CLI, plan mode and permission modes

Claude Code is an agent in your terminal. It reads files, runs commands and edits code. The CLI decides how you talk to it; the permission mode decides how much it can do before it has to ask you. Getting these two right is the first thing to set up on any repo that touches infrastructure.

Two ways to run it

Command	Use it for
`claude`	An interactive session: you chat, approve actions, steer.
`claude -p "query"` (or `--print`)	One-shot, non-interactive runs: scripts, CI jobs, pipes. It prints the result and exits.

Print mode is the basis of everything in the headless lesson later in this course. For now remember one difference: in print mode nobody is there to click “allow”, so the permission setup has to be decided in advance.

Permission modes

A permission mode is a preset for how much Claude may do without prompting. These are the current modes:

Mode	Runs without asking	Typical use
`default` (shown as Manual)	Reads only	Careful work, unfamiliar repos
`acceptEdits`	Reads, file edits and simple file commands (`mkdir`, `mv`, `cp`…) inside the working directories	Iterating on code you will review
`plan`	Reads (plus commands the auto-mode classifier approves, where available); no edits	Exploring and designing before changing anything
`auto`	Everything, with a background classifier checking each action	Long tasks where you trust the guardrails
`dontAsk`	Only pre-approved tools; anything that would prompt is denied	Locked-down CI
`bypassPermissions`	Everything, no checks	Only inside isolated containers or VMs

How the starting mode is chosen

The first match wins:

the --permission-mode flag,
permissions.defaultMode in settings,
the built-in default: auto for interactive sessions, default (Manual) for claude -p and the Agent SDK.

A project’s .claude/settings.json can’t set auto or bypassPermissions as the starting mode. That stops a cloned repo from quietly giving itself more power.

Switching modes

In a session, Shift+Tab cycles through the modes. The cycle runs default → acceptEdits → plan and then any optional modes. The status bar shows where you are, for example ⏸ plan mode on. dontAsk is never in the cycle; you can only start it with --permission-mode dontAsk.

A safe progression for infrastructure work: plan first, then edit with review.

Plan mode

Plan mode is where you should start on infrastructure changes. Claude explores, reads and proposes a plan, but doesn’t edit anything. You can enter it three ways:

press Shift+Tab until the status bar says plan mode,
prefix one prompt with /plan,
start with claude --permission-mode plan.

When the plan is ready you choose how to continue. “Yes, manually approve edits” keeps you in the loop for every change, and “No, keep planning” sends Claude back to refine. Ctrl+G lets you edit the plan text yourself. To make plan mode the default for a whole repo, set "defaultMode": "plan" in .claude/settings.json.

Narrowing tools from the command line

Two flags shape a single run:

# Pre-approve read-only git commands for this run
claude --allowedTools "Bash(git log *)" "Bash(git diff *)" "Read"

# Remove tools or deny specific calls
claude --disallowedTools "Bash(rm *)" "WebFetch"

--allowedTools lets matching calls run without a prompt. --disallowedTools takes deny rules: a bare tool name removes the tool completely, and a scoped rule such as Bash(rm *) only blocks the calls that match. Inside a session, /permissions opens a dialog where you can see and change rules by scope.

Recap

claude is interactive; claude -p is one-shot and has nobody to approve prompts.
Modes run from cautious (plan, default) to open (auto, bypassPermissions). dontAsk is the strict CI mode.
The flag beats settings, and settings beat the built-in default. Project settings can’t start in auto or bypassPermissions.
Deny rules hold in every mode.