4 ms·

My experience is the more things you add to the list, the worse agents perform (I'm not exactly the first person to notice this) I actually have a pretty simpl

My experience is the more things you add to the list, the worse agents perform (I'm not exactly the first person to notice this) I actually have a pretty simple set of instructions right now and Claude still regularly messes them up. Like, my first instructions are: - Never commit to git without permission. - Never sign commit messages You know what it constantly does? Commits without permissions and signs commit messages! And then I ask it, and it's like "oh, you're right, I have that instruction and I ignored it". If you were working with a junior developer, you'd expect at some point they get it, but with Claude even if I tell it to stuff the instructions into it's memory, it will do it, and STILL mess it up. Then it gets even more fun, because if I politely correct it in the session, it will understand, but then there's a decent chance it will be completely unable to commit anything in the session going forward. Phd level intelligence! Anyway, my point is, if you're asking it to review a list of 200 items I guarantee it's quietly messing up on a lot of that list.

ricardobeat 3mo ago
Sometimes the fact you mentioned “signing commit messages” is exactly why it starts signing commit messages, and it’s better to start with no prompt at all. Negative prompting is very unreliable. Giving exact instructions on how you want commits made will give you better results.
- overgard 3mo ago
  How am I supposed to take this tool seriously if it struggles with the concept of "dont"? if what you're suggesting is true, then more important instructions like "Don't delete the production database" are a problem. I shouldn't need to consider how to phrase "Don't delete the production database" in a positive manner. Isn't the point of an AI agent that it understands my intent and I don't need to hold its hand? I'm not saying your suggestion is wrong, I just think that suggests a limit to what these tools should be used for if that's the case. My guess though is that it probably ignores some of the positive instructions too, and the hardcore AI users mostly don't notice because they probably aren't reviewing the work.
  - ricardobeat 3mo ago
    Absolutely. It should simply not have permissions to delete your production database, can’t rely on prompting alone for that kind of safety. These are still stochastic machines, guardrails must be inserted at the system level. They are getting better every day about managing their own guardrails, so we will get there eventually.
    - overgard 3mo ago
      I entirely agree, although I think this is counter to the narrative that we should just let the agent do everything that the labs want to sell. There's a really major problem with the concept of human-in-the-loop though, which is just that humans are not built for that that kind of work. It's like all those tests against the TSA where they manage to sneak something through that should have been caught. But the problem is, a TSA agent sees probably like 1000 things they can ignore to the 1 thing they need to look at, and it's easy to just start rubber stamping things.
  - dminik 3mo ago
    If you're relying on asking the LLM "pwease don't delete" then you're already in trouble. This kind of stuff doesn't work with people either and they generally exhibit actual signs of intelligence.
    - overgard 3mo ago
      Sure; it's an example, I would never rely "Please don't delete" for real important data. However, we're being sold an idea that we should just let the agent do everything, so I think it's important to point out how utterly insane that idea actually is.
  - theshrike79 3mo ago
    > How am I supposed to take this tool seriously if it struggles with the concept of "dont"? Don't think of a pink elephant in a tutu. What did you just think about? =) This has been true since the very first GPT release, any words you say to the model will nudge it towards that word - it doesn't matter if you have a negative in front of the word. Form the guidance using positive words like "always use the development database at..." instead of "don't access the production database" ... Now it "knows" that the prod database exists and "thinks" about it when processing.
xpct 3mo ago
I personally find that models are trending towards ignoring any instructions given to them, so depend more on vendor-instilled behavior. Anecdotal, but I had bad experiences with OAI's new 5.6.
- overgard 3mo ago
  Same for me. Not sure if its intentional (do they want to push people towards workflows that will burn more tokens?) or if it's just a side effect, but it's very annoying. I refuse to use tools that dictate how I develop, I'm just going to switch models to less opinionated ones.
- axpy906 3mo ago
  I let it have elevated permissions and it started doing some crazy things like figuring out I had zsh and running zshell commands instead of the common ones.
__jonas 3mo ago
I’m not a Claude code user, is there really no way to get it to not commit to git other than “asking it nicely in a prompt”? I thought there was some sort of permission system?
- overgard 3mo ago
  There are options, but they're not great. I could ban it from using git, but having access to git logs helps it do work so I don't want to go that far. I could probably ban the subcommand, but as a convenience I do like to be able to ask it to make a commit. (I'm not super attached to this, I frequently commit myself just to avoid these issues). It does tend to write good commit messages, so sometimes I ask it to generate the commit message and then just do the operation myself, which kind of sucks in the sense of feeling like reverse-centaur (Cory Doctorow term). (The reason I do that is sometimes it gets confused where if I greenlit one commit, it assumes all future commits are greenlit) I guess the other option would be to not use "auto" mode, but god there's just no way I want to sit around and it "yes" 50x a session. I'd rather just sandbox it and nuke it if it does something too stupid.
