What probably matters to youSection of the release
What
Remote-controlled sessions now attach a per-turn attribution key to API request metadata as tk, alongside device_id, session_id and parent_session_id. Because of that, tk has been added to the list of metadata names you cannot set yourself: anything you put under that name in CLAUDE_CODE_EXTRA_METADATA or CLAUDE_CODE_EXTRA_BODY is stripped before the request is sent.
Details
The full reserved set is ti, sb, he, uf, ap, tk; your object is filtered against it so the key cannot be spoofed.
The key is carried on queued user messages, propagated through agent contexts, and merged when queued prompts are combined, where the last keyed entry wins.
Only computed when the session is running remote-controlled (CLAUDE_CODE_REMOTE); omitted otherwise, and deliberately not set for cross-session inbound messages.
