— 03 / 第三章

循环 · 计划、动手、验收.

这一章不讲循环,带你跑一次:一个真实的报错,从 /plan 拿到方案、改计划、放它动手、审 diff、验收通过。中途把权限模式六档和 allow / deny / ask 规则的写法讲透 —— 那是决定它「哪些事不用问你」的旋钮,也是全书后面所有放手的前提。跑完你手里有一份能复用的计划请求模板和一份权限配置。This chapter doesn't explain the loop — it runs one with you: a real error, from asking /plan for an approach, editing that plan, letting it act, reading the diff, to accepting the result. Along the way it pins down the six permission modes and the exact syntax of allow / deny / ask rules — the dial that decides what it never has to ask you about, and the precondition for every act of letting go later in the book. You finish holding a reusable planning template and a permissions block.

11 分钟 · 初稿 2026.07 · v2 2026.08

MD 海报

这一章不讲循环,带你跑一次。任务用你自己仓库里一个真实的报错 —— 有栈、能复现、改完能验证的那种。跑完你会得到三样东西:一份能复用的计划请求模板、一份写进仓库的权限配置,和一次亲手验证过的倒带。中间穿插的每一条规则,都是为了让下一次这条线更短。

— I

第一步:让它先交方案,不许动一个字.

计划模式是循环的第一格。进入之后,Claude 只做三件事:读文件、跑探索命令、写出一份「我打算怎么做」—— 在你批准之前,任何编辑都被挡在门外。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.三种进入方式:会话里按 Shift+Tab 循环切换、单条 prompt 前加 /plan、或启动时 claude --permission-mode plan。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.Plan mode is the loop's first cell. Inside it, Claude does three things only: reads files, runs exploration commands, and writes out how it intends to proceed — and until you approve, every edit stays blocked.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. Three ways in: cycle with Shift+Tab, prefix a single prompt with /plan, or launch with claude --permission-mode plan.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. 这份被你改过、批过的计划,不只是开工许可 —— 它是第 10 章验收时的基线:活交回来,diff 就对着它逐条核。所以计划请求本身值得写好:说清目标,更要说清验收标准和禁区。

/plan 我要做:<一句话目标>。
先读 <相关目录或文件>,把打算怎么做写成计划,包括:要改哪些文件、为什么。
验收标准:<能检验的标准,做完要能通过>。
禁区:<不许动的目录 / 不许引的依赖 / 不许做的重构>。
拿不准的地方列成问题问我,别自己猜。/plan I want: <one-sentence goal>.
Read <relevant dirs or files> first, then write a plan: which files change and why.
Acceptance criteria: <a checkable standard the result must pass>.
Off-limits: <directories not to touch / dependencies not to add / refactors not to do>.
List open questions instead of guessing.

/plan 我要做:修掉 POST /api/orders 在并发下偶发的 500。
先读 src/api/orders/ 和 src/db/,把打算怎么做写成计划,包括:要改哪些文件、为什么。
验收标准:npm test -- src/api/orders 全绿,并新增一条并发重现用例,该用例在修复前必须失败。
禁区:不动数据库 schema,不新引依赖,不重构 src/db/pool.ts 的连接池实现。
拿不准的地方列成问题问我,别自己猜。/plan I want: fix the intermittent 500 on POST /api/orders under concurrency.
Read src/api/orders/ and src/db/ first, then write a plan: which files change and why.
Acceptance criteria: npm test -- src/api/orders passes, plus one new concurrency repro case that must fail before the fix.
Off-limits: no schema changes, no new dependencies, no refactor of the pool implementation in src/db/pool.ts.
List open questions instead of guessing.

