One read of Claude Code CLIclaude-code-20260819T153701Z
5 pages moved out of 186 read.
Pages moved
5
significant first
Pages read
186
in this capture
Captured
15:37 UTC
Corpus hash
01bdf2c533d8
corpus-hash
What this read moved
1-5 of 5permissions Changed · +6 / -0 lines
#### Redirections
from line 195
195195
196196Claude Code recognizes a built-in set of Bash commands as read-only and runs them without a permission prompt in every mode. These include `ls`, `cat`, `echo`, `pwd`, `head`, `tail`, `grep`, `find`, `wc`, `which`, `diff`, `stat`, `du`, `cd`, and read-only forms of `git`. The set is not configurable; to require a prompt for one of these commands, add an `ask` or `deny` rule for it.
197197
198A redirect such as `ls > out.txt` adds a check on the target. See [Redirections](#redirections).
199
198200Unquoted glob patterns are permitted for commands whose every flag is read-only, so `ls *.ts` and `wc -l src/*.py` run without a prompt.
199201
200202In Manual mode, commands from this set still prompt in these cases:
from line 229
227229
228230 Note that using WebFetch alone doesn't prevent network access. If Bash is allowed, Claude can still use `curl`, `wget`, or other tools to reach any URL.
229231</Warning>
232
233#### Redirections
234
235Claude Code checks the target of an output redirection, such as `>`, `>>`, or `2>`, as a file write. The check covers your `Edit` allow and deny rules, [protected paths](/docs/en/permission-modes#protected-paths), and the [working directories](#working-directories). A rule such as `Bash(git commit *)` allows the command, not the target. A `/dev/null` target isn't checked. A target that starts with `~` or contains a glob character needs approval.
230236
231237### PowerShell
232238
agent-sdk/modifying-system-prompts Changed · +1 / -1 lines
from line 342
342342
343343## Combine approaches
344344
345These methods compose. A persistent output style or CLAUDE.md sets the long-lived behavior, and `append` layers session-specific instructions on top without touching the saved configuration.
345The approaches compose. A persistent output style or CLAUDE.md sets the long-lived behavior, and `append` layers session-specific instructions on top without touching the saved configuration.
346346
347347### Combine an output style with session-specific additions
348348
env-vars Changed · +1 / -1 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
Nothing in the body moved in this read. What changed is above.
hooks Changed · +1 / -1 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 64
6464
6565### How a hook resolves
6666
67To see how these pieces fit together, consider this `PreToolUse` hook that blocks destructive shell commands.
67To see how the event, the matcher, and the handler fit together, consider this `PreToolUse` hook that blocks destructive shell commands.
6868
6969<Tabs>
7070 <Tab title="macOS/Linux">
from line 3216
321632161. Claude Code spawns a subagent with your prompt and the hook's JSON input
321732172. The subagent can use tools like Read, Grep, and Glob to investigate
321832183. After up to 50 turns, the subagent returns a structured `{ "ok": true/false }` decision
32194. Claude Code allows the action if `ok` is `true`. If `ok` is `false`, Claude Code handles the block the same way as a prompt hook with `continueOnBlock: true` on that event, as listed under [Response schema](#response-schema)
3220
3221Agent hook
32194. Claude Code allows the action if `ok` is `true`. If `ok` is `false`, Claude Code handles the block the same way as a prompt hook with `continueOnBlock: true` on that event, as listed under [Response schema](#r
sandbox-environments Changed · +2 / -2 lines
from line 157
157157
158158## Enforce isolation across an organization
159159
160Individual developers can opt into any approach above. What an organization can enforce, and with which tools, depends on the approach:
160Individual developers can opt into any of the sandboxing approaches on this page. What an organization can enforce, and with which tools, depends on the approach:
161161
162162* **Built-in Bash sandbox**: the only approach Claude Code enforces itself. Deliver the `sandbox` settings keys through [managed settings](/docs/en/settings#settings-files), either as a file managed by your MDM or through [server-managed settings](/docs/en/server-managed-settings) on Claude.ai. See [Enforce sandboxing with managed settings](/docs/en/sandboxing#enforce-sandboxing-with-managed-settings) for the keys to deploy and how to keep developers from widening the policy.
163163* **Dev containers**: commit the [example dev container](/docs/en/devcontainer) to your repositories to standardize the environment across a team. This is a convention rather than an enforcement boundary, because Claude Code does not require a container. If developers should not be able to run Claude Code outside it, enforce that with your organization's device management or software allowlisting tools.
from line 165
165165
166166## See also
167167
168These pages cover configuration and policy details for the approaches above.
168These pages cover configuration and policy details for the sandboxing approaches on this page.
169169
170170* [Sandboxing](/docs/en/sandboxing): configure the built-in sandboxed Bash tool
171171* [Dev container](/docs/en/devcontainer): the preconfigured Docker development container