[Bug] Excessive context re-sending in tool round-trips due to CLAUDE.md file inclusion

~~ConfigChanged hook might enable you to prevent the instruction~~

Proposed solution for Antrhopic: allow decision control on InstructionsLoaded and/or include InstructionsLoaded in ConfigChanged.

Currently there is no straightforward method to prevent this issue.

Current workarounds

• set claudeMdExcludes in the settings for sessions or teammates that are going to be subjected to CLAUDE.md and other instruction files
• configure PreToolUse hooks for intercepting and mocking/deferring Write,Edit, and somehow an omnipotent Bash matcher for writes to the instructions files to prevent actual file change to the live files
• deny all writes to those files and configure a hook/instructions to tell the agent to write to some fork of them isntructions files to later merge into the live state

sudo chown notclaude:notclaude CLAUDE.md
sudo chmod 644 CLAUDE.md
sudo chmod +t .          # sticky: only owner can unlink their files

-

sudo chattr +i CLAUDE.md          # immutable
lsattr CLAUDE.md
sudo chattr -i CLAUDE.md          # to edit it yourself

Claude can we gaslight writers that they're writing to the files?

Yes — that's an overlayfs upper layer inside a private mount namespace. Writes land in a scratch dir, the real file is untouched, nothing outside the namespace sees the change, and the upper dir is your reviewable diff.

bubblewrap (simplest)

mkdir -p /tmp/cc-upper /tmp/cc-work

bwrap --dev-bind / / \
  --overlay-src "$PWD" \
  --overlay /tmp/cc-upper /tmp/cc-work "$PWD" \
  claude

Requires bubblewrap ≥ 0.9 (bwrap --version). Inside, the agent writes CLAUDE.md normally and gets a success. Outside, your file is unchanged.

Throwaway variant — writes vanish on exit:

bwrap --dev-bind / / --overlay-src "$PWD" --tmp-overlay "$PWD" claude

Plain unshare, if bwrap is too old

unshare -m --map-root-user bash -c '
  mount -t overlay overlay \
    -o lowerdir="'"$PWD"'",upperdir=/tmp/cc-upper,workdir=/tmp/cc-work \
    "'"$PWD"'"
  exec claude
'

Reviewing and applying

Everything the agent touched is in the upper dir, whole-file:

find /tmp/cc-upper -type f
diff -u CLAUDE.md /tmp/cc-upper/CLAUDE.md

Apply selectively:

rsync -a /tmp/cc-upper/CLAUDE.md ./

Or all of it:

rsync -a --exclude='.wh.*' /tmp/cc-upper/ ./

Discard: rm -rf /tmp/cc-upper /tmp/cc-work.

Caveats

• upperdir and workdir must be on the same filesystem, and it needs trusted.* xattr support — ext4/xfs/btrfs are fine, and your NVMe setup is fine. Don't put them on tmpfs on older kernels.
• Deletions show up as .wh.NAME whiteouts or char-dev 0:0 nodes in the upper dir, hence the rsync exclude.
• If $PWD is already on an overlay (inside a container), stacking fails — use fuse-overlayfs instead.
• Scoping the overlay to just the instruction files rather than the whole tree is cleaner if you want the agent's code changes to be real: overlay a .claude/ subdir only, and leave the rest bind-mounted normally.

This is strictly better than the chattr/permissions route for your case: the agent gets a plausible success instead of an EPERM it will try to route around with sed -i.

Hold on this only protects other processes

Cooking

This repo's CLAUDE.md is ~900 lines and re-sends on every tool round-trip.

That's a little much. Have you explored path scoped rules.md files yet?

Sounds like you're getting bullied three times?

• Cachd miss from CLAUDE.md change?
• Antrhopic AB testing causes model to use sed/python
• (to bypass your deny rules on the files?) instead of Update?
• This nukes the ctx too.

Typical Tuesday I'd say