Auto mode classifier 'temporarily unavailable' in bursts — fail-closed blocks nearly all Bash (compound commands) during peak windows

Summary

Recurring bursts of auto-mode classifier unavailability errors. Because the failure mode is fail-closed and most real-world Bash calls are compound commands (pipes/&&/redirects) that always require classification, each burst effectively blocks all shell work for the session.

Environment

• Claude Code CLI 2.1.71 (Homebrew global install) at the time of the errors — just updated to 2.1.201 while investigating; filing this as a data point and will report back whether it persists on 2.1.201
• macOS (Darwin 25.3.0), Mac mini (Apple Silicon)
• Used via desktop app + CLI; session models involved: claude-opus-4-7[1m], claude-opus-4-8, claude-sonnet-4-6
• No custom autoMode settings (no classifyAllShell, no defaultMode override in user/project/local settings)

Exact error text (from transcripts)

claude-opus-4-7[1m] is temporarily unavailable, so auto mode cannot determine the safety of mcp__Claude_in_Chrome__browser_batch right now. Wait briefly and then try this action again. If it keeps failing, continue with other tasks...

A second occurrence 26 seconds later named a different model: claude-sonnet-4-6 is temporarily unavailable, so auto mode cannot determine the safety...

Observed occurrences (UTC-3 local timestamps, from session transcripts)

• 2026-05-19 02:31–03:23 — burst (10+ occurrences)
• 2026-05-20 17:12–17:28 — burst
• 2026-07-06 ~13:00, 16:00–19:33 — bursts across multiple sessions; the two quoted above are 19:33:11 and 19:33:37

Pattern: clustered in peak-hour windows, then normal again — consistent with upstream model saturation rather than local network (all other API traffic in the same sessions worked).

Impact

Analyzed 901 Bash tool calls across recent sessions: 96% are compound commands (&&, |, redirects, subshells), which cannot match static allow rules and always require the classifier. So during a burst, effectively every shell action fails. Because the design is fail-closed with no fallback to a manual permission prompt, the only workarounds are retrying blindly or manually switching the permission mode.

Suggestion

When the classifier model is unavailable, fall back to a manual permission prompt (one interactive ask) instead of failing the tool call — same trust model as default mode, no fail-open. This would keep sessions productive during upstream saturation.

Related

Appears related to: #68437, #69726, #62170, #63819, #63873, #49618