bypassPermissions
A Claude Code settings key, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.
Peer-machine isolation prompts now survive bypass permissions mode and are never auto-approved.
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.223.
In the changelogs
52Releases whose published page names bypassPermissions.
-
v2.1.293
Ignored bypass permissions mode now shows a pinned warning
When bypass permissions mode is requested at launch but ignored, a pinned warning now says to set
skipDangerousModePermissionPromptto truefound in this entry's text, named in this entry
-
v2.1.293
Claude in Chrome refuses to upload credential files and device paths
Claude in Chrome file uploads now reject credential files like .env, .pem, .key and .ssh, plus device paths and over-long paths
found in this entry's text
-
v2.1.292
Teammate permission flags now consider whether auto mode was picked by level
When starting a teammate, Claude Code now factors in whether auto mode was chosen by level; the flags sent for each mode are unchanged
found in this entry's text
-
v2.1.290
New variables to turn off proactivity and carry it across a relaunch
Claude Code adds
CLAUDE_CODE_DISABLE_PROACTIVITYand variables that pass proactivity state to a relaunched Claude Codefound in this entry's text
-
v2.1.290
Background workers only keep bypassPermissions mode with consent in your user settings
A background worker in bypassPermissions mode falls back to default unless skipDangerousModePermissionPrompt is true in ~/.claude/settings.json
found in this entry's text, named in this entry
-
v2.1.290
Background sessions ignore
--allow-dangerously-skip-permissionswithout recorded consentBackground sessions now ignore
--allow-dangerously-skip-permissionsunless bypass consent is in your user or policy settingsfound in this entry's text
-
v2.1.286
No behaviour change to MCP policy exemptions in remote bypass mode
The rule that exempts MCP server policy denials in remote bypass-permissions sessions behaves the same as before
found in this entry's text, named in this entry
-
v2.1.285
Tools can opt out of bypass permissions mode, and audio paste handling is removed
A tool can now be excluded from automatic approval in bypass permissions mode, and pasted audio is no longer treated as text
found in this entry's text, named in this entry
-
v2.1.284
Local permission prompts explain why a cloud session's auto mode was not used
When a cloud session claims auto mode but your computer checks a permission in another mode, the prompt now says why
found in this entry's text
-
v2.1.283
--remotecan ask before sharing local MCP servers or serving tools unattendedAn attached
--remotesession can now ask whether to share your local MCP servers, and ask again before serving tools in auto or bypass modefound in this entry's text
-
v2.1.282
Claiming a pre-started session no longer blocks bypassPermissions on internal builds
A check that refused
bypassPermissionswhen claiming an already-started session on internal builds, and said to start cold, has been removedfound in this entry's text, named in this entry
-
v2.1.281
Hidden
claude -p --cloudheadless cloud-print path added, but compiled offCode for a headless
claude -p --cloudrun is added, but the switch that enables it returns false, so no one can use it in 2.1.281found in this entry's text
-
v2.1.281
Internal builds refused bypassPermissions outside a sandbox when claiming a session
Internal builds can no longer take over a session that uses bypassPermissions outside a sandbox
found in this entry's text
-
v2.1.281
Error messages for the dark-launched
--cloudprint modeThe not-yet-launched
--cloudprint mode has fixed messages for timeouts, failed starts, archived sessions, pending questions and Ctrl-Cfound in this entry's text
-
v2.1.281
Bypass-permissions safety-check asks now get a timed approval dialog instead of a flat deny
In bypassPermissions mode, safety-check asks can now show a dialog that denies by itself after a timeout, not deny outright
found in this entry's text, named in this entry
-
v2.1.275
Permission-mode 'auto' resolves to a concrete mode at request time
'Auto' permission mode now resolves to a concrete mode when a tool request is made
found in this entry's text
-
v2.1.269
New bashEditDiffEnabled setting controls Bash-tool file-change diffs and PostToolUse hook data
New bashEditDiffEnabled setting shows diffs for files the Bash tool edits and passes changed files to PostToolUse hooks
found in this entry's text
-
v2.1.269
bypassPermissions availability in plan mode now requires an interactive session
Using bypass-permissions mode while in plan mode now requires an interactive session
found in this entry's text
-
v2.1.269
Permission-mode bypass check consolidated into a shared helper
Permission bypass-mode check consolidated into one shared helper across three call sites
found in this entry's text
-
v2.1.260
New "proactive" permission-mode resolution
A new proactive permission mode picks bypass or auto-accept mode based on context.
found in this entry's text
-
v2.1.259
Additional CLI permission modes surfaced when replaying session state
Replayed sessions now round-trip the default, plan, dontAsk and bubble permission modes, not just the three previously handled.
