Unclear It is not clear what turns on the separate handling for sandboxed runs, so it may not apply to every auto mode session.
What
Auto mode lets Claude Code decide on many actions by itself, using a classifier, a check that judges whether an action is allowed. Two things about it have changed:
- Standing approvals given for sandboxed runs are now tracked separately. Before, they were added to the session's own permission rules. A sandboxed run is one held inside the protective boundary that limits which files a program can touch.
- The "no allowed model" outcome, which already applied when
CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_APIis set, can now also be reached through another check.
Why
Approvals given for sandboxed auto mode runs no longer mix with the permission rules of the wider session, which changes how those approvals carry forward.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear what turns on the separate handling for sandboxed runs, so it may not apply to every auto mode session.