计划出来别急着点头。按 Ctrl+G 能把它整份丢进你的外部编辑器1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. —— 删掉过度设计的那段、补上它漏掉的边界情况,再让它照改好的版本动手。这一下是整条线上性价比最高的动作:改一行计划,比改十行代码便宜。When the plan lands, don't nod it through. Ctrl+G drops the whole thing into your external editor1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. — delete the over-engineered section, add the edge case it missed, then let it act on the corrected version. This is the highest-leverage move on the whole line: editing one line of plan is cheaper than editing ten lines of code. 计划也有成本,别处处开。官方的判断尺很好用:方案不确定、改动跨多个文件、代码不熟 —— 值得计划;一句话能说清那个 diff 的活,直接干。4注 4Claude Code Docs · Best practices —— 推荐工作流:探索、计划、实现、提交四步;计划在方案不确定、改动跨多文件、代码不熟时最值,「如果一句话能说清那个 diff,跳过计划」。跑偏时尽早纠:Esc 打断、同一问题纠正两次仍不对就 /clear 带着教训重开。截至 2026-08-05。Claude Code Docs · Best practices — the recommended workflow: explore, plan, implement, commit; planning pays most when the approach is uncertain, the change spans files, or the code is unfamiliar — 'if you could describe the diff in one sentence, skip the plan.' Course-correct early: Esc to interrupt, and after two failed corrections on the same issue, /clear and restart with what you learned. As of 2026-08-05.改个错字还要走审批,是把仪式当成了纪律。Planning has a cost too — don't run it everywhere. The official yardstick works: uncertain approach, multi-file change, unfamiliar code — plan it; if one sentence describes the diff, just do it.4注 4Claude Code Docs · Best practices —— 推荐工作流:探索、计划、实现、提交四步;计划在方案不确定、改动跨多文件、代码不熟时最值,「如果一句话能说清那个 diff,跳过计划」。跑偏时尽早纠:Esc 打断、同一问题纠正两次仍不对就 /clear 带着教训重开。截至 2026-08-05。Claude Code Docs · Best practices — the recommended workflow: explore, plan, implement, commit; planning pays most when the approach is uncertain, the change spans files, or the code is unfamiliar — 'if you could describe the diff in one sentence, skip the plan.' Course-correct early: Esc to interrupt, and after two failed corrections on the same issue, /clear and restart with what you learned. As of 2026-08-05. Routing a typo fix through approval mistakes ceremony for discipline.

— II

第二步:六档模式,定它的自由度.

批准计划后它开始动手,而「动手时哪些事要问你」由权限模式决定。六档从紧到松:

配置值	不问就能做	适合
`default`	只读操作(界面里叫 Manual)	敏感代码、刚上手
`acceptEdits`	文件编辑,外加 mkdir / touch / rm / rmdir / mv / cp / sed	你事后看 diff 的日常活
`plan`	只读操作	动手前的调研
`auto`	几乎全部,独立分类器在每个动作前把关	方向可信的长任务
`dontAsk`	只有预批准项;其余一律自动拒绝	锁死的 CI 与脚本(第 9 章)
`bypassPermissions`	几乎一切,且不能会话中途进入	只在隔离容器 / VM 里用

— 注意

三条容易吃亏的细节。其一:Shift+Tab 默认只在 default → acceptEdits → plan 三档之间循环,dontAsk 从不出现在循环里,只能用 --permission-mode dontAsk 指定。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.其二:bypassPermissions 不能中途切入,必须启动时就启用。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.其三 —— 也是最该记住的 —— 即便在 bypassPermissions 里,显式 ask 规则、组织设为 ask 的 connector 工具、标了 requiresUserInteraction 的 MCP 工具,以及 root 或 home 目录里的删除,仍然会弹窗。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.「全放行」从来不是字面意思。Three details that cost people. First: Shift+Tab cycles only default → acceptEdits → plan by default; dontAsk never appears in the cycle and must be set with --permission-mode dontAsk.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. Second: bypassPermissions can't be entered mid-session — it has to be enabled at launch.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. Third, and worth memorizing: even inside bypassPermissions, explicit ask rules, connector tools your organization set to ask, MCP tools marked requiresUserInteraction, and deletions in root or home still prompt.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. 'Allow everything' was never literal.

