# Claude Code v2.1.227 > Claude Code v2.1.227, released 10 Aug 2026 (2026-08-10). 358 entries read out of the shipped bundle. Unofficial, and not affiliated with Anthropic. Web version: https://changelogs.core-directive.com/v/2.1.227 A large amount of cloud-session machinery landed switched off. A `device_bash` tool would let a session running in the cloud execute shell commands on your machine inside its OS sandbox, and a companion dialog would ask permission to sync a repository (uncommitted files included, gitignored files never) into cloud sessions, both gated on the `tengu_violin_wood` flag along with the binding of a session to the device that created it. A `ProposeGoal` tool that lets Claude suggest a completion condition for one-keypress approval is hidden behind `tengu_propose_goal`, which is off here. Also present but unreachable: `list_runs` and `get_run_log` actions on the scheduling tool behind `tengu_surreal_dali`, a `resolve` action for artifact comment threads, a read-only subagent that analyses a single comment thread, and the SendFile tool, which moved from hard-off to the remotely switchable `tengu_send_file`. These are twelve of 63 gated entries. Usable today, `/ultrareview` and `/code-review ultra` take `--post` and `--no-post` and can post findings to a GitHub pull request as a plain comment from your own account, with consent scoped to the session. Remote worker sessions now sync the working directory both ways around every turn instead of copying once at startup, when `CLAUDE_CODE_REMOTE_SESSION_ID` is set and `CLAUDE_CODE_DISABLE_WORKING_SYNC` is not. A PermissionRequest hook can now carry an `interrupt` field to stop the whole turn rather than just the one tool call, and MCP connect timeouts are retried and never fall below the global timeout. Enterprise OIDC config gains `use_proxy` to route identity provider requests through `HTTPS_PROXY`, workflow scripts can restrict a subagent's shell to a fixed list via `bashCommandClamp`, and `CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP` forces full transcript reads after a compaction boundary. That is twelve of 139 shipped entries. `MCP_TIMEOUT` and `MCP_CONNECT_TIMEOUT_MS` are now capped at 2147483647 milliseconds, so a huge value no longer overflows the timer and expires immediately. Transcripts blocked because they belong to another account are marked permanently as not to be restored, and forking from the resume picker now carries that suppression onto the new session. Approving a message held from another session re-checks the inbound policy at the moment of approval and drops it if the policy has flipped to refuse. Spawning several teammates at once no longer races when splitting tmux or iTerm2 panes, deleting a background job now reports "occupied" instead of removing a worktree a live process is sitting in, and the `tengu_velvet_cascade` remote model list no longer overrides the simple system prompt. The shell command builder gained an option that skips injecting credential exports and appends a scrubbing step instead, used internally alongside sandboxing, with no user-facing setting. The billing attribution header can now carry a prompt id next to the previous-request id, each validated for shape and sent only under first-party auth, and `CLAUDE_CODE_ATTRIBUTION_HEADER` suppresses it entirely. `CLAUDE_CODE_ENTRYPOINT` accepts a new `remote_cowork_trigger` value that counts as both trigger-launched and remote. On remote runs, startup timing can merge validated numbers supplied by the runner through `CCR_RUNNER_STARTUP_TIMING`. ## What probably matters to you Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail. ### A tool for proposing a session goal, gated off A tool letting Claude propose a session goal you approve with one keypress is present but gated off. **What** A new tool lets Claude propose a completion condition for the session that you approve with a single keypress, plus a matching notification, "Claude proposed a session goal". It takes an `ask_user` argument defaulting to true, and refuses in plan mode, inside agent contexts, and in non-interactive sessions. It is only available when the `tengu_propose_goal` gate is on, and that gate falls back to off. **Evidence** `propose a session goal condition for the user to approve with one keypress` - Flag `tengu_propose_goal`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Session Goals - Tier: Not switched on - Useful: 4/5 - Signal: 5/5 - Present in the build but not switched on ### Ask before syncing a repository to cloud sessions A dialog can ask whether to copy your repo, including uncommitted files, into cloud sessions. **What** A new dialog asks whether Claude Code may copy the current repository, including uncommitted and untracked files but never gitignored ones, into cloud sessions started from that directory. The options are "Yes, sync this repository", "No, don't sync" and "Not now", which is focused by default. The answer is saved per repository as `remoteFileMode`. The prompt is gated on the `tengu_violin_wood` flag, which is treated as off if it errors. **Details** - Reports `tengu_dir_sync_mode_prompt_shown` and `tengu_dir_sync_mode_prompt` with the chosen value. - Skips are reported as `tengu_dir_sync_mode_prompt_skipped` with reason `not_attached`, `no_git_root` or `answered`. **Evidence** `Sync this repository to the cloud?` - Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cloud Sessions - Names: `remoteFileMode` - Tier: Not switched on - Useful: 4/5 - Signal: 5/5 - Present in the build but not switched on ### Cloud sessions can run shell commands on your own machine A cloud session can run shell commands on your own machine, off unless a server flag enables it. **What** A new tool called `device_bash` lets a session running in the cloud execute a shell command on the machine where Claude Code is running, inside its OS sandbox, and return the output. It takes `command` plus an optional `timeout_ms`. It is off unless the remote-config flag `tengu_violin_wood` turns on the device bridge, and it still refuses without a server-asserted session and a bound device id. **Details** - registered alongside the existing device-info probe on the same bridge; the bridge itself starts only behind an async remote-config check that falls back to off on error - the tool description tells the model explicitly that this is the local device, not the cloud container - a per-device-connection concurrency cap limits how many commands can run at once - commands run with sandboxing, protection against changing the working directory, and credential scrubbing of the environment **Evidence** `Run a shell command on the user's local machine (the device running Claude Code), inside Claude Code's OS sandbox.` - Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cloud Sessions - Names: `device_bash` - Tier: Not switched on - Useful: 4/5 - Signal: 5/5 - Present in the build but not switched on ### ProposeGoal: Claude can propose a session goal for one-keypress approval Claude could propose a session goal you approve with one keypress, but it is switched off. **What** A new tool lets Claude propose a completion condition for the session. Approving it sets a session goal, the same as running `/goal`, after which a separate check runs each turn and Claude keeps working until the condition is met. A new setting `modelProposedGoals` takes `auto`, `alwaysAsk` or `disabled`, shown as "Claude-proposed goals" in the config panel. Both the setting row and the tool are hidden unless the flag `tengu_propose_goal` is on, and it is off in this build. **Details** - the approval dialog reads "Claude proposes a goal" with buttons "Set this goal" and "Not now", and explains that approving is like running `/goal` - inputs are `condition` and `ask_user`, which defaults to true; with `ask_user: false`, intended only when the user's own words stated the outcome, the goal is set directly by running `/goal ` - it cannot clear a goal: "ProposeGoal only proposes a new goal; it cannot clear one. The user can clear an active goal with /goal clear." - refused in non-interactive sessions, in plan mode, in sub-agent contexts ("ProposeGoal cannot be used in agent contexts") and when the evaluator is blocked; the condition text is length-capped - only one proposal can be outstanding at a time; events are `tengu_goal_proposed` and `tengu_goal_proposal_decided` - the typed `/goal` command already worked in the previous release; the tool and the setting are new here **Evidence** `tengu_goal_proposed`, `tengu_propose_goal`, `Claude proposes a goal` - Flag `tengu_propose_goal`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Session Goals - Names: `modelProposedGoals`, `/goal` - Tier: Not switched on - Useful: 4/5 - Signal: 5/5 - Present in the build but not switched on ### PermissionRequest hooks can interrupt the whole turn A PermissionRequest hook can now set `interrupt` to stop the whole turn, not just one tool call. **What** A PermissionRequest hook can now stop the turn, not just the one tool call. The hook result carries an `interrupt` field alongside the decision; a hook that denies and sets `interrupt` true interrupts the turn. Denials without a message use "Permission denied by PermissionRequest hook". Allow decisions always carry `interrupt` false. **Evidence** `Permission denied by PermissionRequest hook` - Area: Hooks - Names: `PermissionRequest`, `interrupt` - Tier: Use it now - Useful: 5/5 - Signal: 4/5 ### Durable artifact watches backed by server-side webhooks Artifacts could keep being watched even when your session is not running, but that is off. **What** New machinery keeps watching a published artifact even when the session is not live, by minting a webhook through a dedicated wake service (`watch_url` and `unwatch_url` tools) and subscribing to the artifact's publish events. Unsubscribing releases both the subscription and the webhook. It requires a first-party client and the flag `tengu_scalable_quiche`, which is off in this build. **Details** - the returned https URL is checked against the expected webhook path shape before being used - outcomes are reported as `artifact_durable_subscribe` with reasons including trigger_limit, mint_failed, no_wake_minter and client_policy **Evidence** `artifact_durable_subscribe` - Flag `tengu_scalable_quiche`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Tier: Not switched on - Useful: 3/5 - Signal: 5/5 - Present in the build but not switched on ### Remote worker sessions now sync the working directory both ways around every turn Remote worker sessions now sync your working directory both ways around every turn. **What** A remote worker session now pulls files changed on your laptop before each turn and pushes files it changed back after each turn, instead of the previous one-shot copy at startup. It runs only when the session has an SDK URL, `CLAUDE_CODE_REMOTE_SESSION_ID` is set, and both `CLAUDE_CODE_ENVIRONMENT_KIND` and `CLAUDE_CODE_DISABLE_WORKING_SYNC` are unset. **Details** - The old startup-only entry point `startDirSyncApply` is gone; the module now exports `startWorkerDirSync`, which still arms that apply step and then adds `beforeTurn` (pull and apply incoming files) and `afterTurn` (push locally changed files, republish the record of what the worker holds). - The module is loaded on demand; if the import fails the session logs `dir_sync_worker_import_failed` and simply runs with no syncing. **Evidence** `startWorkerDirSync` - Area: Remote Sync - Names: `CLAUDE_CODE_REMOTE_SESSION_ID`, `CLAUDE_CODE_DISABLE_WORKING_SYNC`, `CLAUDE_CODE_ENVIRONMENT_KIND` - Tier: Use it now - Useful: 4/5 - Signal: 4/5 ### The model can propose a session goal, controlled by `modelProposedGoals` Claude can propose a session goal; modelProposedGoals lets you always confirm or turn it off. **What** A new tool lets the model propose a goal for the session. The `modelProposedGoals` setting takes `auto` (the default when the key is absent), `alwaysAsk` to route every proposal through an approval dialog, and `disabled` to turn the tool off. Because the setting affects consent, it is only read from user, policy and command-line settings; project and local settings in the workspace are ignored. **Details** - The tool refuses to run inside agent contexts, and it can set a goal but never clear one. **Usage** `{ "modelProposedGoals": "alwaysAsk" }` **Evidence** `'alwaysAsk' routes every model-proposed goal through the approval dialog; 'disabled' turns the tool off.` - Area: Settings - Names: `modelProposedGoals` - Tier: Use it now - Useful: 4/5 - Signal: 4/5 ### Subagent hand-back text is checked by the safeguard review A subagent's final text is now treated as untrusted and screened for prompt injection. **What** When a subagent finishes, the final text it hands back to the parent agent is now itself reviewed by the auto-mode safeguard, treated as untrusted agent-authored output that could relay a prompt injection. Previously only the subagent's tool calls were reviewed. **Details** - The hand-back text is wrapped in `` tags and submitted as the action to evaluate. - The review now also runs when the subagent made no reviewable tool calls but did produce hand-back text. - The allowed, blocked, refused and unavailable outcomes were reworked so a policy refusal is no longer reported as unavailable. **Evidence** `` - Area: Subagents - Tier: You'll notice - Useful: 4/5 - Signal: 4/5 ### Server-pushed auto-compaction state is now applied Auto-compaction state pushed from the server is now actually applied in your client. **What** Both the normal streaming reader and the thin-client stream path recognise an `autocompact_state` message and apply it, so auto-compaction state sent by the server is reflected in the client instead of being dropped. **Details** - The applied state is tagged with its origin, `stream` or `thin_client_stream`. **Evidence** `autocompact_state` - Area: Compaction - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 ### Cloud sessions can be bound to the machine that created them Cloud sessions can be bound to your machine so local tools only run there, currently gated off. **What** New machinery ties a remote or cloud session to the device that started it, so local tools only run for that machine. Session creation registers the machine and signs a proof of the binding. It is gated on `tengu_violin_wood`, checked asynchronously, and any error means the session is simply not bound. **Details** - Session creation is refused outright in combinations not yet supported, reported as `device_bind_project_unsupported` and `device_bind_agent_unsupported`. - Binding failures degrade to an unbound session and emit `tengu_device_bind_skipped` or `tengu_device_bind_failed`. - Three new server rejection causes are recognised: `bind_attestation_stale`, `bound_session_unattested_write`, and `untrusted_device`. **Evidence** `bound_session_unattested_write` - Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cloud Sessions - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Live task summary in the spinner The spinner can show a live one-line summary of what the current task is doing. **What** The status line can show a live one-line summary of what the current task is doing, replacing the thinking line, the elapsed-time indicator and the trailing ellipsis while it is present. It only appears when the app is holding a fresh summary and you are not viewing an agent task; nothing in this build was found to populate that summary, so it is not reachable through normal use here. **Details** - A new `isLiveBriefTurn` flag suppresses the usual thinking summary for turns that carry one. **Evidence** `"task-summary"` - Area: Terminal UI - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Prompt section discouraging over-delegation to subagents Claude can be told to stop over-spawning subagents for small tasks, but that guidance is absent by default. **What** A "## Delegating to subagents" section tells Claude to handle small bounded sub-tasks inline, not to fan several subagents out on one small task, not to spawn one to double-check work it can verify itself, and to keep spawn counts low. It is only injected when the subagent steer resolves to "counter_steer". The steer is read from `CLAUDE_CODE_THISTLE_GREBE`, client data, the `tengu_thistle_grebe` flag, or a per-model floor, and defaults to "default", so the section is absent unless configured. **Details** - Applying any non-default steer emits a `tengu_subagent_steer_applied` event. **Evidence** `Subagents multiply cost and time: each one re-establishes context, re-explores, and reports back` - Flag `tengu_thistle_grebe`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Subagents - Names: `CLAUDE_CODE_THISTLE_GREBE` - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Routines tool can list past runs and fetch a run log Claude can read a routine's past runs and detailed run log, but a server flag gates it. **What** The scheduling tool gains two read-only actions, `list_runs` and `get_run_log`. `get_run_log` returns a condensed log of a single run covering provisioning, prompt, tool calls and errors, permission prompts and denials, API retries and the final result, with cursor paging. It requires a run session id starting `cse_` or `session_`. Gated on the `tengu_surreal_dali` flag (off when the server sends nothing) plus the `allow_remote_sessions` and `allow_routines` policy settings. **Details** - `list_runs` returns the run history; `get_run_log` needs the session id of a specific run and errors otherwise - both actions are read-only, they cannot start or cancel a run - with the flag or either policy setting off, the tool is not offered at all **Evidence** `get_run_log requires session_id` - Flag `tengu_surreal_dali`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cloud Routines - Names: `list_runs`, `get_run_log`, `allow_remote_sessions`, `allow_routines` - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### SendFile tool moved from hard-off to a feature flag Sending files to another Claude session went from hard-off to a flag the server can flip. **What** The tool for sending files to another Claude Code session was previously disabled unconditionally. It is now behind the server flag `tengu_send_file`, which falls back to off when the server sends no value, so the tool can be switched on remotely without a new build. **Evidence** `send files to another Claude Code session` - Flag `tengu_send_file`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cross-Session Messaging - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### device_bash refuses on any machine whose sandbox is not fully confining The local-command tool refuses to run unless your sandbox is strict and fully confining. **What** Before running anything, the local-command tool checks the device's sandbox and refuses with a specific reason if sandboxing is off or unsupported on the platform, failed to start, is not in strict mode, allows all Unix sockets, or is set to inject real credentials into network requests. Each refusal returns an error saying what to change on that device. **Details** - successful runs emit `tengu_device_bash_served` with whether the exit code was zero, duration, whether output was truncated, and whether the session matched - separate events cover timeouts, output limits, cancellation and failures - refusals carry distinct reason codes, so a device that never runs commands can be told apart from one that ran and failed **Evidence** `tengu_device_bash_served` - Area: Cloud Sessions - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### A storage backend is threaded through most of the app A new storage backend now runs through hundreds of paths, from plugin installs to worktree cleanup. **What** A new storage backend, previously used at a handful of call sites, is now passed into hundreds of functions covering plugin install and update, marketplace refresh, settings writes, task and daemon state, transcript reads, MCP auth caching and worktree cleanup. A new React context supplies it via `SessionServicesProvider` and `useSessionServices`. **Details** - Every consumer keeps a branch for when no backend is supplied, falling back to the existing filesystem paths, so behaviour is unchanged without one. - The provider's default value is an empty frozen object. - No flag turns this on; the backend is handed down from above, and undefined means the old paths. - Occurrences rise from 37 in v2.1.226 to 689 here. **Evidence** `SessionServicesProvider: () => uNr` - Area: Internals - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### Artifact auto-reply notices are structured notifications Artifact auto-reply stop notices are structured, and new comments delay a watcher's idle teardown. **What** Notices that an artifact auto-reply subscription has stopped are now sent as task notifications carrying a type and a summary rather than plain strings. Supervisors watching a live artifact also refresh their last-activity timestamp on a new comment or publish, which delays idle teardown. **Evidence** `taskType: "artifact-auto-react"` - Area: Artifacts - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### Shell commands can run with credentials stripped from the environment Shell commands can run with credentials stripped from the environment, but there's no setting for it. **What** The command builder gained an option that skips injecting the usual credential exports and instead appends a scrubbing step before the command runs. At least one internal caller uses it alongside sandboxing and cwd-change prevention. There is no user-facing setting for it. **Evidence** `scrubCredentialEnv` - Area: Shell Execution - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### Transcripts can record that history was deliberately withheld Transcripts can mark that earlier history was withheld, usually after an account switch, and won't sync it. **What** A new transcript entry marks a session whose earlier history was suppressed, most often because the signed-in account changed. Replay skips it, and remote sync refuses to backfill or upload the merged pair produced by compaction for any conversation carrying that mark. **Details** - The record holds a session id, a cause and optionally the account it was vetoed against; duplicate detection for it uses only the type and session id. - Session state gained matching flags, surfaced to forks so a branched conversation inherits the suppression. **Evidence** `[persistence-sync] Refusing backfill: conversation carries a history-suppression taint`, `[persist-remote] Skipping compact-pair upload: conversation carries a history-suppression taint` - Area: Sessions - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### /code-review ultra can post its findings to the pull request as you Ultra review adds --post and --no-post, so findings go to the PR as a comment from you. **What** The ultra review flow gained `--post` and `--no-post` flags and a third confirmation choice, "Run and post the findings to the PR as me", which runs the cloud review and posts the findings to the GitHub pull request as a comment from your own account. It is controlled by `tengu_ultrareview_post_enabled`, which falls back to on when remote config says nothing. If the target is not a GitHub pull request, or posting is turned off, the dialog says the posting request was dropped; a review that fails adds a note that nothing was posted. **Details** - The launch dialog now also carries your GitHub login, taken from the preflight check, and the review task records where findings should be posted. - Posting happens only after the review completes successfully. **Usage** `/code-review ultra --post /code-review ultra --no-post` **Evidence** `Run and post the findings to the PR as me` - Flag `tengu_ultrareview_post_enabled`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Code Review - Names: `--post`, `--no-post`, `/code-review` - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### /ultrareview can post its findings to a GitHub pull request /ultrareview takes --post and --no-post to comment findings on a GitHub PR as you. **What** `/ultrareview` and `claude ultrareview` now take `--post` and `--no-post`. With posting armed against a GitHub.com pull request, the finished review is posted as a single plain comment from your own GitHub account, not as a formal review. Posting is gated on `tengu_ultrareview_post_enabled` (falls back to on); when it resolves off the CLI replies that posting findings to the PR is currently turned off. Consent is session-scoped: end the session before the review finishes and nothing is posted. **Details** - Interactive runs still confirm in the launch dialog, which gains a `proceed-post` choice described as "Post the finished review's findings to the PR as you (PR targets only; one plain comment, not a review)". Non-interactive runs post on the flag alone. - The task carries the target repo and PR number, and on completion a separate cloud job runs a locked-down posting prompt that calls `get_me` and then `add_issue_comment` exactly once. - Non-GitHub.com targets and non-PR scopes print `Note: --post was ignored` and continue, explaining that posting applies only to GitHub.com pull request reviews. - Progress prints "Posting now — a single plain comment, not a review."; a failed review prints "Nothing was posted to the pull request: the review failed." **Usage** `claude ultrareview --post claude ultrareview --no-post` **Evidence** `"--no-post"`, `Post the finished review's findings to the PR as you (PR targets only; one plain comment, not a review)`, `postReviewToPR`, `Nothing was posted to the pull request: the review failed.` - Flag `tengu_ultrareview_post_enabled`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Code Review - Names: `/ultrareview`, `--post`, `--no-post` - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### Bundled skills for data visualization and artifact data tables Two bundled skills arrive: sortable artifact data tables and a data visualization charting guide. **What** Two new skills ship with this build. `artifact-data-table` builds sortable, filterable tables from strict JSON data, and a brand-neutral Data Visualization skill covers charts with a runnable palette validator plus components, palette and interaction reference files. **Details** - A slot that previously held a Java SDK tool-use reference now holds a dashboard body-fragment template with light and dark color scopes and a deterministic fallback SVG chart renderer keyed on the `data-chart-runtime` attribute. - The platform-availability matrix document was replaced by the new interaction reference. **Evidence** `name: artifact-data-table` - Area: Skills - Names: `artifact-data-table` - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### New setting: Claude-proposed goals A "Claude-proposed goals" setting in the config panel controls whether Claude suggests session goals. **What** A new setting, `modelProposedGoals`, controls whether Claude can propose goals for your session. `auto` (the default when the key is absent) lets the model decide per proposal whether to ask you, `alwaysAsk` sends every proposed goal through the approval dialog, and `disabled` turns the feature off entirely. It appears in the config panel under "Input & controls" as "Claude-proposed goals". **Details** - Values are `["auto", "alwaysAsk", "disabled"]`, with `auto` resolved as the default. - The panel row is consent-gated and only appears when that gate returns true. - Changing it emits `tengu_model_proposed_goals_changed` with the chosen value and source `config_panel`. - A matching "goal proposal" status label was added to the status-string table. **Evidence** `tengu_model_proposed_goals_changed`, `Claude-proposed goals`, `"Claude-proposed goals"` - Area: Settings - Names: `modelProposedGoals` - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### /code-review can post its findings as a comment on a GitHub pull request Code review findings can be posted straight back to your GitHub pull request as a comment. **What** After a review, Claude Code can now post the findings back to the pull request as a GitHub comment. It sets up an `anthropic_cloud` environment, registers a scheduled routine that is allowed only two GitHub tools (`mcp__github__add_issue_comment` and `mcp__github__get_me`), and runs it with the findings. Posting is controlled by `tengu_ultrareview_post_enabled`, which falls back to on; when it is off the reply is "Posting to the pull request is currently turned off". **Details** - The routine's job config sets `github_review_comment_only` so it can only leave a review comment, and every other tool is on a disallowed list. - The routine's identifier is remembered in your settings under `ultrareviewPostRoutines`, along with a version; later runs re-verify it and refresh it rather than creating a new one. - New telemetry `tengu_ultrareview_post` records the outcome: `fired`, `fire_failed`, `deadline` (setup did not complete in time), or `skipped_not_findings`. - If the cloud environment cannot be set up, you get prose telling you to open claude.ai/code and rerun with `--post`. **Evidence** `tengu_ultrareview_post` - Flag `tengu_ultrareview_post_enabled`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Code Review - Names: `/code-review`, `--post` - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Hook output now appears in the transcript Hook output now shows in the transcript and reaches SDK consumers instead of vanishing. **What** Text produced by hooks is turned into visible assistant messages in the streamed output and counted as displayable by the output filter, so it reaches SDK consumers instead of being dropped. **Evidence** `hook_system_message` - Area: Hooks - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Live headline above the spinner describing the current task The spinner can show a short headline of what Claude is actually working on right now. **What** Interactive sessions can now show a short headline saying what Claude is working on, in place of the generic activity text next to the spinner. It is produced by the existing post-turn classifier, which for this surface uses a cheap built-in heuristic instead of an extra model call. The remote setting `tengu_classifier_disabled_surfaces` (empty by default, so nothing is turned off) can list `repl` to disable it. **Details** - The classifier's surface map gained `repl: ["headline"]`, and surface detection now adds `repl` for interactive sessions. - When the headline output is active, the classifier writes new app state `taskSummary` holding the text and a timestamp; the transcript and spinner renderer prefer it over the generic activity text. - Because the requested output set is headline-only, the engine selector resolves to the `heuristic` path, so no additional model request is made for it. **Evidence** `repl: ["headline"]` - Flag `tengu_classifier_disabled_surfaces`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Terminal UI - Names: `tengu_classifier_disabled_surfaces` - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### MCP connection timeouts are retried and never undercut the global timeout MCP connect timeouts now respect the global timeout and get retried instead of failing. **What** The connect timeout for an MCP server is now the larger of that server's own value and the global MCP timeout, so a small per-server value can no longer make connections fail early. Connection timeouts are tagged `CONNECT_TIMEOUT` and retried instead of failing outright, including timeouts raised by the MCP SDK itself. Controlled by the `tengu_mcp_connect_timeout_retry` flag, which is on unless the server turns it off. **Details** - the SDK's own `RequestTimeout` error is mapped onto the same `CONNECT_TIMEOUT` code so it retries too **Evidence** `tengu_mcp_connect_timeout_retry` - Flag `tengu_mcp_connect_timeout_retry`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: MCP - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Session history is withheld when the signed-in account changed Resuming a session under a different account starts fresh instead of replaying the old history. **What** When Claude reattaches to a session that was started earlier or handed over from another process, it now compares the account and organization recorded on that session against whoever is signed in now. On a mismatch it starts a fresh session instead and withholds the earlier history rather than replaying it under the new account. **Details** - The handoff carries the previous owner identity in new environment variables including `CLAUDE_BRIDGE_REATTACH_OWNER_ACCT`. - A suppression record is written into the transcript and `rc_cross_account_suppression` is emitted, with `torn_entry_pair` and `scan_budget_exhausted` variants for partially written or too-large transcripts. **Evidence** `CLAUDE_BRIDGE_REATTACH_OWNER_ACCT` - Area: Sessions - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Switching models checks your organization's entitlement first Switching models now checks your organization's entitlement live and