{"version":"2.1.207","anchor":"auto-mode-setup-expanded-rule-audit","canonical_anchor":"auto-mode-setup-expanded-rule-audit","heading":"\/auto-mode-setup: Expanded Rule Audit","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.207\/e\/auto-mode-setup-expanded-rule-audit","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.207","markdown":"### \/auto-mode-setup: Expanded Rule Audit\n\n**What**\n\nThe `\/auto-mode-setup` command now audits two additional categories of permission rules, replacing the old \"over-broad interpreter-prefix\" check with more targeted categories.\n\n**Details**\n\n- New section: **\"Classifier-bypassing entries\"** \u2014 rules that auto mode ignores at runtime even though they appear in `permissions.allow`. Lists them explicitly so users can review or remove them.\n- New section: **\"Destructive entries\"** \u2014 allow-rules that auto-approve destructive operations without a prompt. Shown separately so users understand which rules carry higher risk.\n- When `classifyAllShell` is active, a note warns that auto mode ignores all Bash\/PowerShell allow rules (a superset of the flagged entries).\n- If the list is capped at the display limit, a note instructs re-running `\/auto-mode-setup` after cleanup to see the rest.\n- Also now reads and reports `autoMode` keys from the project's `.claude\/settings.local.json` with security checks (symlink gate, link-count-1 requirement, and git-tracking status).\n\n**Evidence**\n\nNew audit output with headings \"Classifier-bypassing entries\" and \"Destructive permissions.allow entries\" (search for `\"classifier-bypassing\"` and `\"Destructive permissions.allow entries\"`)"}