Approve tool calls from your notch. See every active agent at a glance. Pick options without leaving your terminal. Auto-approve safe tools; the danger detector always forces a human gate on destructive commands.
$ git reset --hard HEAD~5
Built for people who run agents all day and don't want to babysit them — but also don't want a hard-coded auto-approve on a `rm -rf`.
Permission cards drop straight out of the macOS notch with file paths, diffs, plan markdown, and Approve/Deny buttons.
Multi-choice tool prompts become clickable buttons. Your pick is typed into the right terminal automatically.
Every active agent gets a card in the popover, filterable by project or source. Jump back to its terminal with one click.
Global toggle, per-tool allow-list, and "always allow this tool" inline on the approval card. Destructive Bash never auto-approves.
rm -rf, dd, curl|sh, force-pushes, SQL drops, fork bombs — all force a human gate with a red warning banner.
Bridge talks to the app over /tmp/agentisland.sock. History as plain JSONL. No analytics, no SDK, no phone-home.
Four moving parts, one user-facing surface.
Claude Code (or any agent that speaks the hook contract) calls a tool. agentisland-bridge intercepts.
JSON-RPC over a local UNIX socket. No network, no daemon, no auth ceremony — same user, same machine.
The card surfaces in your notch. Click ✓, click ✗, or let auto-approve handle it. Danger patterns always wait for you.
Decision flows back as permissionDecision. Claude honors it natively; no glue code in your prompts.
Built around Claude Code's hook contract today. Adapter layer ready for more.
/tmp/agentisland.sock with mode 0600. There's no analytics SDK and no crash reporter.PreToolUse hook in ~/.claude/settings.json that pipes each tool call through a local bridge. The app holds the request, waits for your decision (or for auto-approve to fire), and returns hookSpecificOutput.permissionDecision which Claude Code honors natively../scripts/setup-signing-identity.sh once. macOS TCC binds Accessibility/Automation grants to a stable codesign identity; without one, every ad-hoc rebuild rotates the hash and invalidates the grant.DangerousCommand.swift matches a list of patterns (rm -rf, dd, mkfs, curl|sh, git reset --hard, force pushes, SQL drops, fork bombs, and more). Matching commands always wait for a human, regardless of your auto-approve setting.session_id, with a filter bar in the popover to scope by project or source.