refuses if it can't confirm. **What** Choosing a model now forces a server-side entitlement check instead of trusting cached access. If the check denies the model or cannot be completed, the switch is refused with the organization-restriction message rather than silently proceeding. **Details** - Failures are recorded against `model_switch` with the reason `denied_by_entitlement` or `entitlement_probe_failed`. - A successful switch prunes models you are no longer entitled to out of the saved `modelAccessCache`. **Evidence** `denied_by_entitlement` - Area: Models - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Two memory-API environment variables are hidden from commands Claude runs Your memory API base URL and token are now hidden from every command Claude runs. **What** `CLAUDE_CODE_MEMORY_API_BASE_URL` and `CLAUDE_CODE_MEMORY_API_TOKEN` are now stripped from the environment given to every subprocess Claude Code spawns, the same way `CLAUDE_CODE_OAUTH_TOKEN` and `CLAUDE_CODE_ARTIFACTS_API_TOKEN` already were. A bash command or tool cannot read your memory API token. **Details** - Both names are new in this build. - The code that would use the token sends it as an `Authorization: Bearer` header, but only when an override host is set, and the function that supplies that host currently returns nothing. So the memory-API override is not reachable yet; the scrubbing is the part that is live. **Evidence** `CLAUDE_CODE_MEMORY_API_TOKEN` - Area: Permissions - Names: `CLAUDE_CODE_MEMORY_API_BASE_URL`, `CLAUDE_CODE_MEMORY_API_TOKEN` - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Wider detection of secret-shaped environment variables Many more environment variable names are now treated as secrets and protected. **What** Environment variables are now treated as sensitive when their name contains TOKEN, SECRET, PASSWORD, PASSPHRASE, KEY, AUTH, COOKIE, PAT, DSN or CREDENTIAL(S) as a whole word, plus `CLOUDSDK_PROXY_PASSWORD` and the numbered `GIT_CONFIG_KEY_` variables specifically. **Evidence** `"CLOUDSDK_PROXY_PASSWORD", "GIT_CONFIG_KEY_[0-9]*"` - Area: Permissions - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### New entrypoint value: remote_cowork_trigger CLAUDE_CODE_ENTRYPOINT accepts remote_cowork_trigger, counting as both trigger-launched and remote. **What** `CLAUDE_CODE_ENTRYPOINT` accepts a new value, `remote_cowork_trigger`, and sessions started with it count as trigger-launched and as remote, the same as the existing `remote_trigger`. **Evidence** `remote_cowork_trigger` - Area: Sessions - Names: `CLAUDE_CODE_ENTRYPOINT`, `remote_cowork_trigger` - Tier: Use it now - Useful: 2/5 - Signal: 4/5 ### A skills directory named `synced` is now reserved A skills folder named `synced` is skipped, reserved for what claude.ai syncs down. **What** Skill discovery skips any skills directory named `synced`, which is reserved as the root that claude.ai syncs into. Importing from it reports the directory as skipped and explains that you should rename it and import manually. **Details** - Discovery logs a debug line and moves on; nothing in that directory is loaded as a local skill. - If you already keep hand-written skills in a folder called `synced`, rename it or they will silently stop being picked up. **Evidence** `'synced' is the sync-owned root` - Area: Skills - Names: `synced` - Tier: You'll notice - Useful: 2/5 - Signal: 4/5 ### An artifact comment thread can be analysed by a new read-only subagent A read-only subagent that analyses one artifact comment thread exists but stays off. **What** A new built-in subagent reads a single comment thread on an artifact, optionally with the rendered page, and returns an analysis brief. It cannot call any other tool, is capped at 6 turns, and its brief is thrown away if it gets truncated. It is off unless you set `CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER`; failing that it checks `tengu_bracken_sluice`, which falls back to false. **Details** - The brief's first line must be exactly "ANALYSIS BRIEF" or it is not accepted. - A separate small call classifies the newest human request in the thread as either `act` or `pipeline`. **Evidence** `The comment-thread analyst is read-only and scoped to its one artifact and thread` - Flag `tengu_bracken_sluice`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Artifact tool can resolve comment threads, behind an off-by-default flag Claude could mark a comment thread on a published artifact as resolved, but the path is off. **What** The Artifact tool gains a `resolve` action alongside `comments` and `reply`, marking one comment thread on a published artifact as resolved. It is only offered when artifact comments are enabled, via `CLAUDE_CODE_ARTIFACT_COMMENTS` or the `tengu_teal_corbel` remote flag, which falls back to off, so nothing in this build turns it on by itself. **Details** - `thread_id` is required and must be a lowercase UUID taken from the `comments` action; a missing one errors with "thread_id required for action \"resolve\"". - Success reads "Marked comment thread ... resolved. Viewers see it as resolved by Claude; a person can reopen it." Failures separate not-authorized, where only the thread starter or a writer of the artifact may resolve, from Claude not being activated on the thread. - Plan mode never mutates comment-thread state, so the action is refused there. - Guidance tells Claude to reply and then resolve only threads it actually addressed, and never to re-resolve an already-resolved thread. **Evidence** `thread_id must be a thread id from action "comments" (a lowercase UUID)`, `'thread_id required for action "resolve"'`, `Plan mode never mutates comment-thread state`, `thread_id required for action "resolve"`, `'`thread_id` applies only to actions "comments", "reply", and "resolve", and `text` only to "reply"'` - Flag `tengu_teal_corbel`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_COMMENTS` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Artifact watches can be woken by a turn instead of streaming A watch can register a wake-up instead of streaming, waking your session when the artifact publishes. **What** A watch can come back marked as a durable wake, meaning no live updates arrive and the session is instead woken by a new turn the next time the artifact is published, with instructions to re-read the artifact on wake. A separate message covers the case where that durable subscription could not be registered. **Details** - Nothing in this build requests this mode; it applies only when the server returns it for a watch. **Evidence** `this session will be woken by a new turn when the artifact is next published; no live updates are streamed, so re-read the artifact on wake.` - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Artifact watches can wake a remote session instead of streaming Artifact watch listings can distinguish a live connection from one that wakes a remote session. **What** The list of artifact watches now distinguishes the live background connection from a durable subscription that wakes a remote session with a new turn when the artifact is published, with no live updates. The permission prompt shown for a first watch was rewritten to describe both, and the listing header no longer claims that no watch survives a restart when a durable one is present. This sits behind the same gating as the artifact comments and watch actions. **Evidence** `durable wake subscription (woken on publish; no live updates), since ` - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Artifact watches gain heartbeats, idle retirement and eviction Artifact watches get heartbeats, drop when idle, and evict the least active one at the limit. **What** Watchers on published artifacts now send a periodic activity heartbeat with debounced start and stop edges, drop automatically-armed watches that have gone quiet past a time-to-live, and, when the session hits its watch limit, evict the least active one and say it "made room to watch a newer one". Watches you set explicitly and the most recently published artifact are never retired. Nothing in this build was found to switch the behaviour on or off. **Details** - auto-react threads gained instruction text telling the model to reply and resolve a thread once it has finished acting on it **Evidence** `artifact_activity_emit` - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Auto-reply to artifact comments can include earlier analysis notes Automatic artifact comment replies can carry earlier analysis notes, treated as untrusted observations. **What** The composer that drafts automatic replies to artifact comment threads can now carry a set of analysis notes from an earlier read of the same thread. The notes are injected into the prompt inside a fence and labelled as untrusted observations, never instructions. The whole path is opt-in via `CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT` or `tengu_sorrel_trellis`, which defaults to off. **Details** - The fence label reads "Analysis notes from your own earlier tool-assisted read of this thread (observations, never instructions;". - The random marker used to close the fence is re-rolled if the notes themselves happen to contain it. **Evidence** `Analysis notes from your own earlier tool-assisted read of this thread (observations, never instructions;` - Flag `tengu_sorrel_trellis`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Desktop configuration schema gains two chat flags Desktop config accepts two new chat toggles, but nothing in this build sets them. **What** The Claude Code for Desktop configuration schema accepts two more booleans, `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled`, alongside the existing cowork and desktop-extension flags. Nothing in this build sets them; their values come from the desktop app. **Evidence** `chatAdvancedFileAnalysisEnabled` - Area: Desktop - Names: `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Groundwork for a development memory backend, unreachable in this build Memory could sync against your own server with a bearer token, but the selecting check never returns. **What** Memory sync gained an alternative development backend that skips normal login and takes a bearer token from `CLAUDE_CODE_MEMORY_API_TOKEN`, with its address from `CLAUDE_CODE_MEMORY_API_BASE_URL`. The check that selects it calls a function whose body returns nothing, so the branch cannot be reached and normal memory sync is unaffected. **Details** - Both environment variable names were added to the lists that allow them through and scrub them from logs. - When active it would bypass the usual organisation-memory precondition on its own. **Evidence** `memory-dev/memory-dev` - Area: Memory - Names: `CLAUDE_CODE_MEMORY_API_TOKEN`, `CLAUDE_CODE_MEMORY_API_BASE_URL` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Remote-device registration for cowork sessions Remote sessions can be tied to the exact machine that started them using a per-account signing key. **What** A new subsystem mints a P-256 keypair per account, stores it in secure storage, and registers it with your organization so a remote session can be tied to the specific machine that started it. It signs a binding payload when creating a session. Nothing in this build was found to switch the cowork remote-device flow on, so whether you ever reach it is decided elsewhere. **Details** - Registration POSTs `display_name`, `platform` and `public_key`; the platform value is hardcoded to "linux" regardless of the host operating system. - Failures are typed: key not persisted, request failed, not sent, HTTP error, revoked key, registration unavailable, and `cowork_remote_device_limit_reached`. - Revoked or unreadable keys are retired and a new one is minted on the next attempt. - Telemetry: `device_registry_register` success and failure counters, plus `tengu_device_bind_skipped`, `tengu_device_bind_failed` and `tengu_device_bind_prepared`. - If the server accepts a session but does not bind it to this device, Claude retries unbound and reports `silent_drop`. **Evidence** `deviceRegistry: device key revoked server-side; a new key will be minted on the next registration`, `/api/organizations/:orgUUID/cowork/remote_devices` - Area: Cloud Sessions - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Self-hosted memory endpoint is scaffolded but cannot be switched on Two environment variables for pointing memory at your own server exist but do nothing. **What** Two environment variable names for pointing memory at your own server, `CLAUDE_CODE_MEMORY_API_BASE_URL` and `CLAUDE_CODE_MEMORY_API_TOKEN`, are declared in this build and excluded from the environment restored from saved credentials. Setting them does nothing: the function that resolves the base URL has an empty body that returns nothing, so the override branch is never taken. **Details** - The memory client can switch to `auth: "none"` with a bearer header, but only reachable once the resolver returns a URL. **Evidence** `"CLAUDE_CODE_MEMORY_API_TOKEN",` - Area: Memory - Names: `CLAUDE_CODE_MEMORY_API_BASE_URL`, `CLAUDE_CODE_MEMORY_API_TOKEN` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Slack channel autocomplete Typing can offer Slack channel completions, but nothing here switches it on. **What** A completion source that offers Slack channels as you type, showing up to 10 matches formatted as `#channel`. Nothing in this build was found to switch it on, so whether it appears depends on how the Slack integration is enabled. **Details** - Results are cached per typed prefix, with the cache evicting past 50 queries. - An identical query already in flight is reused rather than re-sent. - Keeps a growing set of channels it has seen and notifies the UI when that set changes. **Evidence** `slack-channel-` - Area: Autocomplete - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Two new remote feature flags: artifact auto-read guard and URL watching Two new server flags control automatic artifact reading and subscribing to watched URLs. **What** Two server-controlled flags appeared. `tengu_cobalt_plinth_moss` (fallback on) gates the guard around automatically reading artifacts; with it off, the path logs `artifact_guard_autoread` with "gate_off" and does nothing. `tengu_scalable_quiche` (fallback off) gates subscribing to a watched URL or trigger; with it off, the subscribe call returns skipped with reason "flag_off" unless that item is already being watched. **Details** - Neither flag name existed in 2.1.226; actual values come from remote config, so the fallbacks apply only when config is unavailable. **Evidence** `tengu_scalable_quiche` - Flag `tengu_cobalt_plinth_moss`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Flag `tengu_scalable_quiche`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Watching an artifact can register a wake-up instead of streaming Watching an artifact can register a wake trigger instead of a live stream, and says which you got. **What** A watch on an artifact can return on a "durable wake" path: rather than holding a live subscription and receiving streamed updates, the session registers a trigger and is woken with a new turn the next time that artifact is published. The tool result explains which of the two you got. The watch data gained `rail`, `trigger_id`, `durable_since`, `status` and `note` fields. None of this exists in v2.1.226. **Evidence** `outcome: "durable_wake_registered",` - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Directory sync reports pull, push, base capture and rehoming New reporting covers directory sync pulls, pushes, initial scans and workspace re-pointing. **What** Four events cover the new worker sync: `tengu_dir_sync_worker_pull` and `tengu_dir_sync_worker_push` carry per-turn counts of files considered, filtered, applied, already equal, conflicted, stale, failed and deferred, while `tengu_dir_sync_worker_base` and `tengu_dir_sync_worker_rehome` cover the initial scan and workspace re-pointing. **Details** - Structured pass/fail statuses are also recorded with reasons including `session_refused`, `auth_refused`, `rows_deferred`, `over_budget` and `too_many_paths`. - Emitted only on remote worker sessions, under the same environment gate as the syncer. **Evidence** `tengu_dir_sync_worker_push` - Area: File Sync - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### Memory citation telemetry counts how cited files resolved Memory citations are checked against files Claude actually had, and the counts recorded. **What** When a memory citation tag is stripped from assistant output, the event now reports how many of the cited filenames matched known memory files, how many had been read or written, and how many were injected into the prompt, surfaced, or only listed in an index. **Details** - Filenames come from the tag's filenames attribute and are capped per block. **Evidence** `cited_injected_body_count` - Area: Memory - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### Memory files are tracked by how they entered the session Claude Code now tracks how each memory file reached the session and whether it was used. **What** New bookkeeping records how each memory file arrived (in the prompt body, surfaced, merely listed, or not at all) and whether it was later read, written, or both, then matches a memory the model names against that set. It exists to judge whether a cited memory was actually available; nothing new is shown to you. **Evidence** `read_written` - Area: Memory - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### `ENABLE_TOOL_SEARCH=force` now works from settings-composed environment ENABLE_TOOL_SEARCH=force now works when set through your settings, not just the shell. **What** Setting `ENABLE_TOOL_SEARCH` to `force` pins tool search to its search-based mode and skips the "standard" fallback that would otherwise apply. The value is now read from the environment Claude Code composes from your settings, not just the raw process environment. The override is refused under HIPAA mode and for non-first-party model providers. **Details** - Resolved value `force` selects the `tst` tool search mode; any other value leaves the previous resolution in place. - If reading settings fails, the failure is logged and treated as "not forced", so the standard fallback still applies. **Usage** `ENABLE_TOOL_SEARCH=force claude` **Evidence** `isToolSearchForceOverride: settings read failed` - Area: Tool Search - Names: `ENABLE_TOOL_SEARCH` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Break reminders gain a persistent active-time ledger Break reminders now track active time on disk, so they survive restarts once you enable them. **What** Time spent actively working is now written to disk, so break reminders can survive a restart. The ledger lives in `active-time.json` in the config directory, or under an `active-time-ledger` key when a storage backend is present, and holds start, end and active-seconds windows pruned to one year. Reminders themselves still only fire when the `breakReminder.enabled` setting is turned on, documented as defaulting to false, alongside the existing `breakThresholdMinutes`. **Details** - a failed read logs "active-time ledger read failed" and falls back to an empty ledger rather than erroring - the periodic flush timer is an empty early return in this build, so nothing is written on a schedule; writes happen only when something explicitly flushes **Evidence** `active-time ledger read failed` - Area: Break Reminders - Names: `breakThresholdMinutes` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Cloud gateway login URL is documented as admin-only The cloud gateway login URL is only honoured from admin-managed settings, never user or project ones. **What** The settings description for the cloud gateway login URL no longer marks itself internal and now states that the value is read only from admin-controlled managed settings (MDM, `managed-settings.json`, or the policy helper) and ignored if it appears in user, project, or remotely delivered settings. **Evidence** `Honored only from admin-controlled managed settings (MDM / managed-settings.json / policy helper); ignored in user, project, and remote-delivered settings.` - Area: Enterprise Settings - Names: `managed-settings.json` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Enterprise OIDC login can route identity provider requests through a proxy Enterprise OIDC logins can route identity provider requests through your configured HTTPS proxy. **What** OIDC configuration accepts a new optional `use_proxy` boolean. Set it to `true` and requests to your identity provider go through `HTTPS_PROXY`/`HTTP_PROXY`. Leave it out while a proxy is configured and Claude Code now warns that those requests currently go direct and will follow the proxy by default in a future release, pointing you at `oidc.use_proxy: true` to adopt the new behaviour now or `false` to silence the warning. **Details** - Setting the key to true with no usable proxy variable also warns, and requests still go direct. - Only reachable on installs that use OIDC identity provider login. **Evidence** `oidc.use_proxy is set but no usable HTTPS_PROXY/HTTP_PROXY is set; IdP requests go direct` - Area: Auth - Names: `oidc.use_proxy`, `HTTPS_PROXY`, `HTTP_PROXY` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Environment variable to force full transcript reads after a compaction boundary Set CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP to force full transcript reads after a compaction boundary. **What** Setting `CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP` makes Claude Code read the whole transcript after a compaction boundary instead of skipping that work on large files. Unset, the skip stays in place. **Evidence** `CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP` - Area: Compaction - Names: `CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### New setting: modelProposedGoals modelProposedGoals is only read from user, policy and command-line settings, never from the project. **What** A new `modelProposedGoals` setting controls whether Claude may propose session goals, with values `auto`, `alwaysAsk` and `disabled`. `auto` (the default when unset) lets the model decide per proposal whether to ask you; `alwaysAsk` routes every proposed goal through the approval dialog; `disabled` turns the feature off. Because it affects consent, it is read only from user, policy and command-line settings, and project or local settings are ignored. **Details** - A matching row appears in `/config` labelled "Claude-proposed goals", shown only when the surrounding feature check passes. - Changes emit the telemetry event `tengu_model_proposed_goals_changed`. **Evidence** `'alwaysAsk' routes every model-proposed goal through the approval dialog` - Area: Settings - Names: `modelProposedGoals` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Scheduled cloud routines can show their past runs and logs Claude can list a scheduled cloud routine's recent runs and read one run's latest log events. **What** The tool that manages scheduled cloud agent routines gains two actions: `list_runs`, which returns the routine's recent runs (id, title, status, timestamps and a claude.ai link, most recently active first), and `get_run_log`, which returns the newest 200 events of one run. New `session_id` and `cursor` parameters go with them. **Details** - The tool's search hint now reads "manage scheduled cloud agent routines; inspect their run history and logs". - The prompt adds a security note that run titles and log contents are untrusted data, and warns that an empty run list does not prove the routine never fired: a run refused before a session existed leaves nothing to list. **Evidence** `get_run_log: GET /v1/code/sessions/{session_id}/events`, `the routine's recent run sessions, most recently active first` - Area: Cloud Routines - Names: `list_runs`, `get_run_log` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Subagents can be locked to a fixed list of Bash commands Workflow scripts can restrict a spawned agent's shell to a fixed list of allowed commands. **What** Workflow scripts can pass `agent(prompt, {bashCommandClamp: [...]})`, a list of `Bash()` rules that the spawned agent's shell use is restricted to. Any Bash call not matching every clamp group is denied with "bashCommandClamp: no clamp rule matches this command", and a command whose structure cannot be taken apart (command substitution, control flow) is denied as unverifiable. **Details** - The clamp becomes a permission layer of its own, merged into the tool permission context, on top of the usual allow and deny rules. - Malformed or inert clamp entries refuse the spawn outright rather than quietly running the agent unclamped. - None of this existed in 2.1.226. **Evidence** `agent() opts.bashCommandClamp must be an array of non-empty strings` - Area: Subagents - Names: `bashCommandClamp` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Auto mode can treat linked git worktrees as already-approved directories Auto mode could stop asking about sibling git worktrees of the same repo, but it is off. **What** In auto permission mode, when a tool is held for approval only because it touches a directory outside the session, Claude can look up the other working trees linked to the same repository and retry the check with those included. The resolver returns nothing unless `tengu_auto_mode_worktree_fast_path` is on, and it falls back to off, so behaviour is unchanged in this build. **Evidence** `tengu_auto_mode_worktree_fast_path` - Flag `tengu_auto_mode_worktree_fast_path`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Permissions - Tier: Not switched on - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Automatic turn budget can now be set from remote config How many turns Claude takes automatically can now be set from the server, still defaulting to 60. **What** The cap on how many turns Claude takes automatically is read from a new remote-config key, `tengu_sorrel_trellis_weir`. No value from the server means the built-in default of 60 applies, and a session-level override still wins over both. Values that are not positive numbers are ignored. **Evidence** `tengu_sorrel_trellis_weir` - Area: Agent Loop - Tier: Under the hood - Useful: 3/5 - Signal: 3/5 ### Billing attribution header carries a prompt id and validates its values Usage attribution headers can carry a prompt id, and one env var suppresses the header entirely. **What** The attribution header sent with API requests can now include a prompt id alongside the existing previous-request id. Each is emitted only if it matches a strict shape, a `req_` prefix for the request id and a UUID for the prompt id, and only under first-party auth. Setting `CLAUDE_CODE_ATTRIBUTION_HEADER` suppresses the header entirely. **Evidence** ` cc_prompt_id=${n};` - Area: Usage & Limits - Names: `CLAUDE_CODE_ATTRIBUTION_HEADER` - Tier: Under the hood - Useful: 3/5 - Signal: 3/5 ### /review can post cloud review findings to a GitHub pull request /review gains --post and --no-post to publish cloud review findings on a GitHub PR. **What** `/review` now accepts `--post` and `--no-post`. For a cloud review of a GitHub.com pull request, `--post` publishes the finished findings as a single comment from your own GitHub account. Interactive sessions still confirm in the launch dialog; non-interactive runs post on the flag alone. Posting is controlled by the server flag `tengu_ultrareview_post_enabled`, which defaults to on when the server says nothing. **Details** - The review command parser gained the two new words alongside the existing ones: `qgh(e, ["comment", "fix", "post", "no-post"])`, and the remote review task carries a new `postReviewTo` target. - The flag is ignored, with an explanatory message, when the target is not a GitHub.com pull request or when the review runs locally rather than in the cloud. - If no cloud environment can be obtained for the posting step, you get "Couldn't find or create a cloud environment for the posting session." **Usage** `/review --post /review --no-post` **Evidence** `Note: --post was ignored — posting applies only to GitHub.com pull request reviews.` - Flag `tengu_ultrareview_post_enabled`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Code Review - Names: `/review`, `--post`, `--no-post` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Artifact tool: put the title near the top, and pass a URL to update an existing artifact To update an existing artifact you must pass its URL; find it with the list action. **What** The Artifact tool's instructions now state that only the first 8KB of the file is scanned for the ``, so a title further down will be missed. The guidance for updating an artifact from an earlier conversation was rewritten: find its URL with `action: "list"` or ask for it, because publishing without `url` creates a new artifact instead of updating the old one. **Evidence** `only the first 8KB of the file is scanned for it` - Area: Artifacts - Names: `url`, `action: "list"` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Huge MCP timeout values no longer fire instantly Very large MCP_TIMEOUT values are capped instead of overflowing and timing out instantly. **What** `MCP_TIMEOUT` and `MCP_CONNECT_TIMEOUT_MS` are now capped at 2147483647 milliseconds. Values above that used to overflow the underlying timer and expire immediately; defaults remain 30000 and 5000 milliseconds. **Evidence** `MCP_CONNECT_TIMEOUT_MS` - Area: MCP - Names: `MCP_TIMEOUT`, `MCP_CONNECT_TIMEOUT_MS` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Local reviews now tell you that `--post` did nothing Using `--post` on a local review now tells you to use `--comment` instead. **What** If you type `--post` but the review runs locally, Claude Code says so in one short line and points you at `--comment`, which is the flag that posts local findings as inline PR comments. `--post` applies only to the cloud `/code-review ultra` path. **Details** - Applies both when the review falls back to local and when it was local all along, with wording that varies depending on whether `--comment` was also given. **Usage** `/code-review --comment` **Evidence** `this local review will not post to GitHub; \`--comment\` is the flag that posts local findings as inline PR comments. Tell the user this in one short line.` - Area: Code Review - Names: `--post`, `--comment` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Sandbox refusal now tells you how to turn sandboxing on Sandbox refusals now hand you the exact setting to enable and point at /sandbox. **What** When a request is refused because sandboxing is disabled on the device, the message now includes the exact settings to add, `"sandbox": {"enabled": true}`, and points at the `/sandbox` command to check the current state. **Evidence** `refused: sandboxing is not enabled on this device. Set "sandbox": {"enabled": true} in Claude Code settings on the device (check with /sandbox) and retry.