Advanced Features I — Autonomy & Control

Ways to activate

Power-ups

• claude --model opusplan — a model alias that uses Opus for planning, Sonnet for execution
• Ctrl+G — open the current plan in your external editor for detailed edits
• Plan files are named after the prompt that produced them (v2.1.112) — easier to browse and reuse

Three ways in

• /ultraplan <prompt> — explicit
• The keyword ultraplan anywhere in a normal prompt
• From a finished local plan: "refine with Ultraplan" in the approval dialog

Two execution paths

• Approve in the browser — the cloud session implements and opens a PR
• Teleport back to terminal — implement here, start a new session, or cancel (saves the plan to a file)

Fine print

Research preview, v2.1.91+; v2.1.101 auto-creates the cloud environment on first run. Needs a Claude Code on the web account and a GitHub repo. Not on Bedrock, Vertex, or Foundry.

Controls

• Option+T / Alt+T toggle · Ctrl+O view the reasoning
• /effort high · claude --effort high
• CLAUDE_CODE_EFFORT_LEVEL=high
• MAX_THINKING_TOKENS=16000 custom budget

Requirements

• Plan: Team, Enterprise, or API — not Pro or Max
• Model: Sonnet 4.6 or Opus 4.8
• Provider: Anthropic API only

Getting in — a short history

• Originally unlocked with claude --enable-auto-mode, then Shift+Tab to it
• v2.1.112: flag no longer required — Max subscribers reach it directly on Opus 4.7
• v2.1.158: opt-in on Bedrock / Vertex / Foundry via CLAUDE_CODE_ENABLE_AUTO_MODE=1
• Or just set it: claude --permission-mode auto / "defaultMode": "auto"

Blocked by default

Allowed by default

Local file operations · declared dependency installs (npm install from manifest) · read-only HTTP · pushing to the current branch. Print the full set: claude auto-mode defaults

Extending without clobbering

{
  "autoMode": {
    "allow": ["$defaults", "Bash(gh pr list:*)"],
    "soft_deny": ["$defaults", "Bash(kubectl delete:*)"],
    "hard_deny": ["Bash(git push --force*)"]
  }
}

"$defaults" (v2.1.118) appends to the built-ins — before that, any user array silently replaced them. hard_deny (v2.1.136) blocks a class of actions regardless of inferred intent — unlike soft_deny, it is not negotiable by the classifier.

# preview, nothing written
python3 setup-auto-mode-permissions.py --dry-run

# apply the conservative baseline
python3 setup-auto-mode-permissions.py

# widen only when you need it
python3 ... --include-edits --include-tests
python3 ... --include-git-write --include-packages

acceptEdits got more careful (v2.1.160)

Even with edits auto-approved, Claude now prompts before writing shell-startup files (.zshenv, .zlogin, .bash_login, ~/.config/git/) and code-executing build configs (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/…).

Why: a "file edit" to those paths is really arbitrary command execution on your next shell or build.

bypassPermissions got broader (v2.1.121/126)

--dangerously-skip-permissions now also skips prompts for writes to .claude/skills/, .claude/agents/, .claude/commands/, .claude/, .git/, .vscode/, and shell config files.

Catastrophic removals (rm -rf /) still prompt regardless of mode — but treat the flag as a sharper tool than before: throwaway sandboxes only.

/task list           # all tasks + progress
/task status bg-1234 # progress + ETA
/task show bg-1234   # live output
/task cancel bg-1234 # stop it

Tuning

{
  "backgroundTasks": {
    "enabled": true,
    "maxConcurrentTasks": 5,
    "notifyOnCompletion": true,
    "autoCleanup": true
  }
}

Stream filter — continuous source

tail -f /var/log/app.log \
  | grep --line-buffered "ERROR"

"Start my dev server and monitor it for errors": server runs as a background task, the filter watches the log, and on the first ERROR|FATAL line Claude wakes, reads it, and reacts — restart, fix, or escalate.

Poll-and-emit — no native stream

last=$(date -u +%Y-%m-%dT%H:%M:%SZ)
while true; do
  gh api "repos/o/r/issues/123/comments?since=$last" || true
  last=$(date -u +%Y-%m-%dT%H:%M:%SZ)
  sleep 30
done

For APIs and databases: check periodically, emit output only when something changed.

Local vs cloud

• Local (/loop, CronCreate): session-scoped, not persisted across restarts
• Cloud (/schedule): runs on Anthropic infrastructure, persists across restarts, no local Claude Code needed — /schedule daily at 9am run the test suite

v2.1.139 gotcha: cloud /schedule is silently unavailable when ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, or apiKeyHelper is set — even if you're also logged in with claude.ai. Same gate hits Remote Control and the other claude.ai-bridged surfaces (Part 2). Local CronCreate is unaffected.

claude -p "Run all tests"

# pipe content in
cat error.log | claude -p "Analyze these errors"

# structured output + schema
claude -p --output-format json "Analyze code quality"
claude -p --json-schema '{"type":"object",…}' "find bugs"

# guardrails for automation
claude -p --max-turns 5 "refactor this module"
claude -p --no-session-persistence "one-off analysis"

The CI/CD shape (GitHub Actions)

# .github/workflows/code-review.yml
on: [pull_request]
steps:
  - uses: actions/checkout@v4
  - run: npm install -g @anthropic-ai/claude-code
  - env:
      ANTHROPIC_API_KEY: ${{ secrets.… }}
    run: |
      claude -p --output-format json --max-turns 3 \
        "Review this PR for quality, security,
         performance, coverage" > review.json
  # then post review.json as a PR comment

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "filesystem": {
      "allowWrite": ["/Users/me/project"],
      "allowRead": ["/Users/me/project", "/usr/local/lib"],
      "denyRead":  ["/Users/me/.ssh", "/Users/me/.aws"]
    },
    "enableWeakerNetworkIsolation": true
  }
}

Network rules

{
  "network": {
    "allowedDomains": ["*.example.com"],
    "deniedDomains":  ["evil.example.com"]
  }
}

deniedDomains (v2.1.113) wins over a broad wildcard — the whole domain passes, the named host stays blocked. On macOS full network isolation isn't available — use enableWeakerNetworkIsolation. Linux/WSL can point at custom bwrapPath / socatPath binaries (v2.1.133).

Tools and hooks

• EnterWorktree — enter one; since v2.1.157 it can switch between Claude-managed worktrees mid-session
• ExitWorktree — exit and clean up
• WorktreeCreate / WorktreeRemove — hook events on create and remove
• Since v2.1.157 finished worktrees are left unlocked, so git worktree remove/prune can collect them