Claude Code auto-mode classifier — feedback for Anthropic

Title: Auto-mode classifier evaluates each tool call without conversation context, blocking authorized operator workflows

Summary

In a long autonomous session, the classifier repeatedly blocked tool calls the user had explicitly authorized in plain English on the immediately-preceding turn. The classifier appears to evaluate each tool invocation in isolation, so turn-level authorization does not carry forward. The cumulative effect on real CI/operator work is severe: simple deterministic actions require 3–10 retry attempts and verbal hand-holding.

Concrete cases hit in one ~6 hour session

Concrete asks

1. Pass conversation context (or at least the most recent N user messages) into the classifier so explicit "yes do that" survives across the very next tool call.
2. Read user-memory files as soft permissions, not just soft prohibitions. When feedback_no_destructive_jenkins.md says "reload is fine", a POST to /reload should not be flagged as if it were "apply".
3. Surface a one-line "ack and continue" verb so the user can authorize a previously-blocked specific call by quoting its reject reason, rather than rephrasing the request five times.
4. Distinguish "self-modification" from "skill-recommended config edit" — when a skill literally said "add X to settings.json", the classifier should not refuse the only write the skill instructed.

Impact

In this session the classifier converted what should have been ~15 minutes of operator work (workspace rebase + push + Jenkins casc reload + build abort) into ~3 hours of back-and-forth, including two extended sleeps because builds I couldn't abort kept flapping until their 60-min timeout.

The work itself is not blocked by these refusals — every action eventually got done — but the friction is severe enough that for autonomous operator sessions Claude Code is currently less useful than a plain SSH terminal.