[DOCS] Auto mode docs omit v2.1.183 destructive git, amend, and destroy safeguards

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://code.claude.com/docs/en/permission-modes

Section/Topic

The auto mode "What the classifier blocks by default" section, plus the related explanation of how explicit user intent clears soft-deny rules.

Current Documentation

The permission modes page currently says:

Blocked by default: Downloading and executing code, like curl | bash Sending sensitive data to external endpoints Production deploys and migrations Mass deletion on cloud storage Granting IAM or repo permissions Modifying shared infrastructure Irreversibly destroying files that existed before the session Force push, or pushing directly to main

The auto mode config page currently says:

soft_deny rules block next. User intent and allow exceptions can override these.

Explicit user intent overrides the remaining soft blocks: if the user's message directly and specifically describes the exact action Claude is about to take, the classifier allows it even when a soft_deny rule matches.

General requests don't count as explicit intent. Asking Claude to "clean up the repo" does not authorize force-pushing, but asking Claude to "force-push this branch" does.

What's Wrong or Missing?

Claude Code v2.1.183 adds several concrete auto mode safety rules, but the user-facing auto mode docs still stop at broad categories and one force-push example.

A. Destructive git cleanup rules are not documented

The v2.1.183 changelog says git reset --hard, git checkout -- ., git clean -fd, and git stash drop are blocked unless the user explicitly asked to discard local work. The current auto mode docs do not mention these command-level examples, so users cannot tell why a generic request like "clean up the repo" still gets blocked.

B. The git commit --amend session-authorship rule is missing

The same release says git commit --amend is blocked when the commit was not made by the agent in the current session. That safeguard is not inferable from the current docs, which only mention broad destructive categories and force-push intent.

C. Stack destroy commands need more specific documentation

The release also says terraform destroy, pulumi destroy, and cdk destroy are blocked unless the user asked for the specific stack. The current docs explain that general requests do not count as explicit intent, but they do not give this stronger stack-specific example, which is likely to surprise users automating infrastructure cleanup in auto mode.

Suggested Improvement

Add a short subsection or callout in the auto mode docs with concrete examples of built-in soft-deny rules introduced in v2.1.183, for example:

• Destructive git cleanup commands such as git reset --hard, git checkout -- ., git clean -fd, and git stash drop require an explicit request to discard local work.
• git commit --amend is allowed only when amending a commit the agent made in the current session.
• terraform destroy, pulumi destroy, and cdk destroy require the user to name the specific stack being destroyed.

It would also help to show one intent example pair, such as:

• Not specific enough: "clean up the repo" or "tear down staging"
• Specific enough: "discard local work with git clean -fd and git reset --hard" or "destroy the staging-us-east-1 Terraform stack"

Keep claude auto-mode defaults as the authoritative full rule dump, but document these high-salience examples in the prose pages because they changed in v2.1.183 and materially affect everyday auto mode behavior.

Impact

Medium - Makes feature difficult to understand

Additional Context

Affected Pages:

| Page | Line(s) | Context |
|------|---------|---------|
| https://code.claude.com/docs/en/permission-modes | 206-229 | "What the classifier blocks by default" lists only broad categories plus force-push as the concrete git example |
| https://code.claude.com/docs/en/auto-mode-config | 101-113 | soft_deny and explicit-intent guidance uses only force-push as the concrete example |

Total scope: 2 pages affected

Version: Claude Code v2.1.183

Changelog cross-reference: The v2.1.183 changelog entry is currently the page that names these safeguards explicitly: destructive git cleanup commands require an explicit discard-local-work request, git commit --amend is limited to commits the agent made in the current session, and terraform destroy / pulumi destroy / cdk destroy require the specific stack to be requested.