[Bug] False positive security flag triggers unnecessary model downgrade mid-session

Bug Description
False positive, Claude Code (Fable 5 → auto-switched to Opus 5).

Solo founder, own machine, own repo: a personal systematic-trading project on an
IBKR paper (simulated-money) account. The session was ordinary engineering —
tests, type checks, code review, docs, ~13 merged PRs.

The flagged turn: I asked for the command to launch a vendor GUI app on my own Mac.

Earlier context was routine self-operations work — checking my own service's port
binding, and a name-only presence check for an env var where Claude explicitly
refused to read or write any value. All own-asset, all defensive.

Fallback worked, no work lost. But that's a low bar to trip, and a mid-session
model switch is costly during a time-boxed market operation.

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.220
• Feedback ID: 297e7b48-9c1f-437a-8f79-a01a019aa9e4

Errors

[{"error":"Error: Connection error.\n    at makeRequest (/$bunfs/root/src/entrypoints/cli.js:80:6799)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-07-31T02:37:21.548Z"}]