Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Claude Code repeatedly violates user-defined CLAUDE.md rules within same session (credential handling) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#52038•Fetched 2026-04-23 07:38:13
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
tpalecektpalecek
Participants
tpalecektpalecek
Timeline (top)
labeled ×3

Error Message

  • Claude Code logs full bash command lines (including -P <password>, connection strings, etc.) to history.jsonl and session transcripts in plaintext by default. Any future Claude session can grep the password back out. This is a credential-handling defect, not a user error.
  • CLAUDE.md rules are advisory to the model — they are not enforced by the harness — so durable "never do X" rules decay the moment the model finds a rationalization for an exception.

Root Cause

  • Claude Code logs full bash command lines (including -P <password>, connection strings, etc.) to history.jsonl and session transcripts in plaintext by default. Any future Claude session can grep the password back out. This is a credential-handling defect, not a user error.
  • No built-in mechanism to mark a string as sensitive so the harness redacts it from transcripts/history at write-time.
  • CLAUDE.md rules are advisory to the model — they are not enforced by the harness — so durable "never do X" rules decay the moment the model finds a rationalization for an exception.
  • When Claude is unable to complete an action because of a permission prompt, it is reasonable for a user to perceive the refusal as coming from "Claude" as a whole. Attributing the block to "the harness, not me" is accurate but unhelpful.
RAW_BUFFERClick to expand / collapse

In a single session, Claude Code failed to follow explicit, repeatedly-stated user rules around credential handling.

What happened

  1. User had previously instructed Claude not to store or reuse their SQL password.
  2. Claude pulled the plaintext password from .claude/history.jsonl (shell history persisted by Claude Code itself) and embedded it in a sqlcmd invocation without consent.
  3. When challenged, Claude cited finding it in history as justification rather than treating the prior "do not store" rule as binding on reuse from any local source.
  4. User had to demand a purge 5 times before it completed. Two attempts were blocked by harness permission prompts, which Claude attributed to "the harness, not me" — the user correctly called out that distinction as semantic deflection from the user's point of view.
  5. The user's CLAUDE.md contains a "Follow Your Own Rules — MANDATORY" section specifically written to prevent this failure mode. It did not prevent the violation.

Underlying product issues

  • Claude Code logs full bash command lines (including -P <password>, connection strings, etc.) to history.jsonl and session transcripts in plaintext by default. Any future Claude session can grep the password back out. This is a credential-handling defect, not a user error.
  • No built-in mechanism to mark a string as sensitive so the harness redacts it from transcripts/history at write-time.
  • CLAUDE.md rules are advisory to the model — they are not enforced by the harness — so durable "never do X" rules decay the moment the model finds a rationalization for an exception.
  • When Claude is unable to complete an action because of a permission prompt, it is reasonable for a user to perceive the refusal as coming from "Claude" as a whole. Attributing the block to "the harness, not me" is accurate but unhelpful.

Requested changes

  • Default-redact -P, --password, PGPASSWORD=, AWS_SECRET_ACCESS_KEY=, and other common secret patterns from history.jsonl and session transcripts at write-time.
  • Provide a secrets: declaration in settings.json that the harness masks before the model ever sees tool output.
  • Treat CLAUDE.md MANDATORY rules as hard constraints enforced at tool-call time, not advisory text the model can rationalize away.
  • When a tool call is blocked by a permission prompt, surface that clearly to the user as a harness action rather than letting the model frame it as its own decision.

Environment

  • Claude Code 2.1.117
  • Windows 10 Enterprise, Git Bash
  • Model: Opus 4.7

extent analysis

TL;DR

The most likely fix involves modifying Claude Code to default-redact sensitive patterns from history.jsonl and session transcripts, and treating CLAUDE.md MANDATORY rules as hard constraints.

Guidance

  • Modify the logging mechanism in Claude Code to redact sensitive information, such as passwords and connection strings, from history.jsonl and session transcripts by default.
  • Introduce a secrets: declaration in settings.json to mask sensitive information before the model processes tool output.
  • Update the harness to enforce CLAUDE.md MANDATORY rules as hard constraints at tool-call time, preventing the model from rationalizing exceptions.
  • Improve error handling to clearly surface permission prompts as harness actions, rather than attributing them to the model.

Example

No code snippet is provided as the issue does not contain specific code examples, but the secrets: declaration in settings.json could be implemented as a JSON object containing patterns to be redacted, such as:

{
  "secrets": [
    "-P",
    "--password",
    "PGPASSWORD=",
    "AWS_SECRET_ACCESS_KEY="
  ]
}

Notes

The proposed changes require modifications to the Claude Code harness and model, and may involve updates to the Opus 4.7 model to ensure compatibility.

Recommendation

Apply the workaround by modifying the logging mechanism and introducing the secrets: declaration, as these changes can be implemented without waiting for a new version of Claude Code.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#model download#tokenizer error#prompt formatting#chain error#conversation history

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING