[BUG] Auto Mode's Bash-first instruction silently disables nested CLAUDE.md and path-scoped rules

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Auto Mode injects an instruction directing file work through Bash instead of the dedicated
tools. Nested CLAUDE.md and path-scoped .claude/rules/ load only via the native Read
tool. So following the Auto Mode instruction guarantees neither ever loads.

The injected instruction, quoted verbatim from the live context of the Auto Mode session in
which I ran the measurements:

While auto mode is active: Do your work through the Bash tool wherever it can accomplish the job: read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated Read, Edit, or Write tools. Fall back to a dedicated tool only when Bash genuinely cannot do the job.

Every verb named there is measured non-triggering. I tested 27 access methods, each against
its own directory holding a uniquely-sentinelled CLAUDE.md:

| Access method | Loads nested memory? |
|---|---|
| Read tool | yes — the only trigger that exists |
| cat, head, sed -n, grep, find, sed -i, heredoc | no — every verb the instruction names |
| tail, awk, python, ls -la | no |
| PowerShell Get-Content, Select-String, Get-ChildItem, Set-Content, [IO.File]::ReadAllText | no |
| cmd.exe type | no |
| Grep, Glob, Write, Edit tools | no |

The instruction steers explicitly away from Read — the one tool that loads nested memory — and
toward six verbs that do not. The two features are mutually exclusive by construction:

• A session that follows the Auto Mode instruction gets no nested CLAUDE.md and no path-scoped

rules.

• A session that loads nested CLAUDE.md is one that ignored the Auto Mode instruction.

There is no configuration in which both work as documented.

It is silent, and it is sticky. The Bash call succeeds and returns exactly the expected
contents; nothing indicates the governing instructions were skipped. Loading is once per
directory per session, so a single early Bash read costs that directory's memory for the whole
session — and after /compact, anything dropped never comes back, because the re-read is also a
Bash call.

Measured impact in a real repo: one Read of a file under .claude/agents/ pulled in three
path-scoped rules at once. The same file opened with Get-Content pulled in none.

What Should Happen?

Auto Mode should not silently disable a documented memory feature. Any of these resolves it, in
my order of preference:

1. Resolve nested memory for Bash commands that reference paths inside the working directory.

Closes the gap at its source and makes the documented behaviour true for any access method.
Most invasive.

1. **Exempt file reads from the Bash-first steering when the target subtree contains a nested

CLAUDE.md or a matching path-scoped rule.** Keeps Auto Mode's token savings everywhere the
gap does not exist.

1. Soften the instruction so Read stays the default for reading files in subdirectories,

with Bash preferred for search, pipelines, and bulk edits — which is where its savings
actually come from.

1. At minimum, document the interaction. The Auto Mode page currently does not mention the

Bash-first instruction at all (see Additional Information), so there is no way for a user with
per-package CLAUDE.md to learn that it stops applying.

A diagnostic would help independently of which fix lands: surfacing *"N nested memory files were
discovered but not loaded this session"* would make the failure visible instead of silent.

Error Messages/Logs

There is no error output — the silence IS the defect. Every call below succeeds.

Auto Mode instruction, verbatim from live session context:

    While auto mode is active:

    Do your work through the Bash tool wherever it can accomplish the job: read
    files with cat, head, or sed -n, search with grep and find, and make file
    changes with sed, heredocs, or short scripts, rather than using the dedicated
    Read, Edit, or Write tools. Fall back to a dedicated tool only when Bash
    genuinely cannot do the job.

What that instruction produces (step 1) vs. what the docs describe (step 2):

--- Bash tool: cat probe/sub/target.txt          <-- what Auto Mode does
hello
(no memory injected)

--- Read tool: probe/sub/target.txt              <-- what the docs describe
     1  hello
<system-reminder>
Contents of /…/probe/sub/CLAUDE.md:
# Sub
SENTINEL-NESTED
</system-reminder>

Same file. Same directory. Same session. Same turn.
The only variable is which tool opened it.

Steps to Reproduce

1. Enable Auto Mode.

1. From any project root, create the fixture:

``bash
mkdir -p probe/sub
printf '# Sub\n\nSENTINEL-NESTED\n' > probe/sub/CLAUDE.md
printf 'hello\n' > probe/sub/target.txt
``

1. Start a session rooted above probe/.

1. Ask Claude to read probe/sub/target.txt. Under the Auto Mode instruction it will reach for

Bash — cat probe/sub/target.txt.

→ hello is returned. SENTINEL-NESTED is not injected. The instructions meant to
govern that subtree never entered context.

1. Now force the dedicated tool — read the same file with the Read tool.

→ hello is returned. SENTINEL-NESTED is injected.

Step 4 is what an Auto Mode session does. Step 5 is what the documentation describes. They
differ only in tool identity.

To see the same effect on path-scoped rules, which is the higher-impact half: create
.claude/rules/probe.md with paths: src/** and a distinctive instruction in the body, restart
the session (rule discovery is launch-time), then open a file under src/ with cat — the rule
does not fire. Open it with Read — it does. Note that rules dedup once per rule per session,
so run the negative first.

Windows: substitute Get-Content probe\sub\target.txt at step 4 — same result.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.250 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Is this a regression?

Yes, with a caveat worth stating plainly: the Read-only load behaviour is long-standing
(complaints date to 2025), but the Bash-first steering that collides with it arrived with the
Auto Mode rollout. I could not pin the exact version myself. #90088 independently marks the
steering a regression, and #86478 references an auto-mode rollout dated 2026-08-14.

