Permissions

Claude asks before it acts. In Vitrino the asking is a card pinned to the bottom of the transcript, and it is the one part of the interface designed to be impossible to skim past.

What a card shows

A permission card cannot be collapsed and does not scroll away. It stays until you answer, and it shows what will actually happen — not a summary of it:

For a command, the whole command. Never a shortened form of it.
For an edit, the diff it would make.
For a new file, the contents it would write.
For a fetch, the URL, and what Claude means to ask of the page.
For anything else, every argument, in full.

Whatever the tool, All arguments opens the complete raw input. A card never truncates the thing you are being asked to approve.

A permission card for a shell command. The risky part is marked, and the command is never shortened.

Commands worth a second look

Some shell commands are marked: deleting recursively, escalating privilege, piping a downloaded script into a shell, force‑pushing. The risky part of the command is highlighted within it and named in plain words above it.

This is presentation only. The choices are the same, in the same order — a pattern match is nowhere near good enough to justify making a button harder to reach. It is there so a dangerous command cannot look like every other one.

An edit is shown as the change it would make, not the arguments that describe it:

A permission card for an edit: you approve the change, not the arguments.

Your choices

Choice	What it does
Allow	Runs this, once.
Always allow	Runs this and saves a rule so you are not asked again.
Deny	Refuses, and Claude carries on and tries something else.
Deny and stop	Refuses and ends the turn — the equivalent of `Esc` in the terminal.
Add a reason	Tells Claude why, or what to do instead. Works with either Deny.

Always allow lists exactly what it will save and where before you press it — which rules, in which settings file. Nothing is written that you have not been shown.

Bash

git status

“Always allow” also saves

Always allow Bash(git status:*)This project, everyone (.claude/settings.json)

“Always allow” lists exactly what it would save, and where, before you press it.

Important

Permission decisions deliberately have no keyboard shortcut. Approving tool use takes a deliberate click, so it cannot be fired by muscle memory.

A tool Vitrino has no card for still shows everything it was asked to do:

A tool with no card of its own still shows every argument, in full.

Permission modes

The mode chip beside the message box changes how much Claude asks. These are Claude Code's own modes, described in its words:

Mode	Behaviour
Ask before acting (default)	Prompts before operations that need permission
Accept edits	Accepts file edits without asking
Plan mode	Plans only; no actual tool execution
Auto	A model classifier approves or denies permission prompts
Don't ask	Never prompts; denies anything not already allowed

Claude Code's bypassPermissions — approve everything, unconditionally — is not offered.

Mode is per session. Changing it in one tab does not change another.

Rules you already have

Vitrino reads the permission rules in your project and user settings exactly as Claude Code does, so anything you have already allowed stays allowed. See Project configuration.

When you are not looking

If Claude needs you and its window is not focused — or not open — Vitrino posts a system notification naming the project and what is wanted. Clicking it opens that window. Only waiting states notify; finished turns and background work do not. You can turn this off in Settings → Notifications.

Writing messages covers the other half of the conversation.