found in this entry's text
-
v2.1.259
Unattended-serving consent prompt for headless/desktop cloud sessions
Headless and desktop cloud sessions in auto or bypass mode now ask once whether Claude may act unattended, and the answer is saved.
found in this entry's text
-
v2.1.257
'bypassPermissions'/'auto' default-permission-mode can now be set from local settings
The auto and bypassPermissions default permission modes can now be set from local settings, not just project settings.
found in this entry's text, named in this entry
-
v2.1.251
Permission mode corrected when feature flags arrive late
Your permission mode is re-checked once remote settings load, so startup no longer sticks on the wrong one.
found in this entry's text
-
v2.1.248
New
--restrictedsession modeNew --restricted flag starts a locked-down session with no shell tools and no settings files.
found in this entry's text
-
v2.1.248
Remote machines can send their own auto-mode rules with a tool-call approval request
A remote machine's permission rules can now influence approvals for tool calls it asks about.
found in this entry's text
-
v2.1.248
Permission rules serialized for the host
Permission rules sent to the host omit allow and environment lists for unpermitted callers.
found in this entry's text
-
v2.1.247
Preview refuses a Chrome binary the session could have written
Preview refuses any Chrome binary sitting somewhere the session could have written to.
named in this entry, found in this entry's text
-
v2.1.247
acceptEdits mode reaches remote clients unchanged
acceptEdits mode now reaches remote clients intact instead of being downgraded to default.
found in this entry's text
-
v2.1.242
Cloud-hosted sessions now refuse local CLI options instead of quietly dropping them
Running with --cloud now tells you which local CLI options were ignored or refused, and why.
found in this entry's text
-
v2.1.239
Tool calls relayed from a cloud agent run under a restricted permission mode
Tool calls relayed from a cloud agent are judged strictly: your hooks skip and relaxed permission modes are downgraded.
found in this entry's text
-
v2.1.234
Bypass permissions mode is now disabled only by settings
Your session won't be killed mid-run with an organization policy message about bypass permissions any more.
found in this entry's text
-
v2.1.234
The remote kill switch for bypassPermissions mode is gone
A remote switch can no longer force you out of bypassPermissions mode mid-session; only the admin setting does.
found in this entry's text
-
v2.1.227
Auto-mode guidance reminders now also appear in bypassPermissions
Bypass permissions mode now gets the same guidance reminders auto mode gets.
named in this entry, found in this entry's text
-
v2.1.225
The bypassPermissions consent flag reaches startup mode resolution
Setting defaultMode to bypassPermissions now works in VS Code when you have enabled the consent setting.
named in this entry, found in this entry's text
-
v2.1.225
VS Code-owned sessions get their own settings defaultMode handling
In VS Code sessions, unsafe default permission modes from settings are refused and fall back to normal.
named in this entry, found in this entry's text
-
v2.1.224
Control-tag sanitizing rules are now shared
The rules that neutralise control tags in subagent output are now shared with a new assistant-output scanner.
found in this entry's text
-
v2.1.223
Circuit breakers carry declared traits instead of hard-coded name checks
Peer-machine isolation prompts now survive bypass permissions mode and are never auto-approved.
named in this entry, found in this entry's text
-
v2.1.223
Permission circuit breakers now have a capability table
Peer-machine isolation prompts now still appear even when you're running in bypass-permissions mode.
named in this entry, found in this entry's text
-
v2.1.202
bypassPermissionsMode Not Restored from Sessions Unless Explicitly Launchedfound in this entry's text
-
v2.1.172
URL Provenance Check for web_fetch
found in this entry's text
-
v2.1.122
Background Job Safety Guards
found in this entry's text
-
v2.1.116
/modeCommandfound in this entry's text
-
v2.1.110
bypassPermissions Mode Scoping
found in this entry's text
-
v2.1.75
Permission Mode Change Events
found in this entry's text
-
v2.1.63
--permission-mode CLI Flag
found in this entry's text
-
v2.1.53
Trust Dialog Bypass Removed
found in this entry's text
-
v2.1.30
SDK Schema Documentation
found in this entry's text
-
v1.0.124
Sandboxed Bash Mode (
-sb/--sandboxed-bash)found in this entry's text
-
v1.0.48
New Features
found in this entry's text
-
v1.0.22
Enhanced Permission Modes
found in this entry's text
-
v1.0.18
Enhanced Permission Modes
found in this entry's text
First cited
9The earliest release whose published evidence quoted bypassPermissions was v2.1.53, 24 Feb 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
3 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
0The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.