日常的甜点位是 acceptEdits:文件随它改,你看最终 diff —— 逐个批编辑的第十次点击之后,你其实已经不在审了。要走得更远用 auto:不是全放行,而是有一个独立的分类器模型在每个动作前把关;它还有两个自我保护的设计 —— 进入 auto 时会主动丢弃那些授予任意代码执行的宽 allow 规则(退出再恢复),以及连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.The everyday sweet spot is acceptEdits: let it edit freely and review the final diff — by the tenth per-edit approval you weren't really reviewing anyway. To go further, use auto: not a blanket pass, but a separate classifier model screening every action; it also carries two self-protections — on entry it drops broad allow rules that grant arbitrary code execution (restoring them on exit), and after 3 consecutive or 20 total blocks it falls back to prompting, with thresholds you can't configure.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.

— 补充

auto 档的可用性取决于你的套餐、组织策略、模型与供应商,不是人人都有。1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05.看不到就当它不存在,用 acceptEdits 加下一节的规则,效果差不了多少。走兼容端点的读者尤其注意:模型识别与供应商都在可用性条件里(第 2 章)。Auto mode's availability depends on your plan, your organization's policy, the model, and the provider — not everyone has it.1注 1Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. If you don't see it, treat it as absent: acceptEdits plus the next section's rules gets you nearly the same place. Readers on a compatible endpoint should note especially that model recognition and provider are both in those conditions (chapter 2).

— III

第三步:把「不用问我」写成规则.

模式是粗调,规则是细调。跑完上面那轮,数一数它问了你几次 —— 那几次就是该写成规则的候选。规则住在 settings 文件的 permissions 块里,三种裁决:allow(不问)、ask(必问)、deny(不许)。Modes are the coarse dial; rules are the fine one. After that first run, count how many times it asked you — those are your candidates. Rules live in a settings file's permissions block, with three verdicts: allow (never ask), ask (always ask), deny (never allowed). 求值顺序是这套规则唯一必须背下来的东西,官方原话:按 deny、ask、allow 的顺序求值,该顺序里第一个命中决定结果,规则的具体程度不改变顺序。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.推论很重要:一条宽 deny 不能带白名单例外 —— Bash(aws *) 拦死之后,再写多细的 Bash(aws s3 ls) allow 都没用。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.The evaluation order is the one thing you must memorize, verbatim: rules are evaluated deny, then ask, then allow; the first match in that order decides, and specificity doesn't change the order.2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05. The corollary matters: a broad deny cannot carry allowlist exceptions — once Bash(aws *) blocks, no Bash(aws s3 ls) allow, however specific, gets through.2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.

.claude/settings.json

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm test *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr merge *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(rm -rf /*)",
      "Bash(curl * | sh)"
    ]
  }
}

一份可抄的起手权限配置:放行日常、拦死危险、可疑的必问

四条写规则的手艺,每条都能省你一次事故:

星号前那个空格是有意义的: Bash(ls *) 匹配 ls -la,但不匹配 lsof;Bash(ls*) 两个都匹配。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.少打一个空格,你就把一个完全不同的命令放行了。Bash(ls *) matches ls -la but not lsof; Bash(ls*) matches both.2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05. Drop that space and you have just approved a completely different command.
复合命令逐段过筛: 识别的分隔符是 &&、||、;、|、|&、& 和换行,规则必须对每个子命令独立命中;批准一条复合命令时最多保存 5 条规则。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.The recognized separators are &&, ||, ;, |, |&, &, and newlines, and a rule must match each subcommand independently; approving one compound command saves at most 5 rules.2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.
包装器会被剥掉,运行器不会: 匹配前会剥掉 timeout、time、nice、nohup、stdbuf 等固定包装 —— 所以 Bash(npm test *) 也盖得住 timeout 30 npm test。但 npx、docker exec、devbox run 这类不在剥离之列,文档给的原例够吓人:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.A fixed wrapper set — timeout, time, nice, nohup, stdbuf — is stripped first, so Bash(npm test *) also covers timeout 30 npm test. But npx, docker exec, and devbox run are not on that list, and the docs' own example is chilling: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf ..2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.
deny 和 ask 能盯参数,allow 不能: 用 Tool(param:value) 匹配顶层标量入参,例如 Agent(isolation:worktree)、Bash(run_in_background:true);一条规则只管一个参数,模型没传的参数永不命中。主内容字段盯不了 —— Bash 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.Match a top-level scalar parameter with Tool(param:value) — say Agent(isolation:worktree) or Bash(run_in_background:true); one parameter per rule, and a parameter the model omits never matches. Primary content fields can't be watched this way: Bash's command, Read / Edit / Write's file_path, Grep / Glob's path.2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.

