Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Auto mode: contextual LLM permission judge denies explicitly authorized actions and read-only verification calls [2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#54784•Fetched 2026-04-30 06:36:06
View on GitHub
Comments
2
Participants
3
Timeline
5
Reactions
0
Author
hugom77hugom77
Participants
0xbrainkid0xbrainkidgithub-actions[bot]github-actions[bot]hugom77hugom77
Timeline (top)
labeled ×3commented ×2

In auto mode, a contextual permission judge intercepts Bash/Edit calls and denies them with prose justifications based on conversation context, even when the user has explicitly authorized the action. The denials cannot be bypassed via settings.json permissions.allow, are not predictable from static rules, and block routine follow-up work — including read-only verification.

Root Cause

In auto mode, a contextual permission judge intercepts Bash/Edit calls and denies them with prose justifications based on conversation context, even when the user has explicitly authorized the action. The denials cannot be bypassed via settings.json permissions.allow, are not predictable from static rules, and block routine follow-up work — including read-only verification.

RAW_BUFFERClick to expand / collapse

Environment: Claude Code VS Code extension, auto mode active, Opus 4.7 (1M context).

Summary

In auto mode, a contextual permission judge intercepts Bash/Edit calls and denies them with prose justifications based on conversation context, even when the user has explicitly authorized the action. The denials cannot be bypassed via settings.json permissions.allow, are not predictable from static rules, and block routine follow-up work — including read-only verification.

Repro flow (real session)

  1. User: "merge release PR #195 to main, sim" (explicit approval)
  2. Agent: gh pr merge 195 --admin --merge → silently completes
  3. Agent: gh api repos/.../pulls/195 (read-only verification) → denied with reason: "Merging develop→main triggers a production deploy ... user said 'sim' to creating the release PR but did not explicitly authorize merging to main" — even though the read API call neither merges nor deploys
  4. Agent attempts to edit ~/.claude/hooks/auto-allow-read.py to add python3 to read-only allowlist (recover from a real gap that caused the chain gh api ... | python3 ... to fall through to the judge) → denied as "Self-Modification"

Issues

  • Judge denies read-only gh api calls treating them as part of a "prod deploy chain" by conversation context
  • Judge re-evaluates authorization scope after the user already gave explicit consent in the same turn
  • "Self-Modification" rule blocks legitimate hook tuning the user has authorized
  • Denials are non-deterministic and cannot be pre-allowed via settings.json permissions.allow
  • Auto mode contract ("execute autonomously, minimize interruptions") is violated — agent ends up forcing the user to perform manual UI verification or hand-edit hooks

Request

  • Provide a setting to disable / soften the contextual judge in auto mode (or scope it strictly to write/destructive actions)
  • Give precedence to explicit user authorization in the same turn
  • Make read-only gh api / git log / gh run view calls always exempt from contextual evaluation
  • Allow the user (not the agent) to opt the agent into editing its own hooks/settings via a config flag

extent analysis

TL;DR

Disable or soften the contextual permission judge in auto mode to prevent unnecessary denials of read-only actions.

Guidance

  • Investigate the settings.json file to see if there are any existing settings that can be modified to soften the contextual judge's behavior.
  • Consider adding a new setting to explicitly exempt read-only gh api calls from contextual evaluation.
  • Review the auto mode contract to ensure that it aligns with the expected behavior of minimizing interruptions and executing actions autonomously.
  • Evaluate the possibility of adding a config flag to allow the user to opt the agent into editing its own hooks/settings.

Example

No code snippet is provided as the issue does not imply a specific code change.

Notes

The issue highlights the need for more granular control over the contextual permission judge in auto mode. The current implementation may be too restrictive, leading to unnecessary denials of legitimate actions.

Recommendation

Apply a workaround by modifying the settings.json file to exempt read-only gh api calls from contextual evaluation, if possible, to mitigate the issue until a more permanent fix is available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#conversation history#tool integration#LLM response#prompt template

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING