Plan mode + pending bypass: let auto-mode classifier "allow" verdicts auto-approve reads instead of disabling the bypass shortcut

Summary

Sessions launched with claude --allow-dangerously-skip-permissions --permission-mode plan used to run read-only/analysis Bash commands silently during plan mode, then offer bypass-permissions when the plan was accepted. As of 2.1.198, plan-launched sessions activate the auto-mode classifier underneath plan mode (when permissions.defaultMode: "auto" is set), and that conversion reintroduces permission prompts for reads. The only workaround is "useAutoModeDuringPlan": false, which opts out of the classifier entirely.

Request: when auto mode is active under plan with bypass pending, let a classifier "allow" verdict auto-approve non-plan-gated asks — the same outcome the plain plan+bypass shortcut produces — instead of disabling that shortcut.

What changed

Pre-2.1.198 behavior with the invocation above:

• Plan mode's permission check auto-approved any non-plan-gated "ask" via the plan mode && isBypassPermissionsModeAvailable shortcut (except dangerous rm/rmdir). Reads, git log, compound analysis commands — all silent.
• Plan gates (file writes, "Cannot call X while in plan mode") still prompted, as expected.
• Accepting the plan offered bypass-permissions.

In 2.1.198, a session that launches directly into plan mode with defaultMode: "auto" is converted to auto-under-plan (useAutoModeDuringPlan, default true). That conversion:

1. Sets isBypassPermissionsModeAvailable: false on the tool permission context, so the auto-approve shortcut can never fire, and
2. Strips broad Bash(...) allow rules from settings as "classifier-bypassing" (Ignoring dangerous permission … (bypasses classifier)).

The result: every rule-engine "ask" that the shortcut used to swallow now reaches the user as a dialog — including plain reads that the static read-only heuristic doesn't recognize.

Why this isn't configurable today

The prompts are rule-engine ask verdicts (plan gates, multi-cd/cd-git-compound heuristic misses, "no rule granted this"), not classifier denials. The auto-mode classifier's rulebook is safety-only and already allows read-only operations; extending it via autoMode.allow in settings cannot approve rule-engine asks. So there is no configuration that keeps the classifier active under plan while restoring silent reads.

"useAutoModeDuringPlan": false restores the old behavior, but it's a blunt opt-out: the safety classifier is fully disabled during plan mode rather than layered on top of it.

Proposed behavior

When mode === "plan", bypass is pending (--allow-dangerously-skip-permissions), and auto mode is active:

• Keep isBypassPermissionsModeAvailable set (or track the pending-bypass state separately).
• For non-plan-gated asks, consult the auto-mode classifier; on an "allow" verdict, auto-approve as the plain shortcut does. Soft-deny → prompt; hard-deny → deny.
• Plan gates (writes, non-plan-callable tools) keep prompting as they do today.

This composes the two systems instead of making them mutually exclusive: users get the safety classifier's protection during plan mode and the frictionless read/analysis flow that plan+bypass launches have always had.

Environment

• Claude Code 2.1.198, macOS (arm64)
• Invocation: claude --allow-dangerously-skip-permissions --permission-mode plan
• Settings: permissions.defaultMode: "auto", broad read-only Bash(...) allow rules

Workaround

"useAutoModeDuringPlan": false in ~/.claude/settings.json.