Daily harness signal

Make “ask” a hard floor

A fresh Claude Code repair shows why approval escalation must outrank automation mode. Pin the fix, then replay the real risky flow before trusting it.

July 16, 2026 · JST Fresh · released 08:02 JST 1 implementation finding
Implementation lesson: an approval hook should be a monotone safety floor. Claude Code 2.1.211 repairs a path where auto mode silently promoted “ask” to “allow” for unsandboxed Bash.
01 · Fresh · source date 2026-07-15 UTC

Regression-test policy precedence inside the dangerous execution mode

Use when. Claude Code runs in auto mode while a PreToolUse hook returns permissionDecision: "ask" for unsandboxed Bash—especially commits, pushes, deployments, credential operations, or commands that change remote state.

Action. Set the deployment floor to Claude Code 2.1.211 or later. In a disposable repository, install a Bash PreToolUse fixture that emits {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"Human approval required"}}. Enable auto mode, stage a sentinel change, and ask the agent to run git commit followed by git push. Replay twice: once immediately after agent-authored edits, and once as a cold, standalone request. Capture the transcript and hook output.

pin → emit ask → exercise in-flow and cold calls → inspect ordering

Acceptance check. Both runs record the hook decision and display a human approval prompt before dispatch. No tool_result appears before the operator’s response; choosing “No” leaves local HEAD and remote refs unchanged. Any silent auto-mode approval, missing prompt, or state mutation blocks rollout.

Evidence. Anthropic’s official 2.1.211 release explicitly says auto mode had overridden a PreToolUse ask decision for unsandboxed Bash and now floors that decision at a prompt. Issue #51255 preserves the exact configuration, reproduction, and observed silent execution. Current hook documentation defines restrictive precedence as deny, defer, ask, then allow.

Caveat. Claude Code’s runtime is closed-source, and the release publishes no regression-test output. Its wording is limited to hook-emitted ask on unsandboxed Bash; do not infer equivalent behavior for static permissions.ask rules, sandboxed commands, other tools, or bypass modes without separate probes.

Compact source notes

  1. Claude Code v2.1.211 release (published July 15, 2026 23:02 UTC / July 16 08:02 JST). Official shipped fix and scope statement.
  2. Claude Code issue #51255 (opened April 20, 2026). Exact hook payload, settings, risky-command scenario, and silent-auto-approval reproduction; later closed stale before the shipped fix.
  3. Claude Code hooks reference (retrieved July 16, 2026). Current decision schema and deny > defer > ask > allow precedence.