[DOCS] acceptEdits docs omit prompt-protected build-tool config files

Documentation Type

Incorrect/outdated documentation

Documentation Location

https://code.claude.com/docs/en/permission-modes

Section/Topic

Auto-approve file edits with acceptEdits mode and Protected paths

Current Documentation

The docs currently say:

acceptEdits mode lets Claude create and edit files in your working directory without prompting. The status bar shows ⏵⏵ accept edits on while this mode is active. In addition to file edits, acceptEdits mode auto-approves common filesystem Bash commands: mkdir, touch, rm, rmdir, mv, cp, and sed. ... Like file edits, auto-approval applies only to paths inside your working directory or additionalDirectories. Paths outside that scope, writes to protected paths, and all other Bash commands still prompt.

Later the same page defines protected paths as:

Protected directories: .git .vscode .idea .husky .cargo .claude, except for .claude/commands, .claude/agents, .claude/skills, and .claude/worktrees where Claude routinely creates content Protected files: .gitconfig, .gitmodules .bashrc, .bash_profile, .zshrc, .zprofile, .profile .ripgreprc .mcp.json, .claude.json

What's Wrong or Missing?

As of v2.1.160, Claude Code prompts before writing build-tool config files that can grant code execution, including .npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, and .devcontainer/.

The current docs still describe acceptEdits as auto-approving in-repo file edits unless the path is outside the working directory or in the protected-path list above, but that list does not include any of these build-tool config files. That makes the page outdated about a security-sensitive exception to acceptEdits behavior.

The same simplified behavior is repeated on the general permissions, headless, desktop, and Agent SDK permissions pages, so users can reasonably expect these files to be auto-approved when they are not.

Suggested Improvement

Update the acceptEdits documentation to call out this exception explicitly anywhere the mode is summarized.

Before:

acceptEdits mode lets Claude create and edit files in your working directory without prompting.

After:

acceptEdits mode lets Claude create and edit most files in your working directory without prompting. Claude still prompts before writing build-tool config files that can grant code execution, such as .npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, and .devcontainer/.

Also add either:

• a dedicated exception note under Auto-approve file edits with acceptEdits mode, or
• an expanded protected-paths/security-sensitive-files section that lists these file patterns and explains why they still prompt.

Then mirror the same note on the Permissions, Headless, Desktop, and Agent SDK permissions pages so all acceptEdits summaries stay consistent.

Impact

Medium - Makes feature difficult to understand

Additional Context

Affected Pages:

| Page | Line(s) | Context |
|------|---------|---------|
| https://code.claude.com/docs/en/permission-modes | 107-111 | Says acceptEdits lets Claude create and edit files without prompting, except protected paths |
| https://code.claude.com/docs/en/permission-modes | 297-312 | Protected-path list omits .npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, and .devcontainer/ |
| https://code.claude.com/docs/en/permissions | 41-48 | Permission modes table says acceptEdits automatically accepts file edits and common filesystem commands |
| https://code.claude.com/docs/en/headless | 197 | Says acceptEdits lets Claude write files without prompting |
| https://code.claude.com/docs/en/desktop | 69-72 | UI description says Claude auto-accepts file edits in acceptEdits mode |
| https://code.claude.com/docs/en/agent-sdk/permissions | 202-211 | SDK docs say acceptEdits auto-approves file operations except protected paths |

Total scope: 5 pages affected

Behavior reference:

• https://code.claude.com/docs/en/changelog — v2.1.160 says: acceptEdits mode now prompts before writing build-tool config files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/, etc.)