Answer Copilot CLI approvals from your notch

You give Copilot CLI a task, switch to the browser, and come back to find it stopped a minute in, waiting for you to say yes to one command. Crest, a Mac notch app, shows that request on the notch the moment it arrives: Allow or Deny in one click, and one click back to the terminal it came from.

Last updated: September 2026

Published by the makers of Crest. Everything this page says about Copilot CLI was read from GitHub's documentation on 25 September 2026 (listed under Sources at the end) or seen in a live run of Copilot CLI 1.0.88 that day, and everything it says about Crest was read from Crest's own source. Where Copilot already does something on its own, this page says so before it says what Crest adds.

Where a Copilot run waits

Unless you started it with an allow flag, Copilot CLI asks before it runs a command that changes something, edits a file or fetches a page: "Do you want to run this command?" in the terminal, with Yes and No. Read-only commands like ls it runs without asking. The work before that point took a minute. The wait after it lasts until you look at the terminal again, and if the terminal is behind a browser window or on the other display, that can be most of an hour.

That is Copilot doing its job. It asks exactly when it should. The problem is where it asks: one terminal, one window, one screen.

What Copilot already does about it

Copilot CLI has its own ways to get your attention, and you should know them before you pay for anything.

• A beep. The beep setting is described as "Beep when Copilot needs your attention". You hear it if the terminal plays bells and you are near the Mac.
• A marker in the session list. A session that is waiting shows !, "The session needs permission to continue", in Copilot's own list.
• A hook you could wire yourself. Copilot's notification hook fires on permission prompts among other things. It is "Fire-and-forget", so a script of yours could post a macOS notification from it, but it cannot answer.

GitHub's pages describe no macOS notification of Copilot's own. So Copilot can tell you, in its terminal, that it is waiting. What it cannot do is let you answer from where you are. Crest puts the command and the two answers on the notch, on every display, and does the terminal-finding for you.

The request on the notch

A Copilot CLI request on the notch. The pill names the agent and the command. Rest the pointer on it and the sheet opens with Deny and Allow.

When Copilot asks, Crest shows a pill at the notch with Copilot and the command, or the file for an edit. Rest the pointer on it and the sheet opens with Deny and Allow. It stays there until you answer.

• On every display, over fullscreen apps. While a request waits, the pill also appears on displays Crest is not normally on, so an approval on the screen you are not facing is still one you see.
• A chime, a macOS notification and an amber menu-bar icon back it up. The chime and the notification each have a switch in Settings.
• The whole ask before you allow it. Rest the pointer on the pill and a sheet unfolds under the notch with the full command, or the lines an edit changes, who asked and when, and the folder. Nothing is sent to Copilot until you press Deny or Allow.
• In terminal hands the request back: the card folds and Copilot shows its own "Do you want to run this command?", where you answer as usual.

The sheet, here for a Claude Code request. A Copilot request opens the same sheet with Copilot in the header: the full command, or the lines an edit changes, the folder it runs in, Deny and Allow.

One click back to the terminal

Getting back afterwards saves more time than the Allow does. Copilot runs a sessionStart hook when a session begins, and Crest's handler records where that session lives: the tty, the terminal app, the iTerm2 session id and the tmux pane if there is one. With Crest Pro, the session then sits in the Agents widget on Crest's Code page with its folder and what it is doing, and one click jumps you to it.

• In iTerm2 and Terminal.app the exact window and tab is selected. macOS asks once for Automation consent the first time.
• In tmux the pane is found by its tty and selected, then the terminal app comes forward.
• In Tabby, Ghostty, Warp, WezTerm, Alacritty, kitty, Hyper, VS Code and Cursor, the app itself is brought forward, and un-minimized if every window was hidden.

The tab-level jump is iTerm2 and Terminal.app only; everywhere else it is app-level.

