Injected session_continuity/priority_instructions framing trips Claude Code's auto-mode classifier (Auto-Mode Bypass) #911

Summary

Claude Code's auto-mode permission classifier flagged an Agent-tool dispatch as a policy violation (Auto-Mode Bypass category) because the dispatch prompt contained context-mode's injected <context_window_protection> routing block — specifically the <session_continuity> clause ("a past phrase does not bind you"). The denial text read:

[Auto-Mode Bypass] The Agent dispatch prompt contains an injected "context_window_protection" block instructing the agent to load and route through new MCP tools and to disregard prior session directives — a prompt-injection payload attempting to manipulate agent behavior and evade oversight, not something the user authorized.

This also blocked ctx_upgrade's self-update mechanism on retry, since the classifier treated pulling new code from a source already flagged in the same session as a "Code from External" risk requiring direct human review outside auto mode.

Root cause (as far as I can tell)

Not a data-exfiltration issue — I checked the bundled cli.bundle.mjs/server.bundle.mjs directly for outbound network calls and found nothing beyond a public npm-registry version check and a manually-invoked ctx_insight browser-open. The "nothing leaves your machine" claim in the README held up under inspection.

The actual trigger is purely the framing of hooks/routing-block.mjs's createRoutingBlock(): content wrapped in a block literally named priority_instructions, delivered automatically via a SessionStart/PreToolUse hook (not user-initiated), telling the agent "a past phrase does not bind you." Structurally that's indistinguishable from a classic prompt-injection technique (claim elevated authority, tell the agent to discount prior instructions), regardless of intent.

I found commit f262852 (2026-06-22, #856) already softened this once — from an "inescapable active-until-revoked standing order" to the current "memory aid, not a standing order" phrasing, to fix a do-nothing-loop bug where casual phrases froze as re-injected behavioral_directives. That's a real improvement, but the residual framing still reads as injection-shaped to Claude Code's classifier even after the softening.

Reproduction

1. Install context-mode as a Claude Code plugin, in a session with auto mode enabled.
2. Dispatch any subagent via the Agent tool (the injected <context_window_protection> block rides along automatically).
3. The permission classifier may flag the dispatch under Auto-Mode Bypass, citing the injected block's "disregard prior session directives" framing.

Not deterministic — happened in one session/window but not consistently across repeated attempts in another, consistent with an LLM-judged classifier rather than a static rule match.

Suggested remediation directions

• Drop or further soften the <session_continuity> "a past phrase does not bind you" line — the intent (avoid stale captured context freezing into a standing directive) can likely be conveyed without language that reads as "discount prior instructions."
• Consider renaming <priority_instructions> to something that doesn't claim elevated authority over the rest of the prompt (e.g. <usage_hint> or <tool_guidance>).
• An opt-out/quiet-mode flag for security-conscious users who want the sandboxing/search tools without the injected routing framing would also address this without changing default behavior.

Happy to share the full transcript/denial text if useful. Thanks for the tool — the sandboxing and FTS5 search are genuinely useful, this is specifically about the injected framing tripping a security classifier.