Auto-mode permission classifier denies ~40% of subagent spawns due to injected <context_window_protection> block

Summary

When a Claude Code session runs with auto-mode permissions, context-mode's subagent-routing hook appends its <context_window_protection> prompt block to every outgoing Agent (subagent) spawn prompt. Claude Code's permission classifier intermittently (~40% of spawns in my session) reads that injected block as a prompt-injection / exfiltration pattern and vetoes the spawn itself. Retries sometimes pass.

To be clear: this is arguably a false positive in Claude Code's classifier, not a defect in context-mode's logic — but context-mode's injected block is what triggers it, so reporting here.

Observed behavior

• Agent tool spawns denied by the permission classifier with an injection-style rationale, at roughly a 40% rate, during a large fan-out refactor (many parallel Edit subagents).
• Subagents that did spawn used the ctx_* tools without issue — the failure is spawn-denial, not tool-denial.
• Likely cause: the injected block steers agents toward the network-capable ctx_* tools, and as unexplained third-party text inside a spawn prompt it pattern-matches "injected instructions to exfiltrate via network tools."

Workaround found

Once the user stated in-conversation that the injected block was benign and spawns were approved, the classifier (which reads the transcript) stopped denying spawns entirely for the rest of the session.

Suggestions

Any of these would help:

• Make the injected block less injection-shaped (e.g. identify itself as coming from a locally installed plugin the user chose to enable).
• Offer a per-project opt-out for the subagent-routing hook.
• Document the in-transcript-confirmation workaround.

Environment

• Claude Code CLI on macOS (Darwin 24.6.0), auto-mode permissions
• context-mode installed as a Claude Code plugin
• Observed 2026-07-15 during a session spawning many parallel subagents