# Claude Code v2.1.234 > Claude Code v2.1.234, released 17 Aug 2026 (2026-08-17). 332 entries read out of the shipped bundle. Unofficial, and not affiliated with Anthropic. Web version: https://changelogs.core-directive.com/v/2.1.234 A large amount of unfinished work sits in this build without a way to reach it, 50 entries in all. Groundwork for a Slack tagging integration is wired through session state, storage and tool selection, including a `CLAUDE_CODE_SLACK_TAG_TOKEN` environment variable and a `slack-tag` status line segment, but nothing ever switches it on. A `session_notice` message that would let one session inject a coordination notice into another needs a remote-session environment variable, the `tengu_polished_lagoon` flag and a helper that always returns false. Status-line narration under the spinner, which runs a background query describing what Claude is doing and plans to do next, requires `CLAUDE_CODE_ENABLE_NARRATION` and a paced interval that falls back to 0. Also inert: a gate for sending queued messages with Enter (`tengu_jiggly_mochi`), reporting newly created pull requests to the cloud service (`tengu_record_created_pr_to_ccr`), an empty `wellbeing` component, and a locked-down HTTP mode in the built-in MCP server that `claude mcp serve` never selects. Sessions stopped by a claude.ai usage limit can now hold open, wait for the reset and resume the interrupted task, controlled by the new `autoContinueAtUsageLimit` setting, which defaults to on. The artifact tool gained four asset actions, `upload_asset`, `list_assets`, `read_asset` and `delete_asset`, capped at 20971520 bytes per file and 2097152 for SVG, and turned off by setting `CLAUDE_CODE_ARTIFACT_ASSETS`; artifacts themselves now default on for consumer OAuth logins. Setting `syncClaudeAiSkills` to `false` stops skills downloading from your claude.ai account and moves already-synced ones to `~/.claude/skills/.trash` at next launch. Plan mode now uses auto-mode permission semantics under the new `useAutoModeDuringPlan` setting, on by default, and programmatic sessions receive a status message on the stream-json output whenever the permission mode changes. Goals blocked by running background shells or agents get a check-in message every 30 minutes, tunable or disabled with `CLAUDE_CODE_GOAL_CHECKIN_MINUTES`. These are 6 of 171 shipped entries. The remote kill switch that could force a session out of bypassPermissions mode is gone, along with the mid-session re-check that exited the process and the "disabled by your organization policy" message; the `disableBypassPermissionsMode` setting is now the only way to disable the mode, and SessionEnd hooks no longer see a `bypass_permissions_disabled` reason. Permission grants from hooks, permission-prompt tools and `updatedPermissions` responses no longer vanish in background agents and SDK hosts, which do not share app state. Listing a command in `sandbox.excludedCommands` no longer runs it outside the sandbox once unsandboxed commands have been disabled for the session. Both git remote URL matchers were narrowed so a crafted remote cannot make Claude Code derive the wrong `owner/repo` identity. A slash command that throws now reports the error into the conversation as command stderr instead of silently clearing the UI. ## What probably matters to you Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail. ### Sessions can wait out a claude.ai usage limit and continue on their own Your session can now wait out a usage limit and pick the task back up by itself. **What** When a claude.ai usage limit stops your session, Claude Code can now hold the session open, wait for the limit to reset, and resume the interrupted task by itself. It is controlled by a new `autoContinueAtUsageLimit` setting that defaults to on, is also offered as a choice in the `/rate-limit-options` dialog when the setting is off, and announces itself with notifications when it arms, fires, or gives up. A set of specific cancellation messages covers every way the wait can end, so you always know whether the task will restart on its own. **Details** - On resume the session sends itself the prompt "Your claude.ai usage limit has reset. Continue the task you were working on when the limit was reached; do not repeat work that is already complete." - The `/config` row is labelled "Continue automatically at usage limit" and described as: when a claude.ai usage limit stops your session, wait for the limit to reset and continue the task automatically; when off, the limit dialog offers the wait as a choice instead. - That `/config` row is consent-gated and appears only when the setting is unset or came from your own user settings; the underlying schema entry is a boolean defaulting to true. - The `/rate-limit-options` menu gains an auto-resume choice plus a cancel choice to disarm it, with the wording varying by what is known: one label when a reset time is available, one when the limit has already passed, one when neither, including "Wait here, then continue automatically when the limit resets". The menu entry is built per render rather than behind its own named flag. - Confirmation text warns the wait may still pause for permission prompts, and the footer shows a cancellable notice with the reset time when known: `Continuing automatically when your limit resets · esc to cancel`. - Notifications include "Usage limit available — Claude is continuing your task" and "Automatic continue was turned off — the task will not resume on its own", added as three new entries in the shared notification type list that also drives hook events, so hooks see them too. No gate was found on the notification types themselves. - Stop cases cover exceeding the wait horizon, a dropped continuation, and hitting the limit repeatedly; there is a cap on re-arming, jitter before firing, and a "stale" state for when the machine slept through the reset time. - The wait cancels on Ctrl+C, escape, switching accounts, backgrounding, relaunch, plain exit, and handing off to Claude Desktop or to the cloud, each with wording naming that specific departure and stating you can send a prompt after the reset to continue, for example `Automatic continue cancelled · Claude Code exited during the wait, so the task will not resume on its own when the usage limit resets (send a prompt after the reset to continue)` and "Automatic continue cancelled · Claude Code relaunched during the wait…". A handoff message also explains that a handoff cancelled the automatic continue and points back at `/rate-limit-options`. - On exit the transcript runs through a handoff step before the session-end path (`process_exit`), and that handoff is also registered as a late-exit callback so it still runs on abrupt shutdowns. - Arming happens only in a normal interactive terminal session, not in print mode, and rate-limit responses from the server now carry the limit details the main loop uses to decide whether to arm; the internal usage-limit object gained a rejection event this machinery subscribes to. - The remote gate `tengu_marble_heron` can switch the whole feature off, but its fallback is an empty value and the enabled check treats an absent value as on, so it is live unless the server says otherwise. - Telemetry: `tengu_quota_auto_resume_armed`, `_fired`, `_cancelled`, `_stale`, `_stale_resumed` (recording how many times the wait was rearmed and how long it lasted), `_offer_armed`, `tengu_quota_auto_resume_setting_changed`, `tengu_rate_limit_options_menu_select_auto_resume`, and `tengu_rate_limit_options_menu_cancel_auto_resume`. **Evidence** `Wait here, then continue automatically when the limit resets`, `Continuing automatically when your limit resets · esc to cancel`, `quota_auto_resume_disabled`, `label: "Continue automatically at usage limit"`, `autoContinueAtUsageLimit`, `tengu_quota_auto_resume_armed`, `When a claude.ai usage limit stops your session, wait for the limit to reset and continue the task automatically. When off, the limit dialog offers the wait as a choice instead.`, `Continue automatically at usage limit`, `Automatic continue cancelled \xB7 Claude Code exited during the wait, so the task will not resume on its own when the usage limit resets (send a prompt after the reset to continue)` - Area: Usage & Limits - Names: `autoContinueAtUsageLimit`, `/rate-limit-options` - Tier: Use it now - Useful: 5/5 - Signal: 4/5 ### Slack tagging wiring in the environment, status line and tool refresh A Slack tag token env var is treated as auth, stripped from subprocesses, and gets a status-line segment. **What** A `CLAUDE_CODE_SLACK_TAG_TOKEN` environment variable now counts as third-party authentication and is stripped from environments given to spawned commands. The status line gained a `slack-tag` segment, which suppresses the separator dot the way the `bridge` and `pr` segments do, and the available tool set is recomputed whenever the Slack tag connection flag changes. **Details** - The status segment only renders when the session is marked connected, which nothing in this build does. **Evidence** `CLAUDE_CODE_SLACK_TAG_TOKEN` - Area: Slack Integration - Names: `CLAUDE_CODE_SLACK_TAG_TOKEN` - Tier: Not switched on - Useful: 3/5 - Signal: 5/5 - Present in the build but not switched on ### Artifacts can now carry uploaded images, video, PDFs and fonts Claude can now upload, list, read and delete images, video, PDFs and fonts attached to your published artifacts. **What** The tool that publishes artifacts to claude.ai gained four actions for that artifact's file store: `upload_asset` sends a local file and returns a `_blob/` URL the page can reference, `list_assets` enumerates them, `read_asset` saves one back to disk (default the working directory, named by its 32-character asset id) and `delete_asset` removes one permanently. Uploads cap at 20971520 bytes, or 2097152 for SVG. Set `CLAUDE_CODE_ARTIFACT_ASSETS` to turn the actions off; they are otherwise present. **Details** - Accepted extensions are a fixed list: `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.svg`, `.mp4`, `.webm`, `.pdf`, `.woff2`, `.woff`, `.ttf`, `.otf`. Anything else is refused, as are network and UNC paths. - The actions also need the account to have the "assets" capability; without it the call fails as unavailable. The extra schema fields (`asset_id`, `out_dir`, `after` for paging) appear only when that capability is on. - Permissions are tracked per artifact and separately from artifact database access, with their own consent maps for upload and read, plus separate human-consent variants. Deletes are irreversible and every delete asks separately; reading your own artifact's assets needs no extra approval while another person's asks once per artifact; uploads either ask each time or are approved for the session. - Reading the source file is still checked against your Read rules ("reading file_path is blocked by a Read permission rule — the upload was not attempted"), and saving an asset is checked against Edit rules. Downloads land in a `.partial` file and are moved into place. - Results report id, content type, sha256 and a files/bytes quota. Transcript lines read "uploaded … as …", "listed N assets", "saved …", "asset deleted", "no such asset" and "no assets listed". New telemetry: `artifact_asset_upload`, `artifact_asset_list`, `artifact_asset_read`, `artifact_asset_delete`. **Evidence** `read_asset only: directory to save the file into (default: the working directory). The file is named by the asset id plus the extension for its type.`, `"no assets listed"`, `artifactAssetUploadHumanConsentSlugs`, `artifact_asset_upload`, `'upload_asset' adds one local media, PDF, or font file to an existing artifact`, `asset_upload_read_denied`, ` For 'upload_asset', the local image, video, PDF, or font file to upload.`, `upload_asset", "list_assets", "read_asset", "delete_asset` - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_ASSETS` - Tier: Use it now - Useful: 4/5 - Signal: 4/5 ### New `syncClaudeAiSkills` setting turns off skills synced from your claude.ai account You can stop Claude Code downloading skills from your claude.ai account with one setting. **What** Claude Code can pull skills down from the claude.ai account you are signed in to, and a new settings key switches that off. Set `syncClaudeAiSkills` to `false` in user or managed settings and nothing more is downloaded, previously synced skills in `~/.claude/skills/synced` stop working and are moved to `~/.claude/skills/.trash` at the next launch. Set it in `.claude/settings.local.json` or via `--settings` and the block covers only that workspace or invocation. Only `false` is honored. **Details** - Sync itself is enabled per account on the server; the setting is an opt-out, not an opt-in. - Your organization can also deny it: the capability check `allow_account_skills_sync` coming back `org_denied` or `unregistered` sets a session-wide veto. - Settings files that fail to parse also trigger the veto. An invalid value logs `"syncClaudeAiSkills" was present but invalid; treating it as false (claude.ai skills sync off) until it is fixed.`, and `--managed-settings` with bad JSON logs `--managed-settings ignored: invalid JSON object` and feeds the same veto. - While vetoed, a synced skill cannot be run or forked: invocation reports `Unknown skill: ` and forking is refused with the reason `forked skill refused: skills-sync veto`. - Sync requires first-party auth and a `claude.ai` account source. **Usage** `{ "syncClaudeAiSkills": false }` **Evidence** `"syncClaudeAiSkills" was present but invalid; treating it as false (claude.ai skills sync off) until it is fixed.