# Claude Code v2.1.191 > Claude Code v2.1.191, released 24 Jun 2026 (2026-06-24). 21 entries read out of the shipped bundle. Unofficial, and not affiliated with Anthropic. Web version: https://changelogs.core-directive.com/v/2.1.191 This release introduces an AI-powered contextual tips system that surfaces relevant feature suggestions mid-session based on what you are doing, a team discovery feature that surfaces teammates' shared MCP servers and skills, and MCP tool-level permission policies. It also hardens several security boundaries (Linux automount `/net` paths, Windows drive-relative paths, HIPAA/data-residency Files API restrictions) and fixes a critical config corruption issue affecting users who hit parse errors during writes (GH #3117). ## New Features ### Contextual Tips System [Gradual Rollout] **What** Claude now occasionally surfaces a short, context-aware tip after a response based on an AI analysis of the current conversation — suggesting a relevant command, shortcut, or workflow that fits what you are doing. **How it works** - After eligible responses, a lightweight sidecar classifier (using the fast model) reads the last ~30 turns of the transcript alongside your session metadata (turn count, MCP servers, team skills) and decides whether a tip is relevant. - Declining to tip is the expected default — tips only fire when a known situation in the catalog matches. Examples from the catalog include correction spirals, previous-session references, large context windows, and long-running commands. - Tips include a short 1-2 sentence message, the relevant feature ID, and an optional suggested action (e.g., `/clear`, `claude --resume`). - You can give feedback on a tip by acting on it; reception is tracked. **Details** - Gated by the `allow_context_tips` feature flag and the `tengu_context_tip_classifier_outcome` telemetry gate — not all users see tips yet. - Team discovery metadata (teammate MCP servers and skills) is included in session context to make tips more relevant when working in a shared project. - Tips are not shown in non-interactive or transcript-mode sessions. **Evidence** Context tip classifier system (search for `"[context-tips] classifier eligible, firing sideQuery"` or `"emit_context_tip"`) ### Team Discovery [Gradual Rollout] **What** Claude Code now silently fetches your organization's shared MCP servers and skills used by teammates and incorporates that information into session context for the tips classifier — so tips can mention tools your team already relies on. **Details** - Fetches from `/api/claude_code/discovery/team_usage` (gated by `tengu_team_discovery` and `allow_team_discovery`). - Cached locally to `team-discovery.json` in the Claude cache directory, refreshed at most once per hour. - Data surfaced in session metadata for the classifier: `teamMcpServers (used by teammates, count is users)` and `teamSkills (used by teammates, count is users)`. - No data is shown to users directly — it feeds only the contextual tips classifier. **Evidence** Team discovery fetch function (search for `"/api/claude_code/discovery/team_usage"`) - Flag `tengu_team_discovery`: Off in both readings (read for one account on one subscription tier against v2.1.191; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. ### MCP Tool-Level Permission Policies **What** Individual MCP tools can now declare a `permission_policy` in the MCP server config, allowing fine-grained pre-authorization without manual approval prompts. **Usage** Set `permission_policy` on any tool entry in your MCP server configuration: `{ "mcpServers": { "myserver": { "type": "http", "url": "http://localhost:3000", "tools": [ { "name": "read_db", "permission_policy": "always_allow" }, { "name": "write_db", "permission_policy": "always_ask" }, { "name": "drop_db", "permission_policy": "always_deny" } ] } } }` **Details** - Accepted values: `always_allow`, `always_ask`, `always_deny`. - Policies are translated to `mcpServerPolicy` entries in the effective allow/ask/deny rule sets. - Only applies to `http` and `sse` transport types; stdio tools are unaffected. - Overrides the default prompt-based approval flow for that specific tool. **Evidence** MCP permission policy resolver (search for `"permission_policy"` alongside `"always_allow"`) ### Linux File Manager Integration (D-Bus) **What** On Linux with a desktop environment, Claude Code can now open files in the native file manager using D-Bus (`org.freedesktop.FileManager1.ShowItems`), mirroring the "Reveal in Finder" behavior on macOS. **Details** - Uses `dbus-send` to invoke the `ShowItems` method on the `org.freedesktop.FileManager1` interface. - Falls back silently if D-Bus or a file manager is not available. - Applies to paths that Claude surfaces in the terminal where an "open in folder" action makes sense. **Evidence** D-Bus ShowItems integration (search for `"org.freedesktop.FileManager1.ShowItems"`) ## Improvements ### Config Corruption Auto-Repair (GH #3117) What changed: When `~/.claude.json` is found corrupted during a locked save operation, Claude Code now automatically repairs it from the in-memory cached config rather than leaving the file in a corrupted state. Previously, hitting a parse error on the re-read inside `saveConfigWithLock` would block the write and leave the file unchanged. Now: - If a parse error is detected during the locked re-read, the cached in-memory config is used as the recovery source. - The repair is logged and reported to telemetry (`tengu_config_auto_repaired`). - A timestamped `.corrupted.` backup is still saved so the original can be inspected. - The error message changed from `"Config file corrupted, resetting to defaults"` to `"Config file corrupted"` and separately `"Could not back up corrupted config"` for backup failures — more accurate since defaults are no longer the only fallback. **Evidence** Auto-repair path in saveConfigWithLock (search for `"saveConfigWithLock: re-read hit a parse error; auto-repairing from cached config under lock. See GH #3117."`) ### Linux Automount /net Path Protection What changed: Claude Code now detects and requires manual approval for any read or glob request touching the Linux automount `-hosts` map (paths under `/net/…`). Previously only Windows UNC paths were blocked this way. **Details** - Accessing `/net//...