` - Area: Sandbox - Names: `/sandbox`, `"sandbox": {"enabled": true}` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Bundled clipboard fallback for Linux On Linux, copy and paste now work even without wl-copy, xclip or xsel installed. **What** A native clipboard component is now built into the binary. On Linux, if none of `wl-copy`, `xclip` or `xsel` is installed but `DISPLAY` or `WAYLAND_DISPLAY` is set, copy and paste now fall back to this built-in component instead of failing. **Details** - It joins the already-embedded image and audio components, with on-disk copies available for x64 Linux. - Selected only after the three external tools are probed and none is found. - If a write through the built-in component fails once, that failure is remembered and the component is not chosen again for the rest of the session. **Evidence** `setLinuxClipboardText` - Area: Linux - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Deleting a background job keeps a directory a live session is sitting in Deleting a background job won't delete a directory another live session is using. **What** Job deletion now reports an "occupied" outcome instead of removing the worktree when it is the working directory of a live process. The message distinguishes a session you backgrounded from this window, a background session with a job id, and a bare process id and kind. **Evidence** `deleteJob: ${c} is the working directory of a live session (pid ${m.pid}, ${m.kind})` - Area: Background Jobs - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Headless mode reports fatal errors instead of dying quietly Headless runs now print a real reason to stderr and exit 1 instead of dying silently. **What** Failures writing to the output stream, and rejections from a headless run, no longer end the process silently. Claude now prints a truncated human-readable reason to stderr, emits it as a stream-json message where applicable, and exits with code 1. **Details** - A `tengu_headless_fatal_error` event records where the failure happened, the message type, the control subtype, how many messages had been drained, how many stdout bytes were still outstanding, and whether stdout had already been destroyed. - Applies to every headless (`-p`) run, no flag required. **Evidence** `tengu_headless_fatal_error` - Area: Headless Mode - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Headless write failures produce a result object, not silence Headless output write failures now produce a proper failed result object in stream-json. **What** If a message cannot be written to the headless output stream, Claude now writes an `Error:` line to stderr, marks the turn's summary as failed, and in stream-json mode emits a `result` object with an `error_during_execution` subtype built by a shared helper. **Details** - The stderr line begins `Could not write a message to the output stream`. - Paired with a `tengu_headless_fatal_error` event carrying the site, message type, control subtype, drained message count, outstanding stdout bytes and whether stdout was destroyed. - None of this existed in v2.1.226. **Evidence** `Could not write a message to the output stream` - Area: Headless Mode - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Long tool results are shortened in the normal view Long tool results are trimmed on screen outside verbose mode; Claude still sees everything. **What** Outside verbose mode, an over-long tool result is now cut short and followed by a note that the full text still went to the model. Nothing is hidden from Claude, only from your screen. **Details** - Results carrying a known prefix marker are truncated at that marker. - The appended note reads `(content shown to the model; elided here)`. - Verbose mode still shows the whole result. **Evidence** `(content shown to the model; elided here)` - Area: CLI UX - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### A new storage backend is being wired through the whole CLI Plugins, MCP, settings, themes and dozens of screens now accept the new storage handle nobody supplies. **What** An optional alternative storage handle, referred to internally as storage v5, is now passed into plugin install and marketplace code, MCP server commands, settings writes, session and history reads, daemon and terminal bookkeeping, theme writes, task registries and dozens of UI components. Mentions went from 37 to 689. Every call site still falls back to reading and writing files directly when no handle is supplied, and nothing in the source shows what decides whether a run gets one. **Details** - Writes pass a durability hint, either `followAtomic` or `inPlace`. - Because of the fallbacks, behaviour with no handle is identical to the previous build. **Evidence** `publishDiscipline` - Area: Storage Backend - Tier: Not switched on - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### A new storage backend is wired through nearly everything, but never built The new storage layer now touches nearly every part of the product but is never actually created. **What** An optional storage handle now threads through session and transcript loading, MCP reconnect, plugin loading, daemon and background jobs, team files, scheduled tasks, memory directories and agent sidecars: mentions grow from 37 in v2.1.226 to 689 here. Every call site branches on whether the handle exists and otherwise takes the existing filesystem path. The only factory that would create one returns nothing regardless of its `tengu_hover_rest` gate, which itself falls back to off, so behaviour is unchanged everywhere. **Details** - Call sites choose between a "v5" arm and the existing "raw" arm. - There is a diagnostic for the case where two callers disagree about which backend a shared plugin load uses: "joining a plugin load that an earlier caller started without the storage backend (tengu_hover_rest); this caller's backend is not used for it". - This release ships the plumbing only. **Evidence** `dt(nui, { tryCreateV5Backend: () => dSf, pinStorageV5: () => RBe });`, `joining a plugin load that an earlier caller started without the storage backend (tengu_hover_rest); this caller's backend is not used for it` - Flag `tengu_hover_rest`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Storage Backend - Tier: Not switched on - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### A new storage backend is wired through the product but returns nothing A new storage layer is plumbed everywhere but builds nothing, so files are still read directly. **What** An optional storage handle, a namespaced key/value store used in place of direct file reads and writes, is now passed explicitly into settings loading, plugin and marketplace commands, MCP task restore, background and fleet jobs, teammate mailboxes, the LSP manager, transcript reads, migrations, the REPL and most dialogs. Nothing changes on this build: it is built only when the `tengu_hover_rest` flag is on (default off), and the factory returns nothing even then, so every call site falls back to the existing filesystem path. **Details** - References to the handle grow from 37 to 693 across the bundle, replacing many module-level globals and ambient lookups. - Keys look like `{ namespace: "jobsRoot", draftKey: ... }`, with namespaces including `state`, `daemon`, `mailbox`, `sidecar` and `fileHistory`. - Code paths now branch on the handle, for example writing a job draft through the store rather than creating a directory and a file. - The CLI builds the handle once at startup and wraps subcommand handlers so they receive it. **Evidence** `storageV5`, `pinStorageV5` - Flag `tengu_hover_rest`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Storage Backend - Tier: Not switched on - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### Gateway config accepts per-upstream pricing overrides Gateway config takes a pricing block with a multiplier and per-model rate overrides. **What** Gateway configuration gains a `pricing` block with a `multiplier` (greater than 0, at most 1) and an `overrides` array of `{upstream, model, input, output, cache_read, cache_write}`, applied by the spend meter. **Details** - Validation warns when `pricing` is set without an `admin:` block, since only the spend meter reads pricing and it only runs when admin is configured. - It also warns when an override names an unknown upstream, duplicates an earlier override, or can never apply to any model that could be requested. **Evidence** `only the spend meter reads pricing, and it only runs when admin is configured` - Area: Gateway - Names: `pricing`, `multiplier`, `overrides` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Proxy config accepts pricing multipliers and per-model rate overrides Proxy config takes an optional pricing block with a multiplier and per-model rate overrides. **What** The proxy configuration file now takes an optional `pricing` block. It holds a `multiplier` that must be greater than 0 and at most 1, defaulting to 1, plus a list of per-upstream, per-model overrides for `input`, `output`, `cache_read` and `cache_write` rates. The block is absent by default, so pricing is unchanged unless you add it. **Details** - The multiplier is coerced to a number, so a string value in the config file is accepted. **Evidence** `multiplier: Ne.coerce.number().gt(0).lte(1).default(1)` - Area: Proxy - Names: `pricing`, `multiplier` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Remote model list no longer overrides the simple system prompt Which models get the simple system prompt is now decided locally, not by remote config. **What** The `tengu_velvet_cascade` remote config, a JSON object listing models that should use the simple system prompt, is gone from the build. The choice now rests on the per-model capability entry, the `CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT` environment variable, and the existing `tengu_velvet_tide` escape hatch. **Evidence** `tengu_velvet_cascade` - Flag `tengu_velvet_cascade`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Flag `tengu_velvet_tide`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: System Prompt - Names: `CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Renderer repaint debugging behind an environment variable Set CLAUDE_CODE_DEBUG_REPAINTS to capture which components trigger terminal redraws. **What** The terminal renderer reads `CLAUDE_CODE_DEBUG_REPAINTS` and only captures per-component debug ownership information when it is set, so normal sessions skip that work. Layout caches also moved onto the nodes themselves. **Details** - Root render nodes are now created with an explicit layout engine config. - New per-node fields `cachedLayout`, `pendingClears` and `scrollCommitStartedAt` replace a separate side map. **Evidence** `CLAUDE_CODE_DEBUG_REPAINTS` - Area: Terminal Rendering - Names: `CLAUDE_CODE_DEBUG_REPAINTS` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Renderer survives a dead stdout under the daemon background backend With the daemon background backend, the display survives stdout disappearing instead of dying. **What** Setting `CLAUDE_BG_BACKEND=daemon` now makes the terminal renderer tolerate stdout going away instead of treating it as fatal. **Details** - The terminal wrapper tracks whether tolerance is on and whether stdout has already died. - Separately, the warnings about garbage or absurd terminal dimensions moved from a once-per-process flag to a per-renderer callback, so a second renderer can still warn. **Evidence** `tolerateDeadStdout: re.CLAUDE_BG_BACKEND === "daemon"` - Area: Background Tasks - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Remote startup timing accepts numbers supplied by the runner On remote runs, startup timings can be supplied by the runner through an environment variable. **What** On remote runs, startup phase timing can merge a JSON blob from the `CCR_RUNNER_STARTUP_TIMING` environment variable into the reported figures, validating each field for type, range and pattern: names must be lowercase with underscores, and numbers and phase durations are capped. Prewarm, prefetch and delta-reset values from the environment are reported alongside. Nothing is reported unless `CLAUDE_CODE_REMOTE` is set. **Evidence** `CCR_RUNNER_STARTUP_TIMING` - Area: Sessions - Names: `CCR_RUNNER_STARTUP_TIMING`, `CLAUDE_CODE_REMOTE` - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### /memory tells you what happened when you switch shared project memory Switching shared project memory now reports exactly what happened and marks old results stale. **What** Choosing a shared project memory in /memory, or turning it off, now runs a full switch: it waits for the connection to settle under a deadline, then shows one of switched, connected, disconnected, unavailable, pending or unchanged. It also tells the model that any memory results it saw earlier are now stale, so it stops relying on them. **Details** - A pending switch reads "saved for this directory — still connecting; Claude can use it once it lands", so the choice is kept even when the connection has not landed yet. - New telemetry `tengu_org_memory_project_switch` records the outcome, how many memory stores existed before and after, and how many shared indexes loaded, came back empty, or were unavailable. **Evidence** `saved for this directory — still connecting; Claude can use it once it lands` - Area: Memory - Names: `/memory` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### `/mcp` explains servers changed in another session `/mcp` now explains servers that another session enabled or disabled behind your back. **What** `/mcp` now spells out cross-session cases that previously looked like bugs: a server re-enabled elsewhere so your disable did not stick, a server disabled elsewhere that needs a disable then re-enable in `/mcp` to reconnect, a server disabled elsewhere that is not configured here, and a server still running in this session that will not come back after restart. **Evidence** `enable then disable each in /mcp to make it stick` - Area: MCP - Names: `/mcp` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Bulk MCP reconnect and enable/disable report changes made in other sessions Bulk MCP reconnect and enable now summarise when another session changed servers behind you. **What** `/mcp reconnect all` and the enable/disable flows now add a single summary note when servers were changed from another running session, for example that N servers were re-enabled elsewhere so your disable did not stick. Previously only per-server versions of these sentences existed. **Details** - The note tells you to disable and re-enable in `/mcp`, or restart, to reconnect affected servers. **Evidence** `MCP server(s) were disabled in another session \u2014 disable and re-enable them in /mcp, or restart, to reconnect.` - Area: MCP - Names: `/mcp reconnect all` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Spawned agents can be clamped to a fixed set of shell commands Spawning an agent with a bad command clamp list now fails immediately instead of running unclamped. **What** The `agent()` spawn API gained a `bashCommandClamp` option: a list of `Bash(...)` permission rules that limits which shell commands the spawned agent may run. It is checked strictly at spawn time, so a malformed list, an entry that does not parse as a Bash rule, or one with empty or space-padded contents aborts the spawn instead of quietly running the agent with no clamp. **Details** - Entries take the form `Bash(<command or prefix>)`, matching the usual permission rule syntax. - Rejection message when the option is not a list of non-empty strings: `agent() opts.bashCommandClamp must be an array of non-empty strings; got `. - The option is now part of the serialized list of spawn options, alongside `disallowedTools`. **Usage** `agent("audit the build", { bashCommandClamp: ["Bash(npm test)", "Bash(git log:*)"] })` **Evidence** `agent() opts.bashCommandClamp must be an array of non-empty strings; got ` - Area: Subagents - Names: `bashCommandClamp` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Backspace recognised when the terminal reports code 8 Backspace now works in terminals that send the older backspace code. **What** Terminals that send BS (0x08) for the backspace key now register as backspace. Previously only code 127 was mapped, so those terminals produced an unrecognised key. **Evidence** `return "backspace";` - Area: Terminal Input - Tier: You'll notice - Useful: 4/5 - Signal: 1/5 ### Connection errors say what actually went wrong Connection errors now name the real problem: DNS, refused, unreachable, or a proxy tunnel failure. **What** "Unable to connect to API (CODE)" is replaced by distinct messages per socket, DNS and proxy error: dropped connections, refused connections with a firewall or proxy hint, unreachable hosts, no route to host, and failed proxy tunnels. Unrecognised codes still get the old generic wording. **Evidence** `check your connection or VPN (` - Area: Error Messages - Tier: You'll notice - Useful: 4/5 - Signal: 1/5 ### `claude gateway` now identifies itself as the gateway provider Running `claude gateway` now reports gateway as the provider regardless of credentials. **What** Running the `gateway` subcommand, which starts the enterprise auth and telemetry gateway, now makes Claude Code report "gateway" as its provider. Previously that only happened when gateway credentials were present. **Evidence** `gatewayServerProcess` - Area: Elsewhere - Names: `claude gateway` - Tier: Use it now - Useful: 2/5 - Signal: 2/5 ### Query profiling now needs an environment variable Query profiling only runs when you set CLAUDE_CODE_PROFILE_QUERY, so ordinary sessions skip it. **What** Timing marks, memory snapshots and the timeline dump only run when `CLAUDE_CODE_PROFILE_QUERY` is set, so ordinary sessions no longer collect them. **Details** - Marks and memory snapshots are cleared at the start of each query. - The ASCII bars in the dump are built with a repeat helper. **Usage** `CLAUDE_CODE_PROFILE_QUERY=1 claude` **Evidence** `CLAUDE_CODE_PROFILE_QUERY` - Area: Performance - Names: `CLAUDE_CODE_PROFILE_QUERY` - Tier: Use it now - Useful: 2/5 - Signal: 2/5 ### Slash commands can restrict subcommands to bare invocations Custom commands can mark subcommands bare-only, so extra words go to the parent command. **What** Command definitions gained a `subcommandsBareOnly` field. When it is set, a subcommand name only matches if nothing follows it, so typing `/foo bar baz` runs the parent `/foo` command with `bar baz` as its arguments instead of dispatching to the `bar` subcommand. **Details** - Carried through both prompt-backed and file-backed command construction, and added to the allow-list used when commands are serialized. - Dispatch bails out on trailing text: `if (e.subcommandsBareOnly && s !== "") return;`. - The field did not exist in v2.1.226. **Evidence** `if (e.subcommandsBareOnly && s !== "") return;`, `subcommandsBareOnly` - Area: Slash Commands - Names: `subcommandsBareOnly` - Tier: Use it now - Useful: 2/5 - Signal: 2/5 ### /mcp reconnect reports every reason at once `/mcp reconnect all` now lists every reason servers failed in one message instead of stopping early. **What** `/mcp reconnect all` no longer stops at the first thing it finds. It now combines the count of disabled servers, servers that are not connected and servers that are not configured into a single message. `/mcp enable all` reports the same not-connected summary. **Details** - The not-configured wording lost its trailing "The rest are already connected or connecting." in the combined message. **Evidence** `MCP server(s) aren't configured yet, so there's nothing to reconnect.` - Area: MCP - Names: `/mcp reconnect all`, `/mcp enable all` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### `ultrareview --post` says plainly when nothing was posted `ultrareview --post` now states outright when no comment was posted to the pull request. **What** When the review fails to poll or the remote returns an error, the CLI now states outright that no comment was made on the pull request, including when a `--post` run ends that way. **Evidence** `Nothing was posted to the pull request: the review failed, so there are no findings to post.` - Area: Code Review - Names: `--post` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ## New Features ### Watching an artifact from a remote session now wakes it instead of streaming In remote sessions, watching an artifact wakes you on publish instead of streaming live updates. **What** With `CLAUDE_CODE_REMOTE` set, the artifact `watch` action no longer opens a live-update connection. It registers a durable wake so the session is woken with a new turn the next time the artifact is published, and nothing is streamed in the meantime, so the artifact has to be re-read on wake. **Details** - The `status` action lists these subscriptions under a `durable_wake` entry with the trigger id and the time it has been watching from. - Failures name the cause: a ceiling of 10 wake triggers, client egress policy, or missing credentials. **Evidence** `Durable wake subscription registered — this session will be woken by a new turn when the artifact is next published. No updates are streamed; re-read the artifact on wake.` - Area: Artifacts - Names: `CLAUDE_CODE_REMOTE` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Cloud sessions explain why they are not bound to your machine When a cloud session cannot bind to your machine, you now get a plain reason why. **What** When a newly created cloud session cannot be tied to the local device, which is what turns off local tools, Claude Code now prints a plain reason instead of leaving it unexplained. Covered cases are device registration failure, hitting the device limit, clock skew, not being logged in, the feature being off server-side, and the server silently dropping the binding. **Evidence** `Not bound to this machine (local tools off): ` - Area: Cloud Sessions - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Remote sessions can adopt the host's auto-compact settings Remote sessions now use the host's auto-compact settings for context and token display. **What** A session running over the SDK or bridge can now be told the host's auto-compact configuration (whether it is on, the effective context window, the threshold, and whether it is enforced) and will use it for its own token-usage and context display, instead of guessing from local settings. A seed value can also arrive at session start. **Details** - Carried as a new control frame type `autocompact_state`, stored in app state as `remoteAutocompactState`. - Successful adoption is reported as `tengu_remote_autocompact_state_adopted`, including `enabled`, `enforced`, `source` and `via`. - Frames that do not parse are dropped once, with the log line "[sdkMessageAdapter] Dropping malformed autocompact_state frame" and an `invalid_frame` error report. - The session state object gained `onAutocompactInputsChanged` and `onConversationReset` callbacks, which fire when the compaction window, model or settings change. **Evidence** `tengu_remote_autocompact_state_adopted`, `[sdkMessageAdapter] Dropping malformed autocompact_state frame` - Area: Compaction - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Posting /ultrareview findings to a pull request can now be turned off remotely A server switch can remove the post-to-PR option from ultrareview; it defaults to available. **What** A remote switch controls whether `/ultrareview` hands its findings to claude.ai to post on a pull request. When it is off, the post-to-PR option disappears from the review confirmation prompt and Claude Code says: "Posting to the pull request is currently turned off, so nothing went to the PR. The findings are above if you want to post them by hand." The in-source fallback is on, so unless remote config says otherwise posting stays available. **Details** - The gate is `tengu_ultrareview_post_enabled`, evaluated with a fallback of true; nothing in the build sets it locally, so the real value comes from remote config. - The same check gates both the posting call path and the confirmation UI option, so a disabled state cannot be reached by accident. - Neither the gate nor its telemetry existed in v2.1.226. **Evidence** `tengu_ultrareview_post_enabled` - Flag `tengu_ultrareview_post_enabled`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Code Review - Names: `/ultrareview` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Command clamps deny rather than fall open If a clamped agent's permission check crashes, the shell command is denied rather than allowed. **What** If the permission check for a clamped agent throws, the Bash call is denied, not run, with the reason "bashCommandClamp fail-closed: permission check crashed". Shell surfaces the clamp cannot inspect, including PowerShell, are denied outright with a message telling the model to use the clamped Bash forms instead. **Details** - Each denial emits a `tengu_bash_command_clamp_denied` event carrying the number of clamp groups in force. **Evidence** `tengu_bash_command_clamp_denied` - Area: Subagents - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Republishing a stale artifact can now pull in the current version for you Publishing over a stale artifact now fetches the current version so Claude can merge and retry. **What** Previously a publish was refused when your session had not seen the latest version of a page you were about to overwrite. Claude can now fetch the live page itself, count it as viewed, and hand it back inline with instructions to merge your changes and republish. It applies only to pages you own that nobody else is co-writing, and only under a size cap and a read timeout. **Details** - Controlled by `tengu_cobalt_plinth_moss`, which falls back to on when no remote value is present. - A successful auto-read raises `stale_version_guard_seeded`; the page is returned in full for you to merge. - Refusals are logged under `artifact_guard_autoread` with a reason: `gate_off`, `over_cap`, `read_timeout` or `sibling_in_flight`. - Pages containing control bytes are rejected rather than read. **Evidence** `artifact_guard_autoread` - Flag `tengu_cobalt_plinth_moss`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### apiKeyHelper output is validated before it is sent Your apiKeyHelper output is now checked for junk characters and length before being used. **What** If you use an `apiKeyHelper` script to supply your API key, its output is now checked for characters that cannot appear in a key and for a maximum length. Bad output makes Claude Code stop with an error telling you the script must print only the key. Previously any non-empty output was sent as-is. **Details** - The rejection message is "apiKeyHelper output rejected: not a printable-ASCII token". - Failure throws rather than falling back to an unauthenticated request, so a script that prints logs or a prompt alongside the key now fails loudly instead of causing a confusing auth error. **Evidence** `apiKeyHelper output rejected: not a printable-ASCII token` - Area: Auth - Names: `apiKeyHelper` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Conflicting files are saved as a dated "conflicted copy" rather than overwritten Sync conflicts save the incoming file as a dated "conflicted copy" and leave yours alone. **What** When a file arriving from the other side differs from one you changed locally, the sync writes the incoming content to a sibling file named with "Claude's conflicted copy" plus a YYYY-MM-DD date, leaving your version untouched. **Details** - If that name is taken it appends a counter, trying up to 100 candidates. - The base name is truncated so the final file name stays within 255 minus 32 bytes, and candidates that are invalid on Windows are rejected. - If no usable name is found the operation is reported as failed instead of clobbering the local file. - Applies only on remote worker sessions, under the same environment gate as the syncer. **Evidence** `Claude's conflicted copy` - Area: Remote Sync - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Sync work per turn is capped by time, path count, row count and file size Per-turn syncing is capped by time, path count and a 64 MiB file size limit. **What** The syncer enforces published limits so a turn cannot be delayed indefinitely by file transfer. The pre-turn pull is bounded by `WORKER_SYNC_BEFORE_TURN_CAP_MS` at 10000 ms, dropping to `WORKER_SYNC_DEGRADED_CAP_MS` at 500 ms once the connection is degraded. Pushing looks at 4096 candidate paths per turn at most and refuses any file over 64 MiB, so very large files never sync. **Details** - Surplus paths beyond 4096 rotate across later turns rather than being dropped. - At most 40 new entries are admitted per turn against a 256-entry cap, with some of that cap held in reserve. - The published record of worker state is capped at 2 MiB, with at most 256 recorded entries and 256 recorded skips. - If a previous worker process still holds the sync, the apply step retries up to `MAX_APPLY_ATTEMPTS` (3) times with `APPLY_RESTART_DELAY_MS` (5000 ms) between attempts. **Evidence** `WORKER_SYNC_BEFORE_TURN_CAP_MS` - Area: Remote Sync - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Tip pointing Slack MCP users at Claude Tag If you use a Slack MCP server, a startup tip points you at the Slack app instead. **What** A new startup tip appears when the session has an MCP server whose name contains "slack" and the Slack app has never been installed: "Using a Slack MCP? With Claude Tag you can @Claude directly in Slack, run /install-slack-app or share claude.com/product/tag with your org owner". It has a cooldown of 10 sessions. **Details** - tip id is `install-slack-app-mcp` - suppressed once the Slack app has been installed **Evidence** `install-slack-app-mcp` - Area: MCP - Names: `/install-slack-app` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Sync stops itself after repeated auth refusals, repeated crashes, or a rehomed workspace Worker syncing shuts itself off after repeated auth failures, crashes or a moved workspace. **What** Rather than retrying forever, the worker syncer turns itself off on three conditions and the session continues without syncing. **Details** - `MAX_CONSECUTIVE_AUTH_REFUSALS` (10) consecutive auth refusals, or a single response saying the session is refused, disarms it with a `dir_sync_worker_session_refused` warning. - `MAX_CONSECUTIVE_PHASE_CRASHES` (3) unexpected exceptions in a pull or push phase also disarms it; each crash logs `dir_sync_worker_phase_crashed` with the error name, error code and consecutive count. - If a resumed worker finds itself pointed at a workspace that already has a non-empty published record from someone else, it logs `dir_sync_worker_rehomed_disarmed` and stops rather than merging the two. **Evidence** `dir_sync_worker_rehomed_disarmed` - Area: Remote Sync - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Worker sync state is stored in a `.ccr-dir-sync` folder beside the repo Sync state lives in a `.ccr-dir-sync` folder beside your repo so restarts resume quickly. **What** The syncer saves what it has already agreed with the laptop into a JSON file under a `.ccr-dir-sync` directory next to the repository root, named after the remote session id, so a restarted worker resumes instead of re-scanning everything. **Details** - Written with restrictive permissions: file mode 0600, directory mode 0700. - Refuses to write if the state exceeds 64 MiB or if the file lists exceed what the reader will accept, logging "sync base too large to store". - Permanently gives up persisting after permission or read-only filesystem errors (EACCES, EPERM, EROFS), logging `dir_sync_worker_persist_failed`; syncing continues without a saved state. **Evidence** `.ccr-dir-sync` - Area: Remote Sync - Names: `.ccr-dir-sync` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### `claude rm` tells you which session is holding a directory When `claude rm` is blocked, it names the session holding the directory and how to stop it. **What** When removal fails because a directory is still in use, the error now names the cause and tells you to exit the Claude Code session using it, or run `claude stop <id>` if it is a background session, then retry. **Details** - Adds an "occupied" failure case alongside the existing removal errors, with the blocking session shown above the hint. **Evidence** `exit the Claude Code session using that directory (shown above; or 'claude stop <id>' if it is a background session), then run 'claude rm ` - Area: CLI - Names: `claude rm`, `claude stop` - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### History search shows results as it finds them Prompt history search shows matches as it scans instead of making you wait. **What** The prompt history picker no longer blocks until the whole scan finishes. It shows partial matches while scanning, and if the search hits its byte budget it stops and marks the results truncated. An empty list mid-scan reads "Searching older prompts…" rather than "No matching prompts". **Details** - Three statuses: scanning while walking history, truncated when the byte budget is reached, complete when the scan finishes. - A scan that fails partway keeps whatever it had already collected instead of discarding it. **Evidence** `Searching older prompts…` - Area: History Search - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Forked sessions inherit the parent's task list Forking a session now carries the parent's task list over instead of starting empty. **What** Forking a session now copies the parent's task entries and its high-water mark into the fork, so the new session starts with the same task list instead of an empty one. **Details** - each entry is written with an if-absent precondition, so an existing entry in the fork is not overwritten - a bounded number of copies run concurrently, and copying stops at a cap with "[tasks] carry to fork stopped at the cap" - an individual failure logs "[tasks] carry to fork skipped" and does not abort the rest - runs only on the newer key/value storage path; when no such backend is attached to the session, the copy is not reached **Evidence** `[tasks] carry to fork stopped at the cap` - Area: Sessions - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Task list watcher no longer dies on error, and says when the lock is busy The task list watcher survives errors and tells you when auto-hiding is blocked by a lock. **What** The file watcher behind the task list now catches errors instead of silently stopping, logging "Task list watcher error" at warn level and rearming a refresh. When auto-hiding completed tasks cannot take the lock, it now says so plainly rather than appearing to do nothing. **Details** - lock contention message: "Task list lock is busy (another session or process sharing this task list, or an in-flight task write, holds it); completed tasks stay visible and the reset is retried on the next refresh" - a second hide will not be armed while one is in flight: "Task list reset still in flight; not arming another hide until it settles" - the reset is retried on the next refresh rather than abandoned **Evidence** `Task list lock is busy (another session or process sharing this task list, or an in-flight task write, holds it); completed tasks stay visible and the reset is retried on the next refresh` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Forks keep the parent's suppressed history Forking a session with suppressed history keeps that suppression instead of restoring it. **What** When a session's transcript history was suppressed, forking it now records that suppression on the fork with reason "fork_inherit" rather than starting the fork with clean history. **Details** - a `precautionarySuppressionHeld` flag is carried across resume and fork so a held suppression is re-applied under the new session id **Evidence** `fork_inherit` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Files with Windows- and WSL-hostile names are skipped during sync Incoming files with names Windows or WSL cannot handle are skipped instead of breaking the sync. **What** Incoming file lists are now validated and filtered before anything is written, so names that cannot exist safely on Windows or WSL are dropped rather than causing failures mid-apply. **Details** - A malformed, oversized, wrong-side or wrong-version list is rejected outright (`oversize`, `unsupported_version`, `malformed`, `wrong_side`). - Paths that look like internal sync paths are dropped. - On Windows and WSL each path segment is cut at the first colon and stripped of trailing dots and spaces, then rejected if it matches an old-style 8.3 short name pattern. - Dropped paths are counted separately and reported as filtered files in the sync telemetry. - Conflicted-copy naming separately rejects reserved Windows device names (con, prn, aux, nul, com, lpt). **Evidence** `unsupported_version` - Area: Remote Sync - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Spinner tip about duplicating an artifact A spinner tip tells you artifacts have a Duplicate action for your own editable copy. **What** A new tip appears in the rotation next to the spinner, telling you that an artifact's title menu has a Duplicate action that gives you your own editable copy. It shows at most 5 times in total, with a 5-session gap between showings, and only when spinner tips are turned on via the `spinnerTipsEnabled` setting. **Details** - Tip id `artifact-duplicate`, priority 3. - The existing artifact publish-plan tip now also consults a shared suppression list, so the two do not crowd each other. **Evidence** `See an artifact you'd like to build on? Duplicate, in its title menu, gives you your own editable copy.