security-guidance: _call_claude sends deprecated top-level output_format → 400 on every hook fire (guardrail fails open)

[kkroo]

Summary

plugins/security-guidance/hooks/llm.py → _call_claude builds the Messages API request body with a top-level output_format field. The API now rejects it:

HTTP 400 invalid_request_error
output_format: This field is deprecated. Use 'output_config.format' instead.
See https://platform.claude.com/docs/en/build-with-claude/structured-outputs

Since this is the structured-output request the LLM-backed hooks rely on, every hook fire 400s → _call_claude returns None → the security guardrail silently fails open, while still consuming one API call per fire. The structured-outputs-2025-11-13 beta header is already sent in _build_auth_headers; only the request-body field name changed upstream.

Repro

Replay the exact request _call_claude builds (beta header structured-outputs-2025-11-13, model e.g. claude-opus-4-7, top-level output_format) against /v1/messages → the 400 above. Swapping the field to output_config.format makes it pass validation.

Affected versions

Reproduced on security-guidance@2.0.0 and present on main HEAD (plugins/security-guidance/hooks/llm.py:482).

Fix

Nest the schema under output_config.format. Gotcha: the adaptive-thinking branch already does payload["output_config"] = {"effort": "high"}, which would clobber the schema — so effort must be merged into the existing dict, not reassigned:

-        "output_format": {
-            "type": "json_schema",
-            "schema": output_schema
-        }
+        "output_config": {
+            "format": {
+                "type": "json_schema",
+                "schema": output_schema,
+            }
+        },
 ...
-            payload["output_config"] = {"effort": "high"}
+            payload["output_config"]["effort"] = "high"

The two claude_agent_sdk ClaudeAgentOptions(output_format=...) call sites are a separate SDK contract and should be left unchanged.

I opened #2097 with this exact patch before realizing the repo only accepts internal PRs (auto-closed) — the diff there is ready to cherry-pick.

[mhegazy]

looking

[mhegazy]

@kkroo I can not reproduce this locally. this API is deprecated, but the old API continues to be supported.

can i get your log line in ~/.claude/security/log.txt -- full text, not a summary:

   grep -E "Failed|error|400|deprecated" ~/.claude/security/log.txt | tail -20

also can i get the version of your cli?

[kkroo]

Thanks for looking, @mhegazy.

CLI version: 2.1.158 (Claude Code)

Log lines — grep -E "Failed|error|400|deprecated" ~/.claude/security/log.txt (representative slice; there are ~462 of these across log.txt + log.txt.1). Note they stop after 08:08Z — that's when I deployed a proxy-side workaround, not when the API stopped rejecting it:

[2026-05-30 07:55:57.736] API error: 400 - {"type":"error","error":{"type":"invalid_request_error","message":"output_format: This field is deprecated. Use 'output_config.format' instead. See https://platform.claude.com/docs/en/build-with-claud[truncated]
[2026-05-30 07:55:57.737] Stop hook: API call failed with status 400
[2026-05-30 08:06:27.840] API error: 400 - {"type":"error","error":{"type":"invalid_request_error","message":"output_format: This field is deprecated. Use 'output_config.format' instead. ...
[2026-05-30 08:08:16.917] Stop hook: API call failed with status 400

(The body is truncated to 200 chars by debug_log, so the file doesn't keep the request_id — but see below.)

Controlled repro (raw curl, bypassing the plugin, sending the exact shape _call_claude builds). Headers anthropic-version: 2023-06-01, anthropic-beta: structured-outputs-2025-11-13, Authorization: Bearer <oauth>, model claude-opus-4-7, stream: true:

• top-level output_format → HTTP 400 output_format: This field is deprecated. Use 'output_config.format' instead. — Anthropic request_id: req_011CbYQ24faaZpeSFYFfjwoo (another: req_011CbZYpKajLEkqWfhZij8C5)
• same request with output_config: { format: {...} } → accepted (returned a 429 rate-limit, not a 400) — request_id: req_011CbYQ7EZ2pcAfvWQA1SzpP

So for these requests the API is returning the deprecation as a hard 400, not soft-supporting it.

A guess at why you can't repro: these are Claude subscription OAuth (Bearer) accounts with the structured-outputs-2025-11-13 beta — not an x-api-key key. If enforcement is auth-path-scoped or a gradual rollout, the API-key path might still accept top-level output_format while the OAuth path rejects it. Tracing those request_ids should show the exact account + payload. Happy to pull anything else useful.

[kkroo]

Thanks for the quick fix, @mhegazy 🙏