`, `forked skill refused: skills-sync veto`, `--managed-settings ignored: invalid JSON object`, `allow_account_skills_sync` - Area: Skills - Names: `syncClaudeAiSkills` - Tier: Use it now - Useful: 4/5 - Signal: 4/5 ### Artifacts now default on for consumer OAuth logins Artifacts are now on by default for consumer OAuth logins instead of off. **What** The artifact feature no longer defaults to off. With no remote-config value present, artifacts are enabled when the account's auth source is unset, `prosumer_oauth`, or `no_auth`, and stay off for every other auth shape. Remote config can still turn it on or off in either direction. **Details** - The gate is `tengu_cobalt_plinth`; only its fallback changed, from a hard false to the auth-source test. - Enterprise and API-key style logins keep the old off-by-default behaviour unless remote config says otherwise. **Evidence** `tengu_cobalt_plinth` - Flag `tengu_cobalt_plinth`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: not a boolean we can read) - Area: Artifacts - Tier: You'll notice - Useful: 4/5 - Signal: 4/5 ### Bypass permissions mode is now disabled only by settings Your session won't be killed mid-run with an organization policy message about bypass permissions any more. **What** The remote flag that could disable bypassPermissions mode, the asynchronous re-check that exited the process mid-session, and the "disabled by your organization policy" message are all removed. The only remaining route to disabling the mode is the `disableBypassPermissionsMode` setting. **Evidence** `Bypass permissions mode was disabled by settings` - Area: Permissions - Names: `disableBypassPermissionsMode` - Tier: You'll notice - Useful: 4/5 - Signal: 4/5 ### The remote kill switch for bypassPermissions mode is gone A remote switch can no longer force you out of bypassPermissions mode mid-session; only the admin setting does. **What** v2.1.233 had a startup check that consulted a remote flag once per process and, if it fired, forced the session out of bypassPermissions back to the default mode and marked the mode unavailable. That check and its one-shot latch are removed. The `disableBypassPermissionsMode` admin setting still parses and still blocks the mode. **Details** - The removed flag name no longer appears anywhere in the build, and the latch class retains only its auto-mode half. **Evidence** `disableBypassPermissionsMode` - Area: Permissions - Names: `disableBypassPermissionsMode` - Tier: You'll notice - Useful: 4/5 - Signal: 4/5 ### Gate for sending queued messages immediately with Enter Pressing Enter could interrupt a running turn and send your queued messages immediately, decided by server config. **What** A new gate, `tengu_jiggly_mochi`, adds a shortcut that sends queued messages right away: while a turn is running in prompt mode, submitting interrupts the turn and flushes the queue. With it on, the input hint changes to "Press up to edit queued messages, Enter to send them immediately". Its in-source fallback is off, so whether it runs is decided by server configuration. **Details** - The interruption is recorded with the source `queued_send_now`, and the outcome under an `input_send_queued_now` counter, with `no_live_controller` as the failure reason when there is nothing running to interrupt. - Without the gate the hint stays at "Press up to edit queued messages". - Neither the gate nor the counter existed in v2.1.233. **Evidence** `Press up to edit queued messages, Enter to send them immediately` - Flag `tengu_jiggly_mochi`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: on) - Area: Message Queue - Names: `tengu_jiggly_mochi` - Tier: Not switched on - Useful: 4/5 - Signal: 4/5 - Present in the build but not switched on ### A frustration-detecting prompt to file an issue, wired up but silent A nudge that watches for frustration and suggests filing an issue is registered but displays nothing. **What** A new in-session nudge watches the conversation for signs of frustration and would suggest flagging an issue. It is registered on every build, but the code that would display anything is empty, so nothing is ever shown. **Details** - Requires at least 3 submitted messages and a 30-minute cooldown between appearances. - One regex set disqualifies conversations that used MCP tools or ran network commands (curl, ssh, kubectl, docker, aws, git push and others); a second detects frustration phrasing in your messages. **Evidence** `"issue-flag"` - Area: Proactivity - Tier: Not switched on - Useful: 2/5 - Signal: 5/5 - Present in the build but not switched on ### Groundwork for a Slack tagging integration, present but inert Session and message records now carry Slack tagging plumbing, but nothing turns it on. **What** Session state and message records now carry the plumbing for connecting Claude Code to Slack tagging, including a connection flag, an environment variable for a token, and a per-message ownership marker. Every piece is wired through to storage and to the tool-selection path, but nothing in this build ever turns any of it on, and no tool or user-facing surface appears as a result. **Details** - Interactive sessions carry a boolean `slackTagConnected`, defaulting to false at every point a session is created. - `slackTagConnected` can be set through the state-patch path and over the control protocol that SDK and IDE clients use, and is read by a status selector. - That same flag forms part of the key used to memoise the list of available tools, so flipping it would recompute which tools are offered. - A `CLAUDE_CODE_SLACK_TAG_TOKEN` environment variable is read for credentials. - Individual messages carry a `slackTagOwnerTurn` marker that is written through into stored transcripts, but the code that would set it is absent here. - None of these fields existed in the previous release. **Evidence** `slackTagConnected`, `slackTagOwnerTurn` - Area: Slack Integration - Names: `CLAUDE_CODE_SLACK_TAG_TOKEN` - Tier: Not switched on - Useful: 2/5 - Signal: 5/5 - Present in the build but not switched on ### Notices passed between sessions, shipped dark One session could inject a coordination notice into another, but three separate gates keep it dark. **What** A new inbound `session_notice` message would let one session inject a coordination notice into another as a turn element. Nothing can trigger it in this build: it needs the remote-session environment variable, the `tengu_polished_lagoon` flag (off unless the server says otherwise), and a helper compiled to always return false. **Details** - Payloads are schema-validated for uuid, notice class and originating session id; oversize content is trimmed down to a byte budget with a visible truncation marker, and hooks get a pass at it. - It is dropped with a warning on any transport that is not the remote one, and only accepted while permission mode is auto; otherwise it is left for redelivery. - Redelivery is deduped through a new pending-delivery list in app state, and the ack is only sent once persistence is confirmed. - Telemetry `ccr_session_notices` records `not_remote_transport`, `malformed_payload`, `flag_disabled`, `mode_not_auto_will_retry` and `queue_cap_will_retry`. **Evidence** `ccr_session_notices`, `[session-notices] session_notice on a non-RemoteIO transport \u2014 dropping without ack`, `\u2026[session_notice content truncated by the CLI: ` - Area: Sessions - Names: `tengu_polished_lagoon` - Tier: Not switched on - Useful: 2/5 - Signal: 5/5 - Present in the build but not switched on ### Asset uploads refuse swapped paths, symlinks, hard links and network files Artifact asset uploads re-verify the file after approval, refusing symlinks and swaps, behind an env var. **What** Before an approved upload is read, the path is re-resolved and opened refusing symlinks, then re-checked against the identity recorded at approval, so a file cannot be substituted after you approve it. Available only where asset actions are enabled by `CLAUDE_CODE_ARTIFACT_ASSETS`. **Details** - The file is re-stated through the open handle and its device, inode, size and nanosecond mtime compared with the approved values, with a further check of the open file's own path entry. - Separate refusals cover network paths, non-regular files, empty files, volumes with no usable inode identity, files reached through a symlink, and files with more than one hard link. - Read permission rules are evaluated on the resolved path, so a symlink cannot be used to send out a file you have denied. **Evidence** `upload_asset reads only local files` - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_ASSETS` - Tier: Use it now - Useful: 3/5 - Signal: 4/5 ### Two more environment variables handled for child sessions Two environment variables for project directory name and environment kind now pass to or get scrubbed from child sessions. **What** `CLAUDE_CODE_PROJECT_DIR_NAME`, used to derive the project directory name, and `CLAUDE_CODE_ENVIRONMENT_KIND`, whose observed values include "bridge" and "byoc", are now on the lists that decide which variables get passed to or scrubbed from child sessions. **Evidence** `CLAUDE_CODE_ENVIRONMENT_KIND` - Area: Environment Variables - Names: `CLAUDE_CODE_PROJECT_DIR_NAME`, `CLAUDE_CODE_ENVIRONMENT_KIND` - Tier: Use it now - Useful: 3/5 - Signal: 4/5 ### Built-in MCP server gains schema validation, cancellation, and an unreachable locked-down HTTP mode The MCP server you expose now validates tool arguments and aborts work when a client cancels. **What** The MCP server Claude Code exposes to other tools now checks incoming tool calls against the tool's own schema before dispatch and refuses a mismatch with "arguments failed schema validation" rather than passing raw input through, and it aborts work already running when a client cancels or the server shuts down. The same code now takes a transport kind, and passing "http" turns on a heavily restricted profile. Nothing in this build passes "http": the `claude mcp serve` command hands the server the stdio transport, so the restricted profile is reachable only by importing the module directly. **Details** - A request's abort signal is wired to the tool's abort controller with reason "remote-cancel"; closing the server aborts in-flight work with reason "shutdown". - Validation and cancellation are live on both transports, so `claude mcp serve` gets them today. - The "http" profile disables background tasks and unsandboxed command execution, and exposes only a fixed allowlist of tools. - It also skips the CLAUDE_CODE_SIMPLE tool filter through a new option, so the allowlist rather than that filter decides what is offered. - Under that profile the `dangerouslyDisableSandbox`, `run_in_background` and `_simulatedSedEdit` fields are removed from the advertised tool schemas and stripped out of incoming arguments, with a note appended to the result when anything was stripped. **Evidence** `[serve-mode] Stripped client-supplied privilege field(s): `, `_simulatedSedEdit` - Area: MCP - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Command allowlists can no longer widen during poll-event delivery Your always-allowed command list can no longer grow while an injected event is being delivered. **What** The permission context used when checking a tool call gained a flag that marks a poll-event or empty dispatch delivery. While it is set, the layers that would normally inject or replace the list of always-allowed commands leave the context untouched, so the allowlist cannot grow during that delivery. **Details** - Applies on every build; no setting turns it on or off. **Evidence** `pollEventDeliveryGuard` - Area: Permissions - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 ### Comments on artifacts can start a Claude Code session from the desktop app Commenting on an artifact in the desktop app can now launch a Claude Code session from that comment. **What** The desktop app can hand the CLI a prompt built from a comment you left on an artifact, and the CLI now recognises that handoff, picks up the comment thread it refers to, and marks the prompt so its own comment watcher does not reply to the same comment a second time. This path is desktop-app only; other clients never see it. **Details** - The seeded prompt is identified by a first line of `[Artifact comment sent to Claude]`, followed by `Artifact: `, `Comment thread: ` and `Sent to Claude at: ` lines, which the CLI parses to claim the thread. - The message flag is `seeded_summon` in the SDK message schema, documented as `@internal Desktop host only: the host's own seeded summon.` - Gated on the client identifying itself as the desktop host (client platform `desktop_app`). None of this existed in the previous release. **Evidence** `[Artifact comment sent to Claude]` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 ### Peer messages can declare the sender's permission class Messages from other sessions now say whether the sender was skipping permission prompts. **What** A message injected between sessions can now carry an optional `fromMode` of `"bypass"` or `"prompting"`, saying whether the sender was running tools without asking. A message from the same class can be delivered immediately; a cross-class or undeclared sender is held when the recipient runs tools without asking. **Details** - The field is only honoured from the injecting host on local stdin, so a remote peer cannot claim a class for itself. **Evidence** `fromMode` - Area: Session Messaging - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 ### Resuming stopped artifact auto-replies, and marking comments the artifact posted itself Comments Claude posts to an artifact are now marked as its own, so it stops replying to itself. **What** Artifacts can be watched so Claude replies to their comments automatically, and this build reworks both ends of that loop. Comments now carry a marker saying they were posted through the artifact's own interface, which keeps Claude from treating its own posts as new human input and gives those comments a distinct attribution label. Alongside it sits a `resume_replies` action for re-arming a watch you stopped, which is fully written but not reachable in this build. **Details** - Stored comments gained an optional `posted_by_artifact` boolean, held in memory as `postedByArtifact` and emitted in comment telemetry as `posted_by_artifact: !0`; auto-reply arming filters those out before deciding a new human comment has arrived, so Claude no longer answers itself. - Two attribution labels, `[human, posted by the artifact]` and `[human, posted by the artifact, sent to you]`, appear in rendered comments and in the comment-scanning prompt; the transcript label becomes "human, posted by the artifact" instead of plain "human", and everything without the marker keeps its existing attribution. - The instructions tell Claude to act on such a comment as that person's request, but to raise it with you if it conflicts with something you typed directly. - All of the comment behaviour rides on the artifact comments capability, switched on by the `CLAUDE_CODE_ARTIFACT_COMMENTS` environment variable or the remote setting `tengu_teal_corbel`, which defaults to off; without it the labels are never rendered. - The `resume_replies` action re-enables automatic replies after they stopped, whether the live-updates task was killed, the artifact was unwatched, or you interrupted with Ctrl+C. It is offered only inside a branch guarded by a build-time constant that is false here, the same constant that hides watch, unwatch and status, so nothing in this build turns it on. - When it does run it asks for approval like a publish, with the always-allow option suppressed so it can never be auto-approved, and prompt copy warning that approving re-arms unattended public replies. - Stopping a watch sets a latch, so later publishes or a plain `watch` return outcome `skipped` with reason `stop_latched` rather than quietly re-enabling unattended replies. - Refusal reasons surfaced to the model are `session_disarmed`, `remote_session`, `not_stopped`, `stale_consent`, `stop_latched`, `cancelled`, `stopped_again` and `not_enabled`; a consent token that no longer matches yields `stale_consent`, and in remote sessions, keyed off the remote-session environment variable, the action is denied outright with a description saying it is unavailable there and the model told to use `watch`. - The kill-all-agents gesture disarms auto-replies for the whole session and a resume cannot reverse it; only a new session re-arms on publish. Plan mode and Cowork also deny the action because there is no place to ask you. - Status output and the connected-artifact list gained an `auto_reply` field per watch, with text distinguishing "not watching (stopped earlier in this session)" from "auto-replies resumed". **Evidence** `Auto-replies are disarmed for this whole session (the kill-all-agents gesture) and a resume cannot reverse that \u2014 a new session re-arms on publish.