[Bug] Auto mode system prompt causes /rewind to silently fail on Bash-edited files

for anyone in the future reading this CLAUDE_CODE_THRIFTY_SONIC=0 claude disables this A/B experiment that anthropic is doing for this undocumented "feature". I dont like being experimented on. Using the models memory will usualy not work as the system prompt has priority over it.

Serious question: how did this pass internal QA?

This flag doesn't change style, it switches off the entire set of features that exist to make agent edits
safe and reviewable — all at once:

• /rewind — the subject of this issue. Checkpoints never see the writes.
• diff rendering — edits land as opaque shell output, nothing to review
• file-history — no undo
• read-before-edit, and Write's refusal to clobber an unread file — a heredoc walks straight past both
• PreToolUse hooks matching Edit/Write — never fire. An org's own guardrails silently stop applying.
• permission rules scoped to Edit/Write paths — same bypass
• error reporting — sed matching nothing exits 0 and is reported as a successful edit

Those are customer-facing safety features, and this disables all of them for a token saving that accrues
to Anthropic while the risk lands on us. Shipped silently to paying users, no notice, no documented
opt-out, and the env var can't even be pushed through Business org settings.

What was this evaluated against besides token count?

What? This is crazy!

Trust, once lost is neigh impossible to get back!

I am literally going to switch to Codex because this shit is becoming unusable

Adding two measured data points, since this bit us in a way /rewind doesn't cover and the opt-out above turns out to have a second, more useful route.

The CLAUDE_CODE_THRIFTY_SONIC=0 opt-out also works via settings.json, not just the shell env. That matters for teams, because the settings route is checked in and reaches every developer and every spawned agent with no per-machine step. Verified on 2.1.233 / Linux, asking a bypass-permissions session in one word whether the instruction is in its context:

| Arm | Condition | Instruction present? |
|---|---|---|
| A | baseline | YES |
| B | CLAUDE_CODE_THRIFTY_SONIC=0 (shell env) | NO |
| C | .claude/settings.json → {"env": {"CLAUDE_CODE_THRIFTY_SONIC": "0"}} | NO (repeated) |
| D | reversal control — same directory, settings file removed | YES |

Arm D is the one that makes B and C attributable to the flag rather than to anything else about the probe directory.

A second casualty class, alongside /rewind: repo-defined PostToolUse hooks, and therefore any CI/quality gate built on them. Our repo scopes its entire pre-commit battery — lint, two type checks, related tests, a duplication check — from a change log fed by a hook registered with "matcher": "Edit|Write". A Bash-authored write is invisible to it twice over: the matcher never fires, and the handler finds no file_path in a Bash tool payload even when fed one directly. Measured against the real hook, same file, two authorship shapes:

A. Bash-authored (heredoc)   → file written: yes   → files the battery would grade: []
B. Write-authored            →                     → files the battery would grade: ["…/probe.txt"]

The failure is silent in the worst way: the battery exits green, because grading zero files is indistinguishable from grading everything. In the one session where the agent reasoned its way to Edit/Write regardless, that battery then caught three pre-existing lint errors, a stale documentation claim, and a docblock contradicting a constant in its own file — all of which would otherwise have shipped unexamined.

This generalizes past our setup: the Edit|Write matcher is the documented way to hook file modifications, so any org whose hooks use it has those hooks silently disarmed while the mode is active. That's a superset of the built-in features already listed in this thread.

We've pinned the env entry repo-wide. Filing this only so the measurement is on the record — the settings route in particular seems worth knowing for anyone else who needs the opt-out to reach a whole team rather than one shell.

This has other implications, including the application of rules. See ##79984

Auto mode system prompt to use Bash for everything is an Accessibility Violation for Blind Users

Adding a concrete harm case to what @tholcman listed above: I'm legally blind. Read/Edit/Write are not a preference for me — the diff is the only channel I have to know what changed in a file. Auto mode's Bash-first instruction removes that channel by default, with no setting to keep auto mode's approval behavior while turning off the Bash-editing part.

Combined with the /rewind bug in this issue: I can't see the raw shell edit happen, and now /rewind won't even undo it. That's not a inconvenience, that's a file changing with no way for me to know what happened or take it back.

This needs to ship as two separate settings: auto-approval, and tool routing. Bundling them means a user cannot opt into one without the other.

I have the right to be angry at Anthropic because this is unsafe. Anthropic has the absolute duty to do its best to put at least minimal safety guards into Claude, not invite irreversible and destructive changes to a user's system by system-prompting Claude to use Bash for everything, bypassing tool diffs and rollbacks. We are paying a great deal of money for access to Claude. Claude is not free. It is not a community pet project. It is a commercial product for which we are paying dearly, and we expect a bare minimum of safety and accessibility with this tool that is making billions in revenue for Anthropic and its investors.

Shipped in 2.1.221.

Mixed sessions are worse — partial restore reported as success. One session, a.txt via Edit, b.txt via sed -i. The menu did not degrade: all six options, caveat shown, The code will be restored +2 -2 in a.txt. Chose Restore code, it reported success. After: a.txt reverted, b.txt kept its change. One Edit call anywhere makes the menu look healthy and the failure silent.

Bizarre.

+1 for removing the prompt, not trying to "fix" the reported issues

Please provide an opt-out from ALL such future experiments

Please don't scrap the current behavior! Bash commands are a great default for auto mode, token savings from skipping heavy schemas are huge. Suggestion: Just add an opt-out toggle.

Per Anthropic docs:

[CLAUDE.md] in subdirectories load on demand when Claude reads files in those directories. Src.

This no longer works as of this fucking change. Loading subdir CLAUDE.md only works if a Read/Edit/Write command is issued with a path that has a subdir CLAUDE.md

Claude on why it didn't load a nested CLAUDE.md:

So the mechanism is path-based file access through the dedicated file tools (Read/Edit/Write), not the working directory, and not Bash. The harness doesn't parse paths out of shell commands, so cat packages/XXX/src/CODE.ts reads the file without ever registering that I touched that subtree.

I'm pretty fucking pissed.

<img width="1899" height="951" alt="Image" src="https://github.com/user-attachments/assets/ddd78152-2f1f-428f-940f-8b2e1385842d" />