From 3718cbc67fd19996612f608bb028689453e37510 Mon Sep 17 00:00:00 2001
From: Alberto Pou <albertopouquiros@gmail.com>
Date: Wed, 5 Aug 2026 12:08:00 +0200
Subject: [PATCH] feat: stop prompting on deletion of agent-generated files

The blanket `Bash(rm *)` ask rule prompted on every deletion, including
the scratch scripts and test fixtures the agent had just created itself.
Permission rules cannot see file provenance, and `ask` outranks `allow`,
so an allowlist alone could never silence it.

Narrow the ask rule to recursive deletes, allowlist the scratchpad and
temp directories outright, and let the auto mode classifier judge the
rest: a new allow rule green-lights agent-generated files, while a new
soft_deny keeps untracked user files and tracked files prompting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hsypi4fmvtYK8PZUJgVRFo
---
 .claude/settings.json | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 46b4006..a9d9dfe 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -25,8 +25,18 @@
       "Read(~/.aws/**)",
       "Read(**/.env)"
     ],
+    "allow": [
+      "Bash(rm /tmp/**)",
+      "Bash(rm -r /tmp/**)",
+      "Bash(rm -rf /tmp/**)",
+      "Bash(rm /private/tmp/**)",
+      "Bash(rm -r /private/tmp/**)",
+      "Bash(rm -rf /private/tmp/**)"
+    ],
     "ask": [
-      "Bash(rm *)",
+      "Bash(rm -r *)",
+      "Bash(rm -rf *)",
+      "Bash(rm -fr *)",
       "Bash(git reset --hard*)",
       "Bash(git clean -*)",
       "Bash(gh pr merge *)"
@@ -34,12 +44,17 @@
     "defaultMode": "auto"
   },
   "autoMode": {
+    "allow": [
+      "$defaults",
+      "Delete files the assistant itself created earlier in this session (scratch scripts, temp fixtures, generated test artifacts, build output) without asking"
+    ],
     "hard_deny": [
       "$defaults",
       "Never read, print, copy, or transmit SSH keys, cloud credentials, or .env contents, by any means including cat, head, grep, cp, base64, or a script"
     ],
     "soft_deny": [
       "$defaults",
+      "Never delete a file the assistant did not create in this session, and never delete a tracked file, even when the deletion looks like cleanup",
       "Never discard uncommitted work (git reset --hard, git clean, git checkout --)",
       "Never rewrite published history, force-push, or delete a remote branch",
       "Never merge, close, or delete a pull request, release, or repository"