-
v2.1.278New telemetry for server-side auto-mode classifier fallback/notice
New analytics events track when auto mode falls back to local classification and when the billing notice shows
found in this entry's text
-
v2.1.278Session-scoped 'server classifier refused' latch drives permanent local fallback
Once the server refuses classification once, auto mode sticks to local classification for the rest of the session
found in this entry's text
-
v2.1.278Auto mode server status surfaced as Enabled/Disabled
A new diagnostics row reports auto mode's server classifier as Enabled or Disabled
found in this entry's text
-
v2.1.278New request-latch state for server-side classifier fallback and gateway tracking
Session state now tracks the inference gateway seen and any classifier fallback choice made
found in this entry's text
-
v2.1.278Auto-mode classifier now distrusts unix-socket proxies unless SSH remote
Sessions using ANTHROPIC_UNIX_SOCKET now lose server-side auto mode classification unless connecting over SSH remote
found in this entry's text
-
v2.1.278Third-party classifier availability check reworked
The check for whether the server-side auto-mode classifier can be used was reworked internally
found in this entry's text
-
v2.1.277Fast-mode toggle behavior adjusted while a background auto-mode setup is in flight
Fast mode's setting sync now behaves differently while a background auto-mode setup is still running
found in this entry's text
-
v2.1.277Auto-mode classifier logging no longer includes raw prompt/action text
Auto-mode classifier logs no longer include raw prompt or error text, only lengths
found in this entry's text
-
v2.1.277Auto-mode Sonnet-5 classifier probe retained, log wording unchanged but refactored
Internal refactor of the auto-mode Sonnet 5 classifier fallback, no behavior change
found in this entry's text
-
v2.1.275New telemetry when auto-mode's decision matches the mode already requested
New telemetry logs when auto-mode's permission decision matches what was already requested
found in this entry's text
-
v2.1.275SDK-host (bridge) lane can now apply a model or effort pick sourced from claude_code_args
SDK-host sessions can now have their model or effort level set from claude_code_args in auto mode
found in this entry's text
-
v2.1.275Auto-mode classifier telemetry now records root tool surface
Auto-mode decision logging now records which tools were available at the root level
found in this entry's text
-
v2.1.275New closed-set
decision_reason_code field on permission decisions
New decision_reason_code field distinguishes specific reasons behind a permission decision
found in this entry's text
-
v2.1.275Tool execution can now flag a permission decision as classifier-driven auto-mode
Tool calls now carry a flag noting when permission was auto-approved by the auto-mode classifier
found in this entry's text
-
v2.1.275Workflow agent() auto-mode classifier call now receives rootToolSurface
Workflow agents running in auto mode now report their root tool surface to the auto-mode classifier
found in this entry's text
-
v2.1.274Auto-mode transcript builder gains a 'summary' turn frame
Auto-mode's transcript reconstruction now handles 'summary' turn frames, not just 'invisible' ones
found in this entry's text
-
v2.1.273New, separate gate for background-hint/auto-mode timing: tengu_shimmying_stardust
Background-hint timing for sync subagents now uses its own separate, oddly-named gate
found in this entry's text
-
v2.1.273Bridge session spawn: session-tag prefetch broadened to more triggers
More conditions now trigger a session-tag prefetch before spawning a Remote Control bridge worker
found in this entry's text
-
v2.1.273Auto-mode-environment check factored into a reusable async helper
The auto-mode-environment check was pulled out into a reusable helper checked at more points
found in this entry's text
-
v2.1.273Dropped auto-mode-environment now records a reason when tags are missing/unread
Dropping a bridge child's inherited auto-mode environment now records why, instead of a plain yes/no
found in this entry's text
-
v2.1.273Bridge server-config gains an explicit 'drop auto mode environment' knob and user-configured tracking
Bridge configuration can now explicitly drop the 'auto mode environment' setting, and tracks if you'd configured your own
found in this entry's text
-
v2.1.273Bridge child auto-mode gate flips its own default this release, and one caller gets swapped to a different, off-by-default flag
Bridge child auto-mode logic re-plumbed to a new flag, while the old flag moves to a different caller and defaults on
found in this entry's text
-
