review and respond to them directly. The current release does not send a separate background notification alerting you that an agent is waiting for approval — if you've left the app, you'll need to return to the session to see and respond to a pending prompt.

What to review before approving

• What the command or agent action will actually do, not just its stated intent.
• Whether it touches files or paths you didn't expect.
• Whether it will send data somewhere over the network.

Your responsibility

Agent-generated commands and code can be incorrect. Approving an action means you're choosing to run it — review it the way you would review a command a colleague asked you to run for them, and keep backups of anything you can't afford to lose.