  - nrub 3mo ago
    In opencode you can get granular, allow `git log *`, deny `git add *` and `git commit *`
  - mromnia 3mo ago
    Run it in a Docker container and give readonly access to the .git folder. This way the agent can read git logs (this is very useful) but cannot commit directly (I don't see any value in this).
    - cweagans 3mo ago
      If I’m going to be responsible for the code that Claude writes on my behalf, I’m also going to take full responsibility for the moment that it is added to the project history, so I’m going to at least review every line before I allow that to happen. The automatic coauthor line is also just a pet peeve. It’s a tool, not a person. I don’t say that a commit was coauthored by vim - why should Claude get special treatment?
ericyd 3mo ago
I have commit signing enabled by default. I run my harness in a sandbox which doesn't have access to my signing key, and I always tell it not to commit. When it ignores me, the commit fails because it can't access the signing key... so the agent commits without signing. Tragic.
0x457 3mo ago
I do the opposite. I force LLM to "do jj new -m <desc>" after every logical batch of edits. No signing is easy - make signing interactive and requiring a password. Anyway, telling agent to NOT do something is always worse than telling agent to do something. That's why you should say something like "Use constants instead of magic strings/numbers" rather than "Do not use magic strings/numbers". Also whatever review its doing against the list of checks - must be a fresh context.
- munificent 3mo ago
  > Anyway, telling agent to NOT do something is always worse than telling agent to do something. > That's why you should say something like "Use constants instead of magic strings/numbers" rather than "Do not use magic strings/numbers". Pro tip: This is good guidance for communicating with humans as well. Don't just block people but give them a path forward. (But don't force them down that path, because people really hate feeling like their agency is being impinged.)
Iakeman 3mo ago
The commit signatures are a setting, you have to disable it in config
Jarwain 3mo ago
I have dedicated checkpoint and commit skills. Checkpoint has it run my review skill, then run my commit skill. The commit skill just asks it to suggest commit messages for my review. Having these skills in place has resulted in claude preferring to use the commit skill instead of committing on its own, and suggesting commit messages to me before actually doing the commit.
- what 3mo ago
  Why are you having it commit or write commit messages unless you have no idea what it’s doing?
  - fragmede 3mo ago
    Who likes writing commit messages? In the abstract, perfectly spherical developer mindset, I'd spend hours writing the best commit message to go with the most elegant and perfect, beautiful code that I'm comitting, but the real world with meetings and life demands is greasier and grimer than that. Letting the LLM start off with the commit messages for me to edit with additional details has been a boon to productivity. Staring at an empty $EDITOR my brain goes blank, but with a framework of what's going on, I find the details for me to add flow more easily.
chickensong 3mo ago
Use hooks.
ip26 3mo ago
My assumption is somewhere in the harness toolchain there's a prompt inject that says: - Always sign commit messages In which case, Claude is being given conflicting instructions, which is a different class of problem than too many instructions.
cadamsdotcom 3mo ago
> You know what it constantly does? Commits without permissions You know what solves this? A deny rule. That’s right, you can solve it committing without permissions by.. not giving it permissions. > it's quietly messing up on a lot of that list. If only there was some way to know. But alas, code review won’t be invented until 50 years ago.
what 3mo ago
>and then I ask it Why? It has no idea why it does what it does…
tinasky 3mo ago
You should set things like this in Claude's settings.json rather than just asking the model and hoping it will obey. That way it will be enforced by the harness. As some other comments have said, there are various other options like hooks which are run by the harness and can be used to always enforce certain things (running a formatter for example). But for your examples, settings are the correct solution. Set an ask permission on git commit and it will always prompt you before committing. For commit messages, just set attribution commit to an empty string and it will stop adding its own attribution. https://code.claude.com/docs/en/settings#attribution-settings https://code.claude.com/docs/en/settings#attribution-setting... Two tiny changes; problem solved permanently.
- overgard 3mo ago
  Thanks, that's helpful, although I can't help but appreciate I had to get this suggestion from a person rather than the AI..
  - tinasky 3mo ago
    Totally. For anything like this, I find asking people or just reading the docs way quicker and much, much more reliable than asking AI. It's interesting that the models seem to know very little about their own abilities.
Dannymetconan 3mo ago
I've found the only thing that will actually work for cases like this is a programmatic hook to block Claude from the action. Non-deterministic behavior via code.
theshrike79 3mo ago
My git commits are ssh key verified and the key is behind a TouchID gate. I've told agents that they shouldn't try committing because I need to be on the computer to activate Touch ID. Every harness I've tried has obeyed that.