v2.1.271Bridge child process kill is now correctly classified as "interrupted" even on nonzero exit
Deliberately killed bridge child processes are now correctly logged as interrupted, not failed
found in this entry's text
-
v2.1.271Bridge child auto-mode permission defaulting, gated off
Bridge-spawned child sessions may be defaulted to auto permission mode, gated off
found in this entry's text
-
v2.1.271SubagentHandback default flipped on (tengu_lively_waffle)
Auto-mode subagents reporting back via SubagentHandback moves from an off-by-default flag to on-by-default in code
found in this entry's text
-
v2.1.271Auto-mode permission rules editor UI: internal refactor only
The auto-mode permission rules editor was refactored internally with no visible change to its behavior
found in this entry's text
-
v2.1.271New auto-mode guard: subshells and multi-directory-change commands can't bypass the read block
With blockReadsOutsideWorkingDirectories on, Bash subshells and multi-cd commands are now refused instead of evaluated
found in this entry's text
-
v2.1.271Auto-mode permission classifier context can now shed 'artifacts' before erroring
Auto mode's permission classifier can now drop 'artifacts' from its context before it errors on being too large
found in this entry's text
-
v2.1.271New third-party MCP server classifier gate
A new gate controls whether a third-party MCP server classifier is enabled, defaulting on
found in this entry's text
-
v2.1.269New "arbiter" mode for the server-side auto-mode classifier
Auto-mode's safety classifier gained a new 'arbiter' mode that can skip some server checks
found in this entry's text
-
v2.1.269Auto-mode classifier: GrowthBook init call carries cache/telemetry params
Auto-mode's GrowthBook setup call now passes caching and telemetry parameters and reuses its result
found in this entry's text
-
v2.1.269Auto-mode classifier: no-input early return extracted to helper
Auto-mode's no-classifier-input check moved into its own helper function
found in this entry's text
-
v2.1.269ExitPlanMode tool rewritten to lazy
create() factory
ExitPlanMode tool internally restructured into a factory pattern, no behavior change
found in this entry's text
-
v2.1.269New autoModeSettingsJson passed to spawned CLI sessions when auto-mode environment is configured
Spawned CLI sessions now include auto-mode settings computed from any configured auto-mode environment
found in this entry's text
-
v2.1.269New auto-mode-environment check before spawning a bridge (remote-control) session
Bridge sessions re-check local auto-mode environment settings before spawning when the work item requests one
found in this entry's text
-
v2.1.268New
allowed_domains parameter for sandboxed Bash commands, gated dark by tengu_flickering_rain
A new allowed_domains parameter lets the model tell a sandboxed Bash command which network hosts it needs, feature-flagged and not yet confirmed live
found in this entry's text
-
v2.1.268Startup now logs auto-mode availability and guards context-metrics collection against failure
Startup now logs auto-mode availability and won't crash if context-metrics collection fails
found in this entry's text
-
v2.1.268Sandbox system-prompt text rewritten to describe allowed_domains / auto-mode network review
Sandbox instructions shown to the model were rewritten to explain listing needed hosts and reacting to blocked-host violations
found in this entry's text
-
v2.1.268New "auto mode" diagnostic snapshot function sEt()
A new internal function assembles a full diagnostic snapshot of Claude's "auto mode" state
found in this entry's text
-
v2.1.268Commands carrying allowed_domains now force an 'ask' via the auto-mode classifier
Commands with allowed_domains now always prompt for approval instead of being auto-allowed
found in this entry's text
-
v2.1.268Auto-mode permission telemetry now tags MCP tool calls with connection/ambiguity info
Auto-mode telemetry now tags MCP tool calls with which server they connect to and whether that's ambiguous
found in this entry's text
-
v2.1.268Auto-mode classifier now also skips its fast path when a tool declares per-call sandbox network lists
Auto-mode's classifier now runs on tools that declare per-call network allow/deny lists, instead of skipping them
found in this entry's text
-
v2.1.268
NAe (proactivity-related gate used by shortcut/auto-mode logic) now hardcoded to return false
A proactivity-related check used by shortcut keys and auto-mode is now hardcoded to always say no
found in this entry's text
-
v2.1.267New auto-mode verdict message for tool calls truncated by the server
Auto-mode now explains when a tool permission check is missing because the model's reply was cut off
