Auto mode classifier denial cannot be overridden by the owner's explicit in-chat consent (no approval prompt)

Summary

In auto mode, the permission classifier blocked an action that the account owner had explicitly authorized in the chat, several times, and there is no way to confirm it from inside the conversation.

What happened

• Environment: Claude Code 2.1.283 in the Claude desktop app (Code tab), macOS, auto mode.
• The owner asked the agent to use a paid cloud GPU/CPU provider (Vast.ai) that another Claude Code session on the same machine already uses with the owner's approval. The goal was to speed up a long test run.
• The agent tried to look up how the other session calls the provider's API. The classifier denied it with:

Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Credential Exploration]

• The owner then wrote in the chat, explicitly and repeatedly, that they own the account, pay for it and authorize the action. The denial message tells the agent not to pursue the same outcome in later turns, so the agent could not act on that consent.
• The only way to unblock is a permission rule set from an interactive terminal (/permissions). The desktop Code tab does not offer that, and the chat gives no in-conversation "allow this once" prompt.

Expected

When a classifier denial blocks an action, the user should get an in-chat approval prompt (allow once / always / deny), the same as a normal permission prompt, so the owner can authorize it without leaving the conversation.

Impact

The owner sees the agent "refusing orders" for reasons that feel arbitrary. The paid resource they had authorized went unused, and the task was delayed by hours.