`, `Claude reports that you asked it to resume automatic comment replies on this artifact`, `when you asked to resume its comment auto-replies`, `use the kill-all-agents gesture to disarm auto-replies for the whole session`, `Auto-replies were NOT resumed: they are disarmed for the whole session (the user's kill-all-agents gesture).`, `No auto-reply stop is recorded for this artifact in this session, so there is nothing to resume. Nothing here needs approval.`, `approving re-arms unattended public replies`, `human, posted by the artifact`, `posted_by_artifact`, `[human, posted by the artifact, sent to you]` - Flag `tengu_teal_corbel`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: off, compiled default: on) - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Your email address in the system prompt now comes with handling rules Claude is now told never to send your email address to unrelated services, with no way to turn it off. **What** The block that tells Claude your email address no longer just states it. It now instructs Claude never to send that address to an unrelated service, whether in a request header, a URL, or a payload, unless you explicitly ask. This applies whenever an email address is known, with no setting to turn it off. **Evidence** `Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.` - Area: System Prompt - Tier: You'll notice - Useful: 3/5 - Signal: 4/5 ### MCP protocol negotiation can be disabled per server from remote config Remote config can force legacy MCP handshakes or suppress listening for named servers, matched by hostname. **What** Two remote-config lists can now switch off newer MCP behaviour for named servers: one disables protocol-era negotiation, so the server gets the legacy handshake, and one suppresses listening. Servers match on URL hostname, exact or suffix, with `*` matching everything. Both lists fall back to empty, so nothing is disabled unless a server value says so. **Details** - The gates are `tengu_mcp_negotiation_server_denylist` and `tengu_mcp_listen_server_denylist`. - A negotiation match is logged and falls back to the legacy handshake. - Both states are reported in connection telemetry as `negotiationDenylisted` and `listenSuppressed`. **Evidence** `tengu_mcp_negotiation_server_denylist`, `MCP era negotiation denylist matched` - Area: MCP - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Narration runner wired to tool rounds, off by default Per-session running commentary hooks into each tool round, off unless you set the narration env var. **What** A new per-session narration facility hooks into each tool round for non-subagent sessions to produce running commentary. It is off unless `CLAUDE_CODE_ENABLE_NARRATION` is set, and the interval that paces it comes from a server config value that falls back to 0, meaning no narration when neither is provided. **Details** - The runner tracks its output sink, whether narration was requested, and the last signature it saw; resetting a session aborts the runner and clears the sink. - Narration is additionally suppressed in two detected environments when the environment variable is unset. **Evidence** `CLAUDE_CODE_ENABLE_NARRATION` - Area: Terminal UI - Names: `CLAUDE_CODE_ENABLE_NARRATION` - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Newly created pull requests can be reported to the cloud service Pull requests you create could be reported to a cloud endpoint, but nothing is sent here. **What** After a successful `gh pr create` that is not a `--dry-run`, Claude Code can post the owner, repo, PR number and head branch to a new `/worker/record-created-pr` endpoint. This is gated on `tengu_record_created_pr_to_ccr`, which reads false without a server value, so nothing is sent in this build. **Details** - Outcomes are counted under `ccr_record_created_pr`, including a `not_deployed` case when the endpoint answers 404 or 501. - Separately, git command parsing now infers that a push happened from the command text on exit 0, and labels link-fetch attempts as "pushed" or "checked-out". **Evidence** `/worker/record-created-pr` - Flag `tengu_record_created_pr_to_ccr`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: on) - Area: Cloud Sessions - Names: `tengu_record_created_pr_to_ccr` - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Resuming a session can retire unanswered permission prompts instead of re-running them Resuming could drop unanswered permission prompts instead of re-running the interrupted turn, but only with an env var set. **What** When a session is resumed and a permission request was parked without an answer, Claude Code can now drop that request, record why, and skip re-running the interrupted turn. All parked prompts left over from the session are cleared together rather than just one, anchored to the latest assistant message among them. The code is present in this build but does nothing unless the environment variable that gates it is set, so by default resume still re-runs the interrupted turn. **Details** - Set `CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION` to take the clearing path, for example `CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION=1 claude --resume`; unset, the previous re-run behaviour is what you get. - Every unanswered parked prompt from the resumed session is retired in one pass, not one per resume, and the retirement is anchored to the most recent assistant message among them. - The outcome is logged to the `tengu_resume_parked_permission` event as `retired_unanswered`, `retire_superseded` when a user command arrived before the retirement could happen, or `retire_write_failed`, alongside a `retired_count` of how many prompts were cleared. - Independently of that gate, a rewind that the server refuses now re-anchors the remote view of the transcript after a persist failure or a state-changed refusal, retrying up to three times in the state-changed case, so the remote and local transcripts do not drift apart. **Evidence** `tengu_resume_parked_permission`, `retiring it unanswered (CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION); not re-running the interrupted turn` - Area: Permissions - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Status-line narration under the spinner A background query could narrate what Claude is doing under the spinner, off unless enabled. **What** While the main loop is busy, Claude Code can run a background one-turn query with no tools available that produces a short status line saying what Claude is doing now and what it plans to do next, then draws it as a block below the spinner instead of the old single-suffix line. It is paced by a configured interval and is off unless explicitly enabled, so nothing changes for most users in this build. **Details** - Enabled by the `CLAUDE_CODE_ENABLE_NARRATION` environment variable; pacing comes from the `tengu_pewter_kite_ms` interval, which defaults to 0 and so leaves narration off on its own. - The model output is parsed into a `now:` line and a `next:` line, and a `next:` value of "none", "n/a" or "not stated" is dropped rather than displayed. - The spinner no longer appends a single "Next: …" or "Tip: …" suffix when narration is active, and instead renders a block with bold ` now: ` and ` next: ` labels plus a separate ` tip: ` line. - Narration is registered as a query source alongside "prompt_suggestion", "away_summary" and "agent_summary", meaning it never triggers auto-compact and never shows the user a prompt-too-long error. - Each generation emits `narration_generate` telemetry. **Evidence** `Status line for the user, who is glancing at the screen.`, `"narration"` - Flag `tengu_pewter_kite_ms`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) - Area: Terminal UI - Names: `CLAUDE_CODE_ENABLE_NARRATION` - Tier: Not switched on - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### Dangerous always-allow rules are set aside rather than carried Always-allow rules matching a dangerous pattern are held aside inactive rather than applied. **What** Permission state now pulls rules matching the dangerous pattern out of the active always-allow list into a separate held list, with a path to put them back, so a session can carry those rules without them taking effect. **Details** - A companion table records which parts of a session's configuration are stripped this way (`allowed_tools`, `avoid_prompts`, `permission_mode`, `working_directory`) and which are kept as-is. **Evidence** `strippedDangerousRules` - Area: Permissions - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### Messages injected by a host are classified separately from peer messages Messages injected by a host are now treated as their own class, separate from messages from peer sessions. **What** Inbound messages from another session used to be classified as peer traffic purely by origin kind. Messages marked as host-injected are now recognised as their own class and run through the coordinator acceptance and opt-out rules instead of the peer ones. **Evidence** `"host-injected"` - Area: Cross-Session Control - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### Quota rejections feed a new auto-resume controller Rate-limit rejections now feed a controller that can arm or cancel an automatic resume after a quota block. **What** The rate-limit tracker now emits an event when a rejected request is observed, and a controller subscribes to it to re-arm or cancel an automatic resume after a quota block. None of the identifiers for this subsystem exist in the previous build. **Details** - The tracker gained a rejection event and a subscribe helper; the controller reacts by re-arming a cap or emitting a cancellation event. - What turns the controller on is decided elsewhere; nothing in the tracker itself gates it. **Evidence** `tengu_quota_auto_resume_cancelled` - Area: Rate Limits - Tier: Under the hood - Useful: 3/5 - Signal: 4/5 ### New setting `useAutoModeDuringPlan`, on by default Plan mode now uses auto-mode permission rules by default; turn it off in /config under Permissions. **What** Plan mode now applies auto-mode permission semantics whenever auto mode is available. The new boolean `useAutoModeDuringPlan` appears in `/config` under Permissions and defaults to true; setting it false in any settings source (policy, command-line flag, user or local settings) wins and turns it off. **Details** - Changing the setting recomputes the session's tool permission context immediately, so it takes effect without a restart. **Evidence** `Whether plan mode uses auto mode semantics when auto mode is available (default: true)` - Area: Permissions - Names: `useAutoModeDuringPlan`, `/config` - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### Permission mode changes are announced on the stream-json output Scripted sessions now get a stream-json status message whenever the permission mode changes. **What** Programmatic sessions (SDK and `--output-format stream-json`) now get a message whenever the permission mode changes: `{type:"system", subtype:"status", status:null, permissionMode, uuid, session_id}`. The same status is re-sent when a remote client reconnects or attaches, so a client that joined late still knows the current mode. Controlled by `tengu_wobbly_pinwheel`, which falls back to true, so it is on unless remote config turns it off. **Details** - The emission on mode change sits behind a flag helper; the reconnect/attach resend keeps late joiners in sync. - `status` is null on these messages; the mode itself is carried in `permissionMode`. **Evidence** `tengu_wobbly_pinwheel` - Flag `tengu_wobbly_pinwheel`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Area: SDK - Names: `--output-format stream-json` - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### /tui and /update refuse to restart when session state would be lost, and say what is holding them up /tui and /update now refuse to restart when it would lose session state, naming the exact blocker. **What** Before relaunching, both commands check for state that cannot be reconstructed from a restart command line: permission rules that exist only for this session, ask rules with no command-line equivalent, added directories that cannot be spelled out, and a running auto-reply monitor for artifact comments. Instead of the old generic "busy" message, they name the specific blocker and tell you what to do about it. `/tui` saves your renderer preference but stays where it is; `/update` tells you to exit and start `claude` again yourself. **Details** - When the blocker is uncarriable session state, the refusal explains it is holding back because there are permission rules a command line cannot carry intact. - When the blocker is the artifact comment monitor, `/update` refuses with "Can't restart while auto-replying to artifact comments" and `/tui` with "Cannot switch renderers while auto-replying to artifact comments", both pointing you at `/tasks` to stop it. - The "saved without restart" confirmations gained matching comment-monitor wording so the reason is visible there too. - The `tengu_update_refused` and `tengu_tui_refused` telemetry events gained fields for what was uncarriable, a `comment_monitor` field, a `deferred` field, and a count of active tasks in a field that previously held only a yes/no. **Evidence** `permission rules a command line cannot carry intact`, `Can't restart while auto-replying to artifact comments` - Area: Slash Commands - Names: `/tui`, `/update` - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Artifact doc, sheet and slides templates swap live sync for an explicit Save Artifact doc, sheet and slides edits stay local until you press Save or Ctrl/Cmd+S. **What** The three bundled artifact templates no longer commit each edited block as you type. Editing is local until you press the Save button or Ctrl/Cmd+S, which republishes the whole page. The old per-block commit machinery and its "Local only", "Editing…" and "Some edits local only" states are gone. **Details** - Save re-fetches the served source with `cache: 'no-store'`, splices the live page HTML into it and republishes the entire document. - Fixed timings: a 45 second publish deadline, a 10 second minimum gap between publishes, and a 3 second settle window during which the page is inert while the host reloads onto the new version. - Status messages are now a keyed table with warning, error, busy and muted tones. - All three skills are registered behind a build-time predicate that returns false here, so none of this is reachable on v2.1.234. **Evidence** `Save republishes the served