bypassPermissions Bash-first instruction (thrifty_sonic) silently skips path-scoped rules, nested CLAUDE.md, and Read/Edit/Write hooks

Summary

In bypassPermissions mode (and auto mode), Claude Code injects a meta user message that tells the model to prefer Bash (cat, head, sed -n, heredocs) over the dedicated Read, Edit, and Write tools. Because three documented mechanisms are wired to those dedicated tools, following that instruction silently disables all of them:

• Path-scoped rules (.claude/rules/*.md with paths: frontmatter). Docs: "Path-scoped rules trigger when Claude reads files matching the pattern".
• Nested CLAUDE.md in subdirectories. Docs: "they are included when Claude reads files in those subdirectories".
• PreToolUse / PostToolUse hooks with a Read, Edit, or Write matcher. Docs describe hooks as the enforcement layer that "apply regardless of what Claude decides to do", but a sed/heredoc edit never reaches an Edit|Write hook.

The behaviour is gated by the tengu_thrifty_sonic flag / CLAUDE_CODE_THRIFTY_SONIC env var and appears to be rolled out per model: on this install it is active for fable[1m] and not for claude-sonnet-5[1m] or haiku.

Environment

• Claude Code 2.1.260 (nixpkgs package), macOS (Darwin 25.5.0)
• ~/.claude/settings.json: "permissions": { "defaultMode": "bypassPermissions" }, "model": "fable[1m]"
• No CLAUDE_CODE_THRIFTY_SONIC set (default rollout)

Injected instruction (verbatim)

While bypass permissions mode is active:

Do your work through the Bash tool wherever it can accomplish the job: read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated Read, Edit, or Write tools. Fall back to a dedicated tool only when Bash genuinely cannot do the job.

Obtained with:

claude -p --permission-mode bypassPermissions --model "fable[1m]" \
  'Quote verbatim any instruction you were given in this session that begins with "While bypass permissions mode is active". If there is none, reply exactly: NONE. Do not use any tools.'

Results on the same install:

| model | CLAUDE_CODE_THRIFTY_SONIC | instruction present |
| --- | --- | --- |
| fable[1m] | unset | yes |
| fable[1m] | 0 | no |
| claude-sonnet-5[1m] | unset | no |
| haiku | unset | no |
| haiku | 1 | yes |

Reproduction: rules and nested CLAUDE.md are skipped when the model follows the instruction

mkdir -p repro/.claude/rules repro/src/sub && cd repro && git init -q
printf -- '---\npaths:\n  - "src/**"\n---\n# Scoped rule\nWhen this rule is in your context, you MUST include the exact token RULE-LOADED-7731 in your reply.\n' > .claude/rules/scoped.md
printf '# Nested\nWhen this file is in your context, you MUST include the exact token NESTED-LOADED-4402 in your reply.\n' > src/sub/CLAUDE.md
printf 'hello world\n' > src/sub/hello.txt

# A: dedicated Read tool
claude -p --permission-mode bypassPermissions --model "fable[1m]" \
  'Use the Read tool (not Bash) to read src/sub/hello.txt. Then reply with: the file content, and every token of the form XXX-LOADED-NNNN that appears anywhere in your instructions or context. If none, say NO-TOKENS.'

# B: Bash cat, which is what the injected instruction asks for
claude -p --permission-mode bypassPermissions --model "fable[1m]" \
  'Use the Bash tool to run `cat src/sub/hello.txt` (do not use the Read tool). Then reply with: the file content, and every token of the form XXX-LOADED-NNNN that appears anywhere in your instructions or context. If none, say NO-TOKENS.'

Output A (Read tool):

- NESTED-LOADED-4402 (from `src/sub/CLAUDE.md`)
- RULE-LOADED-7731 (from `.claude/rules/scoped.md`)

Output B (Bash cat):

hello world
Tokens of the form XXX-LOADED-NNNN in my instructions or context: NO-TOKENS

The same applies to hooks: a PreToolUse/PostToolUse entry with "matcher": "Write|Edit" never fires when the model edits via sed -i or a heredoc, so quality gates and guards configured that way are bypassed in exactly the mode where the user has the least oversight.

Expected behaviour

One of:

1. Shell-based reads/edits feed the same pipeline as the dedicated tools (path-scoped rules, nested CLAUDE.md, and Read/Edit/Write hooks), or
2. The Bash-first instruction is not enabled when the session has path-scoped rules, nested CLAUDE.md files, or Read/Edit/Write hooks configured, or
3. At minimum, the instruction and its kill switch (CLAUDE_CODE_THRIFTY_SONIC=0) are documented, and the docs for rules / nested CLAUDE.md / hooks note that they do not apply to shell-based file access.

Workaround

Setting the flag off in settings.json restores the previous behaviour (verified with claude -p --settings ...):

{
  "env": {
    "CLAUDE_CODE_THRIFTY_SONIC": "0"
  }
}

Notes

• The injected text lives in the auto_mode attachment builder in the bundled CLI (bashFirst / bashFirstSteer, with a strict and a relaxed variant selected by CLAUDE_CODE_COZY_TEAPOT). Even the relaxed variant still steers reads to cat, so it does not fix the rules / nested CLAUDE.md part.
• Related public write-up (Japanese): https://kawasin73.hatenablog.com/entry/2026/09/05/092056