[BUG] Auto-mode classifier blocks a command that literal-text-matches an existing allow rule

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In auto permission mode, the auto-mode classifier misclassified a routine PowerShell script invocation as a "Production Deploy," even though .claude/settings.local.json already contains an explicit allow rule whose literal text matches the command:

"permissions": { "allow": [ "PowerShell(.\\Post-Worklist.ps1 *)", "Bash(powershell -File \"Post-Worklist.ps1\" *)" ] },
"autoMode": { "allow": [ "PowerShell/Bash running Post-Worklist.ps1 ... after he has explicitly said go/post/record. This is bookkeeping data entry, not a software or infrastructure deploy, and must never be classified as one." ] }

Three invocation forms were tried, all blocked, for different stated reasons:

1. powershell -File "C:\...\Run-Day.ps1" -Post (full path) -> blocked, reason: "Production Deploy"
2. powershell -File "C:\...\Post-Worklist.ps1" -Force (full path, matches the documented working fix from a prior session) -> blocked, reason: "Production Deploy"
3. cd into the script's directory, then .\Post-Worklist.ps1 -Force (relative, matching the literal permissions.allow string) -> blocked, reason: "Auto-Mode Bypass"

Even loading the update-config skill (intended to help fix permission settings) was itself blocked by the classifier.

Expected: A command matching an existing autoMode.allow / permissions.allow entry should not be blocked by the semantic classifier.

Actual: Blocked regardless, with three different stated reasons across three attempts.

Workaround used: Switched the session from auto to default permission mode.

What Should Happen?

A command that matches an existing autoMode.allow / permissions.allow entry should not be blocked by the semantic classifier - the allow rule should take precedence, as documented.

Error Messages/Logs

Steps to Reproduce

1. In a project with a .claude/settings.local.json containing:

"permissions": { "allow": [ "PowerShell(.\\Post-Worklist.ps1 *)", "Bash(powershell -File \"Post-Worklist.ps1\" *)" ] },
"autoMode": { "allow": [ "PowerShell/Bash running Post-Worklist.ps1 ... is bookkeeping data entry, not a software or infrastructure deploy, and must never be classified as one." ] }

1. In auto permission mode, run: powershell -File "C:\...\Post-Worklist.ps1" -Force (full path, matching the allow rule)
2. Observe: blocked by the classifier, reason given "Production Deploy"
3. Retry as: cd into the script's directory, then run .\Post-Worklist.ps1 -Force (relative path, also matching the literal permissions.allow string)
4. Observe: blocked again, this time reason given "Auto-Mode Bypass"

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Unknown - running via the Claude desktop app (Code tab), not the CLI, so claude --version isn't reachable from this session

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_