[BUG] Auto mode fails to block tool calls that are not allowed by custom configuration

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I have configured my user-level .claude/settings.json with the following configuration for auto mode:

"autoMode": {
	"soft_deny": [
		"$defaults",
		"Any git command."
	]
}

Whitelisted git commands are in a separate permissions.allow block. I therefore expect _any_ git command that goes through auto mode to be blocked. Instead, auto mode approves git commands that I have not whitelisted (git stash and git pop, called in a way that deletes my staged changes).

What Should Happen?

Auto mode should not approve tool calls that are clearly in violation of the user's custom rules defined in autoMode:soft_deny. AND I SHOULD NOT HAVE TO WRITE AUTO MODE RULES IN CAPSLOCK AND EXPLICITLY TELL IT TO BLOCK THESE COMMANDS LIKE THIS FOR CLAUDE TO TAKE MY RULES SERIOUSLY (in case claude did read my "Any git command" rule, but just three words like this is not enough to actually make it work). My prompt also did not contain anything about git, so there was no "user intent" justification for auto mode to allow this (since I put it in soft_deny instead of hard_deny).

Error Messages/Logs

Steps to Reproduce

1. Configure .claude/settings.json with the above rule for auto mode.
2. Run claude code and wait for it to look for pre-existing or unexpected changes, and it wants to verify this by using git stash (this happens quite often when running sessions in parallel on the same codebase).

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.233 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_