Client WordPress theme, php and a bit of js. I asked Claude Code to fix a bug in one template part. It fixed the bug, and it also reformatted webpack.config.js and rewrote two functions in a helper file that had nothing to do with anything.
The extra changes were not wrong exactly. They were just not asked for, and on a client site every extra line is something I have to explain if it breaks next month.
What I have tried. Telling it in the prompt to only touch the one file, which works maybe four times out of five. Listing the files up front and having it confirm before writing, which works better but is slow and I forget to do it when I am in a hurry.
Is there anything more reliable than remembering to ask nicely? Latest version, macOS.
Two things made this mostly go away for me.
First, a rule in the project file rather than in the prompt: do not modify files outside the ones named in the request, and if a change looks necessary elsewhere, stop and say so instead. Written as an instruction, not a preference. The prompt gets buried after twenty turns. The project file does not.
Second, and this is the one that actually saves me, commit before you start. Then the diff is your review, and an unwanted change to webpack.config.js is one git checkout away instead of a debate with yourself about whether to keep it now that it is there.
Outsider opinion, ignore if it does not translate. In my world, when somebody does work you did not ask for, the brief was vague about scope, not about the task.
Your prompt says what to fix. Does it say what finished looks like, and what is out of bounds? I started putting what must not change at the top of every request and got a lot fewer surprises back.
Small disagreement on the project file, or a caveat at least. I have that rule written down too and it still drifts on long tasks. Worse, once it was written down I stopped watching for the problem, which is the real hazard.
Commit first is the part that holds, because it does not depend on the model cooperating with anything.
reporting back. commit first, plus the scope rule in the project file, plus i stopped handing it tasks that cover more than one thing at a time.
that last one made the biggest difference honestly. almost all of the wandering was on requests where i had already asked for two things and it decided a third was implied.
still happens now and then. costs me thirty seconds instead of a bad deploy.