---
type: analysis
slug: research-claude-code-s-skip-permissions-flag-still-blocks-rm-on-critical-paths-unless-a
title: "Claude Code's skip-permissions flag still blocks rm on critical paths unless a v2.1.311 env var opts out"
description: "Bypass mode keeps a timed prompt-then-deny guard on deleting root, home or the working directory. Since v2.1.311 a launch-only environment variable removes it, with many documented conditions that keep it on."
published_at: 2026-11-09T19:00:00.000Z
topics: ["claude","claude_code","prompting","research"]
source_urls: ["https://code.claude.com/docs/en/permission-modes","https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md","https://api.github.com/repos/anthropics/claude-code/releases/tags/v2.1.281","https://api.github.com/repos/anthropics/claude-code/releases/tags/v2.1.311","https://api.github.com/repos/anthropics/claude-code/releases/tags/v2.1.309"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
A post circulating in Russian-speaking developer channels pointed out that Claude Code's --dangerously-skip-permissions flag does not actually allow everything. The newsroom held it because the supplied evidence confirmed hard stops in bypassPermissions mode but not when the final override for critical-path rm prompts arrived or how it is configured.

This matters for anyone running Claude Code unattended in CI, containers or agent harnesses: whether a destructive delete is prompted, denied, or executed silently depends on the version, the surface (terminal, VS Code, Desktop, SDK) and an environment variable that is easy to miss.

## What we checked

- **Which Claude Code version introduced the final override for critical-path rm prompts, and what exact documented safeguards and configuration govern it?** partly confirmed. The docs say CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1 needs v2.1.311 or later, must be set in the launch environment, and works only in bypassPermissions mode for the Bash and Monitor critical-path check, with a list of hooks, rules and session types that keep the prompt on. The version is confirmed only by the docs; the v2.1.311 changelog and release notes do not mention the variable. [1][2][4]

## What we found

- Claude Code's own permission-modes documentation says --dangerously-skip-permissions (bypassPermissions mode) is not a blanket yes. Actions that no mode auto-approves still get a prompt or a denial, and the docs tell users to run the mode only in isolated containers or VMs. [1]
- The main hard stop is the critical-path removal check on rm and rmdir. It covers the filesystem root, top-level directories, the home directory, Windows drive roots, the working directory and its parents, and risky forms such as a glob directly under a shell variable. The changelog shows this guard has existed at least since v2.1.126 (published 2026-05-01), when bypass mode stopped prompting for protected-path writes but kept catastrophic removals as a safety net. [1][2]
- Since v2.1.281 (published 2026-09-23), the terminal prompt for a critical-path removal in auto and bypassPermissions modes has a two-minute countdown. If nobody answers, the command is denied and Claude gets a rewrite hint. After three unanswered prompts in a session, further critical-path removals are denied at once. So an unattended bypass run does not hang, but it also does not delete the root or home directory. [1][2][3]
- The final override is the environment variable CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1, which the docs say requires v2.1.311 or later (release published 2026-10-26). It is read only from the launch environment, not from a settings file's env block. It applies only in bypassPermissions mode itself, not in plan mode, and only to what the critical-path check flags in the Bash and Monitor tools. The v2.1.311 changelog entry and release notes do not mention the variable, so the version comes from the docs alone. [1][2][4]
- The docs list many conditions that silently keep the prompt on even with the variable set. These include a PermissionRequest hook, a permission-prompt tool or SDK callback, any deny or ask rule on Bash, Edit or Read, blockReadsOutsideWorkingDirectories, unreadable managed settings, running in the VS Code panel or Desktop app, and sessions Claude Code starts itself, such as background sessions or teammates. A claude started inside another session also ignores it, though the docs warn this is not a security boundary. Separately, since v2.1.309 the Desktop app and VS Code deny dangerous rm in bypass mode at once instead of prompting. [1][2][5]

## What it means

If you run Claude Code with --dangerously-skip-permissions in automation, expect critical-path rm and rmdir commands to be denied after a two-minute prompt (v2.1.281+) or at once in the Desktop app and VS Code (v2.1.309+), and design scripts so they don't depend on deleting the working directory or its parents. Use ${VAR:?}-style guards and explicit paths so the check does not trip.

Only set CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1 in throwaway containers, and check the startup line to see whether it actually took effect, since any PermissionRequest hook, Bash deny or ask rule, or managed-settings problem silently keeps the guard on. Platform teams can rely on those same conditions, plus disableBypassPermissionsMode, as controls, but not on the nested-session limit, which the docs say is not a security boundary.

## Competing readings

- **The override is a deliberate, narrow opt-out for isolated environments added in v2.1.311; the critical-path guard remains the default in bypass mode** (likely, about 70%). What would tell it apart: Docs tie the variable to v2.1.311, launch environment only, bypass mode only [1]; Bypass mode still prompts or denies actions no mode auto-approves [1].
- **It is part of a steady loosening of bypass-mode guards that is being shipped quietly** (unlikely, about 25%). What would tell it apart: v2.1.126 already dropped protected-path prompts in bypass mode [2]; The v2.1.311 changelog does not record the new variable.
- **The hard stop is cosmetic for unattended runs because it only prompts and eventually lets commands through** (very unlikely, about 8%). What would tell it apart: Unanswered prompts end in denial, and after three the removals are denied at once [1][2]; Desktop and VS Code deny immediately in bypass mode [2].

## Base rate

The New Runtime archive holds only 0 earlier access-change stories about companies or products from the last 12 months that are at least 3 months old: too few (minimum 5) for a base rate. No BASE_RATE was supplied, so the archive has too few cases (0 cases, 0 matches) to say anything; the conclusion rests on primary documentation instead.

## What would change this view

- A future changelog entry or docs revision says the override variable shipped in a version earlier than v2.1.311 (signal): The docs' version claim is wrong and the dating of the override must be revised.
- Docs or changelog let the override be set from settings files or apply in auto or plan mode (signal): The override is broadening rather than staying a narrow, launch-only opt-out.
- bypassPermissions stops prompting or denying critical-path removals by default (deprecation signal): The default hard stop was removed and the original post's claim no longer holds.

## Still open

- Why the v2.1.311 changelog and release notes omit the new environment variable, and whether it shipped dark earlier.
- Whether the override will extend to PowerShell Remove-Item, which the docs say is denied separately in bypass mode.
- Whether enterprise managed settings will get an explicit switch to forbid the override, rather than relying on indirect conditions.

## Sources

1. [Choose a permission mode - Claude Code Docs](https://code.claude.com/docs/en/permission-modes) (primary)
2. [anthropics/claude-code CHANGELOG.md](https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md)
3. [Claude Code v2.1.281 release (GitHub API)](https://api.github.com/repos/anthropics/claude-code/releases/tags/v2.1.281)
4. [Claude Code v2.1.311 release (GitHub API)](https://api.github.com/repos/anthropics/claude-code/releases/tags/v2.1.311)
5. [Claude Code v2.1.309 release (GitHub API)](https://api.github.com/repos/anthropics/claude-code/releases/tags/v2.1.309)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude_code topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)