When the tengu_auto_mode_config feature flag has repoVisibility: true (or CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY is set), Claude Code now automatically looks up GitHub repo visibility before git push/remote operations and injects a {"meta":{"repoVisibility":...}} line into the classifier context so the auto-mode security classifier can make better decisions about public vs. private pushes.
Details
- Activates when the
CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITYenvironment variable is set, or whentengu_auto_mode_config.repoVisibility === true; only applies to Bash and GitHub CLI (gh) tool calls — all other tool types are skipped immediately - Parses Bash commands for
git pushandgit remote set-url/git remote addpatterns; parsesghcommands forpr createandrepo forksubcommands to identify target repositories - Calls the GitHub REST API (
GET /repos/{owner}/{repo}, API version 2022-11-28) with a 3-second timeout, no redirects, and the locally cached GitHub token when available; results are cached in-memory perhost/owner/repokey for the process lifetime - Visibility values normalised to three states:
"public","private"(GitHub"internal"repos map to"private"), or"unknown"(returned for non-GitHub hosts, essential-traffic-only mode, HTTP/parse errors, or missing API fields) - One
{"meta":{"repoVisibility":{"remote":"owner/repo","visibility":"..."}}}JSON line is prepended to the classifier context for each repository identified in the command; multiple repos in a single command each get their own line - The lookup runs concurrently with the classifier API call via
Promise.racewith a deadline; any already-resolved visibility entries are included in the classifier context even if the full lookup has not yet completed
Evidence
Repo visibility lookup (search for "tengu_auto_mode_repo_visibility_lookup_failed") — T0u() at line ~416404; yEg() GitHub API call at line ~415701; fKi() JSON format at line ~415951
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Feature flag
tengu_auto_mode_config Not enough to sayNothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.
This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.205: not a boolean we can read
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.205. It isn't a statement about your account. What a flag value here can and cannot tell you
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.