Auto mode safety classifier blocks read-only operations when classifier model is unavailable

Description

When the safety classifier model (claude-sonnet-4-6[1m]) is temporarily unavailable, auto mode blocks all Bash commands — including read-only operations that should be exempt per the error message itself.

Steps to Reproduce

1. Enable auto mode (defaultMode: "auto" in settings)
2. Wait for a period when claude-sonnet-4-6[1m] is temporarily unavailable
3. Attempt to run any Bash command, including read-only ones

Observed Behavior

Read-only commands like playwright-cli eval are blocked:

Bash(playwright-cli eval "document.body.classList.contains('course-player-active')")
└ Error: claude-sonnet-4-6[1m] is temporarily unavailable, so auto mode cannot
  determine the safety of Bash right now. Wait briefly and then try this action
  again. Note: reading files, searching code, and other read-only operations do
  not require the classifier and can still be used. (hasExtraBody=false)

Destructive-looking commands are also blocked (more understandable):

Bash(lsof -ti:3000 2>/dev/null | xargs kill -9 2>/dev/null; echo "port 3000 cleared")
└ Same error

Expected Behavior

1. The error message states: "reading files, searching code, and other read-only operations do not require the classifier" — but read-only Bash commands like playwright-cli eval (which just evaluates a JS expression and returns a value) are still blocked.

1. Commands that are explicitly in the user's allow list (e.g., Bash(playwright-cli eval:*), Bash(lsof:*)) should bypass the safety classifier entirely, since the user has already pre-approved them.

Two Issues

1. Read-only Bash commands should not require the classifier. The error message implies they don't, but they do. Either the exemption isn't working, or the classifier is being applied too broadly to all Bash tool calls regardless of content.

1. Pre-approved commands in the allow list should bypass the classifier. If a user has explicitly added Bash(playwright-cli eval:*) to their permissions allow list, it should execute without needing the safety classifier — the user has already made the safety determination.

Environment

• Claude Code CLI
• macOS (Darwin 25.3.0)
• Auto mode enabled with extensive allow list in ~/.claude/settings.json