Cloud sessions get told outright they cannot message peers that require a trusted device.
The trusted-device refusal only fires when tengu_sessions_elevated_auth_enforcement is on, which falls back to off.
tengu_sessions_elevated_auth_enforcement Gate removed from the codeThis release deleted the gate from the code while it was still reading on for the account this site reads, so the code path no longer asks a flag before running.
This account: on · anonymous baseline: on · compiled default in v2.1.232: not a boolean we can read
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.232. It isn't a statement about your account. What a flag value here can and cannot tell you
What's wrong with this entry?
Sending to a Remote Control peer from a cloud session now fails immediately with an explanation that "that session requires a trusted device, which a cloud session never has", instead of attempting the send. This only happens when the flag tengu_sessions_elevated_auth_enforcement is on, which falls back to off, and your organisation enforces the require_trusted_devices policy.
- The check fires when the session is marked remote, has no
CLAUDE_TRUSTED_DEVICE_TOKEN, and the org policy is enforced.
that session requires a trusted device, which a cloud session never has
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
Messages injected by a host are classified separately from peer messages
Both mention cross
-
v2.1.234
Cross-session control requests check ids more carefully
Both mention cross
-
v2.1.234
Notice acks now wait for the record to persist
Both mention cross