found in this entry's text
-
v2.1.267New tengu_fizzy_bonbon gate branches the auto-mode tool-permission-context flow
A new feature flag branches how auto-mode establishes tool permission consent
found in this entry's text
-
v2.1.267SubagentHandback protocol for auto-mode subagents, gated off by default
Subagents running in 'auto' mode may need to report back via a new SubagentHandback tool instead of plain text, gated by an unread flag
found in this entry's text
-
v2.1.267Sub-agent auto-mode classification now skips or clears output based on a 'handback' outcome
Sub-agent output classification in auto mode now depends on a new handback outcome
found in this entry's text
-
v2.1.265auto-mode CLI subcommands fixed to attach to the right command object
Fixed a bug that stopped the claude auto-mode defaults, reset, config, and critique subcommands from working
named in this entry, found in this entry's text
-
v2.1.265New 'classifier-only' tool category: some tools can only be allowed by the auto-mode classifier, never by saved rules or hooks
Some tools can now only be allowed by the auto-mode classifier, ignoring saved allow rules and hooks
found in this entry's text
-
v2.1.265Auto-mode classifier call gains an extra parameter
Auto-mode's classifier call now passes one additional argument alongside the existing transcript and host rules
found in this entry's text
-
v2.1.265Auto-mode permission pipeline wired to honor classifier-only tools' onBlock behavior
Auto-mode permission logic now honors what a classifier-only tool wants to happen when it's blocked
found in this entry's text
-
v2.1.261New telemetry for auto-mode context being withheld entirely
New telemetry fires when auto-mode context is too large and gets withheld entirely.
found in this entry's text
-
v2.1.261Auto-mode permission checks get finer-grained unavailable reasons
Auto-mode's 'action pending' message now explains the specific reason instead of a generic unavailable notice.
found in this entry's text
-
v2.1.261New system-prompt flag: autoModeContextEnabled
A new system-prompt flag controls auto-mode context injection.
found in this entry's text
-
v2.1.261Auto-mode classifier fallback now records a
fallbackCause
Auto-mode fallback telemetry now records why a fallback model was used.
found in this entry's text
-
v2.1.261Auto-mode server-classifier context now has a size budget with progressive truncation
Auto-mode classifier context now trims progressively to stay within a byte budget.
found in this entry's text
-
v2.1.261Server-side auto-mode dangerous-tool-use classifier
Auto mode's dangerous-action classifier now runs server-side and blocks actions it flags or can't reach.
found in this entry's text
-
v2.1.259Skill-invoked model overrides now respect auto-mode/fast-mode compatibility
A model override declared by a skill or command is now ignored when the model isn't supported under the current auto or fast mode.
found in this entry's text
-
v2.1.259New destructive-MCP auto-mode gate added alongside the existing one
Destructive MCP calls under remote auto mode can now be allowed by either the existing gate or a new flag.
found in this entry's text
-
v2.1.259Auto-mode gate fallback notification on plan exit
Exiting plan mode when auto mode is unavailable now tells you it is falling back to the default mode instead of doing it silently.
found in this entry's text
-
v2.1.257Auto-mode edit classification no longer overridable by env var
An env var no longer overrides whether edits get classified for auto mode; only remote config decides.
found in this entry's text
-
v2.1.251Permission mode corrected when feature flags arrive late
Your permission mode is re-checked once remote settings load, so startup no longer sticks on the wrong one.
found in this entry's text
-
v2.1.248Dialog impressions logged once per showing
Dialog view events are recorded once per showing rather than on every redraw.
found in this entry's text
-
v2.1.248Auto-mode default prompt stays up when an answer is refused
The auto-mode default prompt stays visible when a keypress is refused.
found in this entry's text
-
v2.1.248Remote machines can send their own auto-mode rules with a tool-call approval request
A remote machine's permission rules can now influence approvals for tool calls it asks about.
found in this entry's text
-
v2.1.248Auto-mode setup wizard cannot carry a stale accept timestamp
Reopening the auto-mode wizard can no longer let a stray keypress confirm instantly.
found in this entry's text
-
v2.1.247Bash permission prompt explains auto mode and reports the right prompt type
The Bash permission prompt now suggests auto mode and correctly reports which option you picked.
