Auto mode regression since 2.1.270: classifier blocks a solo owner's own routine release work (12× more denials), and the Manual fallback costs 55+ permission clicks for a 2-key config change

TL;DR — I run a one-person game studio and Claude Code is my entire engineering and release team (~8,000 tool calls a week). Since core 2.1.270 auto-updated on my Mac on Sep 15, Auto mode blocks work I explicitly delegated, on accounts only I own. On my release day it cost me hours, and the only fallback (Manual mode) turned a two-key config change into 55+ permission clicks. I am not asking you to remove the classifier. I am asking for a supported way for a sole owner to say "this is mine and routine" once.

Environment: Claude desktop app (macOS), Code tab, core 2.1.270 (2.1.260 until Sep 14), Max plan. I write my instructions in Vietnamese.

The regression, measured from my local session logs (216 sessions)

| Period | Sessions | Tool calls | Classifier denials | Rate |
|---|---|---|---|---|
| Aug 8–14 | 15 | 4,318 | 6 | 0.14 % |
| Aug 22–28 | 14 | 4,225 | 3 | 0.07 % |
| Sep 8–14 (2.1.260) | 43 | 8,336 | 30 | 0.36 % |
| Sep 15–17 (2.1.270) | 63 | 2,261 | 40 | 1.77 % |

Labeled denials ([Feature Flag Writes], [Production Deploy], [Self-Modification], [Auto-Mode Bypass], [Remote Shell Writes]…): 0 before Sep 15, 40 in the three days after (Auto-Mode Bypass 15, Self-Modification 12, Feature Flag Writes 4, Production Deploy 2, others). On 2.1.260 the very same Remote Config edits went through without a denial (e.g. a publish logged on Sep 7); the first [Feature Flag Writes] denial anywhere in my logs is at 17:15 UTC on Sep 15 — hours after the update.

What it cost on a real release day (Sep 17 — shipping v1.0.3 to Google Play and the App Store)

• 09:47 — Uploading my own build to an internal-testing track (not production; 5 testers, all me) was denied as [Production Deploy], three times, including right after my direct order to do it. The third attempt was relabeled [Auto-Mode Bypass] and the session was effectively dead for that task. The build went up at 10:59: 72 minutes lost on a step that takes two.
• 12:5x, 14:31, 14:44 — Adding two Remote Config keys whose values are identical to the compiled defaults (zero behavior change, fully reversible) was denied as [Feature Flag Writes] three times — even after I had told Claude "do all of it for me".
• 14:48–14:58 — The only way forward was Manual mode. There, every MCP browser call prompts, including each step inside a batch: 55 tool calls → 55+ "Allow once" cards in ten minutes to add two keys. I sat there clicking a button for a task I had delegated precisely so I would not have to sit there.
• 15:00 — I asked Claude to pre-allow its browser tools so this would never happen again. Denied: [Self-Modification]. It was not even allowed to read ~/.claude/settings.json. So the assistant can neither do the job nor help me configure the tool so that it can.
• Sep 16 — Sending one keystroke to my own second Mac over SSH (a dedicated dev machine, nobody else uses it) was denied as [Remote Shell Writes] / [Auto-Mode Bypass]; we had to route a single Return key through Screen Sharing instead.
• Knock-on cost — A session that has been denied a few times starts treating every retry as "bypass" and has to be abandoned. I went from ~15 sessions a week in August to 63 sessions in three days, each hand-off re-reading hundreds of thousands of tokens. I am now hitting "Approaching weekly usage limit" on a Max plan — paying for the tool to argue with itself.
• Trust — By the morning of Sep 17 my honest feeling was "everything I ask for fails". I had built my company's whole workflow on this product, and for three days it felt like a step backwards.