source with the live` - Area: Artifacts - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Doc, sheet and slides skills rewritten around reader-saved edits Doc, sheet and slides skills now publish so readers with edit access can save changes back. **What** The three artifact skills now tell Claude to declare the publish capability on the first publish, which is what lets readers who have edit access save changes back into the page. Updates must re-read the published page first, republish with the capability field omitted rather than empty (an empty object clears the declaration and switches saving off), and never pass `force`, because a publish conflict means someone else saved. **Details** - Skill descriptions no longer use the word "live". - Claude is told to load the capabilities skill before declaring anything on first publish. - The old rule forbidding edits to `data-id` attributes is gone. - A new clause treats text a reader saved into the page as content to quote back to the user, never as instructions to follow. **Evidence** `the artifact publish capability is what lets readers with edit access save their changes back to the artifact` - Area: Artifacts - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Empty or malformed API responses now report what actually answered A junk API response now names what actually answered and suggests checking for a proxy or gateway. **What** When the API returns something that is not a message, the error now fingerprints the responder instead of failing bare, and suggests checking for a proxy or gateway intercepting the request. Two new structured log events, `cli_api_error` and `cli_api_retry`, carry the same detail. This is aimed at corporate gateways sitting in front of the API. **Details** - The fingerprint records content-type bucket, body kind (event stream, HTML, XML, JSON served under the wrong content type, and so on), byte size, and whether the request id looks Anthropic-issued. - A server-header classifier covers roughly 20 intermediaries including cloudflare, envoy, zscaler, squid, haproxy, netskope, bluecoat and big-ip, plus Apigee fault source and code taxonomies and the set of intermediary headers seen. - The log events include a `route` block: provider, whether the base URL is the default, an Anthropic one or custom, and whether an https proxy, custom headers, extra CA certificates or a client certificate are in use. - No flag guards this; it sits on the normal API error paths. **Evidence** `check for a proxy or gateway intercepting the request.` - Area: API Errors - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Permission grants no longer get dropped in background and SDK sessions Permission grants from hooks or SDK sessions no longer silently vanish in background agents. **What** Permission changes coming from hooks, a permission-prompt tool or an `updatedPermissions` response now go through a separate session-level setter as well as the app-wide one. Contexts that intentionally do not share app state, such as background agents and some SDK hosts, pass a no-op for the app setter but still forward the session one, so a granted permission takes effect instead of vanishing. **Details** - A helper builds both setters from a single updater for callers that do not care about the distinction. **Evidence** `setSessionToolPermissionContext` - Area: Permissions - Names: `updatedPermissions` - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Permission prompts sent to IDEs and MCP servers are scrubbed and no longer broadcast Permission requests sent to IDEs and MCP servers are now redacted, truncated and no longer broadcast to everyone. **What** When Claude Code asks an IDE or an MCP server to approve a tool call, the description it sends is now run through secret redaction, whitespace collapsing and middle-elision truncation instead of being forwarded as-is. The request also goes only to servers that finished registering their permission channel, rather than to every connected server that advertised support for one. **Details** - The registration check (`isServerRegistered`) is a third condition added on top of the existing connection and capability checks. - The description is sanitized by a new display-only redaction pass whose rule set deliberately skips shell punctuation and path-like matches. - Both changes apply unconditionally on the forwarding paths. **Evidence** `isServerRegistered` - Area: Permissions - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Sandbox exclusion list stops being an escape hatch once unsandboxed commands are disabled Your sandbox exclusion list stops working as a bypass once unsandboxed commands are disabled. **What** A command listed in `sandbox.excludedCommands` used to run outside the sandbox on the strength of that list alone. It now also requires that unsandboxed commands have not been disabled for the session, so once something turns them off the exclusion list no longer opens a hole. **Evidence** `unsandboxedCommandsDisabled` - Area: Sandbox - Names: `sandbox.excludedCommands` - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### Teleporting to a remote session falls back to GitHub instead of failing If uploading your local files to a remote session fails, it continues from GitHub instead of aborting. **What** If uploading your local working copy to the remote session fails, and the session can be sourced from GitHub instead, Claude Code now logs that and continues from GitHub without your uncommitted local changes rather than aborting with an upload error. **Evidence** `starting from GitHub without the local changes` - Area: Sessions - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### The "file changed on disk" note tells Claude to speak up When a file changes under Claude, it's now told to speak up if the change looks wrong. **What** When a file changes underneath Claude mid-session, the note it receives no longer asserts that you made the change deliberately and already know about it. It now says to work from the current contents, to say something if the change looks wrong rather than quietly undoing it, and otherwise not to comment on it. **Details** - The note refers to the Read tool by name instead of a hardcoded string, so it stays correct if the tool is renamed. **Evidence** `changed on disk since you last read it` - Area: File Watching - Tier: You'll notice - Useful: 4/5 - Signal: 3/5 ### A risky-command and frustration detector is present but emits nothing A detector shipping patterns for risky commands and user frustration never fires, its handler is empty. **What** A subscriber called `issue-flag` ships with patterns for risky commands and for signs of user frustration, but its setup returns an empty handler, so it never fires in this build. **Details** - Risky command patterns include `curl`, `ssh`, `kubectl`, `git push` and `nc`. - Frustration phrases include `^no[,!]\s` and `not what I (asked|wanted|meant|said)`. - A 1800000 ms (30 minute) cooldown is defined between flags. - The code was moved out of the older artifact-arming module. **Evidence** `issue-flag` - Area: Proactivity - Tier: Not switched on - Useful: 1/5 - Signal: 5/5 - Present in the build but not switched on ### A slash-command grouping for a command that does not exist The slash-command menu grouping lists a command called "thrash" that does not exist in this build. **What** The table that sorts slash commands into menu groups gained an entry filing a command called "thrash" under actions, alongside teleport, stop and rewind. No such command is defined in this build, so nothing new appears. **Details** - The only other uses of the word are an unrelated warning about repeated auto-compaction and model guidance text. - Consistent with a grouping entry landing before its command, or for a command registered outside this bundle. **Evidence** `thrash: "action"` - Area: Slash Commands - Tier: Not switched on - Useful: 1/5 - Signal: 5/5 - Present in the build but not switched on ### Terminal recordings addressed as stored `.cast` streams Storage addressing learned about terminal recordings saved as timestamped `.cast` files in a session folder. **What** The internal storage addressing scheme learned about terminal recording files, stored as `.cast` streams inside a session folder and named by an epoch-millisecond timestamp. New filesystem helpers reject reads of symlinked paths, non-regular files, hard-linked values and anything over the size cap, each with its own error. **Details** - The timestamp must be 1 to 16 decimal digits. - A new table of errors explains, per kind of key, which members name a single stored value rather than a group of them, so asking for a group by a single-value name gets a specific message. **Evidence** `must be the recording stamp: 1 to 16 decimal digits (epoch milliseconds)` - Area: Storage Backend - Tier: Not switched on - Useful: 1/5 - Signal: 5/5 - Present in the build but not switched on ### An empty "wellbeing" component is registered A component called "wellbeing" is registered and asks for settings, notifications and a clock, but does nothing. **What** A new internal component named `wellbeing` is registered and declares that it needs settings, notifications and a clock, but it does nothing at all in this build. **Details** - Its setup body declares locals that are never used, its two inner functions return false and nothing, and the effect it returns is empty. - Only its teardown does anything, and it stops a timer that is never started. - Nothing about it is observable to anyone using Claude Code. It did not exist in v2.1.233. **Evidence** `id: "wellbeing"` - Area: Session UI - Tier: Under the hood - Useful: 1/5 - Signal: 5/5 - Present in the build but not switched on ### Artifact requests from cloud sessions can go via a gateway relay Cloud sessions may route artifact calls through a gateway relay, falling back to direct calls on failure. **What** When Claude Code is running as a remote session, calls to claude.ai for publishing, comments and reads may now be sent through `/v1/code/agent-proxy/frame` on the gateway using the session's own token, instead of calling claude.ai directly with OAuth. If the relay refuses or errors, the request falls back to the direct call and that request family is skipped for a cool-off period. **Details** - Requests are grouped into families (boot, publish, comments, db) by method and URL shape; each family keeps its own decline and serve windows, with failures opening roughly a five-minute fallback to direct calls. - Replies carry `route: "direct"` or `route: "relay"` plus a flag saying whether the answer really came from claude.ai, derived from an `x-ccr-relay-upstream` header. Every caller now checks it, so a relay-level HTTP status is no longer read as claude.ai's verdict: a database write whose relay call failed reports the outcome as unknown rather than failed, and publish failures get their own advisory. - The relay path only engages when the session is marked remote with no environment kind set, and behind the `tengu_cobalt_plinth_sorrel` flag, whose built-in fallback is on when the server sends no value. - Frame-specific headers matching `^x-frame-[a-z0-9-]+$` are stripped on the relay path. Retry-after on 429/503 is honoured only when the response actually came from claude.ai. - Telemetry `artifact_frame_relay` records `relay_unavailable`, `relay_refused`, `relay_error` and `request_error`, tagged with the family. **Evidence** `artifact_frame_relay`, `/v1/code/agent-proxy/frame`, `x-ccr-relay-upstream`, `tengu_cobalt_plinth_sorrel`, `db write outcome unknown (relay HTTP ` - Flag `tengu_cobalt_plinth_sorrel`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: off) - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 4/5 ### Artifact comment auto-reply gets a settling window and a stand-down, both server-gated Artifact comment replies get grouped wakes and a stand-down when everything was already answered, both switched off. **What** The scheduler that decides when Claude scans and answers comments on an artifact was reworked so that repeated wakes are grouped together instead of each triggering a scan. Wakes can now be tagged as confirmations or re-entries and are coalesced within a settling window, timers carry extra padding, and the fast-acknowledge flag can be refreshed against a deadline before a decision is made. Alongside it sits a stand-down path that skips replying when every comment addressed to Claude was already answered in a visible turn, and neither the window override nor the stand-down is switched on by anything in this build. **Details** - The settling window defaults to 2000 ms, can be overridden per call, and can be overridden remotely by the `tengu_sorrel_trellis_finial` server flag, whose value is clamped to a maximum. - The stand-down branch requires the `tengu_madrone_spindle` server flag to be exactly true and additionally requires every comment recipient to individually pass a check, so it does nothing unless a server config enables it. - When the stand-down does fire it records `stood_down_visible_turn`, which is the string to watch for if the flag is ever turned on. - Neither flag has a value set anywhere in the shipped build, so the handoff branch stays off and the wait falls back to the built-in 2000 ms. - The instructions Claude receives for handling these comments gained a new label for where a comment came from, "human, posted by the artifact". **Evidence** `stood_down_visible_turn`, `tengu_madrone_spindle` - Flag `tengu_madrone_spindle`: Gate removed from the code (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: not a boolean we can read) - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Durable stop latches for Artifact auto-replies, with a resume notice that cannot fire yet Stopping artifact auto-replies can become durable, blocking publishes until relatched; the resume notice cannot fire. **What** Stopping auto-replies on an Artifact can now be made durable: a latched artifact short-circuits publishing and subscribing with the reason `stop_latched` until it is explicitly relatched, and a pending relatch approval is recorded against the tool call that asked. The matching "Auto-replies on Artifact: ... were resumed" notice exists but the resume path is hard-disabled in this build. **Details** - The existing Ctrl+C disclosure is now tagged as a non-durable stop so it can be told apart from a durable latch. - The new notification joins the existing paused and re-enabled messages. **Evidence** `Auto-replies on Artifact: ${e} were resumed` - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Publish-only stub mode for the artifact tool A restricted artifact mode accepts only a plain publish and rejects everything else. **What** A restricted artifact mode is present in which the tool accepts only a plain publish. Any other explicit action, and any live-doc input, is rejected both when validating input and at call time with the error code `stub_mode_publish_only`. **Details** - A URL that does not resolve while in this