found in this entry's text
-
v2.1.247Workflow failures recorded through one function
Workflow failures are now recorded in one place, so logging decisions are consistent.
found in this entry's text
-
v2.1.247Artifact-consent rule in the auto-mode permissions prompt can be switched off remotely
The rule stopping Claude publishing artifacts you didn't ask for can now be removed remotely.
found in this entry's text
-
v2.1.246Auto mode can decline an unattended artifact comment reply, and now says so
If auto mode declines an unattended artifact comment reply, the reply is dropped and you get one notice.
found in this entry's text
-
v2.1.246Auto-mode permission classifier retries get an explicit time ceiling
The auto-mode permission classifier now has a hard overall deadline, so slow checks can't drag on.
found in this entry's text
-
v2.1.246New prompts and dialogs in the interactive session
New automatic prompts appear: a first-time auto mode warning, a spending threshold dialog and a worktree tip.
found in this entry's text
-
v2.1.246Auto-mode classifier dump mirroring is compiled out
A function for shipping auto mode's classifier inputs elsewhere returns immediately and nothing calls it.
found in this entry's text
-
v2.1.246Hook approvals can be sent back through the auto-mode classifier
Hook-approved tool calls could still be checked by the auto-mode classifier, but the flag is off.
found in this entry's text
-
v2.1.246Hosts can turn off the auto-mode handback classifier
A host can set classifyHandoff false to skip the classifier deciding whether a subagent hands control back.
found in this entry's text
-
v2.1.246Settings entries cannot smuggle auto-mode region markers
Settings entries containing auto-mode region markers are refused so they can't pose as classifier structure.
found in this entry's text
-
v2.1.242A stale on-disk auto-mode killswitch no longer keeps auto mode off
A stale local file can no longer keep auto mode switched off; startup re-checks the server.
found in this entry's text
-
v2.1.242Chrome navigation classifier for auto mode moved to remote config
An env var for the Chrome navigation classifier is gone; a server setting now controls it.
found in this entry's text
-
v2.1.242Remote-settings kill switch renamed, and stale reads are discarded
The auto-mode fallback warning now names which kill switch stopped it, and stale settings reads are ignored.
found in this entry's text
-
v2.1.242Shape rules for Claude in Chrome batched actions, off without server config
Browser batch calls get strict shape rules with denials, but only under server config.
found in this entry's text
-
v2.1.237Auto-mode classifier reads poll events by sender
The turn-handling classifier now splits queued events into separate turns depending on whether a human or another agent sent them.
found in this entry's text
-
v2.1.236PostToolUse hooks can pass context to the auto-mode permission classifier
Your PostToolUse hooks can send extra context to the classifier that decides permissions in auto mode.
found in this entry's text
-
v2.1.236One-time prompt offering to make auto mode your default permission mode
Claude can offer once to make auto mode your default permission mode, switched off in this build.
found in this entry's text
-
v2.1.236Four small robustness fixes
Socket path comparisons and error handling in cross-session messaging got tightened.
found in this entry's text
-
v2.1.235Auto-mode environment setup onboarding now counts denials
Auto-mode environment setup onboarding now waits for repeated denials before offering again
found in this entry's text
-
v2.1.234New setting
useAutoModeDuringPlan, on by default
Plan mode now uses auto-mode permission rules by default; turn it off in /config under Permissions.
found in this entry's text
-
v2.1.234Auto-mode classifier failures write a debug dump that ages out with the session
When auto mode's classifier errors, a debug dump lands beside your transcript and gets cleaned up later.
found in this entry's text
-
v2.1.234The remote kill switch for bypassPermissions mode is gone
A remote switch can no longer force you out of bypassPermissions mode mid-session; only the admin setting does.
found in this entry's text
-
v2.1.234The stdin transport now answers the remote-transport questions
Plain stdin sessions now declare they are not remote, so remote-only delivery acks and one auto-mode capability skip out.
found in this entry's text
-
v2.1.234Auto-mode decisions are cached by how long they stay valid
Cached auto-mode verdicts now expire by how long they stay valid, and long-transcript outcomes get reused.