` - Area: Artifacts - Names: `spinnerTipsEnabled` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ## Improvements ### Subagent handoff review now reads the subagent's answer The auto-mode safety check now reads what a subagent actually said before handing results back. **What** In auto permission mode, the safety check that runs when a subagent finishes is now given the subagent's final answer text, and runs even in cases where the conversation transcript alone would not have triggered it. **Details** - The check returns one of four verdicts: refused, unavailable, blocked, or allowed. - If the check itself throws it is turned into an "unavailable" warning rather than failing the call, unless the turn was aborted. **Evidence** `finalResultText` - Area: Subagents - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Skills sync now refuses damaged or hostile skill packages Skill syncing now rejects broken or repo-shaped skill archives and repairs a symlinked skills folder. **What** The background sync that installs skills was reworked to survive bad downloads and crashed runs. A downloaded skill archive is rejected if it has no usable `SKILL.md` or if it looks like a git repository, and if the folder skills sync into turns out to be a symlink it is deleted and recreated. **Details** - New log entries: `skills_sync_extracted_zip_unusable` for a rejected archive, `skills_sync_root_symlink_removed` for the symlinked root, and a hard error "synced skills root is not a directory" if it cannot be made one. - Directories that cannot be deleted are moved to a trash directory instead of blocking the sync. - The record of installed skills gained lists of stale directories and pending claims; a claim carries the owning process id and its start time, so a half-installed directory left by a crashed run is reclaimed by the next one. - An older record layout is migrated or repaired at startup, logged as `skills_sync_legacy_layout_migrated` and `skills_sync_legacy_manifest_repaired`. **Evidence** `skills_sync_extracted_zip_unusable` - Area: Skills - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### agent() refuses spawns whose tool restrictions cannot be applied Spawning a sub-agent fails outright if its disallowed-tools list can't actually be applied. **What** When a workflow spawns a sub-agent, every entry in its `disallowedTools` list is now checked against the tools that agent would actually get. Anything that cannot be matched aborts the spawn with an explanation instead of quietly running the agent with the restriction dropped. Entries that parse fine but match nothing log a "no-op here" warning and the spawn continues. **Details** - rejected: a stray space before rule parentheses, unbalanced parentheses, an empty server name in an `mcp__` entry, wildcards inside an MCP server or tool name, and `*` used outside an `mcp__` spec - also rejected: entries that are not non-empty, non-whitespace-padded strings, and `bashCommandClamp` entries that do not parse as a Bash permission rule with real content - case-mismatched or misspelled MCP entries are caught by a new analyser that classifies each entry as a declared server, a server present in the pool, a near-miss with a suggested correct spelling, or unmatched **Evidence** `agent() opts.disallowedTools unparseable entry`, `Refusing the spawn rather than running it un-narrowed.` - Area: Subagents - Names: `disallowedTools` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### agent() refuses spawns where the Bash command clamp would not bite Sub-agent spawns are refused when the Bash command restriction couldn't be enforced. **What** Two new checks on sub-agent spawns. If the host has remapped Bash or the related exec tools to different names, the clamp cannot be guaranteed on that path and the spawn is refused. If the spawned agent's tool set contains no Bash at all, the spawn is refused rather than running an agent whose clamp does nothing. **Details** - a third guard refuses schema-mode spawns whose combined disallow list denies the StructuredOutput tool, which that mode needs **Evidence** `agent() bashCommandClamp under a shell toolAlias` - Area: Subagents - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Workshop pages are now authored as HTML Workshop pages are always written as HTML now, even if you ask for markdown. **What** The workshop skill no longer picks between HTML and markdown per document. Every workshop is written as a `*.workshop.html` page. The markdown lane survives only for a document that the session's own plan-mode instructions already designated as `*.workshop.md`. If you ask for markdown, Claude will say the workshop page is authored as HTML and use an `.html` path instead. **Evidence** `say the workshop page is authored as HTML` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### PowerShell is denied for agents with a shell command clamp Agents with a shell command restriction can't use PowerShell at all now. **What** An agent spawned with a clamp restricting which shell commands it may run now has PowerShell refused outright, since PowerShell commands cannot be matched against Bash command forms. If the PowerShell permission check itself throws, it fails closed instead of running an unverified command. Agents without a clamp are unaffected. **Evidence** `this agent carries a per-spawn bashCommandClamp, which scopes shell execution to a ` - Area: Permissions - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Auto-reply notices ask the model to close out the thread Artifact auto-replies now always post a short summary and resolve the comment thread. **What** Every artifact auto-reply notice, including the hourly cap, notify-only, no-op edit, failed edit, and plain acknowledgement, now ends with a shared instruction to post a brief reply saying what was done and resolve the thread, with a separate wording for threads already marked resolved. **Evidence** `Once you have acted on the thread, post a brief reply saying what you did (if you have not already); the thread stays resolved.` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Shell-first guidance now also applies in bypass permissions mode Bypass permissions mode now gets the same shell-first behaviour auto mode already had. **What** The instruction telling Claude to do its work through the shell tool rather than the separate read, edit and write tools was previously added only in auto mode. It now has a bypass permissions branch too, so sessions in that mode get the same behaviour. **Evidence** `While bypass permissions mode is active:` - Area: Permissions - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Clamped agents are blocked on every execution surface Command-restricted agents are now blocked on PowerShell and the Monitor tool too, and fail closed. **What** An agent restricted to a specific set of allowed shell commands is now denied when it tries to run through PowerShell or the Monitor tool's websocket mode, not just Bash. A crash inside the permission check now denies for those agents rather than letting the command through. **Details** - Denials carry a dedicated reason, e.g. "bashCommandClamp: no clamp rule matches this command". - Bash denials emit a `tengu_bash_command_clamp_denied` event. - The permission check now fails closed for clamped agents; previously an error in the check could result in execution proceeding. **Evidence** `bashCommandClamp: no clamp rule matches this command` - Area: Permissions - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Auto-mode guidance reminders now also appear in bypassPermissions Bypass permissions mode now gets the same guidance reminders auto mode gets. **What** The reminder that guides Claude in auto mode previously only fired when the permission mode was `auto`. It now also fires in `bypassPermissions`. **Details** - Emitted with `bypass: !0` and treated as steer-only in that mode. - The consent flow is skipped there: `autoModeConsentFlow: !n && ...`. **Evidence** `autoModeConsentFlow: !n && J2o(t),` - Area: Permissions - Names: `bypassPermissions` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Sessions resumed under a different account start clean A background session left by another account is dropped rather than reattached under yours. **What** If a background session was left by one account and Claude Code starts under different credentials, the old session is dropped and a fresh one started with history upload suppressed, rather than being reattached to the wrong account. **Details** - Applies when the stored owner account does not match the current one, and when the stored identity cannot be read at all. - In the mode that must reattach or fail, this raises a terminal error instead of minting a new session. - Outcomes are counted under `rc_cross_account_suppression` with reasons including `torn_entry_pair` and `identity_unreadable`. **Evidence** `rc_cross_account_suppression` - Area: Sessions - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### More accounts qualify for memory sync More accounts now qualify for memory sync through an extra OAuth-scope path. **What** The check that decides whether memory sync is available gained an extra way to qualify: an account on a first-party base URL with the right OAuth scopes now passes even if the previous conditions do not. **Details** - Still requires the `allow_memory_sync` compliance permission, which is denied under HIPAA and zero-data-retention modes. - The added branch is one of three alternatives; exactly which accounts the third branch admits is not fully determined by the code. **Evidence** `allow_memory_sync` - Area: Memory - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Scheduling surfaces now also require the allow_routines policy Scheduling now requires the allow_routines policy as well as remote sessions. **What** The cloud and scheduling prompts and the schedule command previously checked only the `allow_remote_sessions` policy setting. They now also check `allow_routines`, so an organisation that permits remote sessions but not routines will no longer be offered scheduling or given the tool. **Details** - the `tengu_surreal_dali` flag, off unless the server enables it, still gates all of this on top of both policy settings **Evidence** `allow_routines` - Flag `tengu_surreal_dali`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Enterprise Settings - Names: `allow_routines`, `allow_remote_sessions` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Remote session event stream now sends the trusted-device token The live event stream for remote sessions now sends your trusted-device credential too. **What** The live event stream for remote sessions now attaches the same trusted-device credential other API calls already send, as an `X-Trusted-Device-Token` header. If the token cannot be loaded it logs and connects without it, as before. **Details** - The token is loaded once and reused for the life of the connection. **Evidence** `trusted-device token unavailable, sending no td-v1 header` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Tool-search beta header falls back when experimental betas are turned off Turning off experimental betas now falls back to the older tool-search beta header everywhere. **What** Sessions that disable experimental betas now send the older `tool-search-tool-2025-10-19` beta header instead of `advanced-tool-use-2025-11-20`. Previously the older header was used only on Vertex, Bedrock, Mantle and gateway providers. **Details** - Triggered by the `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` environment variable or by HIPAA compliance mode. - Provider-based selection of the older header is unchanged. **Evidence** `advanced-tool-use-2025-11-20` - Area: Tool Search - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Plugins can resolve from a cache-only seed cache Plugins can now resolve from a pre-populated seed cache when their source can't be fetched. **What** When a plugin's source cannot be fetched and seed marketplaces are configured, Claude Code now checks a pre-populated cache before declaring a miss, logging "Using seed cache for … (cache-only)". It consults that cache always, or only when the plugin version is unknown, depending on the case. **Evidence** `(cache-only)` - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Org memory project picker says whether the switch takes effect now The org memory project picker now says whether your switch applies now or next session. **What** Choosing a project for organization memory now tells you whether the change applies immediately or only from the next session, showing `connecting…` or `disconnecting…` while it reconnects in place. **Details** - The selection event `tengu_org_memory_project_selected` gained a `reconnects_now` field recording which of the two happened. **Evidence** `tengu_org_memory_project_selected` - Area: Memory - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Notebook reads and edits now refuse files over 100 MB Notebooks over 100 MB are refused for reads and edits, with a suggestion to slice them. **What** NotebookRead checks the file before opening it and refuses anything larger than 104857600 bytes, suggesting you slice it with jq or PowerShell instead. NotebookEdit refuses an edit that would push the notebook past the same limit and leaves the file untouched. **Details** - Non-regular files (devices, FIFOs, sockets) are rejected outright. - A structural check now rejects files that are not real notebooks: the top-level `cells` must be an array of cell objects each with a string or string-array `source`. **Evidence** `Notebook file is not a valid Jupyter notebook (top-level "cells" must be an array of cell objects, each with a string or string-array "source").` - Area: Notebooks - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Task tool is stricter about when to run an agent in the foreground Claude keeps subagents in the foreground only when the very next step needs their answer. **What** The guidance for launching a subagent used to say run it in the foreground whenever you need the result before proceeding. It now limits that to cases where the very next action depends on the result and nothing else could usefully happen in the meantime, and names fire-and-forget work and independent investigations as background cases. **Evidence** `Wanting the result "next" is not enough on its own.` - Area: Subagents - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### A held cross-session message that is dropped now says so You now get a warning when an approved cross-session message is refused instead of delivered. **What** If you approve a held message from another session but delivery is refused because cross-session messaging was turned off or set to refuse while the prompt was open, you now get an explicit warning that it was not delivered. Previously only a vanished message produced a notice. **Evidence** `That held message was NOT delivered: cross-session messaging was turned off (or set to refuse) while the prompt was open` - Area: Cross-Session Messaging - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Structured-output failures name model fallback as the cause Structured-output failures now tell you when a model fallback caused the retraction. **What** When a structured output is retracted because the request fell back to another model, the failure message now counts those retracted attempts separately, and there is a dedicated message for when no retry ever produced a valid result. **Evidence** `Structured output was retracted by a model fallback and no retry produced a valid result` - Area: Error Messages - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Review posting consent is now explained as one-shot Review comment consent is now clearly one session only, and names what gets posted. **What** When a review runs with comment posting armed, the session message now says that the permission applies only to that session, and if the run fails the message states plainly that nothing was posted and nothing will be. The confirmation screen also names the GitHub account that would author the comment and notes that the comment carries a "Generated by Claude Code" line. **Evidence** `Nothing was posted to the pull request, and nothing will be \u2014 the --post request ends with this run.` - Area: Code Review - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Task tool pushed harder toward background agents Expect more subagents to run in the background rather than blocking your turn. **What** The description of the Task tool's `run_in_background` option was rewritten to discourage waiting on agents. Foreground is now reserved for the case where the very next step depends on that agent's answer and nothing else useful could happen in the meantime, so expect more subagents to run in the background. **Evidence** `Set to false only when your very next action depends on this agent's result and nothing else could usefully happen while it runs` - Area: Subagents - Names: `run_in_background` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Review consent screen names the GitHub account it will post from The review consent screen now shows which GitHub account the comment posts from. **What** Before running a cloud review, the confirmation screen now explains that findings go to the PR as a single plain comment from your GitHub account, showing your login in parentheses when the server reports it. **Details** - The review preflight response gained a `github_login` field; the sentence is assembled at runtime around it, and omits the parenthetical when the login is unknown. **Evidence** `When it finishes, Claude can post the findings to the PR as a single comment from your GitHub account` - Area: Code Review - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Sandboxed sessions can reach three more config directories MCP skill archives and the discovery cache now work inside the sandbox. **What** The generated sandbox profile now grants access to `mcp-skill-archives`, `mcp-discovery-cache` and `shares` under the config home, so MCP skill archives and the MCP discovery cache work inside the sandbox. **Details** - Added alongside existing entries such as `loop.md` and `scheduled_tasks.json`. **Evidence** `for (let de of ["mcp-skill-archives", "mcp-discovery-cache", "shares"])` - Area: Sandbox - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Bash results say when a background command dies with its agent Bash results now flag a background command that dies when its subagent finishes. **What** A backgrounded command started by a synchronous subagent is now marked in the tool result, because it gets killed when that subagent gives its final response. The field is absent when the command outlives its starter, as in the main loop or an async subagent. **Evidence** `backgroundEndsWithFinalResponse` - Area: Bash Tool - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Blocked hosts in the sandbox can now explain why Sandbox-blocked hosts can now tell you the specific reason they were denied. **What** The generated sandbox network policy now includes a per-domain reason for each blocked host. The enforcement side already looked for these and fell back to a generic message, so blocked requests can now say something more specific than "host is on the deny list". **Evidence** `host is on the deny list` - Area: Sandbox - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Plugin sync rejects bare-repo layouts and retries directories it could not delete Plugin sync refuses bare-repo layouts, retries undeletable directories, and redownloads vanished plugins. **What** Plugin sync now skips any path component named `.git` during extraction and refuses a tree that looks like a bare git repository. Directories that could not be removed are recorded and retried on the next sync, and a previously synced plugin whose directory has disappeared is downloaded again. **Details** - Undeletable directories go into a new `staleDirs` list in the plugin manifest, so cleanup is retried rather than forgotten. - Removal of trashed directories is drained in a `finally` block, so a failure mid-sync no longer leaves the work half done. **Evidence** `extracted tree carries a bare-repo layout` - Area: Plugins - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Hook messages are labelled with the hook that produced them Hook output is now labelled with the hook's name on every line. **What** Output from a hook is now shown as a notice with the hook's name and `says: ` in front of every line, with line endings normalised and control characters stripped from both the name and the text. **Details** - Emitted as an informational system message at notice level. - Stripping applies to the hook name too, so a hook cannot smuggle escape sequences into the label. **Evidence** `says: ` - Area: Hooks - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Cloud review says why it did not post your review Cloud review now says why it skipped posting: not a GitHub PR, or posting disabled server-side. **What** When a cloud review is asked to post its result back, the launch message now explains a skip instead of leaving you guessing. One note covers targets that are not GitHub.com pull requests, another covers posting being switched off on the server. **Details** - Posting is attempted only when the scope is a pull request whose host is github.com. - Controlled by `tengu_ultrareview_post_enabled`, which defaults to on; when off, the "currently turned off" note is shown. - The result carries where it would post and whether posting was ignored; review telemetry gained the host and whether refs were present. **Evidence** `posting applies only to GitHub.com pull request reviews.` - Flag `tengu_ultrareview_post_enabled`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Code Review - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### SendUserFile guidance now asks for deliverables as they are produced Claude now sends you files as it produces them, not just the final deliverable. **What** The tool description that tells Claude when to send you a file was rewritten. It previously fired only when the file was the deliverable; it now covers any file you would want to see, sent as it is produced rather than batched at the end. **Details** - explicitly warns off routine working files: "scratch files, debug output, partial fragments, or every incremental save" - also warns against re-sending a file that has not meaningfully changed since the last send **Evidence** `Send deliverables as they are produced, not batched at the end of the task` - Area: File Delivery - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Bash results say when a backgrounded command dies with its subagent Bash results flag a backgrounded command that gets killed when its subagent replies. **What** A backgrounded Bash command started by a synchronous subagent is killed when that agent gives its final response, and the tool result now carries a flag saying so. The flag is absent when the command survives, as it does in the main loop and in async subagents. **Details** - The background notice text is now generated by one shared builder used by both the tool and its renderer. **Evidence** `True when this backgrounded command is owned by a synchronous subagent and is therefore terminated when that agent gives its final response; absent when the command survives (main loop, async subagents)` - Area: Bash Tool - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Working-directory sync will not write into an ignored path Working-directory sync refuses to copy files into paths your ignore rules exclude. **What** When copying files into the synced working directory, Claude now checks the destination and every parent directory it would create against your ignore rules, and fails with the error code `WORKING_DEST_IGNORED` rather than writing there. **Details** - Sits alongside the existing checks for escaping the parent directory and for symlinked destinations. **Evidence** `dest ancestor resolves into an ignored path` - Area: Cloud Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Stricter checks on skill folder names Skill folder names get two extra safety checks before loading. **What** Skills loaded from `~/.claude/skills/` and the other skill directories now have two more checks applied to the first part of their path, on top of the existing rejection of `..`, glob characters, backslashes and `.claude` segments. **Evidence** `~/.claude/skills/` - Area: Skills - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Self-hosted runner setup now points at the Cloud environments admin page Self-hosted runner setup now sends you to Admin settings, Cloud environments. **What** The guided setup for running Claude Code sessions on your own machines was rewritten for the new admin surface. It now sends operators to Admin settings, Cloud environments, rather than the Claude Code settings page. **Details** - Steps: turn on "Allow self-hosted environments", create the environment, copy the environment key, then read the Environment ID from the Configuration tab. - The tour of the interface was updated to match: the Activity tab now splits into Runners and Sessions views, keys are issued from Environment keys with "Issue new key", and diagnostic banners appear inside the environment view. - It warns that the older runner interface is still visible during the transition. **Evidence** `Allow self-hosted environments` - Area: Self-Hosted Runners - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Device-bound sessions reject `--project` and agent ownership up front Device-bound sessions now reject a project id or agent id immediately with a clear message. **What** Creating a device-bound session together with a project grouping id, or with an agent id, now fails immediately with a specific message and its own failure code rather than producing a half-formed session. **Evidence** `--project cannot be combined with a device-bound session yet \u2014 no session was created.` - Area: Sessions - Names: `--project` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Self-hosted runner troubleshooting steps follow the current admin navigation Self-hosted runner troubleshooting steps follow the current admin console navigation. **What** The runbook now routes through Admin settings, Cloud environments, self-hosted environments and the Activity tab instead of the old Keys and Queue tabs, and covers how a failed session is badged and retried. **Evidence** `Re-issue via **Issue new key** on the environment's Configuration tab` - Area: Self-Hosted Runners - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Long listings say when they were cut short Long listings now tell you when they were cut off instead of quietly stopping. **What** Two paged listings that used to stop quietly at an internal page limit now report it. Skills-directory loading returns "listing exceeded N pages" as a load failure alongside its other error codes, and event-log retry warns that it truncated and is retrying only the streams it managed to see. **Evidence** `1P event logging: previous-batch stream listing truncated at ${wI} pages; retrying the ${n.length} streams seen` - Area: Skills - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Launcher wrapper variable warns clearly when it cannot be used A bad process-wrapper variable now logs clearly, and on Windows warns it is ignored entirely. **What** The environment variable naming a process wrapper is now validated once and cached. If the value is unusable, an error-level log says sessions that require it will refuse to start rather than run unwrapped. On Windows it logs a warning that the value is ignored, because the launcher must exec into Claude Code, so sessions run unwrapped. **Details** - Only logged when the variable is set. **Evidence** `is set but ignored on Windows \u2014 the launcher must exec into Claude Code, which Windows can't do; sessions run unwrapped` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Resuming a conversation explains symlinked or unreadable transcripts Resuming explains when a transcript is a symlink or couldn't be read. **What** Two new refusals when opening a stored conversation. A transcript file that is a symbolic link or not a regular file is refused, with advice to resume from the directory holding the real file. A transcript that could not be read at that moment now says so rather than failing generically. **Evidence** `This conversation's file is a symbolic link or not a regular file, so it can't be opened from here` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Retry path for excluded self-hosted sessions updated The retry hint for excluded self-hosted sessions now matches the current admin console path. **What** The hint shown when a self-hosted cloud session is excluded now points at the current admin console navigation: Admin settings → Cloud environments → Self-hosted environments → (environment) → Activity tab → Sessions → (session) → Retry. **Evidence** `Admin settings \u2192 Cloud environments \u2192 Self-hosted environments \u2192 (environment) \u2192 Activity tab \u2192 Sessions \u2192 (session) \u2192 Retry` - Area: Self-Hosted Runners - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Memory screens now say CLAUDE.md and "instructions" /memory screens now say CLAUDE.md and "instructions" instead of "memory". **What** The /memory views dropped the word "memory". The not-loaded notice names CLAUDE.md files, the tree rows read "User instructions" and "Project instructions", the editor-failure message no longer says "memory file", and the loading placeholder is a plain "Loading…". **Evidence** `CLAUDE.md files aren't loaded into this session. You can still edit them \u2014 changes take effect after you` - Area: Memory - Names: `/memory` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Empty teammate messages are rejected up front Sending an empty message to a teammate now fails validation up front. **What** Sending a message to a teammate now fails validation with "message must not be empty" (error code 9) when the text is blank. The old rule requiring a summary alongside a string message was dropped. **Evidence** `message must not be empty` - Area: Cross-Session Messaging - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Self-hosted environment tools point at the new admin console Self-hosted environment tool help now points at the new admin console tabs. **What** The help text for the four self-hosted environment tools (pool overview, runners, queue and sessions, keys) now describes the Admin settings, Cloud environments path and names the Configuration and Activity tabs, replacing the old Settings, Claude Code breadcrumbs. **Evidence** `Cloud environments` - Area: Self-Hosted Runners - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Headline-only classification skips the model call Classification skips the model call when no summary is needed, saving tokens. **What** The classifier now picks the cheap built-in heuristic whenever the requested output does not include a summary or state, before it consults `CLAUDE_CODE_CLASSIFIER_SUMMARY`. Only surfaces that genuinely need a summary pay for a model-backed call. **Evidence** `CLAUDE_CODE_CLASSIFIER_SUMMARY` - Area: Performance - Names: `CLAUDE_CODE_CLASSIFIER_SUMMARY` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Synced plugin archives containing `.git` are re-extracted safely Org-synced plugin archives containing a `.git` entry are rejected and re-extracted safely. **What** When Claude Code unpacks a plugin delivered by org plugin sync, it now rejects any archive whose contents include an entry named `.git`, on top of the existing symlink and oversize checks. Rejected archives are unpacked again with the built-in extractor, which drops `.git` path segments entirely. **Details** - Any non-ok verdict, including the new `reserved` verdict for `.git`, logs `plugins_sync_unzip_fallback` with the reason before re-extracting. - Only affects the synced-plugins path (`CLAUDE_CODE_SYNC_PLUGINS` and org-synced plugins), not locally installed plugins. **Evidence** `plugins_sync_unzip_fallback` - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Plugin names starting with a dot, or matching the sync directory, are rejected Plugin names starting with a dot or matching the sync root are now rejected. **What** Plugin-name validation now rejects names beginning with `.