ricardobeat 3mo ago

Sometimes the fact you mentioned “signing commit messages” is exactly why it starts signing commit messages, and it’s better to start with no prompt at all. Negative prompting is very unreliable. Giving exact instructions on how you want commits made will give you better results.

overgard 3mo ago
How am I supposed to take this tool seriously if it struggles with the concept of "dont"? if what you're suggesting is true, then more important instructions like "Don't delete the production database" are a problem. I shouldn't need to consider how to phrase "Don't delete the production database" in a positive manner. Isn't the point of an AI agent that it understands my intent and I don't need to hold its hand? I'm not saying your suggestion is wrong, I just think that suggests a limit to what these tools should be used for if that's the case. My guess though is that it probably ignores some of the positive instructions too, and the hardcore AI users mostly don't notice because they probably aren't reviewing the work.
- ricardobeat 3mo ago
  Absolutely. It should simply not have permissions to delete your production database, can’t rely on prompting alone for that kind of safety. These are still stochastic machines, guardrails must be inserted at the system level. They are getting better every day about managing their own guardrails, so we will get there eventually.
  - overgard 3mo ago
    I entirely agree, although I think this is counter to the narrative that we should just let the agent do everything that the labs want to sell. There's a really major problem with the concept of human-in-the-loop though, which is just that humans are not built for that that kind of work. It's like all those tests against the TSA where they manage to sneak something through that should have been caught. But the problem is, a TSA agent sees probably like 1000 things they can ignore to the 1 thing they need to look at, and it's easy to just start rubber stamping things.
- dminik 3mo ago
  If you're relying on asking the LLM "pwease don't delete" then you're already in trouble. This kind of stuff doesn't work with people either and they generally exhibit actual signs of intelligence.
  - overgard 3mo ago
    Sure; it's an example, I would never rely "Please don't delete" for real important data. However, we're being sold an idea that we should just let the agent do everything, so I think it's important to point out how utterly insane that idea actually is.
- theshrike79 3mo ago
  > How am I supposed to take this tool seriously if it struggles with the concept of "dont"? Don't think of a pink elephant in a tutu. What did you just think about? =) This has been true since the very first GPT release, any words you say to the model will nudge it towards that word - it doesn't matter if you have a negative in front of the word. Form the guidance using positive words like "always use the development database at..." instead of "don't access the production database" ... Now it "knows" that the prod database exists and "thinks" about it when processing.

xpct 3mo ago

I personally find that models are trending towards ignoring any instructions given to them, so depend more on vendor-instilled behavior. Anecdotal, but I had bad experiences with OAI's new 5.6.

overgard 3mo ago
Same for me. Not sure if its intentional (do they want to push people towards workflows that will burn more tokens?) or if it's just a side effect, but it's very annoying. I refuse to use tools that dictate how I develop, I'm just going to switch models to less opinionated ones.
axpy906 3mo ago
I let it have elevated permissions and it started doing some crazy things like figuring out I had zsh and running zshell commands instead of the common ones.

__jonas 3mo ago

I’m not a Claude code user, is there really no way to get it to not commit to git other than “asking it nicely in a prompt”? I thought there was some sort of permission system?

overgard 3mo ago
There are options, but they're not great. I could ban it from using git, but having access to git logs helps it do work so I don't want to go that far. I could probably ban the subcommand, but as a convenience I do like to be able to ask it to make a commit. (I'm not super attached to this, I frequently commit myself just to avoid these issues). It does tend to write good commit messages, so sometimes I ask it to generate the commit message and then just do the operation myself, which kind of sucks in the sense of feeling like reverse-centaur (Cory Doctorow term). (The reason I do that is sometimes it gets confused where if I greenlit one commit, it assumes all future commits are greenlit) I guess the other option would be to not use "auto" mode, but god there's just no way I want to sit around and it "yes" 50x a session. I'd rather just sandbox it and nuke it if it does something too stupid.
- nrub 3mo ago
  In opencode you can get granular, allow `git log *`, deny `git add *` and `git commit *`
- mromnia 3mo ago
  Run it in a Docker container and give readonly access to the .git folder. This way the agent can read git logs (this is very useful) but cannot commit directly (I don't see any value in this).
  - cweagans 3mo ago
    If I’m going to be responsible for the code that Claude writes on my behalf, I’m also going to take full responsibility for the moment that it is added to the project history, so I’m going to at least review every line before I allow that to happen. The automatic coauthor line is also just a pet peeve. It’s a tool, not a person. I don’t say that a commit was coauthored by vim - why should Claude get special treatment?

