[BUG] Mobile app has no Bypass Permissions mode; with the fail-closed auto-mode classifier outage, remote users are completely locked out (no prompt fallback, settings.json edits also gated)

Status Open

Maintainer reply None cached

Activity 0 comments · opened Jul 17, 2026

Summary

A mobile-controlled Claude Code session can end up with zero recourse to execute anything: the iOS app's mode selector offers no Bypass Permissions option, and when the auto-mode safety classifier has a capacity outage it fails closed without falling back to a permission prompt. The combination locks a remote user out of all Bash/Edit/Write actions entirely, with no action available from the phone. This is a compound failure across two known issue families (#74351 / #74949 / #67542 fail-closed classifier; #29214 mobile bypass gaps), but the mobile lockout combination does not seem to be tracked anywhere.

Environment

Host: Claude Code CLI on Linux (Ubuntu, kernel 5.15), session driven from the iOS app (updated 2026-07-17 AEST)
Session model / classifier model (from error string): claude-fable-5
~/.claude/settings.json has "defaultMode": "bypassPermissions" and "skipDangerousModePermissionPrompt": true (not honored by the mobile-initiated session)
Permission mode during incident: Auto (selected on mobile)

Timeline / what happened

Before the app update, this workflow (long-running GPU training launches controlled from the phone) worked under Accept edits with no Bash prompts. In retrospect this was likely riding on the silent mobile Bash auto-approval hole reported in #37845.
After updating the iOS app (2026-07-17), Accept edits began prompting for every Bash command. This is presumably the intended fix of #37845 plus the July defaults tightening, i.e., correct behavior, but it broke an established mobile workflow overnight with no changelog pointer shown in-app.
To avoid per-command prompts, the user switched the session to Auto from the phone.
The auto-mode safety classifier then hit a capacity outage: every non-read-only tool call fails with

Error: claude-fable-5 is temporarily unavailable, so auto mode cannot determine the safety of Bash right now. Wait briefly and then try this action again.
This persisted intermittently for hours (dozens of retries across ~6 hours). Read-only commands pass; every launch/compound command is denied. Same failure via a sub-agent's Bash.

Attempted mitigations, all dead ends from the phone:

Add a static allow rule for a single simple launch command: editing ~/.claude/settings.json is itself classifier-gated → Error: claude-fable-5 is temporarily unavailable, so auto mode cannot determine the safety of Edit right now. So the documented "static allow rules still work" escape hatch is unreachable mid-outage.
Switch to Bypass Permissions: the iOS app's Select mode sheet offers only Manual / Accept edits / Plan / Auto (screenshot below). No Bypass. settings.json defaultMode: bypassPermissions is not applied to the session either.
Auto mode has no prompt fallback: unlike Manual/Accept edits, a classifier failure does not degrade to a human permission prompt on the phone; it just denies. So the user cannot even approve actions manually.

Net effect: two idle GPU servers, queued experiment launches, and a user physically able to approve anything on their phone, but no code path that will ask them.

Repro

Start a Claude Code session on a host; control it from the iOS app.
Set mode to Auto from the app.
Wait for (or coincide with) an auto-mode classifier capacity event (see #74949 for burst pattern).
Ask Claude to run any compound Bash command, or to Edit ~/.claude/settings.json.
Observe blanket denials; observe the app's mode selector offers no Bypass option; observe no permission prompt is delivered to the phone.

Expected behavior / requests

Fail-open-to-human, not fail-closed: when the auto-mode classifier is unavailable, degrade to a normal permission prompt (relayed to the mobile app like Manual mode does) instead of denying. The human is strictly safer than an unavailable classifier.
Expose Bypass Permissions in the mobile mode selector (or honor permissions.defaultMode from settings for mobile-initiated sessions), consistent with desktop capabilities.
Classifier model fallback: the main loop falls back across models during capacity events, the classifier should too (CLAUDE_CODE_AUTO_MODE_MODEL currently ignored per #67542).
Keep the allowlist escape hatch reachable: settings.json edits could be exempted from the classifier when the change only appends permissions.allow entries, or a claude config allow ... CLI path could exist that does not route through the outaged classifier.

#74351 (classifier failing at scale since 2026-06-20), #74949 (burst outages, fail-closed on compound commands), #67542 (no classifier fallback), #63873, #68437, #49535 (same error family), #29214 (mobile prompts despite --dangerously-skip-permissions), #37845 (the prior silent mobile Bash allow whose fix changed Accept-edits behavior).

Screenshot

iOS app Select mode sheet during the incident (Manual / Accept edits / Plan / Auto only):

(screenshot available; will attach in a follow-up comment from the app if needed)

View original on GitHub ↗