面试题库

Claude 高效使用：从对话到 Claude Code

D5 自动化与规模化：headless -p 进 CI、并行会话与 worktree、Writer / Reviewer 双会话、对抗式审查、常见失败模式；Agent SDK 20 行最小 agent

• 把 claude -p 放进 CI 时要控制哪三件事？具体用哪些参数？为什么推荐加 --bare？What three things must you control when running claude -p in CI, with which flags, and why is --bare recommended?

  国内高频海外高频进阶#headless#ci#permissions

  分析过程 · 先想清楚再作答

  1. 这题考无人值守的风险意识。答「加个 API key 就能跑」会被判没上过线；面试官想听权限、预算、可复现三道锁，以及每道锁对应的参数。
  2. 权限：无人值守时没人回答「允许吗」，所以要么白名单放行（--allowedTools "Read,Grep" 或 "Bash(git diff *)"，注意 * 前的空格），要么定基线（--permission-mode dontAsk 一律拒绝白名单外的动作；acceptEdits 允许改文件），再加 --permission-prompts none 把本来要问人的动作直接拒掉。-p 模式的起始档位是 Manual，必须显式传。
  3. 预算：--max-turns 限轮数、--max-budget-usd 限花费，到了就停并报错。没有它们，一个卡在循环里的任务能耗尽额度；有 Stop hook 时要给足轮数，否则会以「轮数耗尽」而不是「测试通过」结束。
  4. 可复现：--bare 跳过 hooks、skills、插件、MCP、CLAUDE.md 的自动发现，让每台 runner 结果一致、启动更快；同时也是安全措施——不加它，clone 下来的陌生仓库里别人写的 hook 会在 -p 下无提示地执行（无头模式没有信任对话框）。配合 --no-session-persistence 不落盘，提示词与 --append-system-prompt 进版本控制。
  5. 可预期的追问：--bare 之后怎么认证？它不读订阅登录，必须设 ANTHROPIC_API_KEY；再追问怎么判断成败——--output-format json 的 is_error / subtype / total_cost_usd，退出码非零脚本就 fail。

  How to reason about it · think before answering

  1. This tests awareness of unattended risk. 'Add an API key and run it' reads as no production experience; the interviewer wants the three locks — permissions, budget, reproducibility — each with its flags.
  2. Permissions: nobody answers 'allow?' unattended, so either allowlist tools (--allowedTools "Read,Grep" or "Bash(git diff *)", mind the space before *) or set a baseline (--permission-mode dontAsk denies anything outside the allowlist; acceptEdits permits file edits), plus --permission-prompts none to deny anything that would have prompted. -p starts in Manual on every plan, so pass the mode explicitly.
  3. Budget: --max-turns caps turns, --max-budget-usd caps spend; both stop with an error. Without them a looping task can drain your quota; with a Stop hook, allow enough turns or the run ends on 'max turns' rather than 'tests pass'.
  4. Reproducibility: --bare skips auto-discovery of hooks, skills, plugins, MCP, and CLAUDE.md so every runner behaves the same and starts faster — and it is a security measure, since a cloned repo's hooks would otherwise run silently under -p (no trust dialog). Add --no-session-persistence and keep the prompt and --append-system-prompt in version control.
  5. Follow-ups: authentication under --bare — it ignores subscription login, so set ANTHROPIC_API_KEY. Judging success — is_error, subtype, and total_cost_usd from --output-format json; fail the job on a non-zero exit.

  答题要点

  • 权限：--allowedTools 白名单 + --permission-mode dontAsk / acceptEdits + --permission-prompts none；-p 默认 Manual 必须显式传
  • 预算：--max-turns 与 --max-budget-usd，到了就停；有 Stop hook 时给足轮数
  • 可复现：--bare 跳过本机配置自动发现，也防陌生仓库的 hook 在 CI 上跑；--no-session-persistence
  • --bare 需要 ANTHROPIC_API_KEY；成败看 --output-format json 的 is_error 与退出码

  Key points

  • Permissions: --allowedTools allowlist plus --permission-mode dontAsk or acceptEdits and --permission-prompts none; -p defaults to Manual
  • Budget: --max-turns and --max-budget-usd stop the run; leave headroom for Stop hooks
  • Reproducibility: --bare skips local auto-discovery and keeps a cloned repo's hooks from running in CI; --no-session-persistence
  • --bare requires ANTHROPIC_API_KEY; judge success from is_error in the JSON and the exit code