Nothing to try yetTier: how much it should matter to you
4Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Auto ModeArea: what it touches
In DevelopmentKind: in v2.1.265,
What probably matters to youSection of the release
What
Tools that declare classifierOnly() are now always evaluated by the auto mode classifier — saved always-allow rules and hook-based allows are ignored, and outside auto mode such tools are denied with a message naming the tool.
These tools can now set onBlock: 'flag'. When the classifier would otherwise block the action, refuse to review it, or return no verdict, the action is now delivered (allowed) instead of denied, but annotated with a decisionReason noting it was "Flagged by the classifier, delivered with its warning: ...".
A new guard denies the action with an explicit bug message if a classifier-only tool serializes to an empty classifier input, since the classifier would have nothing to judge.
The core auto-mode permission pipeline now checks each tool's classifier-only config: if onBlock === "refuse" and a hook asked for a prompt (or the host re-asks on every allow), it denies with an explanation; if onBlock === "flag", it forces the new allow-with-flag outcome.
Why
This lets certain sensitive tools stay strictly gated by the auto-mode classifier (never allowed by saved rules or hooks) while giving them a softer failure mode: instead of silently blocking an action the classifier is unsure about, Claude Code can deliver it with a visible warning explaining why it was flagged.
