Long runs without bypass

Build-along · ~8 min at your own keyboard

Bypass mode skips every permission prompt. A scratch folder does not contain it: in bypass, Claude can run any command your user account can, anywhere on the machine, including outside that folder. So the beginner answer to 'I want a long job to run without me clicking yes' is not bypass. It's an allow-list: approve the exact commands the job needs in advance, keep deny rules on, start from a backup, and check the result. Real bypass belongs only inside a disposable sandbox (a dev container, a virtual machine, or a cloud sandbox) holding copies of files and no credentials — and only after you've tested that the sandbox actually holds and that you can restore. That's the advanced route below. Keep two ideas apart. Allow and deny rules are permissions: Claude's own harness choosing to obey them. A sandbox is isolation: the operating system stops the process, whatever it tries. Isolation comes in grades, from weakest to strongest: a restricted shell, a container, a virtual machine.

The long version: Bypass mode safely ↗

Mac: Mac: keep backups in Time Machine or a copy of the folder. Dev containers need Docker Desktop.

Windows: Windows: use a scratch folder outside OneDrive and make a copy first. Dev containers need Docker Desktop or WSL.

Do this

0/5

Checkpoints

▸You should now see a backup copy of your scratch folder before the run.
▸You should now see the job run with prompts only for things you didn't pre-approve.
▸You should now see a file-by-file audit and one file restored from the backup.

The three ways this goes wrong

You turned on bypass in a normal folder because the prompts were annoying. — Stop with Esc and switch it off. Check what changed against your backup. Use allow rules for the specific commands instead.
An allow rule is broad, like allowing every shell command. — Delete it. Allow the exact command patterns the job needs, nothing wider.
Your containment test could read files outside the sandbox. — It isn't a sandbox. Don't enable bypass. Rebuild it so your real folders aren't mounted or shared.

Dated facts in this lesson: Claude Code permission rules use the form Tool(specifier), e.g. Read(./.env) in a deny list, managed with /permissions or settings.json (researched Oct 2, 2026, not yet confirmed by a person: check the source before you rely on it).

Where these ideas come from: Sandbox, Permission mode (AI Hero dictionary). Paraphrased here.

Share what happened

Default route: paste the allow rules you added, two lines from your audit, and the restore you did. Sandbox route: paste your preconditions, the two containment-test results, two audit lines, and the restore result.

Strip API keys, passwords, and tokens before you paste. Swap them for [KEY].

🔒 Don't paste confidential, personal-health, or payment info.