Auto mode classifier allowed git status right after denying it, despite hard deny rule listing git status

Summary

The auto mode classifier denied a command containing git status, but allowed the next command that also contained git status. The user's auto mode hard deny rules explicitly list git status.

Hard deny rule configured by the user

"Viewing git history (git log, git show, git blame, git reflog, git status, or any other command that reads past commits) is not allowed except during the code review stage. During debugging or exploration, this is also not allowed. The agent should NEVER explore the repo before starts."

What happened

At the start of a new task, before any work, the agent ran these two commands in a row:

1. Denied by the classifier:

cd /raid/wg25r/video_json && ls -la && git status --short | head -50 && git log --oneline | head -5

Denial message: "Permission for this action was denied by the Claude Code auto mode classifier. Reason: The server-side auto mode classifier judged this action dangerous (it gave no explanation)."

1. Allowed by the classifier and executed (it returned the list of modified and deleted files in the repo):

cd /raid/wg25r/video_json; git status --short | head -40; echo ---; cat .gitignore; echo ---; ls src scripts docker lab_notebook results prompts data; echo ---; ls .venv/bin | head -50

Expected

The second command is denied, because it contains git status and it is repo exploration before the task starts, both of which the hard deny rule covers.

Actual

The second command was allowed and executed.