` and names that fold to the reserved spelling used for the plugin sync root, with an explanation that such directories are never picked up as plugins. Previously only path separators were checked. **Details** - Backed by a new shared module of name-safety helpers covering reserved-name folding and Windows reserved device names. **Evidence** `those directories are never loaded as plugin adoptions` - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### More tools give a specific answer when a permission check fails Bash-family and Monitor tools now decide for themselves when a permission check fails. **What** The Bash-family tool and the Monitor tool now supply their own decision when a permission check throws or fails, instead of falling back to the generic handling. **Evidence** `permissionCheckFailureDecision` - Area: Permissions - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Devin Desktop falls back to Windsurf settings Devin Desktop now finds its settings, falling back to the Windsurf directory. **What** When resolving where an IDE keeps its user settings, "Devin Desktop" now looks for a Devin user directory and falls back to the Windsurf one if it does not exist, using AppData\Roaming on Windows, Library/Application Support on macOS and .config elsewhere. **Details** - Results are cached per editor and home directory. **Evidence** `Devin Desktop` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Cloud review explains a detached-HEAD checkout Cloud review now tells you to create a branch when your checkout has none. **What** If your checkout has no branches at all, cloud review now says so and tells you to create one with `git checkout -b <name>` before rerunning, instead of falling into the generic "no refs" message. **Evidence** `Your checkout has no branches (detached HEAD only), which cloud review can't bundle. Create one first \u2014 \`git checkout -b <name>\` \u2014 then rerun ` - Area: Code Review - Names: `git checkout -b` - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Clearer wording when a command moves to the background Backgrounded Bash commands now explain why they moved to the background and whether they'll be killed. **What** The message you get when a Bash command is backgrounded is now built in one place, with different wording depending on whether you asked for it, whether it hit the timeout, or whether it will be killed when Claude finishes its reply. **Details** - The last case warns explicitly that the process is terminated at the final response, so no completion notice can arrive after that. **Evidence** `If it exits while you are still working you will be notified, but it is terminated when you give your final response and no notification can follow that` - Area: Bash Tool - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Ctrl-C during a remote review explains what continues Ctrl-C during a remote review now tells you the review keeps running and whether a comment posts. **What** Interrupting while a remote review is still running now prints that the review keeps going and, if you asked for a pull request comment, that nothing will be posted. Interrupting after the findings have already arrived prints a different message warning that the comment may already be on its way. **Evidence** `Interrupted. The review already finished (findings above).` - Area: Code Review - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Auth failures now name the credential source Auth failures now name where the bad credential came from, like your custom headers. **What** When a request is rejected and the credentials came from headers rather than a plain API key, the error now names the actual source: `ANTHROPIC_CUSTOM_HEADERS`, an external auth token, or an external API key, with the server's own message appended after a middot. **Details** - Previously these fell through to the generic x-api-key wording, which pointed at a setting the user was not using. - Credentials from a managed key or from a claude.ai login are classified as an authentication failure instead. **Evidence** `Invalid ANTHROPIC_CUSTOM_HEADERS` - Area: Auth - Names: `ANTHROPIC_CUSTOM_HEADERS` - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### MCP connection timeouts are reported as timeouts A slow MCP server is now reported as a timeout rather than a vague connection failure. **What** An MCP server that fails to connect because it timed out is now labelled with its own `CONNECT_TIMEOUT` code instead of being lumped in with generic failures, so the `Connection failed` message tells you the server was too slow rather than unreachable or misconfigured. **Details** - A timeout from the MCP SDK during connect is reclassified to this code, which joins the existing set of MCP failure codes such as `ENDPOINT_NOT_FOUND` and `AUTH_HEADER_REJECTED`. - Emits `mcp_connect_failed` telemetry with `reason: "timeout"`. - Paired with `tengu_mcp_connect_timeout_retry`, which falls back to on; with no server value the timeout tagging is active. **Evidence** `CONNECT_TIMEOUT`, `Object.assign(t, { code: "CONNECT_TIMEOUT" })`, `mcp_connect_failed` - Flag `tengu_mcp_connect_timeout_retry`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: MCP - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Concurrent language server starts no longer double-spawn Language servers no longer get started twice when two things ask at once. **What** Starting a language server now waits for any start already in flight before beginning another, and a failed start is only recorded once, when it is still the current attempt. Two things asking for the same server at once no longer spawn it twice or log two failures. **Details** - The failure event is `lsp_server_start_failed`. - A failed start no longer always throws; it can be superseded by a newer attempt. **Evidence** `lsp_server_start_failed` - Area: Language Servers - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Toggling one MCP server refreshes only its skills Toggling one MCP server no longer wipes every other server's cached skills. **What** Enabling or disabling an MCP server now invalidates the skills cached for that server specifically, instead of clearing a shared cache. Other servers' skills stay warm. **Details** - Skill fetching remains behind the same MCP-skills check that previously guarded it, so nothing new is fetched where MCP skills are off. **Evidence** `invalidateMcpSkillsForServer` - Area: MCP - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Better wording for dropped connections and expired logins Sleep-dropped connections and expired logins now get their own clear messages. **What** A connection dropped because the machine slept now says so directly, and an expired Anthropic profile login is reported as its own error telling you to re-authenticate rather than surfacing as a generic failure. **Evidence** `Connection lost while your computer was asleep` - Area: Error Messages - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Worktree cleanup explains when a directory is still in use Worktree cleanup now tells you when a directory is in use by a live session. **What** Cleanup now gives a distinct reason when a worktree is the working directory of a live Claude Code session, instead of a generic skip. **Details** - The liveness checks around reading worktree state were folded into one helper that distinguishes missing, gone and unreadable. **Evidence** `is the working directory of a live Claude Code session` - Area: Worktrees - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Bad HTTP header values are rejected before the request instead of crashing Illegal header values from your env or key helper now fail clearly instead of crashing. **What** If a header value coming from `ANTHROPIC_CUSTOM_HEADERS`, an API key environment variable, or `apiKeyHelper` is not a legal HTTP header value, Claude Code now fails with a clear error before sending, classified as your mistake rather than an internal crash. **Details** - New `InvalidRequestHeaderValueError`, classified as `invalid_request_header` or `invalid_api_key` when the value is user-supplied. - Logged at error level rather than reported as a crash. - Treated as non-retryable during API key verification, so a malformed key value fails immediately. - The error class does not exist in v2.1.226. **Evidence** `request header value rejected before send: not a valid HTTP header value` - Area: Auth - Names: `ANTHROPIC_CUSTOM_HEADERS`, `apiKeyHelper` - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Exit dialog option relabelled The exit dialog now says "Exit and stop tasks" so you know background work dies. **What** The exit confirmation choice that read "Exit anyway" now reads "Exit and stop tasks", making it clear that background work is terminated. The underlying value is unchanged. **Evidence** `Exit and stop tasks` - Area: CLI UX - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Less eager module loading at startup Startup is faster because fewer modules load before the first screen appears. **What** Startup touches fewer modules before the first render. Long runs of eager sub-module initialization were removed from several bundles, and one skill now loads its markdown through a deferred import rather than a pre-bound loader. **Evidence** `startBackgroundHousekeeping` - Area: Performance - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Expired saved logins now say so instead of failing generically Expired saved logins now tell you to sign in again instead of a generic auth error. **What** When the stored Anthropic credentials have expired and there is no refresh token to renew them, tools now report "Anthropic profile login expired" with a prompt to sign in again, rather than a generic auth error. **Details** - Triggered by auth errors whose message contains "has expired and no refresh is available". - These errors are recorded in refresh-failure telemetry under a distinct `no_refresh_available` class. - They now skip the retry path that invalidates the token and tries again, since a retry cannot succeed. **Evidence** `Anthropic profile login expired` - Area: Auth - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Auth token and custom header failures now say which value is wrong Bad auth tokens and custom headers now each get a message naming the exact value to fix. **What** Three specific one-line messages replace a single generic one, so a bad value points at its own source: "Invalid auth token · Fix external auth token", "Invalid ANTHROPIC_CUSTOM_HEADERS · Fix the environment variable", and "Invalid request header from the environment · Fix the environment variable". **Details** - Which message you get depends on whether the offending value came from `ANTHROPIC_CUSTOM_HEADERS` or from another header source. **Evidence** `Invalid ANTHROPIC_CUSTOM_HEADERS · Fix the environment variable` - Area: Auth - Names: `ANTHROPIC_CUSTOM_HEADERS` - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Notebook edits check file size and type before reading Notebook edits check size and file type first instead of loading a huge file into memory. **What** Editing a notebook now stats the file first and bails out if it is not a regular file or is larger than 100 MB, rather than pulling the whole thing into memory. Within the cap it reads at most one byte past the limit. **Evidence** `notebook_path` - Area: Notebooks - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Terminal probe reports mouse mode, clipboard tool and VTE Startup telemetry now records your mouse mode, Linux clipboard tool and whether VTE is set. **What** The startup terminal probe telemetry now also reports three fields: `mouse_mode`, `linux_clipboard_tool` (one of "not_linux", "not_probed", "none", or the tool that was chosen) and `vte_terminal`, true when the `VTE_VERSION` environment variable is set. **Evidence** `linux_clipboard_tool` - Area: Telemetry - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Lock release failures now say what went wrong Internal lock release failures now show a readable explanation instead of a raw error dump. **What** When Claude Code fails to release an internal lock, it now describes the failure instead of dumping the raw error. **Details** - A lock that was already released reports that it was no longer held and that the protected section may have run without exclusivity. - Any other failure reports that the lock directory could not be removed and is left to go stale. - A release that rejects with something that cannot be described is reported as such rather than throwing inside the error handler. **Evidence** `lock directory could not be removed and is left to go stale` - Area: Error Messages - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Output-style guidance rewritten without em dashes Claude's response-style guidance was reworded to drop em dashes. **What** The response-style prose replaces its em-dash asides with colons and commas. The code-comment rule now ends "it's noise the moment the change merges" instead of referring to a PR. **Evidence** `it's noise the moment the change merges` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact watch-cap message says what is occupying the slots When artifact watches are maxed out, the message now lists what's occupying the slots. **What** When a session is already watching the maximum number of artifacts and a new watch is skipped, the message now lists what each slot could be instead of just saying the cap was reached. **Details** - Slots are described as a watch you asked for, one auto-replying to comments, the artifact you most recently published, or a slot still connecting. - A separate reason, `watch_cap_reconnect`, covers hitting the cap while an existing watch was in the middle of reconnecting. **Evidence** `and none could make room (each is a watch you requested, one auto-replying to comments, or the artifact you most recently published, or watch slots are still connecting); unwatch one first.` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Publish instructions drop the "minted URL" wording Publishing without a link is now described as creating a separate artifact, not updating one. **What** Publishing an artifact without a link, from a conversation that did not publish it, is now described as creating a separate artifact rather than updating the existing one, and the tool suggests asking you for the link. The title fallback now applies only when the HTML has no `<title>` in its first 8KB. **Details** - Both the `url` parameter description and the text shown after a successful publish were reworded. **Evidence** `publishing without \`url\` from a conversation that didn't publish this artifact creates a separate artifact rather than updating this one` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Clearer messages around editing CLAUDE.md Memory prompts now say "CLAUDE.md files" and report failures readably. **What** The memory flow now says "CLAUDE.md files" instead of "memory files", shortens the confirmation shown when a file is opened, and reports failures as a normal system message with the path formatted, rather than a raw error string. **Evidence** `> Safe mode: this session doesn't load CLAUDE.md files, so changes take effect after you ${ux()}.` - Area: Memory - Names: `CLAUDE.md` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Question summaries default to the first line Question headers default to the message's first line and get truncated instead of rejected. **What** When Claude asks you a question, the short header for a plain-text option is no longer required to be supplied separately. It defaults to the first line of the message, and an over-long header is truncated rather than rejected. **Evidence** `Defaults to the first line of a plain-text message; longer summaries are truncated to ` - Area: Agents - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### A broken terminal size is warned about once A broken terminal size warns once instead of spamming or silently guessing. **What** If your terminal reports an unusable window size, Claude Code now logs a single warning instead of repeating it or silently falling back to a default size. **Evidence** `warnGarbageWinsizeOnce` - Area: Terminal UI - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Notebook oversize help uses a placeholder path Oversize-notebook help now shows a placeholder path instead of splicing your real filename in. **What** The jq and PowerShell example commands shown when a notebook is too large to read now print `<notebook_path>` instead of splicing the real file path into each line. **Evidence** `cat <notebook_path> | jq '.cells[:20]' # First 20 cells` - Area: Notebooks - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Skill template no longer emits an em dash Generated skill scaffolds no longer include an em dash in the description placeholder. **What** The SKILL.md scaffold's description placeholder now uses a comma, so generated skill frontmatter reads "one-line summary, used to decide relevance...". **Evidence** `description: {{one-line summary, used to decide relevance in future conversations, so be specific}}` - Area: Skills - Names: `SKILL.md` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Identically-written scripts are no longer classified as one Two scripts with identical contents but different paths are no longer treated as the same. **What** The workflow and script classifier now sees the script body followed by its path or name, rather than just one of the three. Two scripts with the same contents but different paths now classify separately. **Evidence** `toAutoClassifierInput(e) {` - Area: Telemetry - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Usage breakdown wording Two usage breakdown lines were reworded; nothing behaves differently. **What** Two lines in the usage breakdown now read "came from the plugin" and "came from the MCP server". The subagent, slash command and session lines are unchanged. **Evidence** `% of your usage came from the MCP server` - Area: Elsewhere - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ## Bug Fixes ### Approving a held peer message re-checks policy first Approving a held message from another session re-checks policy, so a revoked one stays blocked. **What** Approval of a message held from another session now re-evaluates the inbound policy at the moment you approve. If it has since flipped to refuse, through the kill switch or an opt-out, the message is dropped with an expired or denied receipt instead of being released into the queue. **Evidence** `held peer message approved but policy is now refuse` - Area: Permissions - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Resolved comment threads with new comments no longer go ignored A resolved comment thread that gets new comments now wakes Claude up again. **What** The comment poller used to stop as soon as a thread was marked resolved. It now stops only when the thread is resolved and there are no new or reassigned comments, so a resolved thread that gets fresh work still wakes Claude up. **Evidence** `C = n.resolved && (T.length > 0 || y.length > 0);` - Area: Code Review - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Teammate pane creation serialised under tmux and iTerm2 Spawning several teammates at once no longer races when splitting tmux or iTerm2 panes. **What** Spawning several teammates at once no longer races when splitting terminal panes. Both the tmux and iTerm2 backends now take a lock before creating a pane and release it in a finally block. **Details** - Only applies when running inside tmux or iTerm2; other terminals are unaffected. **Evidence** `paneCreationLock` - Area: Teammates - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Transcripts belonging to another account are permanently marked as not to be restored Transcripts belonging to another account are marked so history never quietly reappears later. **What** When the session bridge blocks saving a transcript because it belongs to a different account, that fact is now written into the transcript itself as a history-suppression record and the session id is marked in memory. Forks of the session inherit the suppression, and the background backfill refuses to restore any transcript carrying the record, so cross-account history can no longer creep back in later. **Details** - backfill also refuses a transcript whose scan for the marker runs past its line budget, erring toward not restoring - a half-written entry pair seen during resume takes a weaker in-memory suppression only, with no permanent marker written - reported as `rc_cross_account_suppression` **Evidence** `[persistence-sync] Refusing backfill: history-suppression entry in transcript` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Forking a session from the resume picker now carries history suppression forward Forking a session from the resume picker now carries over suppression and parent records properly. **What** Forking a past session from the resume picker previously only replayed content replacements. It now runs the shared fork helper, which strips the source session's worktree session and relocated working directory, records the fork's parent, and copies history suppression onto the new session id when the source was suppressed or known to be tainted. **Details** - The suppression record on the destination session is written with cause `fork_inherit`. - The fork helper is called with `stripWorktreeSession` and `stripRelocatedCwd` set, plus the destination session id. - Neither the suppression record type nor the fork options existed in v2.1.226, so forks made from this path previously started without inherited suppression. **Evidence** `stripWorktreeSession` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### More cloud token failures recognised as expired credentials More Bedrock and Vertex token failures now say your credentials expired so you can re-authenticate. **What** Three more provider error strings are now matched by the check that classifies a failure as expired or invalid credentials, so Bedrock and Vertex style token and API key failures surface as an auth expiry you can re-authenticate from, instead of a generic error. **Evidence** `Bearer Token has expired` - Area: Auth - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Logout keeps your cloud device identity Logging out no longer makes your machine re-register with cloud sessions. **What** Logging out no longer forces the machine to re-register with cloud sessions. The stored device identity is read before credentials are wiped and written back afterwards. **Details** - The `coworkRemoteDevice` entry is restored after the secure store is deleted, with one retry on a transient failure. - The read itself is strict and retried; if it fails, an error says the device identity is not carried across the wipe. **Evidence** `coworkRemoteDevice` - Area: Auth - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Internal hook messages no longer surface as assistant turns Internal hook messages no longer show up downstream as if Claude said them. **What** Assistant messages marked as internal, such as synthesised hook system messages, are now dropped when converting to the outbound stream instead of appearing downstream as replies from Claude. **Evidence** `is_meta` - Area: Hooks - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Review confirmation dialog can no longer launch twice Hammering the review confirmation dialog no longer launches twice, and cancelling actually aborts. **What** Pressing a choice repeatedly in the review confirmation dialog no longer fires the launch more than once. Cancelling now aborts the in-flight request, and a failed launch re-enables the dialog. **Evidence** `proceed-post` - Area: Code Review - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Synced skills are no longer rediscovered as local ones Synced skills no longer appear twice in your skill list. **What** Skill discovery now skips `.claude/skills` directories that live inside sync-owned areas under the user skills and plugins roots, including the staging directory, so a synced skill does not show up twice. **Details** - Paths are case-folded and re-checked after symlinks are resolved. - When a local skill has the same name as a synced one, the synced copy is dropped. **Evidence** `[skills] dropping synced skill '` - Area: Skills - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Skill directories managed by skill sync are no longer picked up as plugins Skills managed by skill sync no longer get picked up a second time as plugins. **What** When scanning your skills directory for skills that can act as plugins, Claude Code now skips any directory that skill sync claims, including stale and pending claims, the sync-owned root directory, and hidden dot-prefixed directories. If sync's own record of what it owns cannot be read or is malformed, the entire adoption pass is skipped rather than claiming everything, until a sync round repairs it. **Evidence** `[plugins] skills-dir plugin adoption skipped: sync manifest unreadable or malformed (fail-closed until a sync round repairs it)` - Area: Skills - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Remote bridge honours a stashed supersession close on teardown When another session takes over remotely, this one now closes down as superseded properly. **What** When a remote session's connection closed with a code indicating another session took over, teardown now acts on it: codes 4090 with an epoch conflict, 403 and 404 mark the session superseded and suppress the archive, with a log line recording the decision. **Details** - Where the specific cause is unclear, the session is marked superseded with an unknown reason rather than archived. **Evidence** `[remote-bridge] Teardown latched a stashed supersession close (` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Remote review stops early on a repository with no commits Remote review on an empty repository fails fast with a clear reason instead of hanging on. **What** Before starting a remote review, Claude Code now checks whether the repository has any refs at all and fails the precondition with reason `no_refs`, instead of continuing into a merge-base calculation that could never succeed. **Details** - The check runs `git for-each-ref --count=1 refs/`. **Evidence** `"for-each-ref", "--count=1", "refs/"` - Area: Code Review - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Directory sync stops retrying conflicting uploads Conflicting uploads during directory sync fail immediately instead of burning retries. **What** Uploads that come back with HTTP 409 (conflict) now fail immediately instead of consuming the retry budget. Retries still happen for 429 and 5xx other than 501. **Details** - 409s are still counted separately for reporting. - The in-flight refresh promise is now cleared in a `.finally`, so a failed refresh no longer leaves the slot permanently occupied. **Evidence** `if (b.status === 409) g.status409++;` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Late classifier results from a finished turn are discarded Background classification finishing after your turn ends can no longer clobber session state. **What** A background classification started mid-turn can now no longer overwrite session state if it returns after that turn has already ended. **Details** - The result is checked against the turn it was started in before being applied, and dropped otherwise. **Evidence** `[classifier] dropped stale mid-turn result (turn ended)` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Directory sync rejects duplicate file paths and reports each file Directory sync refuses duplicate paths and tells you what was applied, skipped or missing. **What** A manifest listing the same file path twice is now refused outright, and the completion row can list each file as `applied`, `skipped` or `missing`. **Details** - The sync root is resolved through its real path; when that fails, `dir_sync_apply_root_unresolvable` is logged. **Evidence** `dir_sync_apply_root_unresolvable` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### update_plan is no longer counted as a browser tool Plan updates no longer count as a browser tool, but still show the "Plan updated" label. **What** "update_plan" was removed from the list of Claude-in-Chrome tool names used to build the prefixed browser tool ids, so it no longer counts as one of the browser tools. It is still recognised for display, keeping the "Plan updated" label. **Evidence** `"update_plan"` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Feature-flag client refreshes the OAuth token before it starts Startup refreshes your token first so feature flags don't load with stale credentials. **What** At startup, Claude Code now attempts an OAuth token refresh, bounded by a 5 second timeout, before creating the feature-flag client and resolving its auth headers. Previously a stale token could produce an unauthenticated flag fetch at startup. Failures are logged at debug level (recording 'timeout' or the error name) and startup continues either way. **Details** - Runs only once workspace trust is established. **Evidence** `GrowthBook pre-init OAuth refresh` - Area: Startup - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### A large paste stays recallable even when it cannot be written to disk Big pastes still come back in your prompt history even when saving them to disk fails. **What** Large pastes are saved to a file so history can recall them later. When that write fails, or the storage layer refuses it, the text is now kept in memory instead of being dropped, so pressing up through your prompt history still shows the pasted content rather than an "unavailable" placeholder. **Details** - Retained pastes are capped at 10 MB in total, with the oldest evicted first. - A refusal from the storage layer reports "paste write refused by the storage backend". - Prompt history, its flush on exit, and paste id generation were restructured at the same time. **Evidence** `paste_store_write_failed` - Area: Prompt Input - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### MCP connect retry stops when managed policy blocks the server MCP connection retries stop and tell you when policy blocks the server. **What** If an MCP server becomes blocked by managed policy while Claude Code is retrying its first connection, the retry loop now stops and reports a failed state with a log line, instead of abandoning the retry with no explanation. **Evidence** `Server blocked by managed policy during initial-connect retry, stopping retry` - Area: MCP - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Bad auth headers reported with their real error code Bad auth header errors now show the real error code, including keys you set yourself. **What** API errors with code `invalid_request_header` are now logged the same way as invalid API key errors, showing the actual code rather than falling into generic handling. An API key verification failure is also now recognised when the header at fault is an `X-Api-Key` you supplied yourself rather than one coming from `ANTHROPIC_CUSTOM_HEADERS`. **Evidence** `invalid_request_header` - Area: Auth - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### A failing MCP credential read no longer aborts the request An unreadable MCP credential store no longer kills your request; you get a retryable message. **What** Token lookups in the MCP authentication paths now return nothing on failure rather than throwing, and an unreadable credential store gets its own message saying nothing was sent and the request can be retried. **Details** - The message reads: Stored credentials for MCP server "name" could not be read right now. Nothing was sent. Retry the request. - MCP connection-timeout errors are now built by a shared helper instead of inline. **Evidence** `Stored credentials for MCP server "${e}" could not be read right now. Nothing was sent. Retry the request.