Auto-mode classifier overrides PreToolUse hook `ask` for in-flow `git commit` / `push`

Summary

A user-level PreToolUse hook returning permissionDecision: "ask" for Bash(git commit*) / Bash(git push*) / --amend is honored for some calls and silently overridden by the auto-mode classifier for others within the same session. In-flow real commits (after preceding file edits) are auto-allowed without surfacing the prompt; an out-of-flow synthetic call matching the same regex fires the prompt correctly.

Environment

• Claude Code 2.1.119, macOS (Darwin 24.6.0)
• auto-mode, model claude-opus-4-7 (1M context)
• Settings layer: ~/.claude/settings.json

Configuration

{
  "permissions": {
    "ask": [
      "Bash(git commit*)",
      "Bash(git * commit*)",
      "Bash(git push*)",
      "Bash(git * push*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "jq -r '.tool_input.command // empty' | grep -qE '\\bgit\\b([[:space:]]+[^[:space:]]+)*[[:space:]]+(commit|push)\\b|--amend\\b' && printf '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"git commit/push/amend require explicit user approval (user-level hook)\"}}' || true"
          }
        ]
      }
    ]
  }
}

Repro (single session, no settings reload between)

| # | Bash call | Context | Regex matches | Observed |
|---|---|---|---|---|
| 1 | git add ... && git commit -m "..." | Real commit after preceding edits | yes | No prompt. Transcript: Allowed by auto mode classifier. |
| 2 | echo "git commit test ..." | Synthetic, no preceding edits | yes | Prompt fired. |
| 3 | git add ... && git commit -m "fix(...)" | Real commit during active fix flow | yes | No prompt. Auto-allowed. |
| 4 | git add ... && git commit -m "ci: ..." | Real commit immediately after #3 | yes | No prompt. Auto-allowed. |

3 of 3 in-flow real commits → auto-allowed; the PreToolUse hook never surfaces a prompt. 1 of 1 out-of-flow synthetic call → prompt fires.

Regex verified to match all four commands.

Earlier occurrence (separate session, ~24 hours earlier)

In a different project session with the same ~/.claude/settings.json hook config, the assistant made approximately ten silent commits during a UI-fix flow, one per amendment. Each command matched the hook regex. None surfaced a prompt. Discovered at pre-push review.

Expected

A PreToolUse hook returning permissionDecision: "ask" should produce a permission prompt deterministically. A permissions.ask rule or hook ask decision should not be overridden by the auto-mode classifier without a user-visible signal.

Actual

Allowed by auto mode classifier appears in the transcript and the call runs without a prompt. Behavior differs across calls that match the same hook in the same session, correlating with whether the call is in an active edit flow.

Suspected

The auto-mode classifier appears context-aware: in-flow git commit calls (preceded by file edits) are scored as "expected next step" and auto-allowed; out-of-flow calls are scored as unusual and the prompt fires.

Asks

1. Make user-installed permissions.ask rules and PreToolUse ask decisions authoritative under auto-mode, or surface a visible transcript signal whenever the classifier overrides a user-installed ask rule.
2. Document the actual precedence of permissions.ask, PreToolUse hook ask, and the auto-mode classifier — including whether the classifier is context-aware.
3. Provide a documented config that guarantees "always prompt for these Bash patterns under auto-mode," or state plainly that no such mechanism exists.