AI Coding Guide

Auto-allow npm scripts in Claude Code without allowing npm install

Claude Code Published:

Use Bash(npm run:*) to stop the prompts for lint, test and build while npm install still asks. Covers pnpm, yarn, bun and npx patterns, what :* means, and the Python equivalent.

Verified on Sep 7, 2026 These tools change quickly. Please also check the latest official documentation.
#Claude Code#permissions#npm#pnpm#allow
Contents
  1. The setting
  2. Patterns per package manager
  3. For a Python project
  4. Verify it
  5. Related settings
  6. Summary

A confirmation dialog on every npm run lint, npm run test and npm run build is the single biggest drag on working with Claude Code. The scripts in your package.json are commands you wrote yourself, so there is no reason not to allow them as a group.

In short: put Bash(npm run:*) in allow and every npm script stops prompting. npm install is a different prefix, so it is not swept in by accident.

KEY POINT

What you will learn

  • Patterns that allow scripts for npm, pnpm, yarn and npx
  • What :* means, and how to keep install commands out of the rule
  • The equivalent for Python projects (pytest, ruff)

The setting

{
  "permissions": {
    "allow": [
      "Bash(npm run:*)",
      "Bash(npm test)",
      "Bash(npx tsc:*)",
      "Bash(npx vitest:*)",
      "Bash(npx eslint:*)",
      "Bash(npx prettier:*)"
    ],
    "ask": [
      "Bash(npm install:*)",
      "Bash(npm i:*)",
      "Bash(npm uninstall:*)"
    ]
  }
}

npx can run any package, so this allows only the ones you use rather than the whole program. Note that npx is deliberately not in ask: an ask rule prompts even when a more specific allow rule also matches, so Bash(npx:*) in ask would start prompting for the npx tsc you just allowed. Leaving it out means "the ones I allowed run silently, any other npx follows the default behavior" — a prompt in Manual mode.

用語解説

What :* means: Bash(npm run:*) is a prefix match — "starts with npm run, anything may follow." It matches arguments too, such as npm run test -- --watch. Put the * after the subcommand; a rule with a * before it, like Bash(npm * test), triggers a startup warning.

Patterns per package manager

ToolRunning scriptsInstall commands (ask)
npmBash(npm run:*)Bash(npm install:*), Bash(npm i:*)
pnpmBash(pnpm run:*), Bash(pnpm test), Bash(pnpm lint)Bash(pnpm add:*), Bash(pnpm install:*)
yarnBash(yarn run:*), Bash(yarn test)Bash(yarn add:*), Bash(yarn install)
bunBash(bun run:*)Bash(bun add:*), Bash(bun install:*)

pnpm and yarn let you drop run, as in pnpm lint, so either list the scripts you use individually or allow the whole program and stop the install commands with ask rules. Because ask is evaluated before allow, that combination is safe:

{
  "permissions": {
    "allow": ["Bash(pnpm:*)"],
    "ask": ["Bash(pnpm add:*)", "Bash(pnpm install:*)", "Bash(pnpm remove:*)"]
  }
}

For a Python project

{
  "permissions": {
    "allow": [
      "Bash(pytest:*)",
      "Bash(python -m pytest:*)",
      "Bash(ruff:*)",
      "Bash(mypy:*)",
      "Bash(uv run:*)"
    ],
    "ask": [
      "Bash(pip install:*)",
      "Bash(uv add:*)"
    ]
  }
}

Verify it

  1. Save the setting and restart Claude Code.
  2. Open /permissions and check the allow list.
  3. Say "run the tests." If npm run test goes without a prompt, it works.
  4. Say "add lodash." If npm install lodash prompts, the ask rules work too.

Once the scripts run unattended, a hook that always lints after an edit keeps quality up as you widen the automation — see Run lint and format on save with Claude Code hooks. For the overall design, see the parent article, Design permissions in Claude Code's settings.json.

Summary

  • Bash(npm run:*) allows every npm script in one rule, and npm install is a different prefix so it stays out
  • When allowing a whole program such as pnpm or npx, stop the install commands with ask rules — ask is evaluated before allow
  • For Python, allow pytest, ruff and uv run, and put pip install in ask

FAQ

Does Bash(npm run:*) also allow npm install?
No. The rule matches commands that begin with npm run, and npm install is a different prefix, so it is not covered.
Can I allow all of pnpm and still be asked about pnpm add?
Yes. Put Bash(pnpm:*) in allow and Bash(pnpm add:*) in ask. Rules are evaluated deny, then ask, then allow, so the ask rule prompts even though the broader allow rule also matches.
Should I allow npx as a whole?
It runs arbitrary packages, so allow only the ones you actually use, such as Bash(npx tsc:*). Do not put Bash(npx:*) in ask, or the ones you allowed individually will prompt too.

Primary sources

This article was drafted by AI from official documentation and reviewed by the site operator before publishing. Found a mistake? Let us know via the contact page.

Related articles