found in this entry's text
-
v2.1.233Auto-mode denials moved into a React context
Recent auto-mode denials, capped at twenty, now live in their own shared provider.
found in this entry's text
-
v2.1.232
disableAutoMode setting can switch off the auto permission mode fallback
Set disableAutoMode to "disable" to stop Claude Code ever falling back to auto permission mode.
found in this entry's text
-
v2.1.232Session flags, scheduled tasks and terminal probes moved into grouped stores
Plan-mode flags, scheduled tasks and terminal probes moved into grouped per-session stores.
found in this entry's text
-
v2.1.232Auto-mode setup scan fails cleanly when no model is available
Auto-mode setup now stops with a clear message when no model is available to you.
found in this entry's text
-
v2.1.232IDE and SDK clients can receive auto-default-nudge events
Editor and SDK hosts can react to the auto-mode default prompt being shown or answered.
found in this entry's text
-
v2.1.232Non-interactive /auto-mode-setup no longer needs the onboarding flag
Non-interactive /auto-mode-setup now just needs a resolved model and no remote flag.
found in this entry's text
-
v2.1.232Auto-mode setup picks its own model and retries on a fallback
Auto-mode setup picks its own scan model, retries a fallback, and names the failure.
found in this entry's text
-
v2.1.232IDE hosts can drive the auto-mode default nudge
Your editor can show and answer the prompt offering auto as your default permission mode.
found in this entry's text
-
v2.1.232Auto-mode setup picks its own model instead of the session's
Auto-mode setup uses the auto-mode model and fails clearly when none is configured.
found in this entry's text
-
v2.1.232A proactivity level is threaded through sessions but does nothing yet
A proactivityLevel setting is passed around sessions but changes nothing about Claude's behaviour yet.
found in this entry's text
-
v2.1.229/login warns if an OAuth token is set in your environment
After logging in, you're warned if an OAuth token in your environment will override it later.
found in this entry's text
-
v2.1.229Retry for auto-mode classifier calls that come back unavailable
Auto mode's model-picking call can retry when unavailable, but the retry count defaults to zero.
found in this entry's text
-
v2.1.229Auto-mode setup confirmation is now a single keyboard form
Auto-mode setup confirmation is now one keyboard form with a picker and checkboxes.
found in this entry's text
-
v2.1.229Auto-mode side queries always send the billing attribution header
Auto-mode's side queries send billing attribution metadata even if you set the opt-out variable.
found in this entry's text
-
v2.1.228Twelve more caches moved onto the session object
A dozen caches now hang off the session and are inherited when a session forks.
found in this entry's text
-
v2.1.227Subagent handoff review now reads the subagent's answer
The auto-mode safety check now reads what a subagent actually said before handing results back.
found in this entry's text
-
v2.1.227Final answers from workflow subagents get an extra auto-mode check
In auto mode, what a workflow subagent reports back can now get a warning attached.
found in this entry's text
-
v2.1.227Subagent hand-back text is checked by the safeguard review
A subagent's final text is now treated as untrusted and screened for prompt injection.
found in this entry's text
-
v2.1.227Auto mode can treat linked git worktrees as already-approved directories
Auto mode could stop asking about sibling git worktrees of the same repo, but it is off.
found in this entry's text
-
v2.1.225Auto-default nudge actually flips the mode, and reports the outcome
Saying yes to the auto-mode prompt now actually saves auto as your default permission mode.
found in this entry's text
-
v2.1.225VS Code-owned sessions get their own settings defaultMode handling
In VS Code sessions, unsafe default permission modes from settings are refused and fall back to normal.
found in this entry's text
-
v2.1.225Auto-mode classifier now falls back when the primary model refuses
When the auto-mode model refuses a request, a backup model now gets a try instead of failing.
found in this entry's text
-
v2.1.225Auto mode denies safeguard-refused classifier calls without recording a verdict
A safety refusal during auto mode denies the action but no longer counts against your denial limit.
found in this entry's text
-
v2.1.225Shared "auto mode unavailable" message and a warning-kind notice
The "auto mode unavailable" message is now consistent everywhere and shown as a warning.
found in this entry's text
-
v2.1.225Auto-mode nudge dialog simplified
The auto-mode suggestion dialog now just dismisses itself instead of switching your session to auto.