— 实践提示

还有一手清场的写法:在 deny 里写裸工具名,会把那个工具整个从 Claude 的上下文里移除 —— 它根本看不见,自然不会尝试。Bash(*) 等同于裸 Bash。2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05.给「只该读不该写」的场景用它,比逐条拦干净得多。One more move worth knowing: a bare tool name in deny removes that tool from Claude's context entirely — it never sees it, so it never tries. Bash(*) is equivalent to bare Bash.2注 2Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05. For read-only-by-design situations this is far cleaner than blocking case by case.

— IV

第四步:验收,以及那条退路.

活交回来了。验收只做两件事:对着计划核 diff(要求都实现了吗、点名的边界情况有测试吗、范围之外的东西动了没有),和看它交的证据(测试输出,不是「我搞定了」)。完整的验收工作流在第 10 章,这里先把最小版本跑完。验收敢严,是因为错了能倒回。/rewind,或者输入框为空时连按两次 Esc,打开倒带菜单:只恢复对话、只恢复代码、或两者一起回到任一节点。3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05.(输入框里有字时,双击 Esc 只是清空文本 —— 文本会进历史,按 Up 能召回。3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05.)checkpoint 随对话保存,续开会话后照样能倒。3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05.Review can afford to be strict because mistakes can be rewound. /rewind, or two taps of Esc while the prompt input is empty, opens the menu: restore conversation only, code only, or both, to any point.3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05. (With text in the input, a double Esc just clears it — the text goes to history, recallable with Up.3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05.) Checkpoints are saved with the conversation, so a resumed session can still rewind.3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05.

— 注意

倒带的边界要记牢:它只追踪本次会话内、经 Claude 文件编辑工具做的改动 —— Bash 命令删掉的文件、你自己在编辑器里的手改、其他并发会话的改动,都倒不回来;软链接和硬链接路径会被直接跳过。3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05.git 该提交还是提交:checkpoint 是本地撤销,不是历史。Hold the boundary firmly: rewind tracks only edits made through Claude's file-editing tools within this session — files a bash command deleted, your own edits in an editor, and changes from other concurrent sessions cannot be restored; symlinked and hard-linked paths are skipped outright.3注 3Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05. Keep committing to git — a checkpoint is local undo, not history.

倒回之外还有两个更轻的纠偏动作:Esc 随时打断、补一句再继续;同一个问题纠正两次还不对,说明上下文里已经堆满失败尝试 —— /clear 清场,把学到的教训写进新的第一句,几乎总比在旧会话里继续拉扯更快。4注 4Claude Code Docs · Best practices —— 推荐工作流:探索、计划、实现、提交四步;计划在方案不确定、改动跨多文件、代码不熟时最值,「如果一句话能说清那个 diff,跳过计划」。跑偏时尽早纠:Esc 打断、同一问题纠正两次仍不对就 /clear 带着教训重开。截至 2026-08-05。Claude Code Docs · Best practices — the recommended workflow: explore, plan, implement, commit; planning pays most when the approach is uncertain, the change spans files, or the code is unfamiliar — 'if you could describe the diff in one sentence, skip the plan.' Course-correct early: Esc to interrupt, and after two failed corrections on the same issue, /clear and restart with what you learned. As of 2026-08-05.Beyond rewinding, two lighter corrections: Esc interrupts anytime — add a sentence and continue; and when the same issue survives two corrections, the context is piled with failed attempts — /clear the slate and fold the lesson into a fresh opening line, which almost always beats wrestling on in the old session.4注 4Claude Code Docs · Best practices —— 推荐工作流:探索、计划、实现、提交四步;计划在方案不确定、改动跨多文件、代码不熟时最值,「如果一句话能说清那个 diff,跳过计划」。跑偏时尽早纠:Esc 打断、同一问题纠正两次仍不对就 /clear 带着教训重开。截至 2026-08-05。Claude Code Docs · Best practices — the recommended workflow: explore, plan, implement, commit; planning pays most when the approach is uncertain, the change spans files, or the code is unfamiliar — 'if you could describe the diff in one sentence, skip the plan.' Course-correct early: Esc to interrupt, and after two failed corrections on the same issue, /clear and restart with what you learned. As of 2026-08-05.

