From 6b531fbacd21236070881bb30916983146132c3c Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Tue, 4 Aug 2026 21:36:54 -0300
Subject: [PATCH] fix(claude): remove unconditional always-mode return in
 claudeClassifierCompat (#9276)

---
 changelog.d/fixes/9276-fix.plan.md            |  1 +
 .../chatCore/claudeClassifierCompat.ts        |  5 ++---
 tests/unit/claude-classifier-compat.test.ts   | 20 +++++++++++++++++--
 3 files changed, 21 insertions(+), 5 deletions(-)
 create mode 100644 changelog.d/fixes/9276-fix.plan.md

diff --git a/changelog.d/fixes/9276-fix.plan.md b/changelog.d/fixes/9276-fix.plan.md
new file mode 100644
index 0000000000..4ad84fe574
--- /dev/null
+++ b/changelog.d/fixes/9276-fix.plan.md
@@ -0,0 +1 @@
+- fix(claude): remove unconditional "always" return in claudeClassifierCompat so normal chat requests are not swallowed (#9276)
\ No newline at end of file
diff --git a/open-sse/handlers/chatCore/claudeClassifierCompat.ts b/open-sse/handlers/chatCore/claudeClassifierCompat.ts
index 5b7cc62b2a..2d536b5596 100644
--- a/open-sse/handlers/chatCore/claudeClassifierCompat.ts
+++ b/open-sse/handlers/chatCore/claudeClassifierCompat.ts
@@ -41,8 +41,8 @@ function extractSystemTexts(body: Record<string, unknown> | null | undefined): s
  * True when the inbound request should be default-allowed without calling upstream.
  *
  * - `mode === "off"` (default): never short-circuits.
- * - `mode === "always"`: short-circuits every Claude-format request (operator has
- *   decided every `/v1/messages` call through this route is the classifier).
+ * - `mode === "always"`: short-circuits only when the request carries the classifier's
+ *   system-prompt marker (same body-awareness as "auto").
  * - `mode === "auto"`: only short-circuits when the request carries the classifier's
  *   system-prompt marker. `</block>` in `stop_sequences` is corroborating evidence but
  *   is never sufficient alone — the marker is the strong, classifier-unique signal;
@@ -56,7 +56,6 @@ export function shouldDefaultAllowClassifier(
 ): boolean {
   if (mode !== "auto" && mode !== "always") return false;
   if (sourceFormat !== FORMATS.CLAUDE) return false;
-  if (mode === "always") return true;
 
   return extractSystemTexts(body).some((text) => text.includes(SECURITY_MONITOR_MARKER));
 }
diff --git a/tests/unit/claude-classifier-compat.test.ts b/tests/unit/claude-classifier-compat.test.ts
index a0fd834d33..187c0816ac 100644
--- a/tests/unit/claude-classifier-compat.test.ts
+++ b/tests/unit/claude-classifier-compat.test.ts
@@ -112,9 +112,25 @@ test("detector: never fires for non-Claude source formats even in always mode",
   assert.equal(shouldDefaultAllowClassifier(FORMATS.OPENAI, CLASSIFIER_BODY, "always"), false);
 });
 
-test("detector: always fires for every Claude-format request", () => {
+test("detector: always does NOT fire for normal chat without classifier marker (#9276)", () => {
   const plain = { system: [{ type: "text", text: "hi" }], stop_sequences: [] };
-  assert.equal(shouldDefaultAllowClassifier(FORMATS.CLAUDE, plain, "always"), true);
+  assert.equal(
+    shouldDefaultAllowClassifier(FORMATS.CLAUDE, plain, "always"),
+    false,
+    "always must NOT short-circuit a normal chat (no security-monitor marker)"
+  );
+});
+
+test("detector: always fires when classifier marker is present", () => {
+  const classifier = {
+    system: [{ type: "text", text: "You are a security monitor for autonomous AI coding agents. Evaluate the following action." }],
+    stop_sequences: ["</block>"],
+  };
+  assert.equal(
+    shouldDefaultAllowClassifier(FORMATS.CLAUDE, classifier, "always"),
+    true,
+    "always must short-circuit when the classifier marker is present"
+  );
 });
 
 // ─── Pure builder: buildDefaultAllowClaudeMessage ────────────────────────────