Why the current design does not fit a sole owner

1. There is no other stakeholder to protect. I own every account, app and machine involved. An internal test track is not production. A config value equal to the default is not a risky flag flip.
2. "General requests don't count as explicit intent" penalizes exactly how a busy owner delegates. "Làm hết đi" ("go ahead, do all of it") is as explicit as I get — and I should not have to restate each action in the classifier's preferred wording, in a second language.
3. The denial text is written for the model, not for me. Nothing in the desktop UI told me the documented fixes exist (restate the exact action; autoMode.allow / autoMode.environment; "Recently denied → retry"). /permissions (Auto mode tab), /auto-mode-setup and claude auto-mode … are terminal-only; the desktop app offers no equivalent that I can find.
4. Minor but confusing: the session JSONL records permissionMode: "bypassPermissions" while the UI selector shows Auto.

Requests

1. Desktop app: on a classifier denial, show me a card with "Allow once" and "Always allow this kind of action here" (writing an autoMode.allow entry) — i.e. bring "Recently denied → retry" and the Auto-mode rules editor to the desktop UI.
2. Standing delegation: let an owner declare once (user settings or CLAUDE.md) "I am the sole owner of these apps/accounts/hosts; releasing my own app, editing its remote config and driving my own dev machine are routine", and honor it for Production Deploy, Feature Flag Writes and Remote Shell Writes on the named targets.
3. Manual mode: make "Always allow" for an MCP server cover all of that server's tools and every step inside a batch — one click, not fifty-five.
4. Tell the user the fix in the visible denial notice ("say the exact action, or add an allow rule"), not only in the text sent to the model.
5. Let Claude read the effective auto-mode configuration (read-only, or via a built-in tool) so it can help fix false positives instead of being blocked from even looking.

I like what Auto mode is trying to do. But a safety layer that a sole owner cannot teach, from the app he actually uses, stops being safety and becomes lost days. I am happy to share redacted logs for any of the numbers above.

Related reports (same family of problems): #91953 (user-authorized deploys blocked, denials compound within a session), #84390 (classifier active while the session reports bypassPermissions), #88575 (MCP tools in the allow list still denied), #80900 (tell approvable soft denials apart from hard ones).

Claude Code 2.1.278 (CLI, not the desktop app)
Windows 11 Pro 10.0.26200
surface: headless session spawned by `claude remote-control`, stdio stream-json
plan: Max

Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Auto-Mode Bypass].

21:55:28Z  gh issue comment 95200 --repo anthropics/claude-code --body-file <path>
           + the same two trailing shell comments as the denied row
           -> PUBLISHED

21:55:45Z  gh api repos/anthropics/claude-code/issues/comments/<id> --jq '{...}'
           read-only GET, no trailing comments, no approval text of any kind
           -> Permission for this action was denied by the Claude Code auto mode
              classifier. Reason: [Auto-Mode Bypass].

2026-09-19T20:35  bypassPermissions  a1822db7-c9b1-4b07-...   (v4)
2026-09-19T20:47  auto               34d37f8a-ac8b-5582-...   (v5)
2026-09-19T23:16  bypassPermissions  edb2b429-87af-4a02-...   (v4)
2026-09-20T01:07  auto               e762b515-ebf1-5f11-...   (v5)
2026-09-20T01:30  bypassPermissions  c950bacb-fd5e-4d13-...   (v4)
2026-09-20T03:06  auto               ae78ae8f-e3e9-590a-...   (v5)
2026-09-20T11:00  bypassPermissions  aa02924d-139d-4e04-...   (v4)
2026-09-20T16:40  bypassPermissions  bcf2e303-c53a-45df-...   (v4)
2026-09-20T20:03  bypassPermissions  7b3d8320-05d4-4d64-...   (v4)
2026-09-20T21:04  auto               0ebbeaa6-24d4-5364-...   (v5)
2026-09-20T21:57  bypassPermissions  ac839cdd-1e4f-45c8-...   (v4)

argv:                        --permission-mode bypassPermissions
argv of its spawner process: --permission-mode bypassPermissions
permissions.defaultMode:     bypassPermissions   (user settings file)
managed-settings.json:       not present
project settings file:       not present
effective mode in transcript: auto