mode is rejected as `stub_mode_real_url` or `stub_mode_unknown_slug`. - The not-logged-in check now passes when this mode is active, so publishing works without a login. - Two artifact onboarding tips were narrowed so they do not appear in this mode. - The whole thing is active only when the stub-mode accessor returns a value; otherwise every existing artifact behaviour is unchanged. **Evidence** `stub_mode_publish_only` - Area: Artifacts - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### REPL tool has an async dispatch path, compiled off The REPL tool could return a receipt and deliver results later, but that path is compiled off. **What** The REPL tool can now hand a script to a dispatcher, return a receipt immediately and deliver the real result later as a background poll event. The gate is a build-time constant that is false here, so every call runs the synchronous path. **Details** - The tool's output schema gained an `asyncDispatched` boolean. - There is a cap on how many dispatches can be outstanding; past it, further dispatches are refused. - Both the receipt and the refusal text point at a `` poll event, with the receipt assembled at runtime around the evaluation id and current queue depth. - Settle handling runs a PostToolUse pass over the deferred result, so hooks still see it. **Evidence** `asyncDispatched` - Area: REPL Tool - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Self-scheduling loop state survives a background handoff Checkpoints now record self-scheduling wake counts and open artifact watches, though the loop itself is off. **What** Session checkpoints now record how many times a self-scheduling loop has woken and what live Artifact watches were open, and each scheduled wake-up records when it is due, why, and whether it holds a keepalive budget. The loop feature itself is behind `tengu_kairos_loop_dynamic`, whose in-source fallback is false, so it is off absent a server value. **Details** - The wake count is stored as a non-negative integer, so a loop's wake budget carries over instead of resetting when the session is handed off to the background. **Evidence** `loopWakeFires` - Flag `tengu_kairos_loop_dynamic`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: on) - Area: Sessions - Names: `tengu_kairos_loop_dynamic` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Storage backend writes are now pinned behind a flag and pass explicit file modes Saved data can route through a new storage backend with explicit file permissions, but the flag is off. **What** Dozens of places that save data now use the alternative storage backend only when the `tengu_hover_rest` flag is on, read once per process, and otherwise fall back to ordinary filesystem calls. Absent a server value the flag reads false, so this build writes to the filesystem as before. Files written through the new path get an explicit mode of `438 & ~process.umask()`, or 384 for secrets. **Details** - Affected save paths include job drafts and job deletion, daemon status, plugin config and marketplace manifests, PR status cache, org-memory discovery cache, facets, the paste store, agent metadata, workflow scripts, the closed-issue cache, forked-skill scoping, background dispatch, changelog migration, headless plugin installs, auth-required state, transcript history and REPL shutdown. - Writes gained a `publishDiscipline` option with values `"inPlace"`, `"atomic"` and `"followAtomic"`, replacing bare mode arguments in several places. - Plugin config reads gained an async backend variant alongside the existing synchronous one. **Evidence** `mode: 438 & ~process.umask()`, `publishDiscipline: "inPlace"` - Flag `tengu_hover_rest`: Off in both readings (read for one account on one subscription tier against v2.1.234; this account: off, anonymous baseline: off, compiled default: on) - Area: Storage Backend - Names: `tengu_hover_rest` - Tier: Not switched on - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Artifact auto-react requires a live supervisor connection Artifact auto-react now needs a live connection to the supervising host, not just its declared capabilities. **What** When Claude Code runs underneath a supervising host, a new piece of state tracks whether that connection is live, set false on connect, close and stop and true once the host's capabilities arrive. Artifact auto-react is now treated as available only when both those capabilities and a live link are present. Outside a supervised session the check returns early and nothing changes. **Evidence** `rvSupervisorLinkLive` - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### Handoff records accept scheduled wake-ups and live watches Session handoffs now accept scheduled wake-ups with due times, and count live artifact watches toward their limit. **What** The record a session leaves for its successor now allows scheduled wake-up entries to carry a due time, a reason and a keepalive marker, and the 256-item ceiling on what a handoff will accept now counts live Artifact watches alongside shells, scheduled entries, agents and workflows. **Details** - Giving up a handoff now also stops any Artifact watches that were carried over. - Several of the persistence call sites are conditional on the newer storage layer being enabled. **Evidence** `keepalive: Ne.literal(!0).optional()` - Area: Session Handoff - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### MCP server startup names its transport and registers a shutdown hook The MCP server names stdio explicitly and closes cleanly on shutdown; an http mode exists uncalled. **What** The startup path for Claude Code's MCP server now explicitly asks for the stdio transport and registers a hook that closes the server on shutdown. The builder accepts an alternative http kind that disables background tasks and unsandboxed commands before serving; no caller in this build requests it. **Evidence** `createMCPServer` - Area: MCP - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### Schema now describes cloud sessions and cross-session notices The JSON output description now covers what a cloud-hosted session reports at startup and server-composed notices from other sessions. **What** The machine-readable description of Claude Code's JSON output gained two blocks. One describes what a cloud-hosted session reports when it starts up; the other describes a notice composed by the server on behalf of another session. **Details** - The cloud session block is optional and only appears on start-up frames from the cloud client. It carries the cloud session id, a URL to view it, whether a device is bound and why not with a one-line message, and a directory sync state of off, seeding, armed or stopped with a file mode of container_sync, device_tools or unspecified. - It also carries a client version, with instructions that a consumer seeing a higher one should warn and carry on rather than refuse. - The notice block describes delivery over the polling event channel with server-asserted origin stamps that are stripped on the way in and re-applied by whatever composes the notice, the same discipline used for synthetic messages. **Evidence** `Server-asserted ingest-path marker, same strip-and-restamp discipline as isSynthetic.` - Area: JSON Output - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### The decisions script in the PR-review artifact was edited The decisions script inside PR-review artifacts was rewritten this release. **What** PR-review artifacts are built from parts pinned to exact content hashes, and the hash for the "decisions" part changed, meaning that script was rewritten this release. A part that fails its check blocks publishing with an out-of-sync template error. **Evidence** `89c4f81c0c1c87c2c7b9672006de5e7eb9af82f4366c6d089658555a713e8f0e` - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 4/5 ### A pre-supplied trusted-device token stops the untrusted-device retry Setting a trusted-device token in the environment skips the remote bridge's untrusted-device retry and prompt. **What** If `CLAUDE_TRUSTED_DEVICE_TOKEN` is set in the environment, the remote bridge no longer runs its untrusted-device retry and re-prompt. **Details** - The "post rejected" warning moved into a helper that only logs for non-2xx responses and sanitizes the server-supplied detail before printing it. **Evidence** `CLAUDE_TRUSTED_DEVICE_TOKEN` - Area: Sessions - Names: `CLAUDE_TRUSTED_DEVICE_TOKEN` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Goals nudge themselves when background work is blocking them Goals now nudge Claude every 30 minutes when background shells or agents are blocking evaluation. **What** When a `/goal` cannot be evaluated because background shells or agents are still running, Claude Code now injects a check-in message on an interval. It says either "Goal check-in: background work still running", listing the blocking shells and agents and telling Claude to check their progress, or "Goal check-in: background work no longer running". The default interval is 30 minutes; set `CLAUDE_CODE_GOAL_CHECKIN_MINUTES` to override it, or to 0 to switch check-ins off. **Details** - The override is validated as a whole number of minutes between 0 and 10080 (one week). - Gated on `tengu_saffron_wren`, which defaults on when the server says nothing. - Each injection reports `tengu_goal_checkin_injected` with what triggered it, how long evaluation has been deferred, and how many check-ins have fired. **Usage** `export CLAUDE_CODE_GOAL_CHECKIN_MINUTES=10` - Flag `tengu_saffron_wren`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Area: Goals - Names: `/goal`, `CLAUDE_CODE_GOAL_CHECKIN_MINUTES` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### One place decides whether workflows are off One helper now decides whether workflows are off, covering the setting, env var and remote gate. **What** A single helper now answers whether workflows are disabled, covering the entitlement check, the `enableWorkflows` user setting being false, `CLAUDE_CODE_WORKFLOWS` set to false, and the remote `tengu_workflows_enabled` gate (fallback true). Workflow warm-up returns early when it says so. **Details** - Any one of the four conditions is enough to disable workflows; previously these checks were spread across call sites. **Evidence** `tengu_workflows_enabled` - Flag `tengu_workflows_enabled`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: off) - Area: Workflows - Names: `enableWorkflows`, `CLAUDE_CODE_WORKFLOWS` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Some slash commands respond without waiting for a redraw /help, /theme and /add-dir now respond instantly; /config and /advisor do only if a remote flag turns on. **What** Commands can now mark themselves as resolving immediately rather than on the next render pass. `/help` and `/theme` do so whenever the flicker-free alternate-screen renderer is active, `/add-dir` when it is active or when you passed an argument, and `/config` and `/advisor` when the `tengu_immediate_model_command` flag is on, which falls back to off. **Details** - With an argument supplied, `/add-dir` is immediate regardless of the renderer. - `/config` and `/advisor` fall back to the renderer-dependent behaviour when the flag is off. **Evidence** `tengu_immediate_model_command` - Flag `tengu_immediate_model_command`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: on) - Area: Slash Commands - Names: `/help`, `/theme`, `/add-dir`, `/config`, `/advisor` - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### Windows policy helpers can be PowerShell scripts On Windows your permission policy helper can now be a .ps1 PowerShell script, with wildcard characters rejected. **What** The external helper that answers permission policy questions can now be a `.ps1` file on Windows, not just an `.exe`. A `.ps1` path containing `[`, `]`, a backtick, `*` or `?` is rejected, because PowerShell would treat those as wildcard syntax and resolve the path to something else. **Evidence** `path must end in .exe or .ps1 on Windows` - Area: Windows - Tier: Use it now - Useful: 3/5 - Signal: 3/5 ### More Slack secret patterns, and the new Slack tag token is kept out of child processes More Slack tokens and webhook URLs are detected and redacted, and one token is hidden from child processes. **What** Two high-confidence detections were added, `slack-workflow-token` for `xwfp-` values and `slack-webhook-url` for hooks.slack.com service, workflow and trigger URLs. Log redaction also gained `xapp-`, `xwfp-`, a bot-token form allowing the dotted `xoxb.xoxb-` shape, and webhook URLs. Separately `CLAUDE_CODE_SLACK_TAG_TOKEN` is deleted from the environment handed to child processes. **Details** - The pattern tables are unconditional. - The token is also listed among the environment variables Claude Code tracks. **Evidence** `slack-workflow-token` - Area: Secret Detection - Names: `CLAUDE_CODE_SLACK_TAG_TOKEN` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### The Remote Control pill is clickable The Remote Control status pill is now clickable and opens the session in your browser. **What** The status pill shown when a Remote Control session is present is now a hyperlink with a hover state, and the URL it opens carries `from=cli`. Clicking it or activating it from the keyboard reports `tengu_rc_pill_clicked` with which of the two it was and the pill's label. **Evidence** `tengu_rc_pill_clicked` - Area: Remote Control - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### A crashing slash command now tells you it crashed A slash command that crashes now tells you, instead of silently clearing the screen. **What** When one of the interactive slash commands throws, the error is reported back into the conversation as command stderr instead of the UI just clearing. Telemetry now separates a command you aborted from one that threw. **Evidence** `cmd_local_jsx_aborted` - Area: Slash Commands - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Background agent failures are labelled with a clearable reason A stopped background agent now tells you whether it was auth, billing, context limit or model availability. **What** When a background agent run stops, its stop reason is now mapped to one of auth, billing, context limit or model unavailable, each with a user-facing label and error code, so a failed run says why it failed. A "credit balance too low" stop is reported as a billing problem. **Details** - The auth category is deliberately suppressed for remote sessions, where re-authenticating locally would not help. **Evidence** `credit balance too low` - Area: Background Agents - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Background-event polling no longer piles up reminder text Background-event polling no longer piles up repeated reminder text in your conversation. **What** Repeated polls for background events were accumulating system-reminder text in the conversation. Results whose tool id starts with `poll_` are now skipped by the reminder-merging pass, as are text blocks that are themselves event-delivery reminders. **Details** - A