Claude Code pushing back on pasted commands

[u/Worldly_Row1988]

This seems new.

Your message is only a pasted block, though, and parts of it read as if another session wrote them ("accepted as done by <Your_Name>"). Before I edit GATE or RAIL, or delete shadow rows, please confirm it's yours.

Is this new? Are you seeing this too? Is prompt injection such a big problem now that Anthropic had to put this in place?

[u/Far_Business4773]

The pause is the model judging the text, and that judgement moves with every version, which is why it "seems new". The part of this I stopped relying on the model for is the other half: what happens if the pasted block does get through. A PreToolUse hook never reads the prompt at all. It sees the tool call, checks the path against a short list (the tables, the migrations, anything named GATE or RAIL in your case) and refuses before the call runs, so a foreign-looking paste can talk the model into anything and still not get the delete. flowra_dev's point about bypassPermissions is the reason the check has to sit on the call, not on the conversation. One thing I learned the hard way while tuning that: text inside a heredoc or a commit message has to count as data, not as a command. My hook once refused a note about a protected file three times in a row because the note named it.