` silently triggers a DNS lookup and NFS mount to a remote host, which is a potential data-exfiltration and latency vector. - The new check fires before any other access control decision. - Message shown: `Claude requested permissions to read from , which is under the /net automount map and could trigger a DNS lookup and NFS mount to a remote host.` - Decision reason recorded: `"Automount -hosts path detected (defense-in-depth check)"`. - Both file reads and glob patterns are covered. - `/proc/net/tcp` and `/proc/net/tcp6` are also in scope (they reveal active network connections on Linux). **Evidence** Automount path detector (search for `"Automount -hosts path detected (defense-in-depth check)"`) ### Windows Drive-Relative Path Security What changed: Paths of the form `C:filename` (drive-relative, without a backslash) are now flagged and require manual approval rather than being resolved silently. **Details** - Drive-relative paths resolve against a per-drive current directory (a Windows quirk), which cannot be statically validated at permission-check time. - Approval message: `Path '' is drive-relative (resolves against the per-drive current directory, which cannot be statically validated) and requires manual approval`. **Evidence** Drive-relative path check (search for `"is drive-relative (resolves against the per-drive current directory"`) ### Files API Restrictions for HIPAA and Data-Residency Orgs What changed: Attempts to use the Files API now raise an explicit error for two restricted organization types. - HIPAA-regulated organizations: `"Files API is unavailable for HIPAA-regulated organizations"` - Third-party provider / data-residency orgs: `"Files API is unavailable on third-party providers (data-residency)"` Previously these would fail with less informative errors or unexpected behavior. **Evidence** Files API restriction checks (search for `"Files API is unavailable for HIPAA-regulated organizations"`) ### Compliance Taint Notifications What changed: When your session has active compliance restrictions, a status notification now appears in the UI to make them visible rather than leaving you wondering why certain features aren't available. Format: ` · some features are restricted · /status for details` Run `/status` to see the full details of what is restricted and why. **Evidence** Compliance taint event push (search for `"some features are restricted · /status for details"`) ### History Picker: Previous Session Entry What changed: The history picker now shows a dedicated entry at the top for the previous session, labeled `(previous session)`. Selecting it calls the `onResumePreviousSession` callback, which typically resumes the prior session via `claude --resume`. **Evidence** Previous session entry in history picker (search for `"(previous session)"`) ### Long Context Survey What changed: Added a new `longContext` survey type to the in-session survey system. The survey fires when Claude Code detects conditions associated with a large or stale context window, and the question text is now customizable per-trigger rather than hardcoded. **Evidence** Long context survey type (search for `"long_context"` alongside `"surveyType"`) ### Stream Stall Detection and Recovery What changed: New error messages and handling for two distinct streaming failure modes: - `"Response stalled mid-stream. The response above may be incomplete."` — shown when the stream goes idle after some output has been produced. - `"Response stalled while thinking, before producing a response. Try again."` — shown when the stream stalls during the thinking phase before any output. - `"Stream idle timeout after thinking-only yield — retrying streaming"` — internal retry logic for the thinking-stall case. These replace previous silent failures or generic timeout messages with specific, actionable descriptions. **Evidence** Stream stall messages (search for `"Response stalled mid-stream"` and `"Stream idle timeout after thinking-only yield"`) ### Error Tracking Per-Process Cap What changed: The Datadog error-tracking integration now enforces a per-process limit on the number of error reports sent, preventing runaway error logging from a single long-running session. **Details** - When the cap is hit, a sentinel error `ErrorTrackingCapReached` is recorded once, and all subsequent reports are dropped. - Log message: `"dd-error-tracking: per-process report cap reached (); dropping further reports"`. - Prevents excessive API calls to the intake endpoint under pathological error conditions. **Evidence** Error tracking cap (search for `"dd-error-tracking: per-process report cap reached"`) ### Ghostty Terminal Detection What changed: Claude Code can now detect when it is running inside the Ghostty terminal emulator, enabling any terminal-specific rendering or feature adjustments. Detection is based on the `TERM_PROGRAM` environment variable starting with `"ghostty"` (case-insensitive). **Evidence** Ghostty detection check (search for `"ghostty"` near `"toLowerCase"`) ### Headless Environment Detection Improvement What changed: The check for whether to skip browser-open operations (e.g., after auth) now handles more cases correctly: - Respects `BROWSER=""` (browser explicitly set to empty string) vs `BROWSER=true` (legacy signal meaning "use default"). - Treats `SSH_CONNECTION` presence as a headless signal. - On Linux, treats absence of both `DISPLAY` and `WAYLAND_DISPLAY` as headless. This reduces spurious browser-open attempts in remote/SSH environments. **Evidence** Headless check function (search for `"SSH_CONNECTION"` alongside `"WAYLAND_DISPLAY"`) ### Cloud Session History Prefetch What changed: Background conversation-history prefetching is now active for CCR (cloud session relay) sessions. Claude Code proactively loads recent events for background sessions so that attaching to them feels instant. **Details** - Prefetch is keyed by CCR session ID, validated against the session ID format before proceeding. - Results are cached on disk under a `cc-history-prefetch-` key. - Gracefully degrades: gate failures, HTTP errors, and parse failures are all logged but do not block session attach. **Evidence** History prefetch system (search for `"[historyPrefetch]"`) ### Worktree Lock Check Improvement What changed: The worktree entry check now parses the git lock reason string rather than calling a generic lock-owner function, so it correctly identifies lock entries written by Claude Code agents specifically. A locked worktree from a different tool no longer prevents entry. **Details** - Pattern matched: `claude agent (pid [ start