Gate destructive commands on variable resolution, not just command shape

Claude Code·medium signal

Claude Code's auto mode now asks before running `rm -rf` on a variable it cannot resolve from context, and separately blocks tampering with session transcript files. The generalizable rule for anyone writing agent permission logic: the danger signal is not the command string but an unresolved interpolation inside it — `rm -rf $BUILD_DIR/` is safe when the harness can prove what `$BUILD_DIR` holds and catastrophic when it cannot. Pattern-matching on the command alone either blocks too much or misses the real failure mode; resolve-then-decide is the correct gate.