Claude Code Now Warns When Your Bash Rules Are Too Wide — and Shows You the Auto Mode Classifier

Claude Code v2.1.246 (Aug 25): a startup warning fires when any Bash allow rule lets a wildcard precede the subcommand, and a new Auto mode tab in /permissions exposes the classifier ruleset you can review and edit in-app.

The warning fires for rules like "Bash(npm *)", "Bash(git *)", or "Bash(*:*)". These pass any argument: a prompt injection that adds --force to a git push, or installs a package you didn't ask for, slips through unchecked.

Scope each rule to the exact subcommands you actually need:

// Warns at startup — too broad
"Bash(npm *)",

// Preferred — explicit subcommands only
"Bash(npm install:*)",
"Bash(npm run:*)",
"Bash(npm test:*)"

The same principle applies to git rules: "Bash(git *)" passes git push --force and git reset --hard; "Bash(git status:*)" and "Bash(git diff:*)" don't.

The Auto mode tab in /permissions is the companion change: it lists every tool-call pattern the auto-mode classifier currently approves without prompting, and lets you add or remove patterns without editing settings.json by hand. If you have auto mode enabled and haven't opened this tab, now is the time — the classifier ruleset is not always what you expect.

Limit: The startup warning covers Bash allow rules only. Overly broad patterns on other tools — Read(*), custom MCP tools with wildcard params — don't trigger the same warning yet.

Sources: Claude Code changelog — v2.1.246 · Auto mode docs · Havoptic release summaries