›_ Claude Code Issues
Claude Code Issues / #99813

Auto mode classifier blocks explicitly user-requested merges/deploys; typed approvals in headless claude -p (Slack/remote) never count

Status Open
Reported on v2.1.289
Maintainer reply None cached
Activity 4 comments · opened Oct 5, 2026

Summary

In auto mode, the classifier repeatedly blocks actions that the user has explicitly asked for, in plain words, in the same conversation. Over a full working day, finished, tested work kept stalling at the last step (merge, deploy, env var update). Work was lost and the user had to come back several times.

Environment

  • Claude Code 2.1.289, Linux (WSL2)
  • Headless claude -p launched by a personal Slack bot (Slack DM → claude -p --resume <session>), auto mode
  • Single user who owns the repo, the Vercel project, and the Slack workspace

What happens

Denials seen on 2026-10-05 for actions the user directly asked for:

| Action | Classifier reason |
|---|---|
| gh pr merge on the user's own PR after they typed "Publish the new Podcast voice" | [Merge Without Review] (3 times) |
| Vercel prod deploy / setting a prod env var the user asked for | [Production Deploy] |
| Reading the app's own production blob storage / public sports-results API for test data | [Production Reads] |
| Adding an API key the user approved, where the approval was pasted from an earlier session's output | approval rejected because it was pasted text |
| Read-only scan of local ~/.claude/projects/*.jsonl transcripts to count today's denials | denied as pursuing the earlier denied outcome |

Why this is a problem

  • Typed approvals in headless/remote sessions are not recognized. The user's own typed message ("Publish the new Podcast voice") arrives as the -p prompt. That is the only way a Slack/mobile user can talk to the agent, and it is still treated as insufficient.
  • The required wording is not discoverable. Nothing tells the user what wording, if any, counts as approval, so they guess and get blocked again.
  • The blocks spread to unrelated work. After one merge denial, a purely local, read-only transcript scan was also denied as "pursuing the same outcome".
  • Big cost to non-technical users. The user ends up clicking buttons in GitHub or Vercel, or editing settings files, for work the agent has already finished.

Expected

  • A clear, explicit user instruction in the current conversation ("merge it", "publish it") should be enough to approve that action. In headless mode, the -p prompt text is the user's own words.
  • The denial message should say exactly what the user can type or configure to approve this one action.
  • Read-only local inspection should not be blocked as a follow-on to a different denied write.

Related: #91694, #91754, #96662

View original on GitHub ↗

3 Comments

scottmmorrissey-stack · 9 days ago

Update: work is blocked right now.

A finished change is stuck because of this. It is coded, has passed all 142 tests and type checks, has a PR open, and the user has asked for it to go live. The agent cannot merge or deploy it: [Merge Without Review] was denied three times, each time after the user explicitly asked for it.

The only ways forward the classifier offers are for the user to click merge in GitHub themselves, or to edit permission settings by hand. The user has declined both. They should not have to do the last step manually on work they asked an agent to finish. The change will stay unshipped until this is fixed.

sattyamjjain · 8 days ago

Not a fix for the classifier, but two documented options may unblock the Slack setup today.

  1. A -p run has no prompt to fall back to, so an approval typed in chat never reaches a decision point. --permission-prompt-tool lets you point that decision at an MCP tool. Your Slack bot could implement it: ask you in the DM, return allow or deny. Then the approval is an actual answer to that one action, not something inferred from the prompt text.
  1. For routine actions on your own repo, the docs say to add the pattern to autoMode.allow (and your repo/Vercel project to autoMode.environment) instead of approving each time. Claude auto-mode defaults print the current rules.

https://code.claude.com/docs/en/permission-modes
https://code.claude.com/docs/en/auto-mode-config

Agree on the error message, though. It should name the exact setting that would allow the action.

scottmmorrissey-stack · 8 days ago

Tried both and blocked by the security checker for both.

Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: Sattyam jain @.*>
Sent: Tuesday, 06 October 2026 01:05:54
To: anthropics/claude-code @.*>
Cc: scottmmorrissey-stack @.>; Author @.>
Subject: Re: [anthropics/claude-code] Auto mode classifier blocks explicitly user-requested merges/deploys; typed approvals in headless claude -p (Slack/remote) never count (Issue #99813)

[https://avatars.githubusercontent.com/u/37297369?s=20&v=4]sattyamjjain left a comment (anthropics/claude-code#99813)<https://github.com/anthropics/claude-code/issues/99813#issuecomment-6012069489>

Not a fix for the classifier, but two documented options may unblock the Slack setup today.

  1. A -p run has no prompt to fall back to, so an approval typed in chat never reaches a decision point. --permission-prompt-tool lets you point that decision at an MCP tool. Your Slack bot could implement it: ask you in the DM, return allow or deny. Then the approval is an actual answer to that one action, not something inferred from the prompt text.
  1. For routine actions on your own repo, the docs say to add the pattern to autoMode.allow (and your repo/Vercel project to autoMode.environment) instead of approving each time. Claude auto-mode defaults print the current rules.

https://code.claude.com/docs/en/permission-modes
https://code.claude.com/docs/en/auto-mode-config

Agree on the error message, though. It should name the exact setting that would allow the action.

—
Reply to this email directly, view it on GitHub<https://github.com/anthropics/claude-code/issues/99813?email_source=notifications&email_token=CAMWSW4GWFASZDVRG43RVZL5SSRWFA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBRGIYDMOJUHA42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6012069489>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/CAMWSW2XRMCNMXWQM62LKS35SSRWFAVCNFSNUABFKJSXA33TNF2G64TZHM4TGNZSGUZTINZVHNEXG43VMU5TKNZSGA2DQNBTGIY2C5QC>.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/CAMWSW4IRDRUN6ES5VBRQ3D5SSRWFA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBRGIYDMOJUHA42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android<https://github.com/notifications/mobile/android/CAMWSW6ZOAWXEQQ2UCBQZVL5SSRWFA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMBRGIYDMOJUHA42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today!
You are receiving this because you authored the thread.Message ID: @.***>

Showing cached comments. Read the full discussion on GitHub ↗

Related Claude Code issues

Matched on shared title terms, labels, topic and reported release — ranked so issues with real discussion come first.

Browse by topic

Same class of failure, ranked by community engagement — this issue is one of many, so it may not appear in the visible list: Authentication & login failures

Browse all Claude Code issue topics →