Auto-mode classifier false-positives on codex exec and cross-tool state files

What happened

Two standard Bash commands were blocked by the auto-mode classifier with the message "Blocked by classifier" — no specific rule or reason given.

1. codex exec (OpenAI Codex CLI)

codex exec -m gpt-5.6-sol -c 'model_reasoning_effort="low"' -s workspace-write --ephemeral \
  -o output.md - < prompt.md

This dispatches implementation work to the Codex CLI — a standard command-line tool installed at ~/.local/bin/codex. It's no different from running python, node, or any other CLI tool. Blocked on every attempt, including retries.

2. touch /tmp/.codex-plan-review-bypass

A file that bridges two tools' separate review-gate marker stores. The plan review had already converged (Claude's own review-marker verify confirmed the marker), but the Codex CLI has its own independent gate that looks in a different location. The classifier apparently pattern-matched on "bypass" in the path and blocked it.

Impact

• Both operations required the user to manually run the commands, defeating the purpose of auto mode
• The classifier message gives no explanation ("Blocked by classifier"), making it impossible to understand what rule triggered or how to work around it
• Adding Bash allowlist rules in settings doesn't help because the flag combinations vary per invocation

Expected behavior

• codex exec should be treated like any other CLI tool (it writes to the local filesystem with workspace-write sandbox, same as python or npm)
• Creating files in /tmp should not be blocked based on filename pattern-matching — the classifier can't know whether an external tool's gate was already satisfied through a different path
• When the classifier blocks a command, the reason should be specific enough to act on (which rule triggered, what about the command was flagged)

Environment

• Claude Code CLI, auto mode
• Model: claude-opus-4-6 (1M context)
• Platform: Linux (Ubuntu, code-server container)