Auto mode denies or asks when no safety check gives a verdict

What

Auto mode lets Claude Code approve tool calls on its own after a safety check called the classifier reviews them. A classifier can run on the server or on your machine. Claude Code now handles the cases where no check gives a verdict.

• If the server classifier gives no verdict and no local classifier exists, the tool is no longer run. It is denied, or you are asked instead. New deny messages include "Auto mode is unavailable: its safety check does not run for this session".
• Outside auto mode, when the server gives no verdict for a call, a new fallback either denies it, saying nobody can be asked, or asks you with the reason floor_no_server_verdict.
• When a hook rewrites a tool's input, the call goes to the local classifier, with a reason such as projection_only. A hook is your own command that runs at set points.
• A rewritten server verdict is now tracked by its cause, source and shape. The denial-limit reset also clears these fields.
• Local classifier calls now record which part of Claude Code made them and whether a subagent did, which is a helper Claude starts for part of a job. The gate, handoff and workflowGate call sites are left out. The classifier request carries a caller field.
• Auto-mode decision and fallback-to-ask records, including tengu_auto_mode_decision and tengu_auto_mode_fallback_to_ask, now carry toolUseId, the ID of the tool call.

Why

Tool calls that once went ahead unchecked when the classifier returned nothing can now be refused or brought to you. If you use auto mode, expect some calls to stop with a safety-check-unavailable message or a permission prompt.