` - Area: MCP - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Leftover paste staging files are cleaned up Leftover temporary files from large pastes are now swept up instead of piling forever. **What** Temporary files created while staging a large paste could previously accumulate forever. Cleanup now also matches names containing `.txt.tmp.` and a separate sweep removes stale staging files, logging `Cleaned up old paste staging file: ` with the path. **Evidence** `.txt.tmp.` - Area: Prompt Input - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Rejected tool uses render properly in transcript view Tool calls you rejected now show their rejection message in transcript view instead of vanishing. **What** In verbose and transcript mode, a tool use you rejected or cancelled now shows the tool's own rejection message instead of disappearing. Previously anything that was not a plain result rendered as nothing. **Details** - The renderer detects rejected and cancelled results and calls the tool's `renderToolUseRejectedMessage`. - Falls back to a plain marker when the tool defines no rejection renderer or when its input cannot be parsed. **Evidence** `renderToolUseRejectedMessage` - Area: Transcript View - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Tool-search results no longer show a render error Search tool results no longer print "Unable to render" errors in your transcript. **What** Search-tool result blocks and two search variants used by the model now render as nothing instead of producing "Unable to render server tool block" or "Unable to render message type" errors in the transcript. **Evidence** `tool_search_tool_bm25` - Area: Transcript View - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Concurrent plugin syncs no longer share a staging directory Two Claude Code processes syncing plugins at once no longer trample each other's downloads. **What** Plugin and skill sync now stages files in a directory named after the process ID, so two Claude Code processes syncing at once cannot overwrite each other's in-progress downloads. **Details** - Paths went from `<root>/.staging` to `<root>/.staging/<pid>` for both synced plugins and synced skills. - Cleanup now tracks a list of stale staging directories left by processes that exited, with dedicated helpers for the plugin and skill staging roots. **Evidence** `".staging"` - Area: Plugins - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### A failed MCP credential read no longer triggers a spurious re-login A failed MCP credential read no longer drags you through a pointless re-login. **What** If reading the stored credentials for an MCP server fails, Claude Code now raises and logs an error instead of behaving as though there were no credentials, which previously would have sent you through authentication again for no reason. **Evidence** `Credential store read failed; not reporting credentials as absent` - Area: MCP - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### One-line text fields no longer accept Unicode line separators Exotic Unicode line breaks can no longer sneak into single-line skill proposal fields. **What** The squeeze that flattens skill proposal text to a single line collapsed only carriage returns and newlines. It now also collapses U+2028 and U+2029, the Unicode line and paragraph separators, so those can no longer slip a line break into a one-line field. **Evidence** `/[\r\n\u2028\u2029]+/g` - Area: Skills - Tier: You'll notice - Useful: 1/5 - Signal: 2/5 ### Capped sidecar listings return a distinct error code A truncated stored-entry listing now reports its own error code instead of looking like a failure. **What** When a paginated listing of stored entries stops because it hit its cap, it now returns the error code "ListCapExceeded" instead of falling through, so callers can tell a truncated listing apart from a real storage failure. **Evidence** `ListCapExceeded` - Area: Internals - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### MCP skill caching survives more filesystem failures Skills fetched from MCP servers cache correctly despite permission errors or broken cache folders. **What** Caching a skill file fetched from an MCP server now tolerates permission errors (EPERM and EACCES) on rename in addition to the existing already-exists cases, and if an existing cache directory turns out to contain no skill file it is replaced with the freshly fetched copy instead of being left broken. Temporary directories are cleaned up on failure and failed writes now raise a dedicated error. **Details** - Where a v5 storage backend is present, the write goes through it instead of the filesystem. **Evidence** `MCP skill cache SKILL.md write failed` - Area: MCP - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### A language server that dies during startup is no longer shown as running A language server that crashes while starting is now reported as failed, not running. **What** After the initialization handshake, the client re-checks the server's state and raises the recorded startup error if the process left the starting state, instead of marking it healthy. **Evidence** `LSP server crashed during startup` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Read-only home directories no longer raise an error at startup Starting up on a read-only home directory logs a note instead of throwing an error. **What** Setting up the task output link on a read-only filesystem now logs `initTaskOutputAsSymlink failed (EROFS)` and falls back, instead of surfacing an error report. `EROFS` joined the set of errno values already downgraded to a log line. **Evidence** `initTaskOutputAsSymlink failed (` - Area: Startup - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Daemon lock recovers when the lock path is not a regular file Claude Code starts even if something odd is sitting at its lock file path. **What** If a directory, fifo, socket or symlink sits at the daemon lock path, Claude Code now removes it and retries once instead of failing to start. **Details** - `EISDIR` and `ENXIO` errors during removal trigger the same cleanup; a symlink loop (`ELOOP`) is treated as an existing lock and left alone. - The warning is logged once per process. **Evidence** `removing it as the legacy path does` - Area: Daemon - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Slow git fetches are recognised as timeouts, not server errors A stalled git fetch is now reported as a timeout, not a remote server failure. **What** A git fetch that stalls locally is now correctly reported as a transfer timeout rather than a remote failure. **Details** - Fetch error output is scanned line by line for `Operation too slow`, and attributed to a local curl exit 28 timeout only when that line is not prefixed as a message from the remote. - Fetch telemetry gained extra per-attempt fields. **Evidence** `Operation too slow` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Expired external login credentials with no refresh no longer retry pointlessly An expired external login with no refresh token now stops immediately instead of retrying uselessly. **What** When an external OAuth credential has expired and there is no refresh token to renew it, Claude Code now recognises that case directly and stops, rather than treating it as a generic retryable failure and attempting a refresh that cannot succeed. **Evidence** `no_refresh_available` - Area: Auth - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Dialogs now update when the dialog stack changes Dialogs now refresh when another opens or closes instead of showing stale state. **What** The internal hooks that report which dialog is on top now subscribe to changes instead of reading the value once during render, so components refresh when a dialog opens or closes rather than showing a stale state. **Evidence** `useSyncExternalStore` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Failed heartbeat drops back off the idle interval After a failed heartbeat, Claude Code goes back to checking in more often. **What** When the CLI heartbeat has been told by the server it can beat less often and a beat then fails with anything other than a 429, the longer idle interval is given up and the shorter starting interval takes effect immediately. **Details** - Reported as a warning event named `cli_heartbeat_idle_reverted_on_failure`. - A failed liveness-probe beat is now counted separately from a normal failed beat. **Evidence** `cli_heartbeat_idle_reverted_on_failure` - Area: Internals - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ## In Development ### Wrap-up nudge during the rate-limit grace window Claude could be nudged to wrap up or checkpoint during your usage-limit grace window, but nothing fires. **What** When you are inside the usage-limit grace window, Claude Code can insert a hidden message asking the model either to wrap up, or to checkpoint and list up to three remaining pieces of work. The behaviour comes from `tengu_lantern_wick_mode`, which resolves to `off`, `wrap-up` or `next-steps`; with no remote value it is `off`, so nothing is injected in this build. **Evidence** `tengu_lantern_wick_mode` - Flag `tengu_lantern_wick_mode`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Rate Limits - Tier: Not switched on - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Coordinator agents told to hand blocked tools to a worker When a coordinator agent cannot use a tool, Claude is told to run it from a worker. **What** When a tool is unavailable specifically because the coordinator agent cannot use it, the explanation now says so and tells Claude to run it from a worker instead, rather than reporting a plain unavailability. It only fires when the delegation tool is present and `CLAUDE_CODE_SIMPLE` is unset; the rest of the message is assembled from a template. **Evidence** `. ${e} is not available to you as the coordinator \u2014 run it from a worker via the ${mi} tool instead.` - Area: Subagents - Names: `CLAUDE_CODE_SIMPLE` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Usage-limit grace window can ask for next steps The grace-window nudge can now ask Claude to checkpoint and list remaining work, but stays off. **What** When you hit a usage limit and a grace window opens, the wrap-up nudge is no longer a single fixed message. It is now a three-way mode set by `tengu_lantern_wick_mode`: `off`, `wrap-up`, or the new `next-steps`, which asks the model to checkpoint and list up to 3 bullets of remaining work. The fallback is `off`, and any unrecognised value is treated as off, so nothing appears unless the server turns it on. **Details** - The message opens "[Usage limit reached — grace window active. Checkpoint now: finish the ...". - The telemetry event now records which variant fired, including `next_steps`. **Evidence** `[Usage limit reached \u2014 grace window active. Checkpoint now: finish the ` - Flag `tengu_lantern_wick_mode`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Rate Limits - Tier: Not switched on - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Context indicator can follow a worker's own auto-compact settings The context indicator can use a remote worker's real auto-compact settings so the countdown matches reality. **What** A remote worker can now publish the auto-compact configuration it actually resolved, and the context-usage indicator will use that instead of working it out locally. This makes "% until auto-compact" count down to the point compaction really happens, and switches to "% context used" when the worker says the threshold is not enforced. It only applies when a connected worker sends the frame, and the message is marked internal. **Details** - The message carries whether auto-compact is enabled, the effective context window, the threshold, whether it is enforced, and where the setting came from: environment, settings, client data, experiment, model default, unknown model, or auto. - Adoption is reported as `tengu_remote_autocompact_state_adopted`. **Evidence** `Worker-resolved auto-compact state, emitted by CCR workers at boot` - Area: Compaction - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Refusing peer messages when cross-session messaging is off is now a distinct case Sending messages between your Claude sessions stays off, and refusals now name the kill switch explicitly. **What** Cross-session messaging, which lets one Claude Code session send messages to another, stays off unless the `tengu_harbor_kite` remote flag (which falls back to off) or the `CLAUDE_CODE_HARBOR_KITE` environment variable is set, and it is never available on Windows. When it is off, inbound messages from other sessions are now refused as a kill switch rather than a generic refusal. **Details** - The log says the message was refused because cross-session messaging is disabled, and telemetry records the cause as `kill_switch` instead of `refused`. - Messages already held for delivery are dropped with "gate off — dropped N parked peer message(s)" and receipted as expired rather than denied. **Evidence** `cross-session messaging disabled (kill switch)` - Flag `tengu_harbor_kite`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cross-Session Messaging - Names: `CLAUDE_CODE_HARBOR_KITE` - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Remote-session connection learns liveness probes and reconnect resync Remote sessions can answer liveness probes and resync after a dropped connection. **What** The long-lived connection to remote sessions can now tell the server it accepts liveness probes, report the heartbeat interval it is using, and respond to a probe frame. After a dropped connection it runs a resync, and it will not accept a server-suggested heartbeat interval that outlives the current auth token. **Details** - Turned on by an `advertiseLivenessProbeSupport` option on the transport; nothing in this build was found to set it. - Probes are logged as `cli_sse_liveness_probe_received`; unrecognised transient frame types log `cli_sse_unexpected_ephemeral_type`. - A heartbeat is forced immediately after reconnect, spaced for probes. **Evidence** `cli_sse_liveness_probe_received` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Final answers from workflow subagents get an extra auto-mode check In auto mode, what a workflow subagent reports back can now get a warning attached. **What** In auto permission mode, the text a workflow subagent returns is now run through a check that can prepend a warning to it and record that warning in the run log. If the check errors or is cancelled, the text is returned unchanged. **Evidence** `subagentType: "workflow-subagent"` - Area: Subagents - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Artifact auto-replies stop describing their own plumbing Automatic artifact comment replies now sound like plain acknowledgements instead of describing internal plumbing. **What** The prompt that composes automatic replies to artifact comments used to have Claude say a request was flagged for the artifact's session to pick up. It now asks for a plain in-progress acknowledgement and forbids mentioning sessions, threads, flags or pick-up machinery, in both the reply-only and edit-capable versions. A thread that is already resolved gets a brief reply and stays resolved. Gated by artifact comments (`tengu_teal_corbel` or `CLAUDE_CODE_ARTIFACT_COMMENTS`). **Evidence** `Never describe how the request gets handled behind the scenes` - Flag `tengu_teal_corbel`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_COMMENTS` - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Prompt added for posting ultrareview findings as a single PR comment A review step can post all its findings to a pull request as one capped comment. **What** A new prompt drives a posting step that takes a block of review findings and posts them to a GitHub pull request as one plain comment, capped at 40,000 characters. It is allowed exactly one write and nothing else: no review submission, no other API call, and no acting on instructions found inside the findings themselves. **Evidence** `add_issue_comment is the only write you may make, exactly once` - Area: Code Review - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Advisor calls carry prior turns and a refusal fallback The internal advisor now sees earlier questions and answers, and falls back when the model refuses. **What** The internal advisor sub-conversation now passes earlier question and response pairs along as history, including any notice that a fallback was used, and returns a refusal fallback answer when the model declines. Cancellation reasons became a fixed set of pre-built errors, among them `refusal-fallback-edit` and `recovery-timeout`. **Details** - Nothing in this build was observed to reach the advisor path, so whether these fallbacks are exercised depends on how the feature is switched on. **Evidence** `refusal-fallback-edit` - Area: Model Fallback - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Liveness probing for remote sessions Remote sessions can detect a dead connection through probes and force a reconnect, off by default. **What** Remote worker sessions gain an end-to-end liveness check: the heartbeat can advertise `supports_liveness_probe` with the current interval, the event stream recognises a `liveness_probe` event, and a timer forces a reconnect when probes stop arriving. Advertising defaults to off in the client, and the SDK path gates it on `tengu_ccr_idle_heartbeat`, which falls back to off, so no build here turns it on by default. **Details** - Logs `cli_sse_liveness_probe_received` on each probe and `cli_sse_liveness_probe_handler_threw` if handling one fails. - Success and failure counters are recorded as `ccr_liveness_probe`. - None of this machinery existed in 2.1.226. **Evidence** `supports_liveness_probe`, `liveness_probe`, `cli_sse_liveness_probe_received` - Flag `tengu_ccr_idle_heartbeat`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Sessions - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Startup notice when a cloud session could not be bound to your machine You could get a startup notice when a cloud session could not be bound to your machine. **What** If a cloud session starts and the server returns no device id, the session now queues a plain-language notification instead of staying silent. The text is the fixed prefix `Not bound to this machine (local tools off): ` plus a reason. It only appears on the cloud-session path and only when `tengu_violin_wood` is on. **Details** - Reasons include "this account has reached its device limit", "no stored claude.ai login on this machine (run /login)", "the server refused it (server-side bind flag likely off)", and "the device feature flag was off or unreadable at create time". **Evidence** `the device feature flag was off or unreadable at create time` - Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cloud Sessions - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Resuming an interrupted thinking block accepts more model spellings Resuming an interrupted thinking block now accepts model aliases, but the feature stays off. **What** The check that decides whether an interrupted thinking block can be resumed no longer demands an exact match against two model ids; it now compares canonical forms and a known alias set, so aliases of the same model qualify. Still off unless the `tengu_thinking_block_resumption` flag is enabled, which defaults to false. **Evidence** `tengu_thinking_block_resumption` - Flag `tengu_thinking_block_resumption`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Thinking - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Cross-session file transfer is gated off with a specific message Sending files between sessions now fails with a clear "not available in this session" message. **What** The tool that sends files between sessions now checks a capability gate before doing anything. When it is off it returns error code 9 with the message "Cross-session file transfer is not available in this session." and records telemetry with transport "gated_off" and zero files delivered. The gate is `tengu_send_file`, off unless the server enables it, and the surrounding capability check must also pass. **Details** - in the previous build `tengu_send_file` was only a telemetry event name; both the gate and the unavailable message are new here **Evidence** `Cross-session file transfer is not available in this session.` - Flag `tengu_send_file`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cross-Session Messaging - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### A remote file mode dialog can appear at startup Startup can show a dialog asking how files should be handled for a repository. **What** Startup can now load and show a dialog asking how files should be handled for a repository, which records `tengu_dir_sync_mode_prompt_shown` when it appears. The dialog is loaded only on demand, and nothing in the surrounding startup code identifies the condition that triggers it. **Evidence** `tengu_dir_sync_mode_prompt_shown` - Area: Cloud Sessions - Tier: Not switched on - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### A rate-limit test harness ships switched off Fake usage-limit states for testing ship in the build but every accessor returns nothing. **What** A component holding fake usage-limit states (session limit reached, overage exhausted, seat-tier zero credit limit, fast-mode limits, trial and overage payloads) is bundled in this build but cannot affect anything: every accessor that would read it returns null on its first line, leaving the real body unreachable. **Evidence** `seat-tier-zero-credit-limit` - Area: Rate Limits - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Recognizer for a session metadata endpoint A matcher for a new session metadata endpoint exists but nothing calls it. **What** A new helper matches URLs on the session-ingress host used at startup whose path is exactly a new MCP metadata path. The host is captured once at startup into a holder that can be reset. Nothing in the build was found to call the recognizer, so what it gates is not visible from here. **Evidence** `/v2/ccr-sessions/-/meta/mcp` - Area: MCP - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Storage-backend addressing added across transcripts, sidecars and caches Transcripts, caches, plugin state and more gained storage-backend addresses that no ordinary install uses. **What** A wide set of on-disk state gained backend-addressed equivalents with filesystem fallbacks: subagent transcripts and their `.meta.json` sidecars, session alias files, the MCP discovery cache, marketplace manifests and installed-plugin state, forked-skill scoping records, and the active-time ledger. These paths are only taken when a v5 storage backend is supplied, so on an ordinary install nothing changes. **Details** - Listings are paginated with explicit page budgets, and log when a listing was cut short or failed. - A failed listing yields an empty result rather than a partial one. **Evidence** `recordSessionAlias: update failed via storage` - Area: Storage Backend - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Comment threads report why they were not resolved Failing to resolve an artifact thread now says whether you lacked permission or the thread was inactive. **What** When resolving a discussion thread on an artifact, the result now distinguishes success from two refusals: the person asking is neither the thread starter nor a writer, or the thread was never activated. It appears only where artifact comments are available, which is not on by default in this build. **Evidence** `not resolved (not the thread starter or a writer)` - Area: Artifacts - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Trusted-device header on cloud session requests Cloud session requests can attach a trusted-device token, but the header is added only when flagged on. **What** Cloud session event, poll and title requests now build their auth headers asynchronously so they can wait for a trusted-device token and attach it as `X-Trusted-Device-Token`. The extra header is gated on `tengu_violin_wood`; without it the header builder returns nothing extra and requests are unchanged. **Details** - Trusted-device tokens already existed; what is new is that ordinary request paths now await one before sending. **Evidence** `X-Trusted-Device-Token` - Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.227; this account: off, anonymous baseline: off, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Cloud Sessions - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Model roster flag can redirect refusal fallback The server can list models that should be routed differently when a refusal fallback happens. **What** A new server-controlled list of model ids now feeds the logic that picks a replacement model after a refusal. Models on the list skip an early exit and are pushed down the fallback path. The list is empty unless the server supplies one, so this has no effect in a default build. **Details** - Read from the `tengu_loggia_roster` flag as a JSON array of model ids; anything else logs "is not a JSON array of model ids; treating it as empty" and falls back to an empty list. **Evidence** `tengu_loggia_roster` - Flag `tengu_loggia_roster`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Model Fallback - Tier: Under the hood - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Hook for syncing a worker directory around each headless turn Headless runs can sync a worker directory before and after each turn, if the host provides a callback. **What** The headless streaming loop accepts an optional callback that runs before each turn and again after it, receiving the message IDs from that turn. It only runs when the embedding caller supplies one, and nothing in the CLI itself does. **Evidence** `workerDirSync` - Area: Headless Mode - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Option to hide the welcome banner in embedded sessions Hosts embedding Claude Code can hide the welcome banner and logo header. **What** The main prompt view accepts a new `hideWelcomeChrome` option that suppresses the welcome and logo header. It defaults to off and falls back to the embedded-session flag when unset, so it is only reachable by a host embedding Claude Code rather than by a setting. **Evidence** `hideWelcomeChrome` - Area: Embedded Sessions - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Optional key/value storage backend threaded through background sessions, plugins and the daemon Background jobs, the daemon, plugin caches and plan docs can all route through the optional storage backend. **What** A large amount of state that was read and written directly as files can now go through an optional key/value storage backend, with the file path kept as a fallback at every call site. Covered: background job `state.json` and `adopt.json`, the daemon `roster.json`, pty pid files, the host-managed tombstone, bridge pointer files, plugin cache and `.in-use` markers, plan and workshop docs, task lists, and daemon log tailing. Nothing in the source shows what attaches the backend, so whether it is used is decided elsewhere. **Details** - UI code reaches the backend through a new React context named `storageV5`; when it is undefined, every path falls back to plain filesystem access - new error text includes "adopt.json v5 write failed", "bg roster.json v5 read failed", "host-managed tombstone v5 write failed" and "[bg] v5 jobs listing failed: cursor did not advance" **Evidence** `[bg] v5 jobs listing failed: cursor did not advance` - Area: Storage Backend - Tier: Not switched on - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Unbuffered streaming of partial assistant output Partial assistant output can stream event by event instead of in batches when the flush interval is zero. **What** When the stream flush interval is set to zero, partial output is sent event by event instead of in batches. Consecutive pieces of the same kind on the same content block are merged together up to a byte budget, and any single event larger than the 61440-byte frame budget is dropped. Whether the zero interval is ever used in practice is set outside this code. **Details** - Merging covers text, tool-input JSON and thinking increments; for thinking, the token estimates are summed. - The merge budget is the frame budget minus 4096 bytes. - Dropped oversize events are recorded as `oversize_ephemeral_skipped`. **Evidence** `oversize_ephemeral_skipped` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Artifact listings can show who an artifact is shared with Artifact listings can show whether one is private, shared with a group, or shared with you. **What** Lines describing an artifact can now include its audience: an artifact you own reads as private or as shared with a named group, and one shared with you as a writer carries an explanatory note in parentheses. **Details** - Only rendered when the server includes an audience field in its response, so it is invisible against servers that do not. **Evidence** `audienceViewNote` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### File-history IDE notification is currently a no-op The editor is no longer told about file writes, edits and snapshots; the helper does nothing. **What** The helper called after file writes, edits and snapshots (three call sites) fetches the VS Code client and then returns without using it, so whatever it notified the editor about is not being sent in this build. What the equivalent code sent in 2.1.226 is not clear, as that build organises this path under different names. **Evidence** `vscodeClient` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### Branching a conversation through the newer storage backend Forking a conversation has a second implementation for sessions stored in the newer backend. **What** Forking a conversation has a second implementation that copies the source records forward in bounded batches through the newer storage layer, and deletes the half-written fork if anything fails partway. It runs only when the session's history is held in that backend. **Details** - Carries over edited and moved records, and inherits a withheld-history marker as a `fork_inherit` record. - Distinct errors for a conversation that cannot be read and one that is too long to branch. **Evidence** `Conversation too long to branch through storage` - Area: Storage Backend - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Memory scanning can go through the new storage layer Listing memory files can page through the new storage layer instead of walking the directory. **What** Listing memory files gained a second path that pages through the storage layer and reads only the head of each file rather than walking the directory. It runs only when a storage backend is handed to the scan; otherwise the existing filesystem walk is used, unchanged. **Details** - Failures on the new path report `memory_scan_storage_list_failed`, kept separate from directory-read failures so the two can be told apart. **Evidence** `memory_scan_storage_list_failed` - Area: Memory - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Settings can be pre-loaded through the v5 storage backend Settings can be pre-read through the new storage backend, skipping re-parsing when unchanged. **What** A new primer reads `settings.json` through the storage backend whenever settings are invalidated, hashing the bytes so unchanged content is not re-parsed, and seeds the result into the settings store. It only runs when a session has a v5 storage backend configured, so it is inert otherwise. **Details** - Files over the size cap, missing files, and backend errors fall back to the ordinary raw-file read, with a log line. - After a fixed number of consecutive failures the primer switches itself off for the rest of the process. **Evidence** `settingsPrime: user settings seeded` - Area: Storage Backend - Names: `settings.json` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Remote bridge idle liveness probes, off unless the flag is on The remote bridge can support idle liveness probes and resync on reconnect, off by default. **What** The remote bridge can tell the server it supports idle liveness probes, gated on `tengu_ccr_idle_heartbeat`, which falls back to off. When enabled, a probe triggers an immediate heartbeat and a reconnect triggers a resync. **Details** - Advertisement is `advertiseLivenessProbeSupport`; the session wires `setOnLivenessProbe` and `setOnReconnected`. - Separately and not gated: proactive and recovery credential refreshes now stop early if the session has been replaced, logging `[remote-bridge] Proactive refresh skipped: session superseded` and reporting outcome `skipped_superseded`. **Evidence** `advertiseLivenessProbeSupport: Hn(),` - Flag `tengu_ccr_idle_heartbeat`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.227; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Sessions - Tier: Not switched on - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Remote control config can be read through a storage backend Remote control config can be read through the storage backend, with clearer failure reasons. **What** Reading the remote control configuration gained an alternative path that goes through a storage backend rather than reading the file directly, classifying the result as text, absent, refused, failed or thrown. Absent maps to an empty config, and failures produce distinct messages that include the backend's error code. Which path a given session takes is not decided anywhere in this build. **Evidence** `failed to read ` - Area: Storage Backend - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ## Internal Changes ### Subagent handoff safety check returns a typed result The safety check on subagent output now says whether it refused, failed, or flagged something. **What** The check that reviews subagent output before it is handed back now returns an outcome kind (refused, unavailable, or flagged) alongside the warning text, rather than a bare string. The refusal wording now tells the caller to check for prompt injection, and the unavailable case also covers a classifier that failed closed without reaching a verdict. **Evidence** `Handoff classifier unavailable or failed closed without a verdict, allowing sub-agent output with warning` - Area: Subagents - Tier: Under the hood - Useful: 3/5 - Signal: 3/5 ### Teammate mailboxes and team files move to the newer storage backend Teammate mailbox and team-config writes use the newer storage layer when it's present. **What** Mailbox writes, marking messages read, message pruning and team-config updates now go through a transactional storage update when the session has the newer storage backend, and fall back to the old lockfile-plus-atomic-write path when it does not. **Details** - The new path retries when a lock looks suspect and separates contention from hard failures in telemetry. - Hard failures surface as "Team file update failed (storage v5)". - The old file-based mailbox read and clear helpers are gone. **Evidence** `Team file update failed (storage v5)` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Session identity and directories collapse into one object Session identity and working directories now live in one object that can be forked per project. **What** The scattered globals for session id, parent id and working directories were replaced by a single session object that can be subscribed to and updated, with a project fork that keeps the root's identity but overrides directories. Re-identifying through such a fork now throws instead of silently succeeding. **Details** - The settings cache and the CLI launch flags (interactive, print output format, client type, bypass permissions, scheduled tasks, init JSON schema and the rest) were each folded into a class with a `reset()`. **Evidence** `A withProject fork cannot re-identify the session` - Area: Session State - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Workflow tool description does not mention the new command clamp The Workflow tool enforces a Bash command limit but never mentions it in its description. **What** The Workflow tool's description moved between modules with its text unchanged, and the slots where extra `agent()` options would be documented are empty strings in this build. The Bash command clamp is enforced but never described to the model. **Evidence** `opts.isolation: 'worktree' runs the agent in a fresh git worktree` - Area: Workflows - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Module-level mutable state folded into owning objects Dozens of long-lived caches moved onto objects so a session can be reset inside one process. **What** Across dozens of subsystems, loose file-scope variables were moved onto single state objects or small classes, covering terminal capability detection, plugin and marketplace caches, skills loading, git directory lookups, org policy status, the teammate mailbox, agent observer pairings, computer-use state, voice recording, the global config cache and child-process tracking. Behaviour is meant to be identical; the point is that this state can now be reset per run rather than living for the life of the process. **Details** - Some memoised dynamic imports were deliberately de-memoised back to a plain promise each time. - Terminal backends such as tmux and iTerm are now cached singletons instead of being rebuilt on every call, and settings-file parse caches are held per store rather than process-wide. **Evidence** `VoiceRecorderState.reset() called while a recording is live; call stopRecording() first`, `AA.shouldAutoEnable`, `synchronizedOutputSupported` - Area: Session State - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Runner prewarm and prefetch markers are read from disk Remote runners read marker files to report whether prewarm and prefetch finished, yielded or timed out. **What** On remote runners, small marker files in /tmp written by the runner are parsed into outcomes: done, yielded, aborted or timeout, with elapsed seconds, plus a prefetch state file giving phase, run counts, age of the last success and an index. Reads do not follow symlinks, do not block, and stop at 4KB; a missing file reports `absent`. A timer for runner prep steps was added too. **Evidence** `ccr-byoc-prewarm-vda.done` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Workshop telemetry moved into app state, plus a first-page timing metric Workshop timing now records how long the first page takes to publish. **What** Per-session workshop counters moved out of module-level sets into an app-state slice, next to new whiteboard-telemetry and PR-review-target slices. A new `workshop_first_page` event records the milliseconds from tool invocation to the first publish along with that publish's state. **Evidence** `invoke_to_publish_ms` - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### More local state can route through a new storage backend Mailboxes, plugin registry, daemon config and plugin cache can now read and write through newer storage. **What** Teammate mailboxes, the plugin marketplace registry, flagged plugins, the daemon config file and the plugin cache each gained a path that reads and writes through a newer storage layer when one is handed in. Without it the existing direct filesystem path runs unchanged. Errors now separate backend faults from parse and corruption faults. **Evidence** `failed to load marketplace configuration (v5 backend error)` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Memory-directory telemetry classifies each file access Memory file reads and writes now record what kind of file it was and how it arrived. **What** Read, edit and write events for files in the memory directory now record what kind of file it was, whether it had been accessed before, and whether it was injected, alongside the subagent name that was already reported. Each access is logged as either a read or a write. **Evidence** `file_class` - Area: Memory - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Storage keys added for mailboxes, file history and job drafts New storage key types cover mailboxes, file history, job drafts and session aliases. **What** Alongside the new storage handle, key builders were added for `mailbox`, `fileHistory`, `jobPins`, `jobDraft`, `bridgePointer`, `sessionAliases` and a journal variant of transcripts, and the handle is now an explicit argument to settings writes, scheduled task enable and remove, job dispatch and respawn, MCP CLI subcommands, worktree and workflow dialogs, and the daemon's claim and adopt paths. **Evidence** `sessionAliases: (e) => ({ namespace: "sessionAliases", projectKey: e })` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### New storage key namespaces New cache namespaces for marketplaces and daemon state, and per-agent memory is now user-level. **What** Cached data gained three new namespaces: marketplace listings keyed by marketplace and form, daemon state keyed by relative path, and a task-list high-water mark. Per-agent memory is now always stored at the user level, keyed only by agent type. **Details** - The agent memory key dropped its layer and project parameters, so memory that was previously scoped per project is now user-wide. **Evidence** `namespace: "marketplaceCache"` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Storage handle passed explicitly through commands, plugins, MCP and daemon paths Plugin, MCP, resume and worktree paths now take an explicit storage handle, changing where state lives. **What** Settings writes, the plugin enable, disable, install, prune and uninstall commands, MCP client setup and reconnect, agent and skill loading, session resume, transcript reads, worktree metadata and background process spawn all now take an explicit storage handle, which changes where that state is read and written from. **Details** - On Windows, the daemon's terminal process-id files are read and deleted through storage keys in a `pty-pids` namespace rather than direct filesystem paths, when a handle is available. **Evidence** `pty-pids` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Synced files now carry content hashes in their results Synced files now report both server and locally computed content hashes. **What** Each applied file from a directory sync now reports the server's content hash and a locally computed sha256 alongside its path, status and byte count, which is the material needed for conditional writes later. **Evidence** `status: "applied",` - Area: File Sync - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Comment listings mark scoped dispatch for delegated subagents A subagent reading a comment thread for you no longer gets the re-run hint or extra context. **What** When a subagent reading a thread on your behalf lists comments, the result is now marked as scoped, which suppresses the usual hint to re-run without a thread id. The same condition also drops extra context messages when assembling the tool result. **Evidence** `scoped_dispatch` - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Transcript reads can go through the storage backend Transcript tails and session lists can be read from the storage backend when one is supplied. **What** Transcript tails, recent-session lists, session enumeration and project-directory scans gained a path that reads from the storage backend instead of the filesystem. It is only taken when a backend is supplied; otherwise the existing file reads run unchanged. **Details** - Tails are assembled by reading records backwards under a byte budget; recent sessions are listed by walking the transcript namespace with cursors instead of directory reads. - Transcripts marked as containing third-party content are still withheld, logged per session. **Evidence** `withheld: contains_3p_transcript_markers` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### More caches and settings can read and write through the storage backend Plugin catalog, memory, keybindings, workflow snapshots and stats can all read through the storage backend. **What** The plugin catalog cache, user memory and settings reads, the keybindings template, remote settings save and clear, workflow run snapshots and scripts, and the stats cache all learned to use the storage backend when one is supplied, falling back to the same file paths otherwise. Failures are logged rather than thrown. **Evidence** `Failed to save plugin catalog cache` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Plan-mode route selection telemetry Plan mode records which route it took and whether you were asked or sent straight there. **What** When a plan-mode command picks a route, the choice is recorded once as `plan_route_chosen`, along with whether you were shown a routing prompt (`offered`) or it went straight there (`direct`). **Evidence** `plan_route_chosen` - Area: Plan Mode - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Scattered globals replaced with resettable state records Globals became resettable objects, making it possible to restart a session inside a running process. **What** A large mechanical refactor turned dozens of module-level variables into fields on lazily created singleton objects reached through accessors, some with an explicit `reset()`. Nothing changes for you, but it makes tearing down and restarting a session inside a running process possible. **Details** - Covers the command fuzzy-search index, shell history, sandbox session flags, artifact and workshop state, plugin and marketplace caches, MCP tool-refresh sequences, terminal layout caching (a per-node cached layout instead of a WeakMap) and several event emitters. - The sandbox reset is async and calls the settings-subscription cleanup. **Evidence** `sandboxDisabledThisSession` - Area: Session State - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Prompts carry an ID through billing attribution and request metadata Each prompt now carries its own id so usage can be attributed prompt by prompt. **What** Each user message now gets its own prompt identifier, sent as a `cc_prompt_id` segment in the billing attribution header and in request metadata, so usage can be attributed to individual prompts. **Details** - Added to the attribution header only for first-party authentication, and only when the value matches a UUID shape. - Removed again when transcripts are exported or serialised, so it does not appear in saved conversation files. **Evidence** `cc_prompt_id` - Area: Usage & Limits - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### File-sync manifests now require a per-file sha256 Directory sync manifests must now include a sha256 for every file or they fail. **What** The manifests used to sync a directory between machines must now include a 64-character hex sha256 digest for every file alongside path, size, mode and etag. Manifests without it fail validation. **Evidence** `sha256` - Area: File Sync - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Delegated observer subagents are identified directly and skip attachments Observer subagents watching a delegated task no longer receive the usual attached files. **What** Subagents that exist only to observe a delegated task are now recognised from their own agent context rather than from a global list, and the code that gathers attachments returns early for them, so they no longer receive the usual attached files and context. **Evidence** `delegatedObservation` - Area: Subagents - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Prompt IDs attached to messages and request metadata Prompt identifiers follow your message into transcripts and request metadata, stripped from some exports. **What** Each user prompt now carries an identifier that follows it into the message record, into queued and appended transcript entries, and into the metadata sent with the request. Some export paths strip it back out. **Evidence** `promptId` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Ultrareview posting reports an outcome for every path Ultrareview PR posting now reports an outcome for every path, including deadline and failure. **What** The pull request posting routine now emits a `tengu_ultrareview_post` event tagged with what happened: disabled, skipped because there were no findings, send failed, sent, deadline reached, or exception. **Details** - Matching error keys include `ultrareview_post_disabled` and `ultrareview_post_no_findings`. - None of these strings appear in v2.1.226. **Evidence** `ultrareview_post_no_findings` - Area: Code Review - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Fleet view can read session transcripts through a stream backend The fleet list can read each job's last transcript line through a stream backend when supplied. **What** The agents/fleet list reads each job's last transcript line through a transcript stream backend when one is supplied, statting the transcript and reading its final 16384 bytes. With no backend it falls back to the previous local filesystem stat and tail read, so behaviour is unchanged for anyone not running one. **Details** - The stream key only resolves for a `.jsonl` file sitting directly under the projects directory; anything else takes the filesystem path. - Stat results are reported as present with a modification time, absent, refused (for `ELOOP` and `ENXIO`) or unreadable. - Failures raise "fleet view transcript tail read failed" or "fleet view transcript tail: stream not found". - Neither the errors nor the key descriptor shape exist in v2.1.226. **Evidence** `fleet view transcript tail read failed` - Area: Background Tasks - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Memory-directory access telemetry records what kind of file was touched Memory file access reporting now notes the file kind and how it reached the model. **What** When a tool reads or edits a file inside the memory directory, the event now also records whether it was a topic file, the memory entrypoint, a reserved path or something else, whether it had been accessed before, and how it had reached the model's context. Previously only the tool name was recorded. **Evidence** `tengu_memdir_accessed` - Area: Memory - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Newer storage layer reaches org memory, plugin caches and plugin skills Org memory cache, plugin orphan markers and plugin skills can route through the storage layer. **What** The organisation memory discovery cache, plugin version orphan markers and plugin skill loading now accept an optional storage handle and route reads and writes through it, each falling back to the previous direct filesystem path when no handle is passed. **Details** - Orphan marker write, delete and stat go through a plugin cache key when the path maps to a marketplace, plugin and version; plugin skills memoise in a separate cache slot when a handle is present. - References to this storage handle rise from a few dozen in the previous build to several hundred, so this release is mostly migration groundwork. - Which of the two paths a given user gets is decided by the callers and is not fixed in the source. **Evidence** `skillsV5` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### CLAUDE.md loading is now cached per project root CLAUDE.md and rules are now cached per project root rather than once per process. **What** The loader for CLAUDE.md, rules and AutoMem kept one process-wide cache; it now keeps separate state for each project root. The eager-load reason and the one-time `tengu_claudemd__initial_load` event are therefore per root rather than per process, and user-level memory can be read through the storage layer. **Evidence** `tengu_claudemd__initial_load` - Area: Memory - Tier: Under the hood - Useful: 3/5 - Signal: 2/5 ### Debug logging rebuilt around a single logger instance Debug logging now runs through one logger that keeps queued lines when it restarts. **What** Debug log settings that were separate cached lookups (`CLAUDE_CODE_DEBUG_LOG_LEVEL`, `--debug=`, `--debug-to-stderr`, `--debug-file`, `CLAUDE_CODE_DEBUG_LOGS_DIR`) now live on one object. Lines are tagged with their session and grouped before flushing, and can be written through the storage layer when one is installed, falling back to plain rotated log files otherwise. A newly started logger takes over the previous one's queued lines instead of losing them. **Evidence** `CLAUDE_CODE_DEBUG_LOGS_DIR` - Area: Debug Logging - Names: `CLAUDE_CODE_DEBUG_LOG_LEVEL`, `--debug-to-stderr`, `--debug-file`, `CLAUDE_CODE_DEBUG_LOGS_DIR` - Tier: Under the hood - Useful: 3/5 - Signal: 2/5 ### Fleet view state gathered into one host object The fleet view keeps your selected tab and cached statuses across a remount. **What** All of the fleet view's state now lives in a single host object built by a new factory, which callers can create once and pass back in. That lets the selected tab, cached job statuses, worktrees and the set of already-reported results survive a remount instead of being rebuilt. **Details** - The host holds jobs, earlier entries, loop kicks, statuses and their timestamps, PR statuses, the active tab (defaulting to "local"), remote jobs, child repos, repo worktrees, templates, skills, routines, and a block tracking which results have already been seen. - Both fleet view entry points now use a caller-supplied host if given, otherwise build a fresh one. **Evidence** `createFleetViewHost` - Area: Background Tasks - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### New timing mark and refusal reason Runner setup times repo settings reads, and refusals gained a new named reason. **What** The self-hosted runner setup records how long reading repository settings takes, and the classifier for model refusals gained a `gb_listed` reason ahead of its "other" catch-all. **Evidence** `runner_prep_repo_settings_ms` - Area: Telemetry - Tier: Under the hood - Useful: 1/5 - Signal: 3/5 ### Plan mode counts a routing question being offered Plan mode counts the first time a plan offers you a routing question. **What** Plan mode emits a new counter the first time a plan offers a routing question, recorded once per transcript, alongside the existing workshop and artifacts-first counters. **Evidence** `plan_routing_ask_offered` - Area: Plan Mode - Tier: Under the hood - Useful: 1/5 - Signal: 3/5 ### Version-control change notices include the branch Repository change notices now include the branch name alongside the event. **What** The internal notice sent when the repository state changes now carries structured details instead of bare labels, so a commit event includes the branch name along with the event kind and directory. **Evidence** `vcs_state_changed` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### claude.ai connector list moved onto session state Your claude.ai connector list is now cached on session state and cleared explicitly. **What** The fetch of your claude.ai MCP servers, its cached result, the cross-organisation notice and the set of servers connected this session moved from a memoized function onto a session object, so clearing it is now an explicit call. Retries, duplicate dropping and name collision handling are unchanged. **Evidence** `[claudeai-mcp] Dropping duplicate upstream ` - Area: MCP - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Managed policy limits can be cached through the storage backend Managed policy limits can be cached through the storage backend, falling back to the cache file. **What** The loader for managed policy limits can now prime its cache from a storage backend at startup and write and delete through it, under a `policy-limits` key. If the prime read fails or the cached blob is too large it logs and falls back to reading the raw cache file as before. Polling, stale-cache fallback and the existing telemetry are unchanged. **Details** - the storage path is used only when a storage backend is supplied; otherwise the file path is used **Evidence** `Policy limits: prime skipped (oversize cache); raw cache read stays` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Background-session rendezvous server rebuilt as an object The socket background sessions connect through is now created per start rather than shared. **What** The socket that background sessions connect through, including its authentication handshake, 30-second heartbeat, attacher caps, startup watchdog and prompt-draft restore, moved from module-level state into an object created per start, and its job-state reads and writes now take a storage backend. Behaviour, including the accounting of unauthenticated drops, is unchanged. **Evidence** `[bg-rv] dropped ` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Diagnostics tracking became an object, and plugin LSP configs can come from storage Diagnostics tracking is now per-instance and plugin language-server configs can come from storage. **What** Pending and delivered diagnostics, with their deduplication, per-file and total caps and purge on file change, are now per-instance rather than shared module state. Loading a plugin's language-server config can now go through the storage backend, with separate errors for a path containing a symlink, a missing file, and a path storage cannot address. **Evidence** `LSP config path contains a symbolic link that plugin storage does not follow` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Repository-mutation events can name the branch Commit events can now name the branch, as a best-effort hint from git's output. **What** The internal event emitted when a shell command changes repository state gained an optional branch field, read from the summary line git prints for a commit. Only commit events carry it, and it is a best-effort hint that is left out whenever attribution is uncertain. **Evidence** `The branch the commit landed on` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Session state and module caches reorganised into resettable objects Session state is built by a factory so caches clear as a unit instead of individually. **What** Session state is now built by a factory with a nested project group, and many long-lived caches (git availability, plugin agents, ripgrep availability and file counts, footer-link regexes, team-artifact scanning, temp directory resolution, marketplace loads, messaging socket state) became classes with an explicit reset. Per-session state is cleared as a unit rather than cache by cache; behaviour is meant to be unchanged. **Evidence** `project: { originalCwd: e, projectRoot: e, cwd: e },` - Area: Session State - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Daemon config reads refuse odd or oversized files A corrupt or huge daemon config file is refused rather than overwritten. **What** Reading the daemon config now classifies the result as text, absent, refused, failed or thrown. A device-node, directory, too-large-for-the-filesystem error, or content over 1 MiB counts as a refusal that aborts the read-modify-write rather than overwriting the file. This applies on the newer storage read path only. **Evidence** `is not a regular file (or exceeds 1MiB); refusing read-modify-write` - Area: Daemon - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Sandbox and container detection folded into one cached prober Docker, bubblewrap and root-outside-sandbox checks share one cached prober that answers false until ready. **What** Docker, bubblewrap, running as root outside a deliberate sandbox, and "contained with no internet" checks now live in a single class that caches each probe. One gate additionally requires an internal-network probe to come back empty. Its synchronous accessor reports false until the asynchronous checks have settled, so very early callers see the negative answer. The bubblewrap and `IS_SANDBOX=1` signals are Linux-only. **Evidence** `passesAntDspEnvGateSync` - Area: Sandbox - Names: `IS_SANDBOX` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Six known API error messages are reported verbatim in telemetry Six known API errors, including expired tokens, keep their real text in error reports. **What** Error telemetry usually replaces the server's message with a generic type-and-status string. A fixed allowlist now exempts six messages, including expired OAuth tokens and oversize requests, so those failures stay distinguishable in aggregate. **Evidence** `"OAuth access token has expired. Re-authenticate to continue."` - Area: Telemetry - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Crash reports count concurrent sessions Crash reports note when two or more sessions were running at the same time. **What** A new helper counts active bridge sessions when a crash is recorded and, if two or more overlap, fires a `multi_session_crash` event carrying that count. Failures are swallowed. **Evidence** `multi_session_crash` - Area: Telemetry - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Module-level caches became resettable session state Long-lived caches now clear per session or fork rather than lasting the whole process. **What** Dozens of long-lived caches now hang off a session state object with a reset method, so they can be cleared per session or fork instead of living for the whole process. **Details** - Covers the install-latest in-flight promise, task-list leader name, artifact live, auto-react and wake registries, clipboard probe results, gitignore pattern compile caches, the plugin activity ring buffer, marketplace tip caches, the plugin flag cache, session title and agent-name events, and the background-result-seen channel. **Evidence** `resetMarketplaceCaches` - Area: Session State - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Rejected background dispatch files now say why The background daemon now records why it refused a queued dispatch file. **What** The background daemon records a specific reason when it refuses a queued dispatch file, so failures are distinguishable instead of silent. **Details** - Reasons: `bad_name`, `not_a_file`, `oversized`, `read_failed`, `stale`, `schema`, `bad_json`, `transform_throw`, `symlink`. - A shared helper logs `[bg-dispatch] rejected …` and emits `tengu_bg_dispatch_rejected` with a truncated reason. - A newer storage path reads dispatches with a byte cap and deletes the entry once handed off. **Evidence** `daemon_bg_dispatch_ingest` - Area: Daemon - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Markdown config files are listed in one recursive pass Commands, agents and output styles load in one recursive listing when the newer storage client is available. **What** Loading markdown-backed config from the user config directory (commands, agents, output styles, routines and so on) now makes a single recursive listing request filtered to `.md` files instead of walking directories page by page. This only happens when the newer storage client is available; otherwise the old direct filesystem scan runs unchanged. **Details** - On a listing error it logs a warning and falls back to the raw filesystem scan; if the 10000 page cap is hit it keeps the entries already seen and warns. - Each file is then read with a bounded read and skipped when its reported total size exceeds 1 MiB, rather than trusting a size from the directory listing. - The recursive listing call does not exist at all in v2.1.226. **Evidence** `loadMarkdownFilesFromDir: skipping ` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Feature-flag machinery rebuilt as a class with a real dispose path Feature-flag handling now cleans up properly, restoring the original fetch when disposed. **What** Client creation, exposure logging, remote evaluation, disk sync and the periodic refresh loop moved from module-level globals into one class with injected dependencies behind a lazy singleton. Disposing now restores the SDK's own fetch function instead of leaving the patched wrapper installed, and a disposed instance stops creating clients or refreshing. **Details** - The authenticated evaluation endpoint is still decided per call by `tengu_gb_eval_authed_enable`, whose in-source fallback is false; nothing in this build sets it, so the real value comes from remote config. **Evidence** `tengu_gb_eval_authed_enable` - Flag `tengu_gb_eval_authed_enable`: Not enough to say (read for one account on one subscription tier against v2.1.227; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Session file scanning no longer blocks, and recent projects are checked first Searching across projects now checks your most recently used ones first and doesn't block. **What** The size probe on session files uses a non-blocking stat, and when searching across projects Claude now collects every project first and scans them newest-modified first rather than in directory order. **Evidence** `Number.NEGATIVE_INFINITY` - Area: Sessions - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### "Did you mean" file suggestions no longer block on a directory scan "Did you mean" file suggestions no longer scan the directory while the screen renders. **What** The sibling-file lookup behind Read, Write and Edit error suggestions now reads the directory asynchronously. Same suggestions, no synchronous scan while rendering. **Evidence** `let r = await Cmt(e),` - Area: File Tools - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Markdown and output-style caches now clear with the rest of session state Reloading config now reliably drops cached markdown commands and output styles. **What** The loaders for markdown config files and output styles used to memoise their results in module-level variables that lived for the process lifetime. Those results now sit in three named slots on the shared load