You are running Claude Code as part of an automated continuous integration pipeline.

Option B is the correct automation pattern. A CI pipeline must operate non-interactively, so Claude Code should be invoked in its programmatic/headless execution mode and given only the permissions required for the predefined workflow. Output can then be captured by the pipeline and supplied to subsequent build, testing, reporting, or deployment stages.

Claude Code's configuration system supports explicit permission rules in JSON settings. Anthropic documents that settings.json controls, among other behavior, what Claude Code can execute without asking. For example, permissions.allow can authorize specific commands while permissions.deny prevents sensitive operations. Project-level .claude/settings.json can be version-controlled so CI behavior is reproducible across runners.

This is substantially safer than C, which disables confirmation behavior globally and expands the blast radius beyond the CI workload. D defeats automation because a human must remain present. A is unnecessary because Claude Code is explicitly configurable for automation scenarios.

The principle is least-privilege non-interactive configuration: authorize only the commands and resources required by the pipeline and capture machine-readable output for downstream processing. Relevant Claude Developer topics are Claude Code automation, configuration management, permissions, CI/CD integration, headless execution, and reproducible project settings.