Plan mode, sandboxes, and the skip-permissions trap

Plan mode is a boundary in time: investigate now, implement after approval. Run a real task in it and check the working tree afterwards — a useful plan and an unchanged tree is the outcome you're looking for, and confirming it once is how you learn to trust the mode.

Sandboxing is a boundary in space. Where it's available, Claude Code can run its Bash tool with filesystem and network isolation, so commands operate inside a box rather than on your machine at large. Test it the way you test a permission rule: attempt a harmless out-of-scope write and confirm it's refused while in-scope work still succeeds.

And then there's --dangerously-skip-permissions. It's named that for a reason. A narrow allow rule says "this specific safe thing needn't ask". Skipping permissions says "nothing needs to ask" — including the operations you have never seen, the ones you'd have caught, and the ones an injected instruction produces. It's not a stronger version of an allow rule; it's the absence of the whole system.

The honest version of the need behind it is "I'm being prompted constantly and it's breaking my flow". That's a real problem with a real fix: allow the handful of commands you run every few minutes, by name. Ten minutes writing rules buys you a quiet session that still stops for the unexpected — which is the only part that was ever protecting you.

Loading your workspace…