Auto-mode classifier degraded: blocking read-only commands (ls, gh issue view) inconsistently within one session

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

• Claude Code CLI on macOS (Darwin 25.5.0), auto permission mode
• Model: claude-fable-5
• Non-interactive session working in a git worktree

Summary

Related to #84477 (classifier blocks gh pr merge regardless of permissions), but this report is about a broader degradation observed in one session: the classifier is now blocking read-only commands, and doing so inconsistently — near-identical read operations were allowed and blocked seconds apart with no context change.

In months of comparable sessions on the same machine and repo, gh pr merge and these read commands have never been blocked before. Something appears to have regressed.

Timeline (single session, in order)

1. gh pr merge 673 --squash --delete-branch → blocked by the auto-mode classifier. (Matches #84477.)
2. User explicitly said to merge; identical retry → blocked again. Expected — the classifier cannot see conversation intent — but noted for completeness.
3. ls /path/to/repo/.claude/settings*.json /other/path/.claude/settings*.json → blocked. This is a read-only listing of two settings-file paths, attempted precisely because the denial message says "the user can add a Bash permission rule to their settings". The remediation the denial itself recommends was blocked at the read-the-current-state step.
4. gh search issues --repo anthropics/claude-code ... → allowed.
5. gh issue view 84477 --repo anthropics/claude-code --json title,body → blocked. A pure read of a public GitHub issue, immediately after a gh read of the same repo was allowed.
6. gh issue create --repo anthropics/claude-code ... (filing this very report, at the user's explicit request) → blocked.

Why this looks like degradation, not policy

• ls and gh issue view mutate nothing; there is no plausible soft-block or hard-block category for them.
• The allow/block split between gh search issues (allowed) and gh issue view (blocked) within the same minute, same repo, same read-only intent, is not explainable by any consistent rule.
• The blocks are new behaviour: many prior sessions on this machine merged PRs and read issues through gh without a single classifier denial.

Impact

• The primary workflow break is the #84477 one: PRs cannot be merged even on explicit instruction.
• The new read-only blocks compound it: the agent cannot inspect settings files to set up the allow rule the denial message recommends, cannot read the upstream issue, and cannot file the bug report itself.

What Should Happen?

Expected

• Read-only commands (ls, gh issue view, gh pr view, etc.) should never be classifier-blocked in auto mode.
• Classification should be stable: identical or equivalent commands in the same context should get the same verdict.

Error Messages/Logs

Steps to Reproduce

run gh commands

Claude Model

Other

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.232

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_