{"version":"2.1.319","anchor":"bash-permission-checks-rm-and-windows-path-hardening-auto","canonical_anchor":"repeated-refusals-now-end-the-turn","heading":"Auto mode: tighter Bash checks, and a turn ends after repeated refusals","tier":"notice","area":"Bash Safety","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/bash-permission-checks-rm-and-windows-path-hardening-auto","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### Auto mode: tighter Bash checks, and a turn ends after repeated refusals\n\nAuto mode now ends a turn after repeated refusals, flags Bash commands accept-edits cannot allow, and asks first about more rm and Windows-path commands\n\n**Unclear.** What `CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT` turns off is not stated.\n\n**What**\n\nAuto mode lets Claude act with less asking, with an automatic reviewer checking each action. Accept-edits mode allows file edits without asking.\n\n- When actions keep being refused and no work goes ahead in between, the call is not run and the turn ends. The message says \"actions were refused and no work went ahead in between\". A subagent (a helper Claude starts for part of a task) gets a version saying it was stopped before it finished and that its output is partial.\n\n- In auto mode, Bash commands are checked as they would be in accept-edits mode. A command that check cannot allow is marked `acceptEditsCannotAllow`. This covers the loop case \"Only the first pass of a loop in this command could be checked, and its later passes may run something else\".\n\n- An `rm` with a Git Bash Windows path that the check cannot place now needs approval, with \"Git Bash may read this Windows path differently from this check\".\n\n- Nested command substitutions, commands run inside other commands, are now analysed up to a limit.\n\n- A new plain-line check is recorded. A new pattern and the switch `tengu_lively_cook`, which falls back to true, are related, but how they are used was not traced.\n\n- The server-controlled switch `tengu_lively_crown`, which falls back to \"off\", runs an experiment on decisions marked `acceptEditsCannotAllow`, including ones nested inside `subcommandResults`. With \"count\", the call is only marked as counted. With \"skip\", the call flagged `runsAloneToolUseId` can be picked at random to skip the accept-edits pre-check. It does nothing unless the server sets \"count\" or \"skip\".\n\nNothing has been read about `tengu_lively_crown`, `tengu_lively_cook` or `tengu_iridescent_boot`.\n\n**Why**\n\nFewer partly checked commands are allowed in auto mode, and you may see more approval prompts for `rm` and Windows paths. A run that keeps being refused now stops. A server-side experiment can change which pre-check runs for some auto-mode calls.\n\n- Flag `tengu_iridescent_boot`: Not enough to say (read for one account on one subscription tier against v2.1.319; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Flag `tengu_lively_cook`: Not enough to say (read for one account on one subscription tier against v2.1.319; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Bash Safety\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: yes"}