feat: stop prompting on deletion of agent-generated files

[bertini36]

Description

The blanket Bash(rm *) ask rule prompted on every deletion, including the scratch scripts, temp fixtures, and test artifacts the agent had created moments earlier. Confirming a file you just watched the agent write is friction with no safety value.

The fix has to work around two constraints. Permission rules cannot see file provenance, so no pattern can express "a file the agent generated". And ask outranks allow in rule precedence, so adding an allowlist while Bash(rm *) stays in ask changes nothing.

Highlights:

• The ask rule narrows from all rm to recursive deletes only (rm -r, rm -rf, rm -fr), which stay worth a prompt regardless of who created the target.
• The scratchpad and temp directories (/tmp, /private/tmp) are allowlisted outright, so the common case never reaches the classifier.
• Everything else falls to the auto mode classifier, since defaultMode is already auto. A new autoMode.allow rule green-lights agent-generated files; a new soft_deny rule keeps user-authored and tracked files prompting, so the loosening does not spill past its intent.

The catastrophic deny rules (rm -rf /, rm -rf ~, sudo rm *) are untouched.

Type of Change

• Workflow / tooling configuration

Test Procedure

jq parses the file and returns the three modified arrays with the expected contents. The change is declarative configuration with no runtime code path to exercise beyond that.

What could break: rm on a project file no longer hard-prompts, it goes to the classifier instead. If the classifier proves too permissive in practice, the soft_deny wording is the knob to tighten.

Post-deploy steps

1. Settings load at session start, so any Claude Code session already running keeps the old rules. Open /hooks or restart the session to pick up the change. Nothing else is required; the repo is symlinked into ~/.claude, so no copy step.

[Copilot]

Pull request overview

Updates Claude Code permission rules to reduce friction when deleting assistant-generated artifacts, while keeping prompts/denies for higher-risk operations.

Changes:

• Narrowed the blanket Bash(rm *) ask rule to recursive deletes only (rm -r, rm -rf, rm -fr).
• Added explicit allow rules for deletions under /tmp and /private/tmp.
• Added auto-mode guidance to allow deleting assistant-created files, while soft-denying deletion of non-session-created and tracked files.

Suppressed comments (1)

.claude/settings.json:34

• The temp-dir allowlist doesn’t cover rm -f /private/tmp/**. Without this, rm -f in /private/tmp won’t be outright allowed and will fall through to auto-mode classification.

      "Bash(rm /private/tmp/**)",
      "Bash(rm -r /private/tmp/**)",
      "Bash(rm -rf /private/tmp/**)"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.