I don't understand this either, it makes commands really hard to parse. It seems like 90% of what claude does could be going through some mcp tool that could be easily sandboxed instead of bash gibberish.
replyIf it was human approval ? Read("./file.name") then Bash("docker compose run unit-tests"), sure, I can read that fine !
replyAs I was reading your post I got another approval request that auto-mode did not understand. It was a single Bash call !!23!! lines tall on a retina mac display with six different variables. If anything this is the cause of approval fatigue and auto mode does nothing helpful when this is every call. I also have in my claude.md and global instructions to use tool calls rather than bash grep/cat/find, which are disregarded.
Yeah I agree, I didn't used to feel approval fatigue but lately the huge bash chains are giving it to me. I haven't even tried auto mode. I'm just sure it has some definition of "safe" that does not align with my own.
replyI'm not sure when claude started preferring huge bash chains but auto mode tends to decline most of them and drop to a permission prompt -- getting rid of the use of auto mode -- because it refuses to handle anything chained with expansions, variables or similar items
replydeleted
replyI use a hook to deny attempts to invoke `grep /` and `find /`, even as part of a complex pipeline.
replyI had claude write a hook to deny `find /`. It tested it thoroughly. Much later I learned that the hook denied `find /` but allowed everything else that existing permissions denied, like running whatever random python/bash code it wanted without asking.
reply