Why Claude Code Still Prompts for Edits to .claude/ Files (Even with Auto-Accept On)

I had auto-accept edits turned on in Claude Code. The status line said so: ⏵ accept edits on (shift+tab to cycle).

But Claude kept asking me to approve edits to .claude/agents/blog-structure-editor/AGENT.md.

Every. Single. Time.

I was working on creating and improving agent definitions with assistance from Claude, and the agents were in ~/.claude/agents/. This is the same kind of agent configuration work I later tackled more systematically — see how I consolidated OpenCode slash commands for the full picture.

I'd hit Shift+Tab a few times to cycle through the modes, confirm I was back on "accept edits on," and try again. Still prompted. What was going on?

Testing the Theory

After quite a while of this happening, I decided to test it systematically.

The exact prompt I kept seeing was:

Accept edits to .claude/agents/blog-structure-editor/AGENT.md? (y/n)

Even though my status line clearly showed ⏵ accept edits on (shift+tab to cycle).

First theory: maybe I wasn't actually in acceptEdits mode? But the status line was clear. And when I asked Claude to edit CLAUDE.md (my project instructions), it went through without prompting. So acceptEdits was working.

Just... not for files in .claude/.

To confirm this wasn't just me, I asked Claude to try editing the same file:

"Try editing .claude/agents/blog-skeptical-reader/AGENT.md - let's see if you get prompted too."

Claude got prompted too.

Then I tested it systematically myself in different directories:

In /home/luke/projects/my-app/ - No prompt (auto-accept working) In /home/luke/.claude/agents/ - Got prompted (auto-accept disabled)

I noticed the pattern immediately—only the agents directory was prompting me. So it wasn't my settings. It wasn't a glitch. Something about the .claude/ directory was different.

The Aha Moment

This wasn't a bug. It was a security feature.

Think about what lives in .claude/:

• Agent definitions - the system prompts that define how Claude behaves
• Tool permissions - what Claude can and can't do on your system
• Commands and skills - custom workflows you've defined
• Settings - your preferences and configurations

These aren't just any files. These are the files that control how Claude Code works.

If Claude could silently edit them without prompting, even in auto-accept mode, you could accidentally grant broader permissions, change agent behavior, or modify critical settings without realizing it.

Why This Design Makes Sense

Auto-accept mode is great for the 95% of edits you want to flow through quickly:

• Code files you're actively working on
• Documentation updates
• Test file changes
• Configuration tweaks

But .claude/ files are in a different category. They're meta-level - they affect the tool itself, not just your project.

Requiring explicit approval for these edits is like how sudo requires your password even if you're already logged in. It's a speed bump that makes you pause and think: "Do I really want to make this change?"

Overriding If You Really Want To

My first instinct was to add an explicit allow rule:

{
  "permissions": {
    "allow": ["Edit(.claude/**)"]
  }
}

That was a dead end. The permission modes docs list .claude as a protected path, and the protection check runs before allow rules are evaluated, so the snippet above changes nothing. The prompt itself offers one way through: "Yes, and allow Claude to edit files in this project's .claude folder for this session" (there's a ~/.claude/ variant too). That's session-scoped, not a standing rule. The only mode that skips the check entirely is bypassPermissions, and that turns off every permission check, not just this one.

I'm keeping the default behavior though. The prompts are a feature, not a bug.

What I Learned

When a tool doesn't work the way you expect, there's usually a reason. Sometimes it's a bug. Sometimes it's a misunderstanding. And sometimes - like this - it's intentional design that makes sense once you understand the why.

Claude Code's auto-accept mode is smart enough to know:

• Most file edits are safe to auto-approve (your project code)
• Some file edits need a human check (configuration that affects the tool itself)

I went from "Why isn't this working?" to "Oh, that's actually really thoughtful."

This experience shifted how I think about unexpected behavior. Now when something seems broken, I pause and ask: what would break if it worked the way I expected? Maybe the friction exists for a reason.

I hit the same shape of problem with my OpenCode subagents, where the answer was the opposite: I had explicit allow rules set and the tool still asked for every command, and it turned out to be a config ordering trap (how I untangled it). There, the prompts meant something was misconfigured. Here, they mean something is working.

---

TL;DR: Claude Code's auto-accept mode skips .claude/ files even when it's on. Now that I get why—I realized silent edits to my agent definitions would be dangerous—I'm keeping the default.