The auto mode classifier ignores project settings entirely, and omitting "$defaults" silently discards every built-in block rule
The auto-mode-config reference spells out two traps worth acting on today. The classifier reads `autoMode` only from ~/.claude/settings.json, managed settings, and `--settings`, never from `.claude/settings.json` or `.claude/settings.local.json`, so a checked-in repo or a build step cannot inject its own allow rules; if you still have an `autoMode` block in settings.local.json from before v2.1.207 it is now dead config. Separately, setting `environment`, `allow`, `soft_deny` or `hard_deny` without the literal `"$defaults"` replaces the whole built-in list, dropping force-push, `curl | bash`, production-deploy and data-exfiltration rules. Run `claude auto-mode config` to see the effective result and `claude auto-mode critique` to have your custom rules reviewed.
↳ Follow the thread