Regression-test policy precedence inside the dangerous execution mode
Use
when.
Claude
Code
runs
in
auto
mode
while
a
PreToolUse
hook
returns
permissionDecision:
"ask"
for
unsandboxed
Bash—especially
commits,
pushes,
deployments,
credential
operations,
or
commands
that
change
remote
state.
Action.
Set
the
deployment
floor
to
Claude
Code
2.1.211
or
later.
In
a
disposable
repository,
install
a
Bash
PreToolUse
fixture
that
emits
{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"Human approval required"}}.
Enable
auto
mode,
stage
a
sentinel
change,
and
ask
the
agent
to
run
git
commit
followed
by
git
push.
Replay
twice:
once
immediately
after
agent-authored
edits,
and
once
as
a
cold,
standalone
request.
Capture
the
transcript
and
hook
output.
pin
→
emit
ask
→
exercise
in-flow
and
cold
calls
→
inspect
ordering
Acceptance
check.
Both
runs
record
the
hook
decision
and
display
a
human
approval
prompt
before
dispatch.
No
tool_result
appears
before
the
operator’s
response;
choosing
“No”
leaves
local
HEAD
and
remote
refs
unchanged.
Any
silent
auto-mode
approval,
missing
prompt,
or
state
mutation
blocks
rollout.
2.1.211
release
explicitly
says
auto
mode
had
overridden
a
PreToolUse
ask
decision
for
unsandboxed
Bash
and
now
floors
that
decision
at
a
prompt.
Issue
#51255
preserves
the
exact
configuration,
reproduction,
and
observed
silent
execution.
Current
hook
documentation
defines
restrictive
precedence
as
deny,
defer,
ask,
then
allow.
Caveat.
Claude
Code’s
runtime
is
closed-source,
and
the
release
publishes
no
regression-test
output.
Its
wording
is
limited
to
hook-emitted
ask
on
unsandboxed
Bash;
do
not
infer
equivalent
behavior
for
static
permissions.ask
rules,
sandboxed
commands,
other
tools,
or
bypass
modes
without
separate
probes.