Claude Code now warns about the permission rule that looks narrow and is not

A permission rule is a promise you make to yourself about what a tool may do without asking. Claude Code 2.1.246, released on August 25, adds a warning at startup for a shape of rule that quietly breaks that promise: an allow rule for Bash with a wildcard sitting before the subcommand.

Why the wildcard position matters

Written as Bash(git * main), the rule reads like permission for one narrow thing. The wildcard sits where the subcommand goes, so what it actually covers is any git subcommand at all, as long as the rest matches. The distance between what the rule looks like and what it grants is the entire problem, and until now nothing pointed it out.

The warning fires at startup rather than at the moment the command runs, which is the right time for it: a permission list is written once and then trusted for weeks.

Auto mode's rules stop being invisible

The same release adds an Auto mode tab to the permissions screen, for viewing and editing the classifier rules that decide what auto mode may do on its own. Rules that decide things on your behalf and cannot be read are difficult to trust; this makes them a list like any other.

The rest of the release is a long run of fixes rather than features, among them background sessions that failed to open, MCP tool arguments sent as JSON strings, and the Write tool reporting an out-of-memory error on large files.