Running commands

bash is the most general tool tCode has access to: it can run anything an ordinary shell command could, running your test suite, installing a dependency, checking git status, formatting a file, or something far more specific to your own project's tooling.

That generality is exactly why it is never allowed to run without your approval first: a shell command's real behavior is defined entirely by its literal text, and there is no way to summarize intent that would be reliably safe to skip reviewing.

The exact command is always shown to you in full, unabbreviated, before it executes, which is what the permission prompt described in Permissions and safety is actually showing you for a bash call specifically.

Each bash call is a single, one-shot command execution, not an interactive shell session the model can keep typing into across multiple exchanges. It runs, returns its output, and that call is complete; the next command, if one is needed, is a fresh call of its own.

This one-shot design is what keeps every individual command reviewable on its own terms at the permission prompt; there is never a standing shell session running in the background whose later commands you did not get to see approved individually.