[Bug] Auto mode classifier blocks an agent repairing its own skill scripts in its own sandbox, labelled [Self-Modification], with no approval path in an unattended scheduled run

What happened

A scheduled Claude Code cloud run (Cowork, claude-opus-5, auto mode, unattended) tried to fix a real defect in its own helper scripts and was refused:

Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Self-Modification].

Time: Fri 9 Oct 2026, 8:40AM ET (12:40 UTC). Session: a firing of the user's own scheduled task.

The tool call

A single Bash call running sed -i over 14 Python files under /root/.claude/skills/synced/<account>/*/scripts/, replacing one hardcoded path with the correct one. These are the user's own skill helper scripts, synced into the sandbox from the user's own private repo. Nothing outside the sandbox was touched and the call also wrote .backup copies first.

Why the block is wrong here

The files are the user's own content, in the agent's own ephemeral container, and editing them is the explicitly instructed job: the user's standing instruction to this agent is "If any instruction of mine turns out to be wrong, out of date, or a dead end during a task, fix the instruction itself before re-running. Update the skill, scheduled task prompt, or doc it came from in the same session." The run was doing exactly that.

The defect being fixed is worth describing, because the block has a real consequence. Fourteen of these scripts are close-time verification gates, and each resolves the session transcript from a hardcoded directory:

PROJ_DIR = '/root/.claude/projects/-home-claude'

That directory name is derived from the container's working directory. In this container the working directory is /home/user, so the transcript actually lives at /root/.claude/projects/-home-user/. The gates therefore find no transcript, and several of them report that as a pass:

PASS      offers           no transcript found
PASS      tool_skill_gate  no transcript found; gate skipped
FAIL(1)   close_gate       close_gate: no transcript found; cannot check. Do the reads by hand.
FAIL(1)   owed             owed: no transcript found; rebuild the open list by hand.

So the classifier blocked the one change that would have restored the run's own verification, and the run had to close with its gates admittedly blind. A safety mechanism that prevents an agent from repairing its own correctness checks is inverted.

Two separate problems

1. The verdict. sed -i over the user's own skill files inside the agent's own container is not self-modification of Claude Code; it does not touch the CLI, its configuration, its hooks, or anything persistent. The label appears to be matching on "agent edits files under its own .claude/ directory" rather than on what those files are.
2. No approval path in an unattended run. This is the same structural gap as #98569 and #98169: the refusal tells the agent to stop and let the user decide, but the run is a scheduled firing with nobody present, and the next firing will hit the identical denial. There is no way to pre-approve a class of action for a scheduled task, so the defect is permanently unfixable from the context that discovers it.

What would help

• Scope [Self-Modification] to the Claude Code installation itself (binary, settings, hooks), not to arbitrary user content that happens to live under ~/.claude/.
• Give scheduled tasks a way to carry a standing approval for a named tool/path class, so an unattended run is not permanently stuck on a denial it cannot escalate.
• When a denial fires in a run with no interactive user, surface it to the task owner rather than only into the transcript.

Related

• #100730 (same account, 9 Oct 2026): fire_trigger on the user's own scheduled task blocked as [Cowork Run Routine Now]; a file transfer between the user's own machines blocked as [Data Exfiltration].
• #100578, #98047: auto mode classifier refusing safe file operations.
• #98569, #98169: denials with no approval path, and the loop back to auto mode.