What the hook writes, and when it steps aside

Crest uses Copilot's own hook system and nothing else. When you turn on "Allow or deny commands here" in Crest's Settings, under Coding agents, Crest writes one file of its own, ~/.copilot/hooks/crest.json, and only if Copilot has been run on the Mac (its ~/.copilot folder exists). Copilot loads every .json file in that folder, so Crest never needs to open or change your own hook files. crest.json registers one POSIX shell script, copilot-hook.sh in Crest's own Application Support folder, for three events:

• sessionStart records the terminal identity above.
• permissionRequest writes the request where Crest can see it, waits for your answer, then prints Copilot's own decision JSON, behavior: allow or deny. Copilot's default hook timeout is 30 seconds, so Crest registers this one for a day: the request waits for you instead of timing out under you.
• sessionEnd clears any card left over when the session ends.

How it steps aside, because that matters more than how it works:

• If you started Copilot with --yolo, --allow-all, any other --allow-all- flag, or an --allow-tool rule, you asked Copilot to decide, so the hook prints nothing and Copilot's own rules run. The notch never shows those. One gap, said plainly: /yolo typed inside a running session leaves no trace the hook can see, so the notch still asks there.
• If Crest is not running, the hook prints nothing and you get Copilot's usual terminal prompt. The script checks a heartbeat Crest keeps fresh; if it is older than 30 seconds, it steps aside. A quit Crest never stalls a run.
• Turn the switch off and Crest deletes crest.json, and only if the file is Crest's.

There is no trust step to do in Copilot. In our run on version 1.0.88 the hook worked at the next session start, with nothing to approve.

Claude Code and Codex too, on the same switch

If you also run Claude Code or Codex, the same switch installs their hooks, and their requests land on the same notch. Each has its own page: Claude Code approvals in the notch and Codex approvals in the notch. Every agent's sessions sit side by side on the Code page, each with its own jump back.

Set it up

1. Download Crest. Signed and notarized, so macOS installs it without warnings. Copilot support needs Crest 5.1.4 or later.Free tier, no account · 7-day Pro trial, no card · macOS 14 or later
2. Run Copilot CLI once if you never have, so its ~/.copilot folder exists.
3. Open Crest's Settings, go to Coding agents and turn on "Allow or deny commands here". Crest writes the Copilot hook, and the Claude Code and Codex ones if those are installed.
4. Start a new Copilot session, give it a task and switch away. The next approval lands on the notch.

Answering from the notch is free, and the free tier needs no account at all. Crest Pro adds the Agents widget, which lists every running session with what it is doing and takes you to its terminal in one click. Crest Pro, with Take and Minutes, is $24.99 once, or $2.99 a month, and signing in starts a 7-day full-Pro trial with no card, so you can put a real workday through it before paying. Everything, Crest Pro with Take and Minutes, is $24.99 once.

Sources

• GitHub Docs, Hooks configuration. Read 25 September 2026. The hook events, user hooks in ~/.copilot/hooks/ (or $COPILOT_HOME/hooks/), the version 1 JSON shape with timeoutSec ("Default: 30"), permissionRequest firing "before the permission service runs (rules engine, session approvals, auto-allow/auto-deny, and user prompting)", an allow or deny that "short-circuits the normal permission flow", and the notification event, which is "Fire-and-forget".
• GitHub Docs, Configuring GitHub Copilot CLI. Read 25 September 2026. --allow-all-tools, --allow-tool, --deny-tool, --allow-all-paths, --allow-all-urls, "--allow-all, or its alias, --yolo", the /allow-all and /yolo slash commands, and trusted folders kept in config.json.
• GitHub Docs, Changing settings and the CLI command reference. Read 25 September 2026. beep, "Beep when Copilot needs your attention", and the session list marker "! The session needs permission to continue". Neither page describes a macOS notification.
• Crest source, read 25 September 2026: CopilotCLIHook.swift (crest.json, the script, the step-aside, the heartbeat), AgentMonitor.swift (the pending scan, the decision JSON, Copilot sessions), TerminalJumper.swift (the jump back), ApprovalDetailView.swift (the sheet), DeveloperView.swift (the toggle and the In terminal button). And a live run the same day on Copilot CLI 1.0.88: allow, deny, --yolo and --allow-all-tools stepping aside, the sheet, and In terminal handing the request back to Copilot's own prompt.

FAQ

Keep reading: Claude Code in the notch · Codex approvals in the notch · Best Mac notch apps in 2026 · Dynamic Island for Mac · Facts and prices · Crest overview