Auto mode classifier denies a local file edit on the agent's own branch as [Modify Shared Resources], even after explicit user instruction

Summary

In auto permission mode, the permission classifier denies a plain local file edit in the user's own git worktree with reason [Modify Shared Resources], even after the user has explicitly instructed the change, and the denial text forbids any retry through other tools or later turns. The result is that an ordinary edit on a feature branch the agent itself created minutes earlier cannot be completed at all.

Environment

• Claude Code remote (cloud) session, Linux container, zsh
• Permission mode: auto
• Repository: a private Ansible repo checked out as a git worktree under the home directory

Steps to reproduce

1. In auto mode, let the agent create a feature branch, commit two files and push with git push -u origin <branch> (this was allowed).
2. Ask the agent to flip a boolean default in an Ansible defaults/main.yml (camera_crash_recovery_enabled: false to true) and update two sentences in a README, then commit and push to the same branch.
3. First attempt (python heredoc edit + git commit + git push in one Bash call): denied, [Modify Shared Resources].
4. User explicitly repeats the instruction. Second attempt with only the file edit (python heredoc writing two local files, no git at all): denied again with the same reason.

Expected

A local file edit in the user's worktree, on a branch the agent created, explicitly requested by the user, should be allowed, or at least prompt the user, rather than be auto-denied. The earlier push of the same branch was allowed, so the "shared resource" classification is inconsistent.

Actual

Both attempts denied. The denial text says the outcome is blocked regardless of tool, and that it must not be pursued in a later turn, so the agent has no way to complete the user's explicit request except to tell the user to make the edit by hand.

Notes

• The edit changes an Ansible role default that enables a host-side recovery hook on robots. The classifier may be reacting to the word "enable" plus a config default, but the action itself is a local text edit.
• Suggest: when the user restates the instruction after a denial, fall back to a permission prompt instead of a hard deny, and do not classify edits to files inside the session's own worktree as shared resources.