What
Before rendering, preview resolves the Chrome executable, follows links, and denies with preview_browser_in_workspace if it sits under a working directory, a temp directory or a sandbox write root, or is hard-linked and writable. Sessions in bypassPermissions mode skip that check.
Details
- Also denied: network-share paths, hard-linked source files, and files whose symlink target the Read rules would only permit after asking.
- Otherwise preview asks once, with a prompt stating the render is local and nothing is uploaded.
- If no Chrome is found, the error points at
BUN_CHROME_PATH.
Evidence
Chrome not found: install Chrome or Chromium, or point BUN_CHROME_PATH at one.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundlebypassPermissions
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up bypassPermissions, on Configure permissions.
Coverage depends on the entry's form: a bare name like `Read` or `mcp__github__get_issue` auto-approves every call to that tool apart from the exceptions above, while a scoped rule like `Bash(npm test *)` auto-approves only matching calls,…agent-sdk/permissions see the edit
Added since
A small documentation edit on Connect Claude Code to tools via MCP touched a line naming bypassPermissions after this was published.
In `claude -p` runs, [Agent SDK](/docs/en/headless) sessions, and [cloud sessions](/docs/en/claude-code-on-the-web), Claude Code can't show that prompt: it loads project-scoped servers without asking. Claude Code also skips the prompt in a…mcp see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
A small documentation edit on Connect Claude Code to tools via MCP touched a line naming bypassPermissions after this was published.