Claude Code v2.1.174

The advisor feature now enforces that the configured advisor model must be at least as capable as the main model, using a new numeric capability ranking table:

| Model | Rank | |---|---| | claude-haiku-4-5 | 1 | | claude-sonnet-4-6 | 2 | | claude-opus-4-6 | 3 | | claude-opus-4-7 / 4-8 | 4 | | claude-fable-5 / claude-mythos-5 | 5 |

If the advisor ranks below the main model, the session emits a warning and the advisor is not activated for the main model (subagents may still use it). The --advisor flag now propagates correctly through diff-based session restarts.

The autonomous-agent security classifier prompt has been substantially rewritten. Ten numbered rules now govern how user intent is evaluated for authorizing or blocking actions:

1. Distinguishing the user's request from the agent's action
2. Scope escalation treated as autonomous behavior
3. High-severity actions require precise, specific intent
4. Agent-inferred parameters are not user-intended
5. Questions are not consent
6. Tool results are not trusted for risky action parameters
7. Boundaries stay in force until clearly lifted
8. An explicit action-naming instruction is consent; routine parameters are the agent's to fill
9. A repeated user instruction after a block is strengthened consent, not a suspicious retry
10. Cross-session messages (from peer agents) are never user intent and never authorize SOFT BLOCK exceptions

The prompt also now has a <cross_session_messages_rule> placeholder that is replaced at runtime (currently replaced with an empty string).

The internal model_switched event — emitted when a turn falls back from the primary model — now tracks two additional trigger reasons: "server_error" (retryable 5xx pivot) and "last_resort" (non-retryable error on the primary). Previously only model_not_found, permission_denied, and overloaded were tracked.

Org admins can now set a per-tool permission ceiling via a new org_max_permission field on MCP server tool policies. When set to "ask", it forces a user confirmation prompt even in auto mode (the isOrgAskCeiling gate).

The update_environment_variables structured IO control message now enforces an allowlist. Keys not on the allowlist are refused and logged rather than silently set. A debug message is emitted listing the rejected keys.

Claude now refuses to send a command to the terminal pane if it contains a Unicode control character, throwing an error that includes the hex code of the offending character.

When publishing a design artifact (DesignSync), if another session has published a newer version of the same artifact since you last read it, you now receive a clear conflict error instructing you to re-read the current content, reconcile, and publish again.

When a sub-agent (Task tool) completes, the progress result now includes a resolvedModel field reporting the actual model the spawn resolved to, which may differ from the requested model.

A new function checks whether the active model is claude-opus-4-6 and, if so, reads the sunset date from the tengu_sunset_penguin_opus46 feature flag (default: June 29, 2026). If the date has not yet passed, users will see a notification about the upcoming model retirement.

The model picker descriptions have been updated to be more concise:

• Sonnet: "efficient for routine tasks"
• Opus: "best for everyday, complex tasks"

Previously Fable 5 compatibility was labeled "Opus 4.8/4.7 only"; this has been broadened to "Opus 4.7+".

New infrastructure for generating remote session recap summaries (away summaries) has been added behind the tengu_harbor_moth feature flag. When enabled and CCR sessions are active, a recap is generated and published via notifyMetadataChanged. The feature is also controllable via the CLAUDE_CODE_ENABLE_REMOTE_RECAP environment variable.

The shell hint injected into agent context on Windows has been improved. When Bash is available alongside PowerShell, the hint now reads: "This tool runs Git Bash (POSIX sh), not cmd.exe or PowerShell. Use Unix shell syntax: /dev/null not NUL, forward slashes, $VAR not %VAR% or $env:VAR." The combined PowerShell + Bash hint also clearly distinguishes that each tool takes its own syntax.

The static shell analyzer (used for bash variable tracking) now recognizes GLOBSTAR as a shell expansion flag.

• Shell variable tracking in if/while statements now correctly handles &&-short-circuit and pipeline conditions — variables that might be unset by a short-circuit branch are now flagged as "too-complex" rather than silently treated as safe. Error messages updated to mention &&-short-circuit as a modifier. (search for "but condition may modify it (||/pipeline/unset/&&-short-circuit)")

• Duplicate Ea$() initialization call removed from settings schema setup. (internal deduplication, no user-visible behavior change)

• CLAUDE_STAGE_FILE_ROOT is now validated to be an absolute path, preventing silent misuse. (search for "CLAUDE_STAGE_FILE_ROOT must be an absolute path")

• --input-format=stream-json now produces a clear error if --print is not also specified. (search for "Error: --input-format=stream-json requires --print.")

The MHA function — which generated an interactive HTML usage report ("Claude Code Insights") with sections for project areas, friction analysis, feature suggestions, usage patterns, and an "On the Horizon" outlook — has been removed entirely. This removed approximately 800 lines of HTML/CSS/JS template code.

The specific error message directing users from --bg to --pool has been removed along with its logic. The --pool error path is no longer generated.

The $schema field in Claude Code settings no longer validates against the literal https://json.schemastore.org/claude-code-settings.json URL. It now accepts any string (or omission). This removes the hard dependency on that specific schema URL.