Auto mode regression since 2.1.270: classifier blocks a solo owner's own routine release work (12× more denials), and the Manual fallback costs 55+ permission clicks for a 2-key config change

**TL;DR** — I run a one-person game studio and Claude Code is my entire engineering and release team (~8,000 tool calls a week). Since core 2.1.270 auto-updated on my Mac on Sep 15, Auto mode blocks work I explicitly delegated, on accounts only I own. On my release day it cost me hours, and the only fallback (Manual mode) turned a two-key config change into 55+ permission clicks. I am not asking you to remove the classifier. I am asking for a supported way for a sole owner to say "this is mine and routine" **once**.

**Environment:** Claude desktop app (macOS), Code tab, core 2.1.270 (2.1.260 until Sep 14), Max plan. I write my instructions in Vietnamese.

### The regression, measured from my local session logs (216 sessions)

| Period | Sessions | Tool calls | Classifier denials | Rate |
|---|---|---|---|---|
| Aug 8–14 | 15 | 4,318 | 6 | 0.14 % |
| Aug 22–28 | 14 | 4,225 | 3 | 0.07 % |
| Sep 8–14 (2.1.260) | 43 | 8,336 | 30 | 0.36 % |
| **Sep 15–17 (2.1.270)** | **63** | **2,261** | **40** | **1.77 %** |

Labeled denials (`[Feature Flag Writes]`, `[Production Deploy]`, `[Self-Modification]`, `[Auto-Mode Bypass]`, `[Remote Shell Writes]`…): **0 before Sep 15, 40 in the three days after** (Auto-Mode Bypass 15, Self-Modification 12, Feature Flag Writes 4, Production Deploy 2, others). On 2.1.260 the very same Remote Config edits went through without a denial (e.g. a publish logged on Sep 7); the first `[Feature Flag Writes]` denial anywhere in my logs is at 17:15 UTC on Sep 15 — hours after the update.

### What it cost on a real release day (Sep 17 — shipping v1.0.3 to Google Play and the App Store)

- **09:47** — Uploading *my own* build to an **internal-testing** track (not production; 5 testers, all me) was denied as `[Production Deploy]`, three times, including right after my direct order to do it. The third attempt was relabeled `[Auto-Mode Bypass]` and the session was effectively dead for that task. The build went up at 10:59: **72 minutes lost** on a step that takes two.
- **12:5x, 14:31, 14:44** — Adding two Remote Config keys whose values are *identical to the compiled defaults* (zero behavior change, fully reversible) was denied as `[Feature Flag Writes]` three times — even after I had told Claude "do all of it for me".
- **14:48–14:58** — The only way forward was Manual mode. There, every MCP browser call prompts, including each step inside a batch: **55 tool calls → 55+ "Allow once" cards in ten minutes to add two keys.** I sat there clicking a button for a task I had delegated precisely so I would not have to sit there.
- **15:00** — I asked Claude to pre-allow its browser tools so this would never happen again. Denied: `[Self-Modification]`. It was not even allowed to **read** `~/.claude/settings.json`. So the assistant can neither do the job nor help me configure the tool so that it can.
- **Sep 16** — Sending one keystroke to my own second Mac over SSH (a dedicated dev machine, nobody else uses it) was denied as `[Remote Shell Writes]` / `[Auto-Mode Bypass]`; we had to route a single Return key through Screen Sharing instead.
- **Knock-on cost** — A session that has been denied a few times starts treating every retry as "bypass" and has to be abandoned. I went from ~15 sessions a week in August to **63 sessions in three days**, each hand-off re-reading hundreds of thousands of tokens. I am now hitting "Approaching weekly usage limit" on a Max plan — paying for the tool to argue with itself.
- **Trust** — By the morning of Sep 17 my honest feeling was "everything I ask for fails". I had built my company's whole workflow on this product, and for three days it felt like a step backwards.

### Why the current design does not fit a sole owner

1. There is no other stakeholder to protect. I own every account, app and machine involved. An internal test track is not production. A config value equal to the default is not a risky flag flip.
2. "General requests don't count as explicit intent" penalizes exactly how a busy owner delegates. "Làm hết đi" ("go ahead, do all of it") is as explicit as I get — and I should not have to restate each action in the classifier's preferred wording, in a second language.
3. The denial text is written for the model, not for me. Nothing in the desktop UI told me the documented fixes exist (restate the exact action; `autoMode.allow` / `autoMode.environment`; "Recently denied → retry"). `/permissions` (Auto mode tab), `/auto-mode-setup` and `claude auto-mode …` are terminal-only; the desktop app offers no equivalent that I can find.
4. Minor but confusing: the session JSONL records `permissionMode: "bypassPermissions"` while the UI selector shows **Auto**.

### Requests

1. **Desktop app:** on a classifier denial, show *me* a card with "Allow once" and "Always allow this kind of action here" (writing an `autoMode.allow` entry) — i.e. bring "Recently denied → retry" and the Auto-mode rules editor to the desktop UI.
2. **Standing delegation:** let an owner declare once (user settings or CLAUDE.md) "I am the sole owner of these apps/accounts/hosts; releasing my own app, editing its remote config and driving my own dev machine are routine", and honor it for `Production Deploy`, `Feature Flag Writes` and `Remote Shell Writes` on the named targets.
3. **Manual mode:** make "Always allow" for an MCP server cover all of that server's tools and every step inside a batch — one click, not fifty-five.
4. **Tell the user the fix** in the visible denial notice ("say the exact action, or add an allow rule"), not only in the text sent to the model.
5. **Let Claude read the effective auto-mode configuration** (read-only, or via a built-in tool) so it can help fix false positives instead of being blocked from even looking.

I like what Auto mode is trying to do. But a safety layer that a sole owner cannot teach, from the app he actually uses, stops being safety and becomes lost days. I am happy to share redacted logs for any of the numbers above.

**Related reports (same family of problems):** #91953 (user-authorized deploys blocked, denials compound within a session), #84390 (classifier active while the session reports `bypassPermissions`), #88575 (MCP tools in the allow list still denied), #80900 (tell approvable soft denials apart from hard ones).

Start by reproducing the classifier denial in the Claude desktop app's Auto mode, then read the documented settings locations in ~/.claude/settings.json and CLAUDE.md and review the /permissions and /auto-mode-setup entry points. Done means the requested desktop allow controls, standing delegation rules, clearer denial guidance, batched MCP approval, and read-only configuration visibility are defined and validated without weakening the classifier.

Written by the indexing model from the issue text.