Bash tool blocked (even read-only) when safety-classifier model is unavailable; dangerouslyDisableSandbox does not override

What happens

When the model used to classify Bash command safety is temporarily unavailable, every Bash call is rejected with:

<model> is temporarily unavailable, so auto mode cannot determine the safety of Bash right now. Wait briefly and then try this action again.

This blocks read-only commands (a python script doing HTTP GET / SELECT queries, ls, cat), not just risky ones. During a ~30-minute classifier outage, I could not run any Bash command, stalling a read-only database analysis. Some calls intermittently passed, most failed.

Expected

A transient classifier outage shouldn't hard-block read-only work:

• fall back to the normal permission prompt (ask the user) instead of hard-blocking;
• honor an explicit override for known-safe commands;
• let an allow-list (git status, ls, cat) bypass the classifier.

dangerouslyDisableSandbox does not help

Setting dangerouslyDisableSandbox: true returned the same classifier-unavailable error — no way to proceed even when the user explicitly accepts the risk.

Environment

• Claude Code on Windows 11
• Model claude-opus-4-8
• Intermittent over ~30 min (some calls passed, most failed)