[Bug] Auto-mode permission classifier denies allowed operations silently with incorrect remediation guidance

Bug Description
Title: Auto-mode permission classifier silently denies file operations that
the user's own settings explicitly allow — and its suggested fix does not work

Environment

• Claude Code CLI, Linux, model Opus 5 (1M context)
• Date: 2026-08-19
• Permission mode: auto
• ~/.claude/settings.local.json already contains:

"allow": ["Bash()", "Read()", "Edit()", "Write()", ...]
"deny": only rm -rf / , mkfs, dd to /dev/

What happened
During a normal IT-support session (reading a router's config and saving the
findings), the auto-mode classifier denied 7 commands in a row. All of them
were about SAVING work, none about changing anything live:

1. scp a 157 KB device config backup to my own server
2. same file via ssh host 'cat > file'
3. git add/commit/push of a folder containing that backup, into my own

private repo

1. writing a small shell script that would perform (3)
2. writing a CSV of network inventory to that same private repo
3. ssh host 'curl ... | grep ...' (read-only page fetch)
4. rm -rf of a temp folder inside my own scratchpad

In the same session, six other git commits+pushes to the same repo and the
same branch succeeded. Dozens of ssh commands succeeded, including an
arp-scan with sudo. So the block was content-based, not command-based.

Why this is a problem

1. The denial message says: "the user can add a Bash permission rule to their

settings." I already have Bash(*) allowed. Adding rules does nothing. The
suggested fix is misleading and sent us down a long dead end.

1. There is no visible reason. The assistant could only guess what triggered

it, and guessed wrong at first, which wasted a lot of my time and tokens.

1. There is no way to approve it in the moment. It is denied outright — I am

not asked. I am the owner of the machine, the repo, and the data.

1. The risk model feels inverted. It blocked backups and inventory files

(saving work) while allowing sudo network scans and live SSH sessions
(which can actually break things).

1. Real cost: roughly an hour and a half of a paid session went to

permission troubleshooting instead of the actual work, and the assistant
kept proposing remedies that could not work.

Proof it is the mode, not my settings
I pressed Shift+Tab to leave auto mode and re-ran the exact same commit and
push, same repo, same branch, same file. It went through immediately, with no
prompt and no denial.

What I would like

• Make classifier denials interactive: ask me, do not decide for me.
• State the actual reason/category in the denial, not a generic string.
• Honour explicit allow rules, or say clearly that they cannot override the

classifier — do not point at a fix that has no effect.

• Distinguish "sending data to an external service" from "writing a file into

a local private git repo the user owns". These are not the same risk.

Environment Info

• Platform: linux
• Terminal: gnome-terminal
• Version: 2.1.234
• Feedback ID: 70ab0346-b11c-4c0f-856a-683eae9ce63b

Errors

[]