[Bug] Safety classifier over-blocks defensive work on repository's own agent-safety hooks

Bug Description
Title: Safety classifier repeatedly blocks defensive work on a repository's own agent-safety hooks

What happened:
I maintain a Claude Code plugin, in my own repository, whose PreToolUse hooks protect a project from destructive actions by AI agents. They stop agents from rewriting git history that a plan records, from discarding uncommitted work, and from publishing a release while known bugs are open. In one long session, the safety classifier stopped Claude four times while it was working on these protections:

1. while fixing gaps in the hooks' command-reading logic that a code review had found;
2. while restoring the previous, stricter behaviour of that same logic, after a human-written fix had weakened it (a regression);
3. as soon as Claude started on the next bug in the same component;
4. while Claude was writing an architecture document for a different approach. That approach would check the actual effect on git refs instead of parsing command text, which would remove the need to reason about command spellings at all.

Each time Claude correctly stopped, did not retry, and handed the work to me as a human. I am not a Python developer, so in practice this blocks the project's release. The fixes I wrote by hand needed four review rounds, each of which found regressions, and an automated reviewer had to do the analysis anyway.

Why this looks like a false positive:

• The work is purely defensive: hardening the user's own guardrails against an AI agent's mistakes, in the user's own repository.
• Item 4 was a design document whose whole purpose is to stop depending on knowledge of command spellings.
• Item 2 was restoring code that already existed.
• Reviews and test verification of the same code went through without problems; only writing the protection itself was stopped.

Impact: a security-relevant bug (an agent-safety hook that can be silently bypassed) stays open longer, and the protections get worse rather than better, because the agent best placed to fix them is not allowed to.

Request: please distinguish defensive work on a user's own safety tooling from producing evasion techniques, or give a way to declare that context. One example would be explicit acknowledgement that the repository is the user's own security tooling. A further request is a clearer explanation, when the classifier stops a response, of what kind of content triggered it, so that the work can be restructured.

Environment Info

• Platform: darwin
• Terminal: vscode
• Version: 2.1.281
• Feedback ID: ecbb1633-70ae-47be-8d6a-c59ab7848314

Errors

[]