cache, so a config reload reliably drops them. **Details** - The slots are `markdownFiles`, `outputStyleDirStyles` and `allOutputStyles`, all cleared by the central cache reset; `markdownFiles` is also dropped when skill directories are invalidated. - None of the three names exist in v2.1.226. **Evidence** `outputStyleDirStyles` - Area: Slash Commands - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Probes report whether old code paths are still reached One-off counters now show which old code paths are still being used, so they can be removed. **What** Four one-shot telemetry probes now fire the first time a legacy path is hit, to work out what can be deleted. They cover the Co-Authored-By attribution setting, legacy local settings, the legacy progress bridge, an older token-adoption path and legacy plugin tip counts. No user-visible effect. **Details** - Each probe is deduplicated per call site and can be reset; the token-adoption probe reports the site it fired from, and the plugin tip probe fires once per distinct outcome pair. **Evidence** `tengu_dead_probe_include_coauthored_by`, `tengu_dead_probe_adopt_ticks_token` - Area: Telemetry - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Background jobs, daemon markers and insights caches use storage keys Background job files, daemon markers and insight caches can live in the storage layer instead of on disk. **What** Background job teardown deletes the job's storage scope rather than removing its directory, daemon host-managed markers and pty pid files are written and deleted as storage keys, and the usage-insights caches are read in batches with a per-key fallback. Each keeps the old filesystem path when the newer storage backend is not present. **Evidence** `host-managed` - Area: Internals - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Storage keys are now validated with per-area rules and readable errors Storage keys are checked before use, so malformed ones fail with a clear message. **What** A new layer checks every storage key before it reaches the storage engine and rejects malformed ones with a specific message instead of letting them through. You would only ever see one of these if something were already wrong. **Details** - It enumerates the legal directory names under the user config directory, including `mcp-discovery-cache`, and the plugin registry files: `installed`, `marketplaces`, `flagged`, `catalog`, `inUseSweep`. - Log channels are restricted, with the error text "must be debug, telemetry or apiDump". - Relationships are enforced too, such as a scratch relative path requiring a session id. **Evidence** `must be debug, telemetry or apiDump` - Area: Internals - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Task and jobs keys may only name one thing at a time Task and job storage keys must name exactly one thing or they're rejected. **What** A task key must name exactly one of an item, the list metadata, or the list high-water mark, and a jobs key names either the pins file or one draft. Draft identifiers must be 8 lowercase hex characters. Violations now return a named error rather than passing silently. **Evidence** `a jobs-root key names the pins file or one draft, never both` - Area: Internals - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Daemon records how long a claimed session waited The daemon records how long a claimed session waited, but nothing shows it yet. **What** The background daemon now stamps each claim with the time it was picked up and reads it back as an elapsed duration, clearing the entry on teardown. Nothing surfaces from it yet. **Evidence** `claimVisibility: new Map()` - Area: Daemon - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Two new telemetry events Two new counters cover swept placeholder bridge sessions and iTerm2 crash-restore probes. **What** Two events were added that did not exist before: one recorded when a placeholder bridge session turns out to have been used and is swept away, and one from the iTerm2 crash-restore probe, carrying whether a backup path was found. **Details** - `tengu_bridge_placeholder_used_session` is emitted with `v2: !0` immediately before removal. - `tengu_dead_probe_iterm2_crash_restore` reports the backup-path result. **Evidence** `tengu_dead_probe_iterm2_crash_restore` - Area: Telemetry - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Module-level mutable state folded into resettable holders More scattered state became resettable holders, including per-instance locks instead of one global. **What** Dozens of scattered module-level variables, maps and sets were moved into lazily created state objects reached through accessors, covering plugin state, agent and task state, git scrub paths, config caching, teammate mailboxes and terminal capability probes. Several holders gained a `reset()` method, and a process-wide promise-chain lock became a factory producing per-instance locks, so in-process state can now be torn down and rebuilt. **Details** - MCP errors are now dispatched into a store as `{ type: "mcpError", serverName, error }` rather than accumulated in a module array. - New named fields include `agentTranscriptSubdirs`, `bareGitRepoScrubPaths`, `installedPluginsFile`, `terminalRejects`, `childProcessTmpDirMemo` and `scriptCapsLatched`. - No user-visible behaviour change. **Evidence** `bareGitRepoScrubPaths` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Legacy background-session paths are counted once each Each older background-session operation reports once, showing which legacy paths are still used. **What** The first time each older background-session operation is used, `tengu_dead_probe_bg_legacy_op` fires, making continued use of the pre-storage code path visible without repeating on every call. **Evidence** `tengu_dead_probe_bg_legacy_op` - Area: Sessions - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Debug log buffering now handles structured entries Debug log buffering handles structured entries, letting debug output go to the storage backend. **What** The buffered writer behind debug logging batches items measured by their own content length rather than concatenating strings, with a wrapper preserving the old joined-string behaviour. This is what allows debug output to be appended to the new storage backend rather than straight to a file. **Evidence** `writeBatch` - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Module-wide mutable state gathered into containers Skills, team context, MCP sockets and ingress tokens moved into resettable containers. **What** A large sweep moves file-level variables, maps and sets onto singleton objects reached through accessors, covering skills and commands, team context, MCP monitor sockets, swarm permissions, ingress tokens and the lazy-value helper. Nothing changes for users, but per-process and per-session state can now be reset in one go. **Evidence** `bundledSkillSessionResetHooks` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Auto-accept-edits telemetry separates linked worktrees Edits auto-accepted in a linked worktree are counted separately from ordinary ones. **What** Edits auto-accepted through a linked worktree path are now reported under their own label rather than being counted with ordinary auto-accepted edits, on both the success and error paths. **Evidence** `acceptEditsLinkedWorktree` - Area: Permissions - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Reads of the old local settings file are now reported Reads of the old local settings file are now reported to the caller. **What** The settings loader can notify a caller when it reads a legacy local settings file, distinguishing a read during the full merge of all settings sources from a read of that one source alone. **Details** - The callback `onLegacyLocalSettingsRead` receives `"cascade"` or `"per_source"`; the CLI forwards it to an event emitter. **Evidence** `onLegacyLocalSettingsRead` - Area: Settings - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Recovered background attaches report the same way on both code paths Recovered background attaches report identically whether found by the old or new sweep. **What** The event describing a background attach recovered from its journal moved into one shared function, so the older filesystem sweep and a new storage-backed sweep now produce identical reports. **Details** - `tengu_bg_attach_outcome` carries `journal_recovered: true`, `synthetic: true`, attach timing, first frame kind and message counts. **Evidence** `tengu_bg_attach_outcome` - Area: Sessions - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Workshop authoring-progress failures now report telemetry Workshop authoring-progress failures now report once per session instead of only hitting the log. **What** Errors in the workshop authoring-progress hooks were previously only written to the log. They now also emit a telemetry event, once per session at most, and a separate one when the module cannot be loaded at all. **Details** - The keys are `hook_failed` and `module_load_failed` under `workshop_authoring_progress`; a `failureReported` flag stops repeat reports. - The lazy loader was restructured into a class whose reset can swap the require function, a test seam. **Evidence** `workshop authoring-progress module failed to load` - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Directory listings share one paginator with a 10,000-page ceiling Long directory listings now stop at a ceiling instead of looping forever. **What** Listing loops across skills, tasks, sidecar images, session transcripts for insights, themes, task metadata and session deletion were moved onto a shared paginator that reports done, error or capped, replacing previously unbounded loops. **Details** - The cap is 10,000 pages, with an optional shared budget across callers. - Callers decide what hitting the cap means: task listings are treated as failed, theme listing keeps whatever loaded, and the insights scan keeps the projects it saw and logs how many were left unscanned. **Evidence** `pages; treating the listing as failed` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Settings loading caches ownership and the real home directory Settings loading caches file ownership checks, so startup does less repeated work. **What** Settings loading now caches file ownership for the project root, its `.git` entry and its `.claude` entry, plus a resolved home directory, and reports read problems as structured issues instead of raw errors. **Details** - A home directory that cannot be resolved raises "home directory realpath unavailable"; a file that cannot be read produces a fatal issue reading "Settings file could not be read: ...". - The managed-settings locations (/Library/Application Support/ClaudeCode, C:\Program Files\ClaudeCode, /etc/claude-code) and the drop-in directory beside them moved into a resettable holder. - The settings directory is now created before every write, not only when the file was missing. **Evidence** `home directory realpath unavailable` - Area: Settings - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Shutdown and crash handling gathered into one object Signal handling, crash loops and shutdown timers now live in one lifecycle object. **What** Signal handling, the loop breaker for repeated uncaught exceptions, the HTTP/2 teardown recovery budget, orphan detection, the shutdown failsafe timer and the resume hint moved from scattered variables into a single lifecycle object. The same signals, exit codes and telemetry remain. **Evidence** `SIGHUP_ignored_bg` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Slash command lists rebuilt from shared state Slash command lists are rebuilt from shared state with one explicit refresh call. **What** Built-in commands, loaded commands and skill-backed commands no longer sit in process-wide caches; they hang off a state object with an explicit invalidation call that also clears the workflow cache. The resulting command set is unchanged. **Evidence** `cmd_load_slash_tool_skills_failed` - Area: Slash Commands - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Theme and terminal capability state moved onto objects Themes and terminal probe results moved onto objects, and huge theme files are skipped. **What** Custom theme bases, user and plugin themes and the detected system theme now sit on one object with a change notifier, and terminal probe results (version query, synchronized output, background colour query, native cursor) sit on another that can be reset. User themes can also be listed and read in bulk through the storage backend, with paging capped and individual theme files over 256KB skipped. If that listing fails or hits its cap, already-loaded themes are kept instead of being cleared. **Evidence** `exceeds 256KB; skipping` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Settings environment state moved onto one object Settings-driven environment variables and plugin paths are now handled by one resettable object. **What** Applying environment variables from settings layers, the rules that let managed telemetry settings win, the snapshot of the environment taken before settings load, and the set of keys passed to spawned hosts are now fields on a single object, so resetting them is one call. Plugin cache and marketplace paths can now be turned into storage keys, and plugin MCP server files read through the backend. **Evidence** `so lower-trust scopes cannot redirect ` - Area: Settings - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Version and build stamp bumped to 2.1.227 The version stamp moves to 2.1.227. **What** The embedded build constants move to version 2.1.227 with a new build time and commit hash. These show up in `-v, --version`, the `claude-code/` and `claude-cli/` user agents, the `x-environment-runner-version` header, npm install and view targets, doctor output, bug report metadata, daemon start and version-mismatch messages, auto-updater hints, remote-control minimum-version errors, and the SDK binary version reply. **Evidence** `VERSION: "2.1.227"`, `BUILD_TIME: "2026-08-10T18:40:15Z"` - Area: Elsewhere - Names: `--version` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Cleanup throttle marker self-heals when it is not a regular file If the cleanup marker file is a directory or symlink loop, it's deleted and rebuilt. **What** Before trusting the `.last-cleanup` marker that rate-limits cleanup runs, the code inspects it. If the check fails with a symlink loop, directory or device-node error, it records a telemetry event with the error code and verdict, deletes the marker, and logs whether removal succeeded. A separate pass deletes stale files matching a fixed list of cleanup marker names. **Evidence** `tengu_cleanup_throttle_marker` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Git calls in the sync lane keep custom config paths Git calls in the sync path now respect your custom global and system config paths. **What** The helper that shells out to git now forwards `GIT_CONFIG_GLOBAL` and `GIT_CONFIG_SYSTEM` when they are set, and takes its output buffer size as an argument with a default instead of a hard-coded constant. **Evidence** `GIT_CONFIG_GLOBAL` - Area: File Sync - Names: `GIT_CONFIG_GLOBAL`, `GIT_CONFIG_SYSTEM` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Heartbeat and pid-file writes publish in place Heartbeat writes tolerate harmless failures, though a failed pid-file creation still aborts. **What** Session heartbeat touches and pid-file creation and updates now ask the storage backend to write in place, and tolerate benign write failures instead of throwing. A failure to create the pid file still aborts. **Evidence** `publishDiscipline: "inPlace"` - Area: Daemon - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Bedrock and Vertex share one stale-model check Bedrock and Vertex now share one check for outdated pinned model variables. **What** The duplicated per-provider code that checks whether your pinned model environment variables lag the current defaults is now a single shared routine. **Details** - Covers `ANTHROPIC_DEFAULT_SONNET_MODEL`, `ANTHROPIC_DEFAULT_OPUS_MODEL`, and `ANTHROPIC_SMALL_FAST_MODEL` / `ANTHROPIC_DEFAULT_HAIKU_MODEL`. - The Bedrock path now emits `tengu_bedrock_upgrade_check` before resolving model IDs instead of after. **Evidence** `tengu_bedrock_upgrade_check` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Unreadable agent metadata is logged instead of silently ignored Unreadable agent metadata is now logged with the underlying error instead of ignored. **What** When the small file holding an agent's saved metadata cannot be read, the failure is now logged with the underlying error and the name of the code that hit it, before falling back to treating the file as absent. **Details** - Replaces a bare catch that returned nothing. - Callers identify themselves, for example `persistAgentMetadata` and `clearWorktreeFromAgentMetadata`. **Evidence** `agent metadata sidecar unreadable, treating as absent` - Area: Agents - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Lock releases now log instead of failing silently Failed lock releases now log a warning, including when a lock vanished before release. **What** Releasing a task or mailbox lock goes through a shared helper that catches the error and logs a labelled warning. It distinguishes a lock that was already gone at release time, noting that the protected section may have run without exclusivity, from a stale lock directory left behind. **Details** - Labels identify the call site, such as claiming a task, claiming a task with a busy check, or writing to a named recipient's mailbox. **Evidence** `lock was no longer held at release` - Area: Background Tasks - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Nonsense terminal sizes warned once; scan timing removed A garbage terminal size now warns once per process instead of repeatedly. **What** A garbage terminal size is now logged as a warning once per process instead of repeatedly. Separately, the text-scan routine dropped its timing instrumentation and the counter it fed. **Evidence** `loggedGarbageWinsize` - Area: Terminal Rendering - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Background job state cache rewritten with a read-failure policy A broken job state file is rejected once instead of warning over and over. **What** The cache of per-job state files gained a mode where a failed read returns nothing rather than the last known state, and a state file that is oversized or not a regular file is rejected once instead of warning repeatedly. **Details** - Modification-time keys, transient-error deduplication, prune reporting and sidecar-fallback logging moved from loose module-level maps into one object with named methods. - Callers pick the behaviour by asking for the null-on-failure mode. **Evidence** `shouldReportTransient` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Two new warnings for degraded config listings Config loading warns when its listing falls back to a raw scan or hits the page cap. **What** Config loading now logs a warning when its directory listing degrades, one ending "falling back to the raw scan" on error and one ending "keeping the entries seen" when the page cap is hit. The directory path and error are interpolated in. **Evidence** `keeping the entries seen` - Area: Internals - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### gh pr review short flags now recognised Short flags on gh pr review are now counted the same as long ones. **What** The counters for approvals and change requests on `gh pr review` now also match `-a` and `-r`, not just the long flags. **Evidence** `pr_review_request_changes` - Area: Telemetry - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Module-level caches moved onto objects More caches, from the PR poller to the model catalog, became resettable objects. **What** A large sweep replaced module-level variables holding caches and one-shot flags with objects and classes exposing named accessors, across config file reading, the Chrome install prompt, the GitHub PR poller, sandbox startup, plugin hook hot-reload, iTerm teammate panes, artifact live subscriptions and the model catalog. Behaviour is largely unchanged; these caches are now per-instance and can be reset. **Evidence** `AA.installUpsellBypassSuppressionCounted` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Prompt text de-dashed Memory and shell-command prompt wording swaps em-dashes for plainer punctuation. **What** The memory-saving guidance, its category list (`user`, `feedback`, `project`, `reference`) and the recalled-memory caveat now use colons and full stops instead of em-dashes, as does the prompt about state-changing commands. The wording is otherwise unchanged. **Evidence** `Before running a command that changes system state (such as restarts, deletes, or config edits), check that the evidence actually supports that specific action.` - Area: Agents - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Workflow discovery distinguishes truncated listings Workflow listings that stop early are now reported separately from skipped or broken workflows. **What** When Claude Code stops listing your workflows early, telemetry now records that specifically as `user_listing_truncated` rather than mixing it in with workflows skipped for being oversize, unreadable or having invalid metadata. **Evidence** `user_listing_truncated` - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Task store now comes from a React provider The tasks store is provided through app state instead of a global singleton. **What** The tasks store is read through a context mounted by the app state provider instead of a module-level singleton, and using it outside that provider raises a named error saying so. **Evidence** `useTasksV2 cannot be called outside of a TasksV2StoreContext provider (mounted by <AppStateProvider />)` - Area: Background Tasks - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Fork boilerplate detected by prefix rather than by scanning Forked-conversation boilerplate is spotted by prefix rather than scanning every message. **What** The marker that identifies forked-conversation boilerplate is now matched as a prefix on the first content blocks of a single message, instead of searching every text block of every user message for the substring. **Evidence** `<fork-boilerplate>` - Area: Sessions - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### MCP credential and cache locations are now parameters MCP credentials and the discovery cache are now passed in rather than read from globals. **What** Both MCP OAuth providers read credentials through an injectable store rather than a global, and the MCP discovery cache is described by a location record naming the user config directory and a `mcp-discovery-cache` folder instead of an in-process map. Behaviour is unchanged. **Evidence** `mcp-discovery-cache` - Area: MCP - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Terminal theme-change notifications dispatch per connection Terminal theme change notices now go to the specific connection instead of a global handler. **What** Theme change notices from the terminal are no longer caught by a process-wide handler in the input loop; they go to subscribers of the specific terminal connection, and the old global subscribe and cache helpers were deleted. Behaviour should look identical. **Evidence** `themeNotify` - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Per-process state moved into explicit singleton objects MCP state, bundled skills, keybindings and the command classifier became singletons you can reset. **What** Dozens of loose module-level variables and cached closures were replaced with singleton class instances, covering MCP connection state, bundled skills and builtin plugins, browser-extension state, keybindings, the package-manager detector and the Bash command-prefix classifier. Most now expose `reset()` or `invalidate()`, which changes when caches clear rather than what you see. **Details** - MCP state now carries reconnect, toggle, disabled and policy handling plus a `skippedDynamicServers` list in one place. - Also folds in the remote-settings barrier, the `/dev/tty` stdin override and style-key recording. **Evidence** `skippedDynamicServers` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Root-outside-sandbox detection folded into one class Root-outside-sandbox and container checks moved into one class with a hardcoded Linux platform. **What** The check for running as root outside a deliberate sandbox, along with the related container and environment-gate checks, now lives in a single class with its inputs injected rather than read directly. The platform value passed in is the literal "linux", so the class's non-Windows guard is always satisfied here. **Evidence** `isRootOutsideDeliberateSandbox` - Area: Sandbox - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Per-session state moved into state-container objects Session state variables were gathered into containers so a session resets as a unit. **What** Dozens of module-level variables holding session state were replaced by fields on singleton container objects, so a session's state is now reset as a unit rather than one variable at a time. No behaviour changes. **Details** - transcript and session state now exposes fields such as the session isolation latch and agent name, and methods including `clearInternalEventWriter` and `setRemoteIngressUrl` - the old catch-all app-state object was renamed, and its init JSON schema, scheduled-tasks flag and prompt cache allowlist moved to dedicated modules **Evidence** `clearInternalEventWriter` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Daemon and fleet module state collapsed into resettable holders Daemon, deny rules, plugin caches and compaction gating state can now be reset in one place. **What** Loose module-level variables across the daemon, deny-rule handling, plugin caches, terminal recording, shell config and compaction gating were replaced by state objects with a `reset()`. Behaviour is unchanged; the state can now be cleared in one place. **Evidence** `denyLiteralSymlinkCandidates` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Claude API skill documents are byte-identical despite appearing rewritten The bundled Claude API guides look rewritten in the diff but are byte-for-byte identical. **What** The whole set of bundled `claude-api` skill guides shows up as new text in this build, but this is a bundling artifact. The file map has the same 65 entries, every document occupies the same line span with the same content, and no model ID, beta header or guide entry changed. The skill works exactly as before. **Evidence** `menuDescription: "Build and debug apps that use the Claude API"` - Area: Skills - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Claude API skill drops the cached document loader The Claude API skill reloads its documents each time instead of caching the load. **What** The helper that loads the skill's documents no longer caches its promise, so each invocation starts a fresh load chain. Module setup is still idempotent, so the documents and the `tengu_claude_api_skill_loaded` event are unaffected. **Evidence** `tengu_claude_api_skill_loaded` - Area: Skills - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Large bundled skill and docs blocks moved, not deleted Big skill and docs blocks that look deleted were only moved; nothing was dropped. **What** Several big text blocks that look removed in the diff, including the API reference docs, the artifact skills, the `/run` and `/batch` prompts and the MCP resource tool descriptions, still occur verbatim in this build. They were relocated within the bundle; no capability was dropped. **Evidence** `Provide an instruction describing the batch change you want to make.` - Area: Skills - Names: `/run`, `/batch` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Skill and command text de-duplication cache moved into session state The skill and command text de-duplication cache now clears with the rest of session state. **What** The map that reuses one copy of an unchanged skill or command file body was a process-lifetime global; it is now a field on the shared session state container, so it is cleared along with everything else on reset. **Evidence** `skillContentIntern` - Area: Session State - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Terminal style-pool counters moved onto their recorder Two terminal render pools no longer share one set of counters and warnings. **What** Proactive terminal redraws and their one-time health and cap-hit reports are now driven by per-instance counters instead of module-wide ones, so two pools no longer share a latch. **Evidence** `render_stylepool` - Area: Terminal Rendering - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Layout caching moved onto the nodes themselves Layout data moved onto each node, and mixing layout configurations now raises an error. **What** Cached layout rectangles and pending-clear tracking now live on each layout node rather than in a side lookup table, and the counters for nodes visited, measure calls and cache hits moved onto the layout configuration object. Adding a child created under a different configuration now raises an error instead of producing inconsistent layout. **Evidence** `insertChild: child was created with a different Config` - Area: Terminal Rendering - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Terminal renderer state moved off module globals Renderer instances no longer share mutable state, so multiple renderers don't interfere. **What** Layout rectangles are now stored on each rendered node rather than in a shared module-level map, and the "stdout has died" latch moved onto the renderer instance. Renderer instances no longer share mutable state. **Details** - Node layout is used for hit-testing, click dispatch and scroll adjustment. - Instance fields `stdoutDead` and `tolerateDeadStdout` replace globals; neither name exists in v2.1.226. **Evidence** `if (e.tolerateDeadStdout && (kSd(a) === "EIO" || kSd(a) === "EPIPE")) {` - Area: Terminal Rendering - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Layout results cached on nodes instead of a side table Layout results are cached on each node rather than in a shared table. **What** The terminal renderer now stores each node's computed layout on the node itself rather than in a separate lookup table, and the layout engine carries its own counters for nodes visited, measure calls, cache hits and live nodes in place of module-level functions. **Evidence** `cachedLayout` - Area: Terminal Rendering - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Terminal renderer and input plumbing The renderer and file-path matcher allocate less; nothing looks different. **What** The renderer's style pool gained a recorder that can be turned on, reset and asked for its size, threaded through screen and cursor setup, and the file-path fuzzy matcher now reuses a fixed 64-entry buffer for match positions instead of allocating one. No visible text or behaviour changes. **Evidence** `atlasRecorder` - Area: Terminal Rendering - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Event loop stall detector rewritten as a class The event-loop stall detector was rewritten as a class with identical behaviour. **What** The stall detector's counters were moved into a class with a single instance. Same 200 ms interval, same threshold and sleep/wake heuristic, same `[event-loop-stall] detector started` line, same `tengu_event_loop_stall` event fields, and the same terminal mode reassertion after a suspected sleep/wake. **Details** - Two neighbouring singletons got the same treatment: a run-budget tracker exposing `isOverBudget`, `recordRun` and `firstPolicySkipFor`, and a deduper exposing `markIfChanged`. Nothing in the surrounding code shows what those two control. **Evidence** `[event-loop-stall] detector started` - Area: Performance - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ## Removed ### npm install deprecation warning dropped from startup The startup nag telling npm installers to switch to the native version is gone. **What** The warning shown to people who installed via npm is gone. Both the "Installed via npm (deprecated)" line with its "run claude install to switch to the native version" hint and the underlying setup-issue flag behind it were deleted; they were present in 2.1.226. **Evidence** `Installed via npm (deprecated)`, `npmInstallDeprecated` - Area: Startup - Names: `claude install` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Per-commit render timing log dropped A debug log that wrote per-frame render timings to a file no longer exists. **What** The debug path that appended per-commit gap, reconcile and slow-frame lines to a file under an environment variable is gone, and that variable no longer appears anywhere in the build. What remains is a scroll-commit duration measurement plus the layout and render callbacks. **Evidence** `scrollCommitStartedAt` - Area: Elsewhere - Tier: You'll notice - Useful: 1/5 - Signal: 1/5