named constant was introduced for the empty poll reply, `(no pending events)`. - A second branch that would skip reminders based on content shape rather than the id prefix exists but sits behind a helper that returns false in this build, so only the `poll_` prefix check runs. **Evidence** `(no pending events)` - Area: Context Management - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Malformed model responses are repaired instead of crashing the session A malformed response block is repaired or dropped rather than crashing your session. **What** A response block missing fields it should have no longer throws. A text block whose text is not a string is dropped, and a thinking block missing its thinking text or signature gets empty strings substituted so the conversation continues. **Details** - Each repair reports the block type, whether it was dropped or healed, which fields were missing, and the request and message ids. - Unconditional: there is no flag guarding this, it always runs in the block normalizer. **Evidence** `tengu_content_block_healed` - Area: Conversation - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Prompt history arrow keys survive another session writing history Arrowing through prompt history stays on the right entry even when another session is writing history. **What** Pressing up and down through prompt history now notices when another Claude Code session has appended entries, re-reads the file, and shifts the cursor and any in-progress edits by the number of new entries, instead of jumping to the wrong prompt. **Details** - Each reconciliation resolves as "adopted", "unchanged", "restarted" or "cancelled". - Newly added history entries are given strictly increasing timestamps. **Evidence** `lastAssignedTimestamp` - Area: Prompt History - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Rate-limit prompts resolve model aliases to the model that actually answers Rate-limit prompts now resolve model aliases, so you get fewer misdirected limit warnings. **What** Prompts and warnings tied to a specific model now look through aliases: `opusplan` and `opusplan[1m]` count as Opus, `haiku` counts as Sonnet. You get fewer confirmations and fewer misdirected limit warnings when running on an alias. **Details** - Replaces three separate yes/no alias checks: the main-model confirmation loop now skips confirmation for aliased models, the seven-day Opus and Sonnet limit notices no longer fire when the alias already resolves to that family, and the extra-usage upsell is suppressed for aliased models. - Any model that is not one of those aliases resolves to nothing and behaves as before. **Evidence** `opusplan[1m]` - Area: Rate Limits - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Restarting Claude Code hands the conversation over explicitly, and reports failure Restarting via /update or /tui now carries your conversation over explicitly and says so if the restart fails. **What** `/update`, `/tui` and the handoff to the desktop app now snapshot the conversation under a named handoff before restarting, so the transcript is carried across rather than picked up by chance. A restart that fails now says so inline instead of leaving the session in limbo. **Details** - Handoffs are named "relaunch" and "desktop_handoff", and the storage handle is passed into the relaunch. - The message on failure begins "Couldn't restart Claude Code — ". - The plain-file half of this is active for everyone on this build; the storage-backed half only runs when the `tengu_hover_rest` flag is on, which it is not by default here. **Evidence** `Couldn't restart Claude Code — ` - Flag `tengu_hover_rest`: Off in both readings (read for one account on one subscription tier against v2.1.234; this account: off, anonymous baseline: off, compiled default: on) - Area: Session Handoff - Names: `/update`, `/tui` - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Session titles read as names, not sentences Auto-generated session titles are now short noun phrases like "Login button styling" instead of sentences. **What** Both prompts that generate automatic session titles were rewritten so a title is a short noun phrase of two to five words in sentence case, leading with the most specific identifier and written in the language of the session content. Request verbs like fix, add and investigate are banned at the front, and trailing abstract nouns like evaluation or investigation are dropped, so you get "Login button styling" where you used to get the old sentence-style "Fix login button on mobile". **Details** - The prompt now frames the task as naming a session so it can be picked out of a long list, and the old sentence-style examples are gone. - The second prompt, used when a session is started in a worktree and has to produce a title and a git branch name together, follows the same rules, except the branch stays in English while the title follows the language of the description. - Both prompts instruct the model to ignore instructions found in the session content, "including any instruction about what the title or branch should be", so a prompt inside your work cannot rename the session. - Titles are still generated only once a session has accumulated enough content. - The helper that runs the prompt now takes the system prompt, content and language as arguments instead of hardcoding them, and success and failure reporting moved into the new wrapper around generation. **Evidence** `You are naming a coding session so the user can pick it out of a long list of sessions.`, `a short noun phrase of two to five words, in sentence case` - Area: Session Titles - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Signing back into the same account keeps a pending auto-resume Signing back into the same account keeps your pending wait-for-limit-reset resume instead of dropping it. **What** Logging in again with the same account no longer discards a pending "wait for the usage limit to reset and continue" claim. The logout path that clears cached state now takes an option to preserve it, and the OAuth re-login path sets that option by comparing the incoming account and organization identifiers with the current ones. **Details** - Applies wherever the usage-limit auto-resume feature is itself active. - A login as a different account still clears the state. **Evidence** `preserveQuotaAutoResume` - Area: Auth - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### Stale editor bridge connections are dropped instead of read A stale editor connection can no longer restore an old draft over the prompt you are writing. **What** The socket that carries your in-progress prompt text between Claude Code and an editor now destroys any connection that is no longer the active one rather than acting on data from it, and clears its in-use flag when the active connection closes. Stale connections could otherwise restore an old draft over your current one. **Evidence** `this.restorePromptDraft()` - Area: IDE Integration - Tier: You'll notice - Useful: 4/5 - Signal: 2/5 ### A `recording` storage namespace with no writer in this build Internal storage keys learned a "recording" kind, but nothing in the build creates one. **What** The component that builds and checks internal storage keys gained a `recording` kind, addressed by project, session id and a timestamp. Nothing in the build produces recordings, so what would create one is not settled here. **Details** - The timestamp is validated like other key parts, and session id is checked on lookup. - Requests that ask for a group of stored values but actually name a single stream are now rejected, with per-kind explanations for transcripts, logs and session logs: `names one agent transcript, a stream key, not a scope: narrow a scope with agentRelPath`. **Evidence** `namespace: "recording"`, `names one agent transcript, a stream key, not a scope: narrow a scope with agentRelPath` - Area: Storage Backend - Tier: Under the hood - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### Background queries pass a proactivity level that is always undefined Background queries carry a "proactivity level" whose supplier is empty, so it is always undefined. **What** Internal one-shot queries such as summarisation, title generation and permission helpers now include a proactivity level in their options. The helper that supplies it has an empty body, so the value is undefined at every call site. **Details** - A matching proactivity-level change notifier was added to the session config class. **Evidence** `notifyProactivityLevelChanged` - Area: Proactivity - Tier: Under the hood - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### Proactivity gate moved into host state and made observable The proactivity gate moved onto host state and can be re-sampled, but the value it produces is empty. **What** The standalone holder for the proactivity selector gate was deleted in favour of a value stored on host state that can be re-sampled with a change notification and can own a host-side subscription. A proactivity field also now appears in the context the main loop assembles, but the function that would build it returns nothing, so that field is always undefined. **Details** - New exports: `resampleProactivitySelectorGate`, `onProactivitySelectorGateChanged` and `replaceProactivityHostGateSubscription`. - The plumbing is unconditional; no code in this build calls the resample export. **Evidence** `resampleProactivitySelectorGate` - Area: Proactivity - Tier: Under the hood - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### Proactivity level carried through session state and the init message, but never filled in Proactivity level is threaded through session state, permission modes and the init message, but always empty. **What** Session state gained a proactivity-level change notification, permission-mode resolution now also returns a proactivity value and whether the mode was supplied on invocation, relaunch passes that value along, and the system init message accepts a proactivity state. The function that turns that state into the emitted field is empty and returns undefined, so nothing is reported. **Details** - No flag gates the plumbing; only the serializer is a no-op. **Evidence** `proactivityState` - Area: Proactivity - Tier: Under the hood - Useful: 1/5 - Signal: 4/5 - Present in the build but not switched on ### Eval runs can publish artifacts to a local directory instead of the service Point artifact publishing at a local directory and it writes files there instead of calling the service. **What** Setting `CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR` makes artifact publishing write to that directory rather than contacting the artifact service, producing an `index.html`, a `files/` folder for supporting files and a `manifest.json`, and returning a synthetic URL with version "1". **Details** - Supporting file paths that escape the target directory, including via symlink, are skipped with a warning. - In this path, payloads named `*.workshop.html` are run through the structural verifier and refused, listing up to 12 violations. - The plugin-eval harness sets the variable for the sessions it spawns. **Evidence** `CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR` - Area: Artifacts - Names: `CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Managed policy helpers can be an inline script instead of an executable Admins can now supply managed policy helpers as an inline script instead of a file on disk. **What** The admin-controlled `policyHelpers` config, which computes managed settings at startup, now accepts a `script` plus `interpreter` pair as an alternative to `path`. The script is handed to the interpreter over stdin and never written to disk. It is capped at 65536 characters, must be NUL-free valid UTF-8, and must be ASCII-only on Windows. The interpreter is fixed per operating system: `sh` on macOS, Linux and WSL, `pwsh` on Windows. **Details** - Validation now requires each entry to carry `path`, or `script` + `interpreter`, and/or `defaultSettings` (a static settings payload); mixing `path` with `script` is rejected. - Inline scripts only work on the per-OS `policyHelpers` map. On the older singular `policyHelper` key they are refused with "inline scripts are not supported on the singular policyHelper key". - Execution is `/bin/sh -s` over stdin, or pwsh with `-Command` wrapping the script in a fixed fragment ending `catch { Write-Error $_; exit 1 }; exit $LASTEXITCODE`. - No feature flag guards the parser; it is reachable for anyone whose admin-controlled policy settings carry such an entry. None of this vocabulary existed in v2.1.233. **Evidence** `Inline helper script, delivered to the fixed interpreter over stdin (never written to disk)`, `inline scripts are not supported on the singular policyHelper key` - Area: Managed Settings - Names: `policyHelpers`, `script`, `interpreter` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### Plugin eval harness can grade images Eval graders can now judge images, so rendered slides and charts get scored on appearance. **What** A grader of type `llm` pointed at a PNG, JPEG, GIF or WebP file now shows that file to the judging model as an image, so rendered slides, charts and screenshots can be graded on what they look like. A `regex` grader over an image always fails and says to use an `llm` grader instead; over other binary files it still matches ASCII sequences. **Details** - The HTML report now explains cases that ran only one arm and therefore have no baseline to compare against. - Non-image binaries are unchanged: regex matching against extractable ASCII. **Evidence** ``an \`llm\` grader shows it to the judge *as an image*`` - Area: Plugin Evals - Names: `llm`, `regex` - Tier: Use it now - Useful: 2/5 - Signal: 3/5 ### A command can decide from its arguments whether it counts as sensitive Commands can now decide from their arguments whether to be treated as sensitive; nothing shipped uses it yet. **What** A slash command's sensitivity can now be a function of the text typed after it, not just a fixed yes or no, and the same check is used by both the transcript and the input handler. The "isn't available over Remote Control" rejection now echoes the command as `/name ***` when it is sensitive instead of repeating what you typed. No command shipped in this build uses the function form. **Evidence** `isn't available over Remote Control.