The documentation gap is twofold

| Page | Finding |
|---|---|
| docs/en/memory | Zero occurrences of "auto mode." Says subdirectory files load "when Claude reads files in those directories" — tool-agnostic prose for behaviour that is Read-exclusive. Its only two Read tool mentions are unrelated (HTML-comment stripping; a pre-v2.1.207 glob-bracket bug). |
| docs.anthropic.com/…/memory | Byte-identical to the above (md5 77f47dc4…). Not a second source. |
| docs/en/auto-mode-config | Describes Auto Mode exclusively as a permission classifier — allow / soft_deny / hard_deny, trusted repos and domains. The Bash-first instruction is not documented anywhere on it. The one memory-adjacent sentence points the other way: "The classifier reads the same CLAUDE.md content Claude itself loads." |

So a user reading the Auto Mode page learns it changes permission prompting. Nothing tells them
it also changes which tools Claude uses — which is the actual cause of this bug.

Full access-method matrix — 27 cells, 4 positive

Each cell is an independent directory with a uniquely-sentinelled CLAUDE.md. Rows marked ★ are
verbs the Auto Mode instruction names explicitly.

| Method | Dialect | Result |
|---|---|---|
| Read — absolute path | native | loads |
| Read — relative path | native | loads |
| Read — nonexistent file | native | loads (returns an error; memory injects anyway) |
| Read — file 2 dirs below the CLAUDE.md | native | loads |
| Read — 2nd file, same dir | native | silent (dedup, once per directory per session) |
| Grep tool | native | silent |
| Glob tool | native | silent |
| Write tool | native | silent |
| Edit tool | native | silent |
| ★ cat | POSIX | silent |
| ★ sed -n '1,2p' | POSIX | silent |
| ★ head -2 | POSIX | silent |
| ★ grep -n | POSIX | silent |
| ★ find -type f | POSIX | silent |
| ★ sed -i | POSIX | silent |
| ★ cat > f <<EOF (heredoc) | POSIX | silent |
| tail -2 | POSIX | silent |
| awk 'NR<=2' | POSIX | silent |
| python -c "open(...).read()" | POSIX | silent |
| ls -la | POSIX | silent (prints CLAUDE.md by name) |
| Get-Content | PowerShell | silent |
| Get-Content -TotalCount 2 | PowerShell | silent |
| Select-String | PowerShell | silent |
| Get-ChildItem | PowerShell | silent |
| [System.IO.File]::ReadAllText() | PowerShell | silent |
| Set-Content | PowerShell | silent |
| type | cmd.exe | silent |

All seven starred verbs — the complete set the instruction names — are non-triggering.

Controls

• Same-file within-subject control. One directory's file was read first with cat, then

with Read. The cat injected nothing; the immediately following Read fired. Tool identity
is the only variable.

• Mechanism isolation. A Read of a nonexistent file still injects the directory's

CLAUDE.md — so the trigger is the Read tool resolving its file_path argument, evaluated
independently of whether anything is read.

• Rival explanations ruled out. "Content reaching context" — refuted by Grep, which

returned the file's own lines and injected nothing. "Surfacing the path" — refuted by Glob,
ls -la, find and Get-ChildItem, all of which printed CLAUDE.md by name and injected
nothing.

Path-scoped rules — the higher-impact half

Four independently-scoped bracketed pairs against a real project's live rules. Each ran its
negative first, then a Read against a file matching the same paths: pattern, proving the
rule was still live and the negative genuine:

| paths: scope | Negative method | Negative | Then Read, same pattern |
|---|---|---|---|
| .claude/agents/** | PowerShell Get-Content | no rule | 3 rules injected |
| .claude/skills/** | Grep tool | no rule | 1 rule injected |
| .claude/rules/** | Bash awk over all 10 rule files | no rule | 2 rules injected |
| plugins/** | Bash head -5 | no rule | 3 rules injected |

This matters because path-scoped rules are the documented answer to *"my CLAUDE.md is too
large"* — so in Auto Mode the recommended remedy for context bloat is inert too. Rules also
dedup once per rule per session, so a rule that fires early cannot re-assert itself later
when the model actually reaches the files it governs.

Related issues

| Issue | State | Relationship |
|---|---|---|
| #90088 | open | The symptom, independently observed. "Claude Code is not using native tools like edit and others when set to Auto mode… you should see it uses python or other tools to edit." Filed on macOS / Anthropic API / 2.1.247 — a different platform, so the steering reproduces broadly. Does not connect it to memory or rules. Worth cross-linking. |
| #63142 | closed | Same read-gated load reached via new-file creation. Its premise — "not an issue for editing existing files, since Claude always reads a file before modifying it" — is exactly what Auto Mode invalidates. Worth cross-linking. |
| #48031 | — | CLAUDE_CODE_DISABLE_ATTACHMENTS=1 silently disables subdirectory injection — a second silent-disable path. |
| #2571, #3529, #3103, #18098, #24987 | mixed | Long-running "nested CLAUDE.md doesn't load" reports. Several are plausibly the underlying defect seen from the user side without the trigger identified. |

Limits of this report

• PowerShell ran via powershell.exe launched from the Bash tool, as this build exposes no

separate PowerShell tool — so tool identity at the harness boundary is still Bash. Given that
all three dialects and every native non-Read tool are negative, a first-class PowerShell
executor should behave the same, but that configuration is inference.

• Only Windows PowerShell 5.1 was tested, not pwsh 7.x.
• Edit was measured through the Write→Edit path — the only route to Edit without a

contaminating prior Read, since Write satisfies the read-prerequisite without triggering.

• I did not bisect the regression window for the Auto Mode instruction itself.