Managing Auto Mode Read Permissions in Claude Code 2.1.310

Lachlan Reed

Picture this. You've got auto mode running, you wander off to make a coffee, and you come back to find it parked on a prompt about reading a file outside your project. That's the setup for today's episode of the Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan, and today it's one small wording change in version 2.1.310, released October 23rd, that explains a pretty annoying behavior.

James Turner

I'm James. Here's the exact change. In 2.1.310, auto mode's prompt before the first read outside your working directories now tells you when blocking those reads makes shell commands ask for permission. For context, in auto mode, reads inside your working directory tree, plus any directories you added with the add dir flag, go through automatically. When the agent reaches outside that, say a shared library in a sibling folder, a dotfile in your home directory, or a parent repo, auto mode stops and asks you to establish trust.

Lachlan Reed

And here's why that matters. Hitting deny feels like the safe, tidy answer. But if you deny, that directory stays a hard boundary, and then shell commands that touch those paths, think build tools, package managers, git scripts, will ask for manual approval again and again. My read on it is that if you're away from the keyboard, that's what stalls the run. The prompt now tells you that trade up front, so you're not finding out the hard way.

James Turner

So how do you use this? You've got three options. First, answer the prompt in the moment. You can allow the read for the session, or add the directory permanently. Second, declare it before you start. Run claude with the add dir flag followed by the path, and Claude Code treats that folder as a trusted project root from the first prompt. Third, pre approve it in settings. In .claude/settings.json, or settings.local.json if it's just for your machine, add an entry under permissions allow. It's a Read rule pointing at the path with a double star glob, something like Read of slash path slash to slash shared lib slash double star. If you're ever unsure what's active, run slash status inside the session to check auto mode eligibility and your current permission settings.

Lachlan Reed

Two caveats. First, as far as the release notes go, this is a change to the message, not a new permission model. Nothing about what gets blocked changed, you just get told the consequence. Second, keep those allow rules narrow. A broad glob means an unattended session can read a lot more than you probably intended, so point it at the one shared folder, not your whole home directory.

James Turner

Now a few smaller things from 2.1.310 worth knowing. If you run headless, with the p flag or the Agent SDK, and an MCP tool call times out while the server's elicitation is unanswered, Claude now gets told that no answer came and not to repeat the call. That should stop a headless job from hammering the same call. Also in headless sessions, memory use during compaction is improved when the transcript file is very large.

Lachlan Reed

A couple more. A question's auto continue timer used to fire the moment your external editor closed after a long edit, and that's fixed. For tmux users, mod images now draw inline when allow passthrough and focus events are on, in kitty, Ghostty, and iTerm2 3.5 or newer with fullscreen rendering, where before you only saw the alt text. And for cloud sessions, there's a new Choose file button to load an environment's setup script from a file, and the setup output now shows in a scrolling box. Run claude with the version flag, check you're on 2.1.310, and go pick which folders you actually trust before your next long run.