found in this entry's text
-
v2.1.225Auto-mode default nudge requires the session to actually support auto
The auto-mode suggestion would only appear in sessions where auto mode can actually be used.
found in this entry's text
-
v2.1.225Auto-mode nudge now switches the running session, or explains why it can't
Saying yes to the auto-mode prompt would switch your current session too, not just future ones.
found in this entry's text
-
v2.1.225Auto-mode classifier failures are distinguished from classifier denials
When the auto-mode classifier can't decide, you no longer get a bogus denial message or permission-rule hint.
found in this entry's text
-
v2.1.224AskUserQuestion dialog fallback cannot fire in this build
A fallback to the question dialog when auto-classification is unavailable can never fire here.
found in this entry's text
-
v2.1.224Auto-mode telemetry marks MCP tools
Auto-mode approval events now note whether the tool came from an MCP server.
found in this entry's text
-
v2.1.224Auto-mode telemetry records whether the tool was MCP
More auto-mode permission events record whether the tool was from an MCP server.
found in this entry's text
-
v2.1.224SendMessage skips the auto-mode classifier
Messaging another agent skips the auto-mode classifier and no longer counts toward denials.
found in this entry's text
-
v2.1.222Destructive MCP tools can be included in remote auto-mode
Destructive MCP tools could stop skipping permission prompts in remote auto mode, but that is off.
found in this entry's text
-
v2.1.221Artifact tool: replies validated, and comment text stripped from stored transcript
Artifact reviewer comment text is no longer kept in stored transcripts, and blanket allow rules skip several artifact actions.
found in this entry's text
-
v2.1.221Auto mode bash-first prompt variant
Auto mode can be told to do file reads, searches and edits through Bash, but it's off by default.
found in this entry's text
-
v2.1.221Auto mode can be told to do its work through Bash ("thrifty sonic")
Auto mode can be told to use Bash for reads and edits if you set the env var.
found in this entry's text
-
v2.1.221Auto-mode outcome-code visibility moved behind a wrapper with a dead conditional
The switch controlling outcome codes in auto mode now runs through a wrapper with an empty branch.
found in this entry's text
-
v2.1.220Classifier beta-rejection latch still keys off a null placeholder
The automatic retry that would drop a rejected classifier beta can never trigger in this build.
found in this entry's text
-
v2.1.220Reworded the classifier beta-rejection warning
A warning message about a rejected classifier beta was reworded, though you can't reach it.
found in this entry's text
-
v2.1.219Cross-session safety rule wrapped in a named tag
A safety rule in the auto-mode prompt got a wrapper tag; the rule text is unchanged.
found in this entry's text
-
v2.1.219Auto-mode permission rules are wrapped in their own prompt tag
Auto-mode permission rules are now wrapped in their own tag inside the prompt.
found in this entry's text
-
v2.1.219Auto-mode permission classifier can emit a numeric severity instead of a yes/no block
Auto-mode permission checks can score risk 0-100 instead of yes/no, but only for configured models.
found in this entry's text
-
v2.1.218Permission Mode Race Condition Handling
found in this entry's text
-
v2.1.213SDK Protocol:
matched_ask_rule in Permission Requests
found in this entry's text
-
v2.1.212Auto-mode Setup (/auto-mode-setup)
found in this entry's text
-
v2.1.208Auto-mode opt-in dialog removed
found in this entry's text
-
v2.1.205Auto-mode repo visibility lookup
found in this entry's text
-
v2.1.198Auto-Mode Setup
found in this entry's text
-
v2.1.178
found in this entry's text
-
v2.1.174
org_max_permission Field for MCP Tool Policies
found in this entry's text
-
v2.1.166Auto-mode model config supports per-model overrides
found in this entry's text
-
v2.1.136Auto Mode Hard-Deny Rules
found in this entry's text
-
v2.1.124Auto-mode classifier timeout cleanup
found in this entry's text
-
v2.1.90Auto-Mode Opt-in Logging
found in this entry's text
-
v2.1.89
found in this entry's text
-
v2.1.81Auto Mode Rule Critique CLI
found in this entry's text
-
v2.1.75Auto Mode Circuit Breaker
found in this entry's text
-
v2.1.74
found in this entry's text