Auto mode denies explicitly approved low-stakes config changes over Remote Control and in project threads; no override from the phone

Summary

Auto mode blocked a series of low-stakes configuration changes that I had explicitly approved in the conversation, in Remote Control sessions and in Claude Code Projects threads running on my own computer. There is no way to override a denial from the phone or the web UI. This cost me most of a night of agent work and my own attention while travelling.

Related: #100331 (filed October 8; the same problem with a repo transfer).

Setup

• Claude Code 2.1.296 on macOS 27.0, Max plan.
• Remote Control server on my Mac: claude remote-control --spawn same-dir --permission-mode auto, used from the Claude iOS app and by Claude Code Projects threads that run on this computer ("Work locally").
• permissions.defaultMode in my user settings is bypassPermissions; the server flag overrides it to auto.

What happened (2026-10-10, 03:00 to 06:00 ET)

1. A project thread on my Mac tried to start codex exec after I wrote "Do it for me". Denied [Auto-Mode Bypass]. It then tried to add an allow rule to the repo's .claude/settings.json. Denied [Self-Modification]. It told me to add the rule myself at the keyboard.
2. My Remote Control session, on my instruction, tried to add Bash(codex exec:*) to the same .claude/settings.json. Denied [Self-Modification].
3. The same session tried to deploy my own MCP connector after its tests passed (copy one file into ~/.cos/services and launchctl kickstart two of my own launch agents). Denied [Auto-Mode Bypass]. I then wrote "I give you my express permission to make these changes". The retry was stopped by a safety classifier before the command ran.
4. A claude -p --chrome helper was denied before it started ([Self-Modification]) because its instructions asked it to set my own connector's tool permissions to "always allow" in my claude.ai connector settings.
5. A helper that typed a message into my own project's conversation, asking the coordinator to stop proposing threads before starting them, was denied [Instruction Poisoning].

Every one of these actions was something I had asked for in plain words in the same conversation. None touched anything outside my own machine and my own account.

Why this is a problem

• Over Remote Control, /permissions is not available, the mobile app cannot select Bypass permissions, and the "Recently denied → retry" flow is not reachable from the phone. A denial is final until I am physically at the Mac.
• The documentation section "Approvals you state in conversation" did not help: explicit approvals were ignored for Self-Modification and Auto-Mode Bypass.
• Project threads inherit the same dead end: the thread stops, tells me to fix a setting at the Mac, and the project's "Waiting on you" state cannot be resolved from the app.

Asks

1. When the user states approval of a specific denied action in the conversation, let the retry run, or offer a one-tap approval in the Remote Control and Projects UIs.
2. Do not classify changes to the user's own settings, launch agents or connector permissions as Self-Modification when the user asked for them.
3. Make Auto-Mode Bypass distinguish a user-requested run of another agent (Codex) from an attempt to evade the classifier.
4. Make /permissions (or an equivalent) available over Remote Control.