[bug] Writes under LIFEOS/USER and LIFEOS/MEMORY prompt on every call (safetyCheck) #2787

What happened

Following the upgrade there's an unnecessary number of confirmations that I need to give.

Summary

Since the per-call hooks were removed (Safety.hook.ts, 2026-10-24), Claude Code shows a permission dialog in auto mode (the installer's opt-in) for every Write and Edit under LIFEOS/USER/ or LIFEOS/MEMORY/ when the session runs from the config root, which is the lifeos default. I have not tested default mode. The decision is logged as reasonCode: safetyCheck. The shipped allow rule on the config root does not cover it. Research hits it on every report: six dialogs for one report and one HTML page.

Cause. setupUserSeparation() symlinks both directories into the USER data home, so these writes resolve outside the working directory. Before the hooks were removed, the auto-approve in Safety.hook.ts answered these dialogs. settings.system.json sets additionalDirectories: [] and has no allow rule for the data home.

Fix, verified locally. I added the data home to permissions.additionalDirectories and a matching Edit(<data-home>/**) allow rule. After that, the same write was accepted by the rule with no dialog. Suggestion: ship both in settings.system.json, or have the installer write them with the path it created.

Related: #2701 (same symptom in auto mode, from the subagent sandbox wrap).

LifeOS 8.761.0 · Claude Code 2.1.323 · macOS

Details

• Kind: bug
• LifeOS version: 8.761.0

Filed with the LifeOS /feedback command. The reporter approved this exact text before it was sent; paths, secrets and personal details were stripped locally.