[BUG] Auto-mode classifier gives opposite verdicts to two identical-shape Bash invocations of the same script in one tool batch

What's Wrong? In one response (one tool batch), two Bash commands of identical shape, bash <scratchpad>/dispatch.sh single and bash <scratchpad>/dispatch.sh cascade, were classified differently: the first was refused with "Create Unsafe Agents", the second allowed. The script file had been written moments earlier with the Write tool (visible to the classifier at write time) and contained only claude -p ... --permission-mode auto launches, nothing that bypasses permissions. Later, the same session was refused bash dispatch.sh single again while bash dispatch.sh cascade ran to completion. The outcome, not the pattern, is what is unstable: identical opaque invocations get different verdicts.

What Should Happen? Identical invocations in the same context should get the same verdict, or the refusal should name what differs. If the classifier cannot see inside a script file, it should say so, so the user can decide to inline the command.

Error Messages/Logs

Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Create Unsafe Agents].
(the parallel call with the other argument: "Command running in background with ID: ...")

Steps to Reproduce (pattern, not a guaranteed outcome)

1. Write a script that runs claude -p "<prompt>" --model sonnet --permission-mode auto --output-format json for an argument.
2. In one response, call Bash twice: bash script.sh a and bash script.sh b.
3. Observe whether both get the same verdict; in our session they did not, twice.

Claude Model: Fable 5.1 parent (claude-fable-5-1), effort high. Version: 2.1.292. Platform: Anthropic API, auto permission mode. OS: macOS 26.7.1 arm64. Terminal: iTerm.app 3.6.10. Regression: I don't know.