[BUG] Auto mode classifier requests Sonnet 5 despite an OpenAI-only session model

Summary

In Claude Code 2.1.280, auto mode's local safety classifier independently requests claude-sonnet-5 even when the active session and subagents are configured to use an OpenAI-compatible model. This makes Agent calls fail for gateways or organizations that intentionally allow only OpenAI models.

Reproduction

1. Start a fresh Claude Code 2.1.280 CLI session through an OpenAI-compatible LiteLLM gateway.
2. Configure the session and subagents to use an allowed OpenAI model, for example openai/gpt-5.6-luna.
3. Configure the gateway credential to allow only OpenAI models and reject Bedrock/Anthropic models.
4. Leave auto mode enabled.
5. Invoke an Agent, for example a test-running agent.

Observed error:

claude-sonnet-5 is temporarily unavailable, so auto mode cannot determine the safety of Agent right now.

The Agent does not start.

Expected behavior

The classifier should either:

• inherit the effective session model;
• use a documented classifier-model override that is allowed by the active gateway credential; or
• gracefully fall back to an allowed model or a normal permission prompt when its preferred classifier model is unavailable.

A session configured for an OpenAI-only gateway should not make an unconfigurable request for a Bedrock/Anthropic classifier model.

Evidence

• The session transcript records the coordinator and spawned subagents using openai/gpt-5.6-luna.
• No interactive /model switch appears in the transcript.
• The Agent definition has no static model field.
• The gateway records the classifier request as claude-sonnet-5 with no fallback or retry.
• Restricting the gateway credential to OpenAI models prevents the unintended request from incurring Bedrock spend, but causes the Agent action to be blocked.

Impact

This prevents Agent-based workflows from running through a gateway with an intentional model allowlist. It also makes the classifier's model selection opaque and can cause unexpected spend when the gateway permits the model.

Related issue

This appears related to feature request #69002, but this report focuses on the failure mode where the fixed classifier model is unavailable and blocks the Agent action.

Environment

• Claude Code: 2.1.280
• Interface: CLI
• Transport: LiteLLM gateway / OpenAI-compatible gateway
• Permission mode: auto mode