— V

循环连起来,就是最小的派活单元.

没有循环的一小时

一句接一句地聊,它边想边改。三十分钟后 diff 大得没法看,你说不清它在哪一步拐错的,也没有任何一条能复跑的检查能告诉你「现在算好了没有」。唯一的验收信号是你自己的眼睛。

有循环的一小时

一份你改过的计划当基线,一套写进仓库的规则决定它什么时候不用问你,一条测试命令替你回答「好了没有」,一个验证过的 /rewind 兜底。你做了两次判断,其余时间它在跑。

把四步连起来看:计划,是你在定义这件活和它的验收标准;模式与规则,是你在决定盯多紧;diff 加倒带,是你在收活。这正是第 1 章那个切换的最小版本 —— 你已经不是在写代码,是在派一件活、收一件活。后面的章节只是把这个循环放大:记忆让你不用每次重新交代(第 4 章),subagent 让循环并行开好几个(第 6 章),headless 让循环在没有你的地方转(第 9 章)。Connect the four steps: the plan is you defining the job and its acceptance criteria; modes and rules are you deciding how closely to watch; diff plus rewind is you collecting the work. That's the smallest version of chapter 1's shift — you're no longer writing code, you're sending out one job and taking one back. The later chapters only scale this loop: memory spares the re-briefing (chapter 4), subagents run several loops in parallel (chapter 6), headless runs the loop where you aren't (chapter 9). 本章验收 · 这条线你跑完了吗:

用上面的模板对一件真活请求了计划,并且按 Ctrl+G 亲手删改了至少一条。
数出了这一轮它问你的次数,并把其中至少两条写进了 settings 的 allow(或 deny)。
收活时对着计划逐条核过 diff,并且拿到了一份真实的检查输出,而不是一句「搞定了」。
故意 /rewind 了一次,确认这条退路真的存在 —— 并且知道它盖不住 Bash 删的文件。

— 引用与参考

参考.

