How approvals reach your phone
Claude Code and Codex each have their own permission system. Tweety Bird plugs into both: every permission request either agent raises comes to your Mac's Tweety Bird first. It checks the repo's policy. If the policy says it can run, it runs with no message. If not, your phone gets the request with the command or the diff and three buttons:
- Approve runs it this once.
- Deny stops it, and the agent is told you said no.
- Always runs it now and approves the same command in this repo from then on.
On apps without buttons, reply "yes", "no", or "always". Only a paired account can approve. A request with no answer for 30 minutes is denied.
The three modes
| Mode | What runs on its own | What waits for your tap |
|---|---|---|
ask | Reads: files, search, git status and log, listing. | Every edit, every command, every network call. |
safe (default) | Reads, tests, lint, builds, local edits, branch pushes and PRs, browsing. | Money, prod, messaging, deletes, publishing, secrets. |
open | Everything. | Nothing. Only for repos where that is truly fine. |
What "safe" always holds for your tap
- Deletes:
rm -r,rm -f, patches that delete files,git reset --hard,git clean -f,git branch -D, destructive SQL (DROP,TRUNCATE,DELETE FROM). - Prod and publishing: pushes to main, master, production, or release, force pushes,
npm publish, Vercel, Netlify, Wrangler, gcloud, AWS, Fly, Heroku deploys, kubectl and helm changes,terraform apply,docker push,gh pr merge,gh release create. - Money: anything touching Stripe, PayPal, Braintree, or Plaid. In the browser, clicks and typing on buttons or fields labelled pay, buy, checkout, send, post, delete, and similar.
- Messaging people: mail, Twilio, iMessage, Slack and Discord webhooks, Telegram bot calls.
- Everything with elevated reach:
sudo,curl | sh, POST, PUT, PATCH, or DELETE with curl, keychain access, unloading launch agents.
Change it per repo
From the thread, in the repo you want to change:
/policy shows the current mode and what each one means
/policy ask
/policy safe
/policy openPolicy is stored per working folder. The default for new folders is safe.
How each agent is run
- Claude Code runs headless with Tweety Bird as its permission-prompt tool, so each permission request is routed through the policy above.
- Codex runs through its app server with its sandbox on (read-only in
ask, workspace-write otherwise) and asks before leaving the sandbox. Those requests go through the same policy.
The flag we do not use
Tweety Bird never runs an agent with --dangerously-skip-permissions or Codex's bypass flag. A phone bridge running with that flag turns every text into unrestricted code execution on your Mac. open mode is the closest thing, it is per repo, and you choose it on purpose.