Tag
3 posts tagged.
allowedTools auto-approves, tools restricts. That half is documented. What is not: an AgentDefinition has no allowedTools field, and the SDK forwards one verbatim to the CLI anyway, unvalidated.
Set _meta["anthropic/requiresUserInteraction"] to true and Claude Code prompts for that tool on every call, even in bypassPermissions, and even when an allow rule matches. It shipped in v2.1.199 with no changelog entry, which is why almost nobody has written about it.
permissions.blockReadsOutsideWorkingDirectories blocks reads outside your working directories in every permission mode, including bypassPermissions. Writing false does not turn it off, because the key is a logical OR across all settings sources. Plus the 53-hour macOS defect window, dated from the npm registry.
