Guides

How to approve Claude Code and Codex commands before they run

Write a rule for the commands you want to see first, such as git push --force or rm -rf. When an agent tries one, Diana holds it before it runs and asks you, Allow once or Deny, in one place. Everything else runs without interrupting you.

How it works

1. Rules decide what needs you. A rule matches a command and says ask or deny, with a reason, for example “Force-push rewrites history other people may have pulled.”
2. The command is held before it runs. Diana hooks into the agent's own tool calls, so the check happens before the command reaches your shell, not after.
3. You answer once. The request shows the exact command, which task it came from, and what it would do. Allow once, or Deny. The agent is told the answer and carries on.

Rules for you, or for the whole team

Rules can live on your machine or in a repository, so everyone working in that repository gets the same ones. A deny in the repository wins over an allow on one machine.

Which agents

Claude Code and Codex are supported and tested. Gemini CLI is wired up the same way.

Why not just turn off auto-approve?

Because then every command asks, and you stop reading the prompts. Holding only the commands that matter means the ones you see are worth seeing.

Questions