torben
18ae28f918
Chemenu kompiliert Rohnotizen zu einem verlinkten, quellengebundenen Wiki: raw/ -> types/ + tools/ -> kb/ -> reports/. Was mechanisch ist, macht tools/wikitool; was Urteil braucht, macht ein Agent unter Contracts, deren Grenzen in Code durchgesetzt sind statt im Prompt. Dieser Commit ist der Startpunkt der oeffentlichen Historie. Die vorherige Entwicklung fand in einer privaten Instanz statt und ist nicht Teil dieses Repositorys; ihre Erzaehlung steht vollstaendig in CHANGES.md, das mit 44 Eintraegen von 0.1.0 bis 2.1.0 erhalten geblieben ist. Der mitgelieferte Korpus ist ein Testbett und eine Demo: 170 Seiten ueber den Stack selbst - Gates, Lint, Versionierung, Suche, das Wiki-Muster. Er dokumentiert das Werkzeug mit den eigenen Mitteln des Werkzeugs. Lizenz: AGPL-3.0 fuer den Stack (tools/, types/), CC-BY-4.0 fuer die Inhalte. Die Grenze zwischen beiden ist der Dateiplan, den dist export berechnet - siehe NOTICE.
123 lines
6.7 KiB
Markdown
123 lines
6.7 KiB
Markdown
# Conversation Transcript - Auto Mode and Tool Choice Session
|
|
|
|
> Source: Claude Code session (`claude-opus-5`), llm-wiki-test1 workspace
|
|
> Collected: 2026-08-31
|
|
> Participant: Torben
|
|
> Fidelity: **faithful summary transcript, not a verbatim log.** Reconstructed by the assistant
|
|
> at the end of the session. Torben's question is quoted verbatim; the assistant's reasoning is
|
|
> condensed. Command outputs quoted below are real.
|
|
> **The findings in the "documented" section below come from a `claude-code-guide` subagent that
|
|
> searched the Claude Code documentation during this session.** They are second-hand relative to
|
|
> this transcript and are marked as such where it matters.
|
|
> No credentials appeared in the session.
|
|
> One of three transcripts cut from the same session; the other two cover the tooling fixes for
|
|
> issues #12/#13, and issue triage and planning.
|
|
|
|
Covers a correction to the assistant's own working method, and what could and could not be
|
|
established about the harness behaviour that caused it. This is about **Claude Code**, the
|
|
harness - not about the wiki stack. No commit resulted; the outcome was a persisted preference
|
|
and a queued product feedback draft.
|
|
|
|
---
|
|
|
|
## Turn 1 - "Warum verwendest du seit neuestem immer die Shell um Dateien zu editieren?"
|
|
|
|
Torben's full message: *"Warum verwendest du seit neuestem immer die Shell um Dateien zu
|
|
editieren anstelle der file edit Tools? Das macht die Session schwer nachvollziehbar."*
|
|
|
|
The cause was an instruction injected into the session by the active permission mode:
|
|
|
|
> While auto mode is active: Do your work through the Bash tool wherever it can accomplish the
|
|
> job: read files with `cat`, `head`, or `sed -n`, search with `grep` and `find`, and make file
|
|
> changes with `sed`, heredocs, or short scripts, rather than using the dedicated Read, Edit, or
|
|
> Write tools. Fall back to a dedicated tool only when Bash genuinely cannot do the job.
|
|
|
|
The assistant had followed it and, in doing so, rewritten `lint.py`, `frontmatter_io.py` and
|
|
`run_budget.py` through heredoc'd `python3 - <<'PY'` blocks performing `s.replace(old, new)`.
|
|
|
|
**The cost Torben identified is real and specific:** such a block shows the reader two string
|
|
literals and no diff. What was in the file before, and what is in it now, is not visible. The
|
|
`Edit` tool shows exactly that. For a one-line `sed` the difference is immaterial; for a
|
|
multi-block rewrite of a compiler module it is not.
|
|
|
|
Resolution: the user's explicit instruction outranks a mode default, and the mode's own text
|
|
carries the qualifier - *"wherever it can accomplish the job"*. An edit whose diff nobody can
|
|
review does not accomplish the job. Reading with `cat`/`sed -n` stays fine; writing does not.
|
|
The preference was written to the assistant's persistent memory so it survives the session, and
|
|
the working rule became: `Edit`/`Write` for file changes, Bash for `git`, `pytest`,
|
|
`tools/wikitool`, `grep`, `find`.
