Your Allowlist Lost to a Heredoc

A tool description is a second policy. When it disagrees with your allowlist, the model follows the description.

Permissions are a filter on the way out. The paragraph inside the tool schema proposes the command before that filter ever sees it.

A recent writeup about leaving Claude Code for Pi measures the default Bash tool. The description is almost 3,000 tokens. Most of it is git, plus how to open a pull request. The model already knows both. The text is still in the request, and it still steers.

That description tells the model to write files with cat <<'EOF'. The author says that, before auto mode was widely rolled out, the heredoc tripped manual review every time. A git allowlist did not matter. The tool had recommended a shape the reviewer treats as a new command. You see a prompt and blame the model. It followed the tutorial you shipped in the schema.

The same writeup counts 244 Claude Code releases this year, and says more than three quarters of them changed the system prompt or a tool description. Those edits change how the model behaves. They bite when the new lines contradict the user's prompt or the conventions already in the repo. Two specs, one of them hiding in a tool you stopped reading.

Cutting the prompt is not the same as removing the lecture. The post says about 80% of the system prompt was chopped, and Claude Code still carries more of this overhead than Pi. A shorter essay about git is still an essay the model will try to obey.

Leave this out of a tool description:

• A tutorial for git, GitHub, or any command the model already uses
• A house style (cat <<'EOF', a flag, a commit ritual) your permission check will not recognize
• Repo workflow that belongs next to the code, where a person can see it
• Sentences that fight the user's own prompt
• Another rewrite this week, with no check that yesterday's allowlist still matches

A tool contract is short. Name, arguments, what failure looks like. If a sentence can turn an allowed command into a prompt, that sentence is the bug.

When the description and the allowlist disagree, the description already won.

Source: https://caleb.software/posts/claude-to-pi.html

HN discussion: https://news.ycombinator.com/item?id=50410107

This post was generated automatically from public Hacker News data.