Teach Claude Code Auto Mode What Your Team Trusts

Lachlan Reed

G'day, this is the Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan. Here's a situation you might know. You flip on auto mode, Claude's cruising along, and then it stops dead because it wants to push to a sibling repo in your own GitHub org. Nothing wrong with the push. The classifier just has no idea that repo is yours.

James Turner

And that's the default behavior, by design. Per the auto mode docs, the classifier trusts only your working directory and the current repo's configured remotes. Everything else, your company's other repos, a team S3 bucket, an internal API domain, counts as potentially outside your boundary. Claude Code 2.1.304, released October 19, 2026, makes the fix for that available in a lot more places. The slash auto mode setup command now works on Amazon Bedrock, Google Vertex AI, Microsoft Foundry, Claude apps gateway sessions, and telemetry disabled sessions.

Lachlan Reed

Which ties back to the episode we did on 2.1.302 and CLAUDE_CODE_AUTO_MODE_MODEL, pinning the client side classifier model on Bedrock, Vertex, and proxy setups. That gave those teams control over which model judges the actions. This gives them a way to tell that classifier what's trusted, without hand writing it.

James Turner

Right. So what does the command actually do? You run slash auto mode setup, and Claude Code drafts autoMode.environment entries, and sometimes rule entries too, from your project and your recent sessions. Those entries are plain prose, not regex. Things like "Source control: github.example.com/acme-corp and all repos under it", or "Trusted cloud buckets: s3://acme-build-artifacts", or "Trusted internal domains: star dot corp dot example dot com".

Lachlan Reed

What does it read to get there? Always your project's CLAUDE.md, README, config files, and git remotes. Your existing autoMode and permissions.allow settings. And the hosts, buckets, and command names from commands Claude ran in recent sessions in that project. The docs are explicit that it's never your messages. Then there are two optional scans you opt into. One reads the first word of each command in your shell history. The other reads the remote hosts and names of repositories under your home directory.

James Turner

Then you get a draft, and here's the thing to know: you accept or discard it as a whole. No picking single lines in the dialog. So accept, then open ~/.claude/settings.json and trim anything too generous. When it saves, it writes to that user settings file, and it includes "$defaults" in the allow, soft deny, and hard deny lists it touches, so the built in rules you haven't replaced stay active. It'll also offer to remove permissions.allow rules that auto mode ignores, like a blanket Bash star.

Lachlan Reed

After that, run claude auto mode config. That prints the effective rules so you can confirm your entries landed. And if you're curious what you're layering on top of, claude auto mode defaults prints the built in entries.

James Turner

Now the caveats, and there are a few. First, scope. The classifier does not read autoMode from .claude/settings.json or .claude/settings.local.json in the repo. That's on purpose, because a checked in repo or a build step could otherwise inject its own allow rules. So for a team, you'd distribute trusted infrastructure through managed settings instead. Second, it needs a Pro, Max, or Team plan and Claude Code 2.1.228 or later, and it can't run in a cloud session.

Lachlan Reed

Third, ask and deny rules still win. Put Bash(git push star) in permissions.ask and you'll still get a prompt in auto mode, because those rules run before the classifier. Handy if you want a human checkpoint on pushes. And if the setup dialog nags you, "Teach auto mode about your environment?", you can switch off both the offer and the command with a skillOverrides entry in your user settings: auto mode setup, set to off.

James Turner

Quick hits from the same release. The Ctrl+O transcript view now lists the names of tools called earlier in the compaction summary. On Pro and Max, you get a warning when resuming an inactive conversation would eat a noticeable share of your five hour limit, with the option to start fresh and let Claude look up the old one.

Lachlan Reed

Two fixes worth knowing. CLAUDE_CODE_AUTO_COMPACT_WINDOW set to 200k used to silently become a 100K window. It now accepts k and M suffixes and warns when a value's out of range. And self paced loop wakeups scheduled at the one hour maximum were firing just after the one hour prompt cache expired, so they re read the whole conversation uncached. That's fixed too. Also, Code Review owners can now pick Quick, Standard, or Deep levels. That's the changelog for today.