|
|
|
|
---
|
|
|
|
## Turn 2 - "Was ist denn der Hintergrund zu dieser Vorgabe des Auto Modus?"
|
|
|
|
The assistant separated what it could establish from what it could not, rather than
|
|
constructing a plausible rationale - the failure mode `SOUL.md` names as the cardinal one.
|
|
|
|
**Established locally**, from `claude --help` on Claude Code 2.1.251:
|
|
|
|
- `auto` is one of six values for `--permission-mode`, alongside `acceptEdits`,
|
|
`bypassPermissions`, `manual`, `dontAsk` and `plan`. It is a *permission* mode, not a
|
|
performance mode.
|
|
- The Bash tool in this session carries a `dangerouslyDisableSandbox` parameter, so it is
|
|
sandboxed by default, and the session's scratchpad directory is described as usable "without
|
|
permission prompts".
|
|
|
|
**Explicitly marked as speculation at the time:** that the Bash preference exists because
|
|
sandboxed shell work is the path the mode can approve without asking, while `Write`/`Edit` are
|
|
what a permission system most wants to gate. Congruent with the mechanics, but unsourced.
|
|
|
|
Torben asked for the documented answer, and a `claude-code-guide` subagent was dispatched with
|
|
an explicit brief to separate documentation from inference and to name gaps as gaps.
|
|
|
|
### What the subagent found documented
|
|
|
|
- **`auto` mode** runs a separate classifier model (default Claude Sonnet 5) that evaluates
|
|
actions before execution instead of prompting. It auto-approves read operations and file
|
|
changes *inside the working directory*, checks everything else against a fixed blocklist
|
|
(deletes, force-pushes, credential exposure), and falls back to a prompt when uncertain -
|
|
except in `-p` non-interactive runs. Built-in default on Pro/Max/Team plans from v2.1.228
|
|
(macOS/Linux/WSL) and v2.1.233 (Windows).
|
|
- **Switching it:** `Shift+Tab` cycles modes in a running session; `claude --permission-mode
|
|
auto` at startup; `permissions.defaultMode` in `~/.claude/settings.json` for a machine, or
|
|
managed settings for an organisation. **There is no `/auto` slash command** - the assistant
|
|
had claimed one existed earlier in the session and corrected itself here.
|
|
- **A documented trap:** a `"auto"` value for `permissions.defaultMode` in a *project*
|
|
`.claude/settings.json` or `.claude/settings.local.json` is **ignored**. Only the global file
|
|
and managed settings accept it.
|
|
- Configuration surface for the mode: `autoMode.environment`, `permissions.allow`/`deny`,
|
|
`disableAutoMode`.
|
|
|
|
### What the subagent could not find
|
|
|
|
**The Bash preference itself is not in the public documentation** - neither its text nor a
|
|
rationale - and no setting was found that disables it without leaving `auto` mode entirely.
|
|
|
|
### State of this instance
|
|
|
|
`~/.claude/settings.json` contains only `theme`, `inputNeededNotifEnabled` and
|
|
`agentPushNotifEnabled` - no `permissions.defaultMode`. So `auto` was the built-in default for
|
|
the plan and version, not a choice anyone made here.
|
|
|
|
### Recommendation given
|
|
|
|
Stay in `auto` mode. Leaving it costs permission prompts on everything, for a problem a standing
|
|
preference already solves. The alternative named for completeness:
|
|
`permissions.defaultMode: "acceptEdits"` in the global settings file, which approves edits and
|
|
prompts on shell commands - practically the inverse of the complaint.
|
|
|
|
One judgment was stated as a judgment: an injected instruction that changes visible working
|
|
behaviour ought to be documented and individually disableable. That was drafted as product
|
|
feedback, queued locally for Torben to send or discard.
|
|
|
|
---
|
|
|
|
## Outcome
|
|
|
|
| Artifact | Result |
|
|
|---|---|
|
|
| Working method | `Edit`/`Write` for file changes; Bash for `git`, `pytest`, `wikitool`, `grep`. Persisted to the assistant's memory |
|
|
| Corrections made | The claim that a `/auto` slash command exists was wrong and was retracted |
|
|
| Documentation status | `auto` mode documented; its Bash preference not |
|
|
| Repo | No change. This turn produced no commit |
|