01
Claude Code Docs · Permission modes —— 计划模式:让 Claude 调研、提方案,但不动源码 —— 读文件、跑探索命令、写出计划,批准前编辑一律被挡;Shift+Tab、/plan 或 claude --permission-mode plan 进入,Ctrl+G 把计划丢进外部编辑器改。六档模式配置值:default(界面标 Manual,manual 是可接受的别名)、acceptEdits、plan、auto、dontAsk、bypassPermissions。Shift+Tab 默认只在 default → acceptEdits → plan 之间循环,auto 与 bypassPermissions 按条件加入,dontAsk 从不出现在循环里。状态栏原样显示:⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on。acceptEdits 额外自动放行 mkdir、touch、rm、rmdir、mv、cp、sed(限工作目录或 additionalDirectories 内)。auto 由一个独立分类器模型审查每个动作,进入时丢弃授予任意代码执行的宽 allow 规则、退出时恢复;连续 3 次或累计 20 次拦截后回落到弹窗,阈值不可配。dontAsk 自动拒绝一切本会弹窗的调用,只放行 allow 规则命中项、只读 Bash 与 PreToolUse hook 批准的调用。bypassPermissions 不能会话中途进入,须启动时启用;即便在该模式下,显式 ask 规则、组织设为 ask 的 connector 工具、标记 requiresUserInteraction 的 MCP 工具,以及 root / home 目录删除仍会弹窗。auto 模式的可用性取决于套餐、组织策略、模型与供应商。截至 2026-08-05。Claude Code Docs · Permission modes — plan mode has Claude research and propose without touching source: it reads files, runs exploration commands, and writes a plan, with edits blocked until you approve; enter via Shift+Tab, /plan, or claude --permission-mode plan, and press Ctrl+G to open the plan in an external editor. Six modes by config value: default (labeled Manual in the UI, with manual an accepted alias), acceptEdits, plan, auto, dontAsk, bypassPermissions. Shift+Tab cycles only default → acceptEdits → plan by default; auto and bypassPermissions join conditionally and dontAsk never appears in the cycle. The status bar shows exactly: ⏸ plan mode on / ⏵⏵ accept edits on / ⏵⏵ auto mode on / ⏵⏵ don't ask on / ⏵⏵ bypass permissions on. acceptEdits additionally auto-approves mkdir, touch, rm, rmdir, mv, cp, and sed, limited to the working directory or additionalDirectories. auto uses a separate classifier model on every action, drops broad allow rules granting arbitrary code execution on entry and restores them on exit, and falls back to prompting after 3 consecutive or 20 total blocks — thresholds not configurable. dontAsk auto-denies every call that would otherwise prompt, permitting only allow-rule matches, read-only Bash commands, and PreToolUse-hook approvals. bypassPermissions cannot be entered mid-session and must be enabled at launch; even inside it, explicit ask rules, connector tools an organization set to ask, MCP tools marked requiresUserInteraction, and removals in root or home still prompt. auto mode availability depends on plan, organization policy, model, and provider. As of 2026-08-05. Claude Code Docs · Permission modes
↩
02
Claude Code Docs · Configure permissions —— 规则求值顺序原话:「Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.」宽 deny 不能带白名单例外。格式为 Tool 或 Tool(specifier);deny 里写裸工具名会把该工具整个从 Claude 的上下文里移除(EndConversation 除外),Bash(*) 等同于裸 Bash。通配符:`*` 匹配任意字符序列(含空格),`Bash(ls *)` 匹配 ls -la 但不匹配 lsof,`Bash(ls*)` 两者都匹配,:* 后缀是等价的尾部通配写法。识别的命令分隔符为 && || ; | |& & 与换行,规则必须逐个子命令独立命中;批准一条复合命令最多保存 5 条规则。匹配前会剥掉一组固定包装:timeout、time、nice、nohup、stdbuf,加上内建 command、builtin 与 zsh 的 noglob;该列表内建不可配。开发环境运行器 direnv exec、devbox run、mise exec、npx、docker exec 不在剥离之列 —— 原文示例:Bash(devbox run *) 会匹配 run 之后的任何东西,包括 devbox run rm -rf .。watch、setsid、ionice、flock 等 exec 包装以及带 -exec / -delete 的 find 永远弹窗,前缀规则盖不住。deny 与 ask(不含 allow)可用 Tool(param:value) 匹配顶层标量入参,如 Agent(model:opus)、Agent(isolation:worktree)、Bash(run_in_background:true),每条规则一个参数,模型省略的参数永不命中;主内容字段不能这样匹配 —— Bash / PowerShell 的 command、Read / Edit / Write 的 file_path、Grep / Glob 的 path、NotebookEdit 的 notebook_path。截至 2026-08-05。