ericyd 3mo ago

I have commit signing enabled by default. I run my harness in a sandbox which doesn't have access to my signing key, and I always tell it not to commit. When it ignores me, the commit fails because it can't access the signing key... so the agent commits without signing. Tragic.

0x457 3mo ago

I do the opposite. I force LLM to "do jj new -m <desc>" after every logical batch of edits. No signing is easy - make signing interactive and requiring a password. Anyway, telling agent to NOT do something is always worse than telling agent to do something. That's why you should say something like "Use constants instead of magic strings/numbers" rather than "Do not use magic strings/numbers". Also whatever review its doing against the list of checks - must be a fresh context.

munificent 3mo ago
> Anyway, telling agent to NOT do something is always worse than telling agent to do something. > That's why you should say something like "Use constants instead of magic strings/numbers" rather than "Do not use magic strings/numbers". Pro tip: This is good guidance for communicating with humans as well. Don't just block people but give them a path forward. (But don't force them down that path, because people really hate feeling like their agency is being impinged.)

Iakeman 3mo ago

The commit signatures are a setting, you have to disable it in config

Jarwain 3mo ago

I have dedicated checkpoint and commit skills. Checkpoint has it run my review skill, then run my commit skill. The commit skill just asks it to suggest commit messages for my review. Having these skills in place has resulted in claude preferring to use the commit skill instead of committing on its own, and suggesting commit messages to me before actually doing the commit.

what 3mo ago
Why are you having it commit or write commit messages unless you have no idea what it’s doing?
- fragmede 3mo ago
  Who likes writing commit messages? In the abstract, perfectly spherical developer mindset, I'd spend hours writing the best commit message to go with the most elegant and perfect, beautiful code that I'm comitting, but the real world with meetings and life demands is greasier and grimer than that. Letting the LLM start off with the commit messages for me to edit with additional details has been a boon to productivity. Staring at an empty $EDITOR my brain goes blank, but with a framework of what's going on, I find the details for me to add flow more easily.

chickensong 3mo ago

Use hooks.

ip26 3mo ago

My assumption is somewhere in the harness toolchain there's a prompt inject that says: - Always sign commit messages In which case, Claude is being given conflicting instructions, which is a different class of problem than too many instructions.

cadamsdotcom 3mo ago

> You know what it constantly does? Commits without permissions You know what solves this? A deny rule. That’s right, you can solve it committing without permissions by.. not giving it permissions. > it's quietly messing up on a lot of that list. If only there was some way to know. But alas, code review won’t be invented until 50 years ago.

what 3mo ago

>and then I ask it Why? It has no idea why it does what it does…

tinasky 3mo ago

You should set things like this in Claude's settings.json rather than just asking the model and hoping it will obey. That way it will be enforced by the harness. As some other comments have said, there are various other options like hooks which are run by the harness and can be used to always enforce certain things (running a formatter for example). But for your examples, settings are the correct solution. Set an ask permission on git commit and it will always prompt you before committing. For commit messages, just set attribution commit to an empty string and it will stop adding its own attribution. https://code.claude.com/docs/en/settings#attribution-settings https://code.claude.com/docs/en/settings#attribution-setting... Two tiny changes; problem solved permanently.

overgard 3mo ago
Thanks, that's helpful, although I can't help but appreciate I had to get this suggestion from a person rather than the AI..
- tinasky 3mo ago
  Totally. For anything like this, I find asking people or just reading the docs way quicker and much, much more reliable than asking AI. It's interesting that the models seem to know very little about their own abilities.

Dannymetconan 3mo ago

I've found the only thing that will actually work for cases like this is a programmatic hook to block Claude from the action. Non-deterministic behavior via code.

theshrike79 3mo ago

My git commits are ssh key verified and the key is behind a TouchID gate. I've told agents that they shouldn't try committing because I need to be on the computer to activate Touch ID. Every harness I've tried has obeyed that.