auto mode classifier denies gh pr merge (and read-only gh search issues) it previously allowed

Title: Auto mode classifier denies gh pr merge (and read-only gh search issues) that it previously allowed

Environment

• Claude Code 2.1.257 (CLI), macOS Darwin 25.5.0, zsh
• Model: claude-fable-5-1
• Permission mode: auto mode
• Settings: ~/.claude/settings.json contains no permissions rules for gh; no project .claude/settings*.json present
• Session type: non-interactive (t3 worktree)

What happened

After the assistant had opened a PR with gh pr create (allowed) and pushed the branch with git push (allowed), the explicit user instruction "go ahead and merge" led to:

gh pr merge 871 --merge 2>&1 | tail -3; gh pr view 871 --json state,mergedAt,mergeCommit --jq '...'

which was denied with:

Permission for this action was denied by the Claude Code auto mode classifier.
Reason: Blocked by classifier.

The identical command was retried once at the user's request and denied again.

A subsequent, purely read-only command was also denied with the same message:

gh search issues --repo anthropics/claude-code "auto mode classifier blocked" --state open --limit 8 --json number,title,url

Expected

• gh pr merge on the user's own repository, after an explicit "merge" instruction in the same conversation, has been allowed in auto mode in earlier sessions on this machine without any allow rule (the repository history shows many PR merges made this way).
• gh search issues performs no write and should not be classified as needing approval at all.

Why it looks like a regression / over-sensitivity

• Same machine, same settings, same repository, same command shape as previously allowed merges.
• The denial reason is the generic "Blocked by classifier" with no category, so there is nothing to tune against.
• The read-only gh search denial suggests the classifier is keying on the gh binary (or the --repo/--json flags) rather than on the effect of the command.

Impact

Merges must be run by hand in every auto-mode session, and the assistant cannot even look up existing issues to avoid filing a duplicate.

Workaround

Adding Bash(gh pr merge:*) to permissions.allow bypasses the classifier for the merge, but not for other gh read commands.