Claude Code Docs · Configure permissions — evaluation order verbatim: 'Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.' A broad deny cannot carry allowlist exceptions. The format is Tool or Tool(specifier); a bare tool name in deny removes the tool from Claude's context entirely (except EndConversation), and Bash(*) is equivalent to bare Bash. Wildcards: a single * matches any sequence including spaces; Bash(ls *) matches ls -la but not lsof, while Bash(ls*) matches both; the :* suffix is an equivalent trailing-wildcard form. Recognized separators are && || ; | |& & and newlines, and a rule must match each subcommand independently; approving one compound command saves up to 5 rules. A fixed wrapper set is stripped before matching: timeout, time, nice, nohup, stdbuf, plus the builtins command and builtin and zsh's noglob; the list is built in and not configurable. Development environment runners direnv exec, devbox run, mise exec, npx, and docker exec are not stripped — the page's own example: Bash(devbox run *) matches whatever follows run, including devbox run rm -rf . Exec wrappers such as watch, setsid, ionice, and flock, and find with -exec or -delete, always prompt and cannot be covered by a prefix rule. deny and ask rules (not allow) can match a top-level scalar parameter with Tool(param:value) — Agent(model:opus), Agent(isolation:worktree), Bash(run_in_background:true) — one parameter per rule, and a parameter the model omits never matches; primary content fields cannot be matched this way: command for Bash and PowerShell, file_path for Read, Edit, and Write, path for Grep and Glob, notebook_path for NotebookEdit. As of 2026-08-05. Claude Code Docs · Configure permissions
↩
03
Claude Code Docs · Checkpointing —— /rewind,或在输入框为空时连按两次 Esc,打开倒带菜单;输入框有字时双击 Esc 只清空文本(文本入历史,按 Up 可召回)。checkpoint 随对话保存,续开会话后仍可 /rewind。边界写得明白:只追踪本次会话内经 Claude 文件编辑工具做的改动 —— 你在编辑器里的手改、其他并发会话的改动通常不在内;倒带跳过软链接与硬链接路径,并给出提示。所选 checkpoint 没有可回滚的文件改动时,菜单只给恢复对话与摘要选项。截至 2026-08-05。Claude Code Docs · Checkpointing — /rewind, or Esc twice while the prompt input is empty, opens the rewind menu; with text in the input, a double Esc merely clears it (the text goes to input history, recallable with Up). Checkpoints are saved with the conversation, so /rewind still works after resuming a session. The boundary is stated plainly: only edits made through Claude's file-editing tools within the current session are tracked — your own edits in an editor and changes from other concurrent sessions normally are not; rewind skips symlinked and hard-linked paths and reports it. When the selected checkpoint has no revertible file changes, the menu offers only conversation restore and the summarize options. As of 2026-08-05. Claude Code Docs · Checkpointing
↩
04
Claude Code Docs · Best practices —— 推荐工作流:探索、计划、实现、提交四步;计划在方案不确定、改动跨多文件、代码不熟时最值,「如果一句话能说清那个 diff,跳过计划」。跑偏时尽早纠:Esc 打断、同一问题纠正两次仍不对就 /clear 带着教训重开。截至 2026-08-05。Claude Code Docs · Best practices — the recommended workflow: explore, plan, implement, commit; planning pays most when the approach is uncertain, the change spans files, or the code is unfamiliar — 'if you could describe the diff in one sentence, skip the plan.' Course-correct early: Esc to interrupt, and after two failed corrections on the same issue, /clear and restart with what you learned. As of 2026-08-05. Claude Code Docs · Best practices
↩

先批方案,再收结果, 中间的键盘留给它.

Approve the plan, collect the result — leave the keys in between to it.

Aklman Library

— 讨论

讨论.

评论区初始化中…

循环 · 计划、动手、验收The Loop · Plan, Act, Review.

第一步:让它先交方案,不许动一个字Step One: Get the Approach First, Not a Single Edit.

第二步:六档模式,定它的自由度Step Two: Six Modes Set Its Freedom.

第三步:把「不用问我」写成规则Step Three: Write 'Never Ask Me' Into Rules.

第四步:验收,以及那条退路Step Four: Accept — and the Retreat Behind You.

循环连起来,就是最小的派活单元Closed, the Loop Is the Smallest Unit of Delegation.

讨论Discussion.