Approvals
Answer the agent's permission prompts from the Parallax window, and see what is kept on disk.
There are two separate things here. Pick the one you want, or both.
Strict approvals: gate Parallax's own tools
setup <agent> --strict-approvals makes the tools that act (tap, type, swipe, open URL, launch, reload, run command) wait for you. Each call becomes a card in the window's Approvals tab with Deny and Allow. When the window is not running, those tools fail with a clear error instead of running. Details and limits are in Install.
Answer the agent's own prompts from the window
setup <agent> --answer-approvals installs one more PermissionRequest hook entry, with its own diff and question. When the agent is about to ask you whether it may run a tool (a file write, a shell command, an MCP tool), the window shows a card with:
- the agent, and the tab (or the thread and folder);
- the tool, and one identifying field: a file path, or the first 200 characters of a command, scrubbed of obvious secrets and kept in memory only.
Your Allow or Deny goes back to the agent. The card is held for up to 100 s.
In every other case the agent's own prompt appears exactly as before: the window is closed or has no open window, the card expires, you answer in the terminal, the session is in a mode that asks nothing, or anything fails. An unanswered card says "The agent will ask you in its own terminal." Claude Code shows its own prompt in the terminal at the same time, and the first answer wins. Codex shows nothing of its own while the card waits.
An Allow from the window replaces your terminal prompt, so install this only if you want that. --hook alone installs the observe-only entry, which answers nothing.
setup <agent> --undo --answer-approvals removes only the answering entry. On Codex the changed hook needs review again: open /hooks and trust it. doctor has an answer_hooks row.
Which modes can be answered
| Agent and mode | Card in the window |
|---|---|
| Claude Code, default | Yes (MCP tools, file writes, shell commands) |
| Claude Code, plan mode | No. The only request is the plan approval, which stays Claude's own dialog |
| Claude Code, acceptEdits | Yes, for what the mode does not already allow (MCP tools, shell commands) |
| Claude Code, auto, dontAsk, bypassPermissions | No card can appear: Claude sends no permission request. The session says so, for example "Auto mode: Parallax cannot ask for this agent's file and shell requests". To get cards, start Claude Code with claude --permission-mode default. Only strict mode protects Parallax's own tools there |
| Codex, default ("Ask for approval") | Yes, for MCP tool prompts and shell escalations (writes inside the workspace ask nothing) |
| Codex, plan mode | Yes, for MCP tool prompts |
| Codex, "Approve for me" | A card can appear: the hook fires before Codex's own reviewer decides |
Codex 0.164 to 0.166: no approval prompt in the terminal
When Codex calls a Parallax tool from its code mode and needs an approval, its terminal may show no prompt at all: the call stays at "Calling parallax.<tool>" until you press Esc. It happens with or without Parallax's hooks; it is how Codex's terminal UI behaves, not something the hook causes. With the Parallax app open and setup codex --answer-approvals, the card in the window answers it. Without the app, approve Parallax's tools in Codex's own settings (default_tools_approval_mode under [mcp_servers.parallax] in ~/.codex/config.toml) if you accept that, or press Esc. Claude Code is not affected: with the window closed its own prompt appears at once.
Under Codex's shared daemon the card cannot name the tab (see the Codex note); it names the thread and the folder. With strict approvals on, the acting Parallax tools are held by Parallax's own card and are not mirrored a second time.
What is kept on disk
Two files in the Parallax state folder, readable only by you:
approvals.json, the Decisions list, kept 30 days: time, agent, tool name, the decision, and who decided (card, timeout, no window, answered elsewhere, agent left). No arguments, no file path, no command text.activity.json, the activity list across a restart, kept 24 hours or 5,000 entries: tool, outcome, duration, client label. No screenshots, no log text, no tab.
The text of a mirrored card is never saved. Clear history in the session list removes both files and what is in memory.
A speed bump, not a sandbox
Approvals protect against an agent that uses the Parallax tools or goes around them to the core. They do not stop a process of your own macOS user that is out to defeat them. See Install.