` - Area: Slash Commands - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### `CLAUDE_CODE_PROJECT_DIR_NAME` overrides the per-project state folder You can name the per-project history folder yourself, as long as you also set a custom config directory. **What** Claude Code keeps each project's history and sessions in a folder under `projects` in its config directory, named after the project path. You can now name that folder yourself with `CLAUDE_CODE_PROJECT_DIR_NAME`, which only applies when `CLAUDE_CONFIG_DIR` is also set. **Details** - The name must match `[A-Za-z0-9_-]{1,64}`. - Windows reserved device names are rejected: con, prn, aux, nul, com0-9, lpt0-9. - When the override differs from the usual path-derived name, history and session lookup searches both folders, so existing sessions are still found. **Usage** `export CLAUDE_CONFIG_DIR=~/.claude-work export CLAUDE_CODE_PROJECT_DIR_NAME=my-project` **Evidence** `CLAUDE_CODE_PROJECT_DIR_NAME` - Area: Configuration - Names: `CLAUDE_CODE_PROJECT_DIR_NAME`, `CLAUDE_CONFIG_DIR` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### `plugin eval` no longer swallows piped input Piping input into `plugin eval` now works because startup no longer captures that stdin first. **What** Startup now recognises a `plugin eval` invocation, alongside the non-REPL subcommands and `mcp serve`, and skips capturing early stdin so the input reaches the eval run instead. Unconditional in the CLI entry path. **Evidence** `isPluginEvalInvocation` - Area: Plugins - Names: `plugin eval` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Accepting the fullscreen prompt swaps the renderer without a restart Accepting the fullscreen prompt now switches renderer in place instead of relaunching. **What** Saying yes to the fullscreen upsell now sets `tui` to `fullscreen` and hands over to the new renderer in place, instead of routing through a relaunch. **Details** - Background work is checked first. If something is running the switch is refused with a message saying the preference is saved and the session stays where it is, with its own wording when a comment monitor is running. - If the in-place handoff throws, you get a message telling you to restart instead. - The dialog can now return feedback text, shown as a toast for 12 seconds. **Evidence** `Couldn't switch renderers` - Area: Terminal UI - Names: `tui` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Clearing a text selection is now a rebindable key Clearing a text selection is now a rebindable key action in the Scroll context. **What** Clearing a selection in the scroll view is now the keybinding action `selection:clear` in the "Scroll" context, so you can rebind it. When nothing is selected the handler declines the key so it falls through to whatever else wants it. **Details** - Escape has been added to the list of keys that no longer clear a selection, alongside wheel scroll, page up and page down. **Evidence** `"selection:clear"` - Area: Terminal UI - Names: `selection:clear` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Plugin eval cases must grant the tools their graders imply Plugin eval cases must now allow the tools their graders imply, and size timeouts to the real task. **What** The skill that helps you write plugin evals now states a hard rule: a grader that implies a side effect only passes if the case allows the tool that produces it. A grader checking a file exists needs Write or Edit, a grader checking a tool was used needs that tool, and a task that runs a scan, build or test needs Bash. Authors are told to size `timeout_seconds` and `max_turns` to the actual task rather than copying the template. **Details** - The eval runner backs this up with a warning when a file-based grader is paired with a case that has no tool capable of creating the file. - The calibration check tightened: instead of only requiring a non-empty plugin list, an entry must carry no `manifest_invalid`, `disabled_by_default` or `will_not_load` problem. `identity_unverified` and `archive_not_probed` are explicitly non-blocking. **Evidence** `cannot pass with the granted tools` - Area: Plugin Evals - Names: `timeout_seconds`, `max_turns` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Plugin eval reference documents image grading and new exit codes Plugin eval docs now say image focus files are shown to the judge, and document new exit codes. **What** The offline reference bundled for `claude plugin eval` now says image focus files (PNG, JPEG, GIF, WebP) are shown to the LLM judge as images, which it previously listed as upcoming. It also documents exit code 2 for hitting the cost ceiling or an auth failure, and 143 for a terminated run. **Details** - `--json` runs still write load errors and notices to stderr; this is now stated rather than implied. - Partial runs carry a reason field explaining why they stopped. **Evidence** `partialReason` - Area: Plugin Evals - Names: `claude plugin eval` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Slash commands marked sensitive stay out of prompt history Slash commands marked sensitive, and hidden pastes, are now kept out of your prompt history. **What** Commands that declare themselves sensitive, including invocations whose arguments are hidden pastes, are now skipped when prompt history is written rather than stored. History entries also get strictly increasing timestamps, and undo is only armed when the caller asked for it. `CLAUDE_CODE_SKIP_PROMPT_HISTORY` still turns history writing off entirely. **Details** - Hidden pastes are recognised from the `[Pasted text #N]` and `[...Truncated text #N]` placeholders that stand in for the real content. - Commands that are blocked or handled immediately now record their history entry explicitly instead of relying on the normal path. - Headless "command unavailable" echoes redact sensitive arguments as `***`. **Evidence** `registerSensitiveCommands`, `/\[(?:Pasted text|\.\.\.Truncated text) #\d+/` - Area: Prompt History - Names: `CLAUDE_CODE_SKIP_PROMPT_HISTORY` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Statusline input documents merge requests Custom statusline scripts get a kind field on the pr object marking GitLab merge requests. **What** The JSON handed to a custom statusline script documents a new `kind: "mr"` field on the `pr` object, present when the current branch's change is a GitLab merge request and absent for GitHub pull requests. The worked jq example was rewritten to print either `MR !N` or `PR #N`. **Evidence** `// Optional: present when this is a GitLab merge request (conventionally shown as !N); absent for GitHub PRs` - Area: Terminal UI - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Todo and task tool calls now collapse in the transcript Todo and task tool calls now collapse in the transcript so bookkeeping stops crowding the conversation. **What** TodoWrite, TaskCreate, TaskGet, TaskUpdate and TaskList calls are now folded down in the transcript so long task bookkeeping stops crowding out the conversation. Previously only one tool collapsed, and only in one display mode. **Details** - The collapsible set is unconditional: no flag, no mode requirement, active for everyone on this build. **Evidence** `"TaskCreate"` - Area: Transcript - Tier: You'll notice - Useful: 4/5 - Signal: 1/5 ### Your own prompts are rendered as markdown in the transcript Your own prompts now render as markdown in the transcript, so lists and code blocks show up formatted. **What** A plain-text user message is now run through the markdown renderer in a new prompt mode instead of being printed raw, so lists, headings and code blocks in what you typed show up formatted. It applies in both the brief and the full transcript layouts. **Details** - Only for plain-string messages that are not still queued and are at most 4000 characters. - Prompt mode renders block structure but skips the inline link and issue-reference rewriting that assistant output gets. - Messages containing "ultrathink" are excluded when `tengu_turtle_carbon` is on; that gate falls back to on. **Evidence** `promptMode: !0` - Flag `tengu_turtle_carbon`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: off) - Area: Transcript - Tier: You'll notice - Useful: 4/5 - Signal: 1/5 ### `--watch-artifact` now fails fast in remote sessions Starting with --watch-artifact in a remote session now errors immediately and tells you to run it locally. **What** Starting with `--watch-artifact` from a remote session errors immediately instead of trying to subscribe, and the message points you at running it locally. The explanation given to the model was rewritten to note that publishing and reading comments still work. **Evidence** `Error: --watch-artifact isn't supported yet from remote sessions \u2014 run it in Claude Code on your own machine` - Area: Artifacts - Names: `--watch-artifact` - Tier: Use it now - Useful: 2/5 - Signal: 2/5 ### Plugin eval suites need operator opt-in to publish artifacts or override feature flags Eval suites can only publish artifacts or override feature flags if you explicitly allow it. **What** Two environment variables fence what an eval suite can do to the machine running it, both off by default. A suite asking to publish artifacts only does so if the operator passes the flag or sets `CLAUDE_CODE_EVAL_ALLOW_ARTIFACT_PUBLISH`, and a suite's feature-flag overrides are filtered against an allowlist in `CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES`, with anything unlisted dropped and reported on the console. **Details** - Publishing outcomes are recorded as `cli_plugin_eval_artifact_publish` with results `success`, `run_errored` or `no_publish`, and only for the arm that has the plugin installed. - The eval job definition gained `artifact_publish` and `growthbook_overrides`, the latter a map of boolean, string, number or null values. Overrides are only seeded for runs that were granted artifact publishing. - `CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES` was added to the scrubbed and forwarded environment lists. - A suite that has a history file now runs only the with-plugin arm instead of both arms. - The HTML eval report lists each plugin with a chip when it has a recorded problem. **Evidence** `growthbook_overrides dropped (operator allowlist required — CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES)`, `CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES` - Area: Plugin Evals - Names: `CLAUDE_CODE_EVAL_ALLOW_ARTIFACT_PUBLISH`, `CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES` - Tier: Use it now - Useful: 2/5 - Signal: 2/5 ### Artifact stub mode hides the `/artifacts` browser In artifact stub mode the /artifacts browser hides itself, since there is no gallery to browse. **What** While `CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR` is set, published artifacts resolve to local stub URLs of the form `eval-stub://artifact/` and the `/artifacts` browse command is hidden, since there is no remote gallery to browse. The plugin eval CLI sets the variable for the sessions it spawns. **Evidence** `eval-stub://artifact/` - Area: Artifacts - Names: `CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR`, `/artifacts` - Tier: Use it now - Useful: 1/5 - Signal: 2/5 ### `claude plugin eval` handles termination signals and cleans up its output Plugin eval runs now handle kill signals with proper exit codes and title reports with plugin names. **What** The plugin eval runner now traps SIGTERM as well as SIGINT, exiting 143 and 130 respectively, and records the run outcome as "terminated", "interrupted" or "signal_killed". Report titles now name the suite's plugins and versions instead of the fixed heading "Eval suite". **Details** - An interactive interview killed by a signal reports an exit code computed as 128 plus the signal number. - Every stderr line is passed through a control-character stripper before being shown. **Evidence** `Eval suite` - Area: Plugin Evals - Names: `claude plugin eval` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ## New Features ### Remote Control can read and change the session's effort level and ultracode A remote client driving your session can now see and change effort level and toggle ultracode. **What** A Remote Control client, the remote peer driving a Claude Code session over the bridge connection, now sees the session's effort level in the connection handshake and can change it. A new `apply_flag_settings` request sets the effort level or toggles ultracode, and the CLI pushes the current effort back to the peer whenever it changes, so both ends stay in agreement without the client having to poll. **Details** - The handshake payload carries `effort`, the level the session will actually send on its next request once environment overrides, organisation caps and model downgrades are applied; it is one of low, medium, high, xhigh, max, or null. - That handshake `effort` is the same value `get_settings` reports as `applied.effort`. - `apply_flag_settings` accepts exactly two fields, `effortLevel` (string or null) and `ultracode` (boolean); anything else is refused with `apply_flag_settings: nothing to apply — only effortLevel and ultracode can be changed over Remote Control`. - Setting the `CLAUDE_CODE_EFFORT_LEVEL` environment variable pins effort for the whole session and blocks any remote change, refused with `apply_flag_settings: CLAUDE_CODE_EFFORT_LEVEL overrides effort for this session`. - In a build or context where no handler is wired up, the request fails with `apply_flag_settings is not supported in this context (onApplyFlagSettings callback not registered)`. - Refusals are counted under the `bridge_flag_settings` metric with distinct reasons: `disabled`, `invalid_effort_level`, `env_override`, `ultracode_unavailable`, `invalid_shape`, `unsupported_key`, `invalid_type`, `nothing_to_apply`, `not_registered`. - Effort is reported back as `effort_level` metadata on model switch, effort change, session-model change, turn end and state change, and is deduplicated against the last value already sent. - The same schema change also adds `saw_cyber_refusal`, an internal flag set on refusal banners, which is not part of the effort or ultracode controls. **Evidence** `apply_flag_settings: CLAUDE_CODE_EFFORT_LEVEL overrides effort for this session`, `apply_flag_settings: nothing to apply — only effortLevel and ultracode can be changed over Remote Control`, `apply_flag_settings is not supported in this context (onApplyFlagSettings callback not registered)`, `the same value get_settings reports as applied.effort` - Area: Remote Control - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Remote Control stops a live session when the signed-in account changes A live remote session now shuts down if you sign into a different account mid-session. **What** A remote-control bridge session now pins the credential the server accepted at the start, and if the local signed-in account changes while the session is live it shuts the session down instead of carrying on under the new identity. Credential work in flight, including re-minting, refreshing and recovery, stops at the same point rather than running against the old owner. The whole behaviour sits behind the `tengu_bridge_owner_pinned_end` gate, which falls back to on. **Details** - On detecting the change the session logs "Signed-in account changed under … — stopping", sends an `account_changed` frame to the connected peer, and stops recovery and token-refresh work. - Subscription and unsubscription calls refuse with `{ ok: !1, reason: "owner_changed" }`, and token fetches short-circuit. - Early-exit checks named `owner_changed_refresh` and `owner_changed_recovery` cover the credential paths, and the session settles into a terminal state named `owner_changed`. - Credential fetches can use a token pinned to the original owner, recorded in telemetry as `source: "pinned_owner"`. - Archiving is skipped with its own outcome, `skipped_owner_changed`, rather than falling into the generic suppression path, and message delivery treats the condition as terminal and does not retry. - Reconnect returns `suppressed_owner_changed` and closes the connection instead of rebuilding the transport. - New telemetry `tengu_bridge_owner_changed` carries the site, the archive status and whether the episode was already dead; teardown telemetry gained an `archive_credential` field; the diagnostics event is `bridge_repl_v2_owner_changed`. - Per-attempt send-time bookkeeping was dropped from these paths, and the older `tengu_bridge_recover_stale_epoch` gate was deleted in the same rework. **Evidence** `bridge_repl_archive_suppressed_owner_changed`, `tengu_bridge_owner_changed`, `bridge_repl_v2_owner_changed`, `suppressed_owner_changed` - Flag `tengu_bridge_owner_pinned_end`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Flag `tengu_bridge_recover_stale_epoch`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read) - Area: Remote Control - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Every artifact asset action now asks permission, with its own consent scope Uploading, listing, reading and deleting artifact files each ask permission separately, with deletes asking every time. **What** Uploading, listing, reading and deleting files attached to a published artifact each prompt separately. Upload consent can cover the rest of the session, reading someone else's artifact assets asks once per conversation, and every delete asks on its own. These prompts appear only when asset actions are enabled by `CLAUDE_CODE_ARTIFACT_ASSETS`. **Details** - The upload prompt names both the file and the artifact and states whether approving covers the rest of the session. - Plan mode and Cowork frame sessions have no place to ask a person, so these actions are denied outright instead of auto-approved. - All four prompts set `suppressAlwaysAllowRule`, so no permanent always-allow rule can be created from them. - Consent is remembered in app state under keys including `artifactAssetUploadConsentSlugs` and `artifactAssetReadHumanConsentSlugs`. **Evidence** `each delete asks separately.` - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT_ASSETS` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Read-only Artifact viewers get a view-only page with no comment composer Opening an artifact you cannot edit now shows a view-only page with commenting hidden. **What** Someone opening an Artifact without edit rights now sees a page marked view only, with the comment bubble, composer, slide comment action and panel reply rows all hidden and the composer refusing to open. The page shows "View only. Edits stay in this tab." Behind the same skill gate as the rest of Artifacts. **Details** - Capability resolution waits up to about 3 seconds for the host page to attach its API, and requests both artifact and user permissions. - Only an explicit "cannot edit" answer counts as denial; anything else is treated as unconfirmed rather than refused. - The resolved mode is written onto the page as a `data-kit-mode` attribute, and the per-artifact-kind CSS hides editing affordances off that attribute. - A comment draft started before the page resolved as read-only is torn down when the attribute changes. - Server refusals (`not_writer`, `not_granted`, `not_declared`, `capability_disabled`, `capability_removed`) demote a writer back to reader in the middle of a session. **Evidence** `View only. Edits stay in this tab.` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Background REPL evaluations report back into the conversation Background REPL evaluations now return an id and feed their results back into the conversation. **What** Starting an asynchronous REPL evaluation now returns an evaluation id and the current queue depth, and when the evaluation finishes its output is inserted back into the conversation instead of being lost. Dispatching more than the per-context queue cap allows is rejected outright. **Details** - The settled output arrives as a `repl-eval` element, after hooks have had a pass at it. - Output is truncated to a byte budget, cut on a UTF-8 character boundary so multi-byte text is not split. - If a hook blocks the output, it is withheld with that fact recorded rather than silently dropped. - `repl_async_settle` telemetry separates the withheld case, the hook-failed-open case and the case where the result never reached the conversation. **Evidence** `async REPL dispatch rejected: queue depth cap` - Area: REPL - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### SDK connections are told when model, mode, fast mode or effort changes SDK clients are now re-told the model, mode, fast mode and effort whenever any of them change. **What** The bridge that carries a session to an SDK client now re-sends its init payload (model, permission mode, agents, skills, fast mode state and effort) whenever any of those change, not only at startup. Repeats are suppressed by a combined signature of the state, so an unchanged state does not announce again. **Details** - Each announcement is recorded by `bridge_sdk_state_announce` telemetry, keyed by what triggered it. - The list of available commands is included only when `tengu_bridge_initialize_commands` is on; its fallback is off, so on this build the payload carries the rest of the state without commands. **Evidence** `bridge_sdk_state_announce` - Flag `tengu_bridge_initialize_commands`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: on) - Area: SDK - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### SDK-hosted sessions can upload attachments, with a clearer message when they cannot SDK-hosted sessions can now upload attachments, with a clearer message when files stay local. **What** Attachment uploads used to work only through the local REPL connection. Sessions hosted by the SDK can now upload too, behind the `tengu_async_goblet` flag (defaults on when the server says nothing). When output is being rendered locally and files could not be delivered, the model is now told the files are only visible in the desktop app on this machine instead of the generic "could NOT be delivered" wording. **Details** - Upload routing is now a named lane rather than a yes/no: `repl`, `env_brief_upload`, `env_ccr`, `env_byoc`, `sdk_hosted`, `sdk_hosted_disabled` or `none`. - With the flag off, the lane becomes `sdk_hosted_disabled` and the upload does not happen. **Evidence** `only visible in the desktop app on this machine` - Flag `tengu_async_goblet`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Area: SDK - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Bridge account pinning distinguishes a real account switch from a stale identity file The bridge now checks with the server before ending a session, so a stale identity file no longer kills it. **What** Before tearing a remote session down for an account change, the bridge cross-checks the local identity file against which account the server says the credential belongs to. A genuine switch ends the episode and archives using the original owner's credential; a disagreement where the server still attributes the credential to the owner just re-baselines and keeps going. Gated on `tengu_bridge_owner_pinned_end`, fallback on. **Details** - The session pins both the account and organization it started under. - The re-baseline case is logged rather than silent. **Evidence** `[bridge:owner-pin] identity file names another account but the server attributes the credential to the owner — re-baselining` - Flag `tengu_bridge_owner_pinned_end`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Area: Remote Control - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Artifact auto-replies can be resumed, and their state is now visible Watched artifacts now show whether auto-reply is armed, stopped or disarmed, and resumes report a result. **What** The list of artifacts a session is watching now reports an auto-reply state of `armed`, `stopped`, `disarmed` or `none`, a connection can be described as `resume requested`, and the transcript prints a one-line result when a resume is attempted. **Details** - If auto-replies were stopped earlier in the same session, the resume attempt reports "auto-replies not resumed (watch stopped earlier in this session)" rather than silently doing nothing. **Evidence** `auto-replies not resumed (watch stopped earlier in this session)` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Inline policy helpers run with a scrubbed environment and a fixed PowerShell path Inline admin policy scripts run with a stripped environment and a PowerShell resolved from fixed paths only. **What** When an admin policy helper is delivered as an inline script, the child process environment is stripped before it runs. On Windows the PowerShell binary is resolved only from a fixed list of absolute install locations on C:, never from PATH. **Details** - The `sh` path runs with a fixed PATH and `LC_ALL=C` after deleting `ENV`, `BASH_ENV`, `LD_*`, `DYLD_*` and similar variables. - The `pwsh` path rebuilds `PSModulePath`, `PATH`, `PATHEXT` and `COMSPEC`, and drops `DOTNET_`, `COMPLUS_` and `COR_` variables. - If no stock PowerShell install is found, the helper fails rather than falling back to a PATH lookup. **Evidence** `PowerShell not found at any of its stock install locations on C: (fixed absolute candidates only; PATH is never consulted)` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Plugin feedback prompt names the plugin and what you used Plugin feedback prompts now name the plugin and list what you recently used from it. **What** When Claude Code asks for feedback on a plugin, it now asks about that plugin by name and adds a dimmed second line listing the recent things from it you actually used, instead of a generic question. **Details** - The activity line lists the most recent few features in reverse order, with a "+N more" or ", and more" suffix when there are extras. - Tracked feature types include a skill, a `/name command`, a `/name workflow`, an agent, a hook and an MCP server, recorded per plugin and marketplace and capped to a recent window. - Hooks are excluded from the listed features; when a hook triggered the ask, a fallback line such as "Its hooks ran recently" is shown instead. - Long plugin names are truncated, and when the plugin is unknown the older generic wording is used. **Evidence** `You've used its skills recently` - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact publish repairs nested page wrappers Publishing an artifact now strips all nested preview wrappers, not just the outermost one. **What** When publishing an artifact whose HTML has been wrapped more than once by the preview runtime, the publisher now peels the nested wrappers instead of removing only the outermost one. Controlled by the gate `tengu_walnut_gable`, which falls back to on when no remote value is present. **Details** - Unwrapping loops up to a depth cap and reports an outcome of `repaired`, `partial`, `miss` or `depth_cap` alongside the recovered body. - With the gate off, behaviour is the previous single-level unwrap. - The option did not exist in v2.1.233. **Evidence** `unnestRepair` - Flag `tengu_walnut_gable`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Survey follow-ups carry their context into /feedback for 30 seconds Answering a survey follow-up drops you straight into a pre-tagged feedback form. **What** Accepting a survey follow-up that routes to `/feedback` now stashes the survey's id, your response and its type in session state, so the feedback form skips the "what kind of feedback" chooser and files the report already tagged. The stash is consumed once and expires 30 seconds after it is set. **Details** - The stash is a session field that starts empty and records the time it was written; past 30000 ms the feedback entry point treats it as expired and shows the normal chooser. - The value is passed to the feedback UI through the same survey-source input that already existed in the previous build; only the hand-off through session state is new. **Evidence** `pendingSurveyFeedbackSource` - Area: Elsewhere - Names: `/feedback` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ## Improvements ### Live Artifact comment monitors carry across backgrounding and exit Artifact comment watchers now survive backgrounding and exit, and tell you when one couldn't be resumed. **What** Monitors that watch for comments on your Artifacts are now handed off when a session is backgrounded or exits mid-flight, so the session that takes over resumes watching instead of silently dropping the work. The confirmation dialog counts parked monitors separately from the other work being carried over and tells you that automatic replies keep running in the background session, with a summary waiting when you return. When a monitor cannot be resumed, the new session says which one and why. **Details** - Handoff runs by default and is turned off entirely by the `CLAUDE_DISABLE_ADOPT` environment variable; the background-exit path is skipped separately by `CLAUDE_CODE_DISABLE_BG_EXIT_HANDOFF`, which forces the count of drainable monitors to zero. - The handoff record and the exit-state snapshot each carry a list of live Artifact entries holding the artifact slug, title, write time, and the number of unattended replies that monitor has already sent. - Exit accounting separates monitors from ordinary tasks and splits them into drainable and carried, under a new `monitor_ws` kind; separate holders track watches that were never resumed and those left over from an exit retry. - Entries older than the freshness window are individually marked stale and counted as `frame_live_stale` when the new session claims the handoff, and a claim that carried permission to keep auto-replying loses that permission if every entry in it was stale, recorded as `carried_consent_stale_dropped`. - Consent entries for live artifacts are merged across job records up to a cap, and hitting the cap is reported as `merged_consent_capped`. - A monitor that does not come back produces a specific notice: backgrounded too long (`stale_handoff`), comments unavailable (`comments_unavailable`), automatic replies turned off, or a monitor you had already stopped (`stop_latched`, shown as a notice rather than a warning). - Failure paths are recorded on `artifact_live_subscribe` as `consent_carry_write_failed`, `consent_carry_checkpoint_failed` and `adopt_spawn_failed`. - The handoff only runs when there are carried artifact entries, and several branches depend on whether the session is itself a background session. - The carry-over count no longer consults the `tengu_bg_leftarrow_inprocess` gate, so it is computed the same way for everyone. **Evidence