After the Person Hitting "Yes" Disappears, Who Audits the AI's Decisions? — Claude Code v2.1.246 Adds a "Peephole" and an Editing Pen to Auto-Approval Rules
On August 14, Auto mode became the default, moving approval from humans to an AI classifier. v2.1.246 adds a tab in /permissions to view and edit those rules, and warns about the over-broad permissions caused by wildcards placed before subcommands. A step toward reclaiming control over "what you del
On August 14, Claude Code switched the default for consumer plans from "a person approves each action one at a time" to Auto mode, where an AI classifier decides whether to allow or deny. It keeps things moving without pausing, but some pointed out that the very judgment of approval was being pushed into a black box. Released on August 25, v2.1.246 provides a window you can read and write for those rules, and along the way adds a warning about a "trap" lurking in permission settings.
The classifier's rules are now visible from the settings screen
v2.1.246 adds an Auto mode tab to /permissions. Here you can list the classifier rules that decide auto-approval, and edit them on the spot.
For the first time, the criteria behind operations that used to pass on "the AI judged it fine" are now open to human eyes. The more you run agents unattended, the more this visibility matters — because the operators can spell out and reclaim control over what gets waved through automatically and what gets stopped.
The wildcard's position invites over-broad permissions
The other addition is a startup warning about Bash permission rules. A rule that places a wildcard before the subcommand (for example, Bash(git * main)) will also match options slipped in ahead of the subcommand. In other words, it can permit a broader range than intended. When v2.1.246 finds this pattern, it flags it at startup.
In addition, malformed commands left with a dangling && or || at the end are now fixed to always require approval. It's a change that narrows one more gap in permission "slip-throughs."
Shoring up unattended operation
This release also has notable fixes for scenarios where automation runs for a long time. The main ones are as follows.
- Returns work in progress: When a subagent stops at its turn limit (maxTurns), it no longer pretends to have finished — it now returns its output clearly marked as "incomplete."
- Doesn't quit on its own: Non-interactive sessions (
-p, SDK, cloud execution) now automatically pick up where they left off even if the response is cut short by a transient server-side error. - Doesn't over-ping: A
/goalwaiting session now limits check-ins about long-running background work to a maximum of three times per goal.
A hole around authentication was also closed. In environments configured with a third-party gateway (ANTHROPIC_BASE_URL), telemetry and metrics requests were being sent with the API key attached; this was fixed so that credentials are sent only to their intended destination.
Key points of the two versions
| Version | Main contents |
|---|---|
| v2.1.246 | Auto mode tab in /permissions (view and edit classifier rules) / warning for wildcards before subcommands / forced approval for malformed commands / explicit incomplete output from subagents / auto-continuation for non-interactive sessions |
| v2.1.245 | Fixed a bug that caused a startup crash on Linux distributions using glibc 2.44 (Arch Linux, CachyOS, Fedora Rawhide, etc.) |
What adopters should reclaim now
If you're going to use Auto mode by default, it's safer to run through this checklist once, in order.
- Open the Auto mode tab in
/permissionsand eyeball what the classifier is auto-approving. - In your Bash permission rules, check whether any wildcard is placed before the subcommand, and tighten it if so.
- For agents you run unattended, establish a practice of periodically reviewing whether any unexpectedly broad permissions have crept in.
The homework left behind convenience
The shift of handing approval from humans to AI resolves the click-hell of confirmations, but it also has a side that makes it harder for operators to grasp the basis for each decision. This new tab gives, for the first time, a foothold for inspecting and correcting that basis — but opening it doesn't automatically make things safe. One can also raise the concern that unless you decide who reviews it, how often, and by what criteria, the visibility risks going to waste. The wildcard warning and the forced approval of malformed commands are, likewise, safety nets that assume a human will review the settings. The more you keep agents running without stopping, the more a practice of writing down and preserving your permission design pays off.
It's not a flashy new feature, but for teams running coding agents unattended, it can be called a step toward taking back into your own hands the scope of what you delegate.
References: Claude Code changelog (official) / anthropics/claude-code CHANGELOG / Releasebot: Claude Code Updates / Anthropic: Auto mode as the default in Claude Code
