[Bug] Auto-mode "bashFirst" system prompt instructs sed/heredoc file edits instead of Edit/Write tools
Status Open
Reported on v2.1.234
Maintainer reply None cached
Activity 13 comments · opened Aug 19, 2026
Bug Description
Auto-mode tries to edit files via Python scripts thanks to this bad instruction, please fix it:
It's hardcoded in the CLI binary — not your config. I found it in /opt/claude-code/bin/claude (the real binary; /usr/bin/claude is a 4-line wrapper). The raw template: …read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated ${Qs}, ${xl}, or ${fu} tools. Fall back to a dedicated tool only when ${_i} genuinely cannot do the job. and the gate that selects it: s = tools.has(Bash) && (tools.has(Edit) || tools.has(Write)) && d5o(); return [{ type:"auto_mode", bashFirst: s, steerOnly: o, bypass: n }] bashFirst fires when the session has Bash and Edit/Write, and an internal gate d5o() returns true. There is no settings key and no env var — it's a code-level feature gate. bypassPermissions has its own sibling injection, so bypass isn't an escape either.
Environment Info
- Platform: linux
- Terminal: vte-based
- Version: 2.1.234
- Feedback ID: 454c9a94-1484-4204-84c3-861352e878c3
Errors
[]Showing cached comments. Read the full discussion on GitHub ↗
3 Comments
+1, this is really disruptive to my workflow. I can't see the edits as they go by without clicking into the shell operations. Single file edits should be done using the edit/write tools even in auto mode. I'm having to prompt my way around this by instructing it to ignore that template instruction.
Auto-mode "bashFirst" system prompt is an Accessibility Violation for Blind Users
Confirming this is code-level, not config, matches what I found: no setting anywhere lets me keep auto mode's approval behavior while turning off bashFirst.
I'm legally blind. Read/Edit/Write produce a diff — that's the only channel I have for knowing what changed in a file. sed, heredocs, and cat > file produce none of that: the file changes, nothing legible marks what changed, and there's no built-in way back. paulirwin above can at least glance at the shell output; I can't use that fallback at all.
This isn't a workflow inconvenience for me, it's the removal of the only accessible review channel I have, turned on by default, with no disclosure and no toggle. Since it's gated in the binary (d5o()), the fix has to ship as a real setting — auto-approval and Bash-first edit routing need to be separable.
Yes, I am angry at Antrhopic, because we are paying a lot of money for this tool -- it is not free or a community project. Anthropic has the absolute duty to make a best effort at making this tool safe. Anthropic is violating its duty to users to give it a system prompt we cannot override that deliberately tells Claude to use Bash for everything which is not safe and bypasses tool checks such as edit diffs and invites irreversible changes to the user's system.
This problem is destroying my life. Please fix this issue now!!!!!!