What
The /auto-mode-setup command now audits two additional categories of permission rules, replacing the old "over-broad interpreter-prefix" check with more targeted categories.
Details
- New section: "Classifier-bypassing entries" — rules that auto mode ignores at runtime even though they appear in
permissions.allow. Lists them explicitly so users can review or remove them. - New section: "Destructive entries" — allow-rules that auto-approve destructive operations without a prompt. Shown separately so users understand which rules carry higher risk.
- When
classifyAllShellis active, a note warns that auto mode ignores all Bash/PowerShell allow rules (a superset of the flagged entries). - If the list is capped at the display limit, a note instructs re-running
/auto-mode-setupafter cleanup to see the rest. - Also now reads and reports
autoModekeys from the project's.claude/settings.local.jsonwith security checks (symlink gate, link-count-1 requirement, and git-tracking status).
Evidence
New audit output with headings "Classifier-bypassing entries" and "Destructive permissions.allow entries" (search for "classifier-bypassing" and "Destructive permissions.allow entries")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Changed auto mode to no longer read autoMode from .claude/settings.local.json (repo-resident); use ~/.claude/settings.json instead