Conversation permanently blocked after credential-related context — rewind doesn't help

Bug Description

When Claude Code guides the user through setting up a credentials file (e.g., creating a JSON config for an API service), and the conversation context touches on passwords/credentials, the safety guardrail system permanently blocks the entire conversation. Every subsequent message gets blocked, regardless of content.

Steps to Reproduce

1. Claude Code suggests creating a credentials config file (in my case, jqdata_credentials.json for a Chinese stock data SDK)
2. Claude creates the file template and instructs the user to fill in username/password locally
3. User sends a follow-up message (e.g., "cancel using this service, delete the credentials file")
4. Message is blocked by safety guardrails
5. User rewinds the conversation and tries again with different wording
6. Still blocked — any message, no matter how innocuous, gets blocked
7. Even messages like "continue" or completely unrelated requests are blocked
8. The conversation is permanently unusable; the only option is to start a new session

Expected Behavior

• Block a single problematic message if necessary, not the entire conversation
• Allow the user to rewind and continue with different input
• At minimum, provide a clear explanation of what triggered the block
• Never block messages that have nothing to do with credentials (e.g., "cancel using this service")

Actual Behavior

The safety classifier appears to be contaminated by the conversation history. Once credential-related tokens exist in the context, every subsequent message is flagged as high-risk regardless of its actual content. Rewinding does not help — the context pollution persists.

Impact

• Paying customer unable to use the product they paid for
• Hours of conversation context and work progress lost
• User was following Claude's own instructions when the block was triggered — Claude suggested the credential setup flow, then blocked the user for participating in it
• Forces starting a completely new session, losing all prior context

Environment

• Claude Code CLI
• macOS
• Max plan (paying customer)

Additional Context

The irony: Claude itself initiated the credential file creation flow. It created the template, told the user how to fill it in locally, and even offered to open a text editor. The user never sent any actual passwords in the chat. The mere topic of credentials in the conversation history was enough to permanently lock it.