Agent Skills: YOLO Mode — What It Bypasses, What It Doesn't

YOLO Mode — What It Bypasses, What It Doesn't

TL;DR

--dangerously-skip-permissions (a.k.a. bypassPermissions) does NOT bypass everything. Three categories always prompt:

1. Tools requiring user interaction — ExitPlanMode, AskUserQuestion (by design)
2. ask rules in settings.json — user-configured permissions.ask entries override bypass
3. Hardcoded safety-check guardrails (non-negotiable security):
   • Sensitive files (.env, credentials, .git/)
   • Writes outside allowed working directories
   • Shell metachars in file paths ($VAR, $(...), %VAR%, >(...))
   • /dev/tcp, /dev/udp
   • Remove-Item -Recurse near .git / .claude
   • PowerShell

How the resolver actually decides

Permission resolution (from 2.1.109 binary analysis) runs checks in this order, and returns on first match:

1. deny rules → block
2. requiresUserInteraction() on the tool → ask (category 1)
3. ask rules in settings.json → ask (category 2)
4. safetyCheck hardcoded guardrails → ask (category 3)
5. bypassPermissions → allow ← YOLO short-circuits HERE, not earlier
6. allow rules → allow
7. Default → ask

Bypass only wins after categories 1–3 have already had their say. That's the whole story.

Most common complaint

"I'm in YOLO mode and it keeps prompting me."

Almost always: a file write outside the current working directory. Blog edits from an igor2 session, dotfile edits, ~/.claude/* changes, cross-repo work without --add-dir.

Fix — add all cross-repo dirs to settings.json:

{
  "permissions": {
    "additionalDirectories": [
      "/home/developer/gits/larry-blog",
      "/home/developer/gits/chop-conventions",
      "/home/developer/.claude"
    ]
  }
}

Or per-launch without touching settings:

claude --dangerously-skip-permissions \
  --add-dir ~/gits/larry-blog \
  --add-dir ~/gits/chop-conventions \
  --add-dir ~/.claude

additionalDirectories merges from settings.json + --add-dir — set the stable ones in settings, use --add-dir for ad-hoc work.

Diagnosing a prompt

When a prompt DOES fire in YOLO, the exact message text pins which guardrail hit:

| Message contains | Category | Recovery | |---|---|---| | "requires manual approval" | 1 — tool self-declared | Can't bypass. ExitPlanMode / AskUserQuestion always ask by design. | | Matching ask rule in settings | 2 — user-configured ask | Remove the permissions.ask entry from settings.json if it's stale. | | "is a sensitive file" | 3 — sensitive-path list | Not bypassable. Move credentials out of the write target, or do the edit manually. | | "outside the allowed working directories" | 3 — cwd guard | Add the dir via additionalDirectories / --add-dir. | | "contains shell expansion" / "contains unsafe characters" | 3 — static-validation guard | Rewrite the command to quote the path or avoid metachars. No setting bypasses this. | | /dev/tcp / /dev/udp | 3 — network redirect guard | Not bypassable. Use a real networking tool (curl, nc). | | PowerShell | 3 — deny-by-default | Not bypassable on Linux/macOS. Use bash. |

What YOLO is NOT

There is no super-YOLO flag that bypasses category 3. Don't go looking for one. Running Claude as root with IS_SANDBOX=1 exits immediately — that path is closed.

If a category-3 prompt is genuinely blocking you, the right moves are:

• Narrow the operation so it doesn't trip the guard (e.g. write to an allowed dir then mv).
• Do the one-off step by hand in the shell.
• File an issue upstream if the guard is a false positive on a legitimate pattern.

Source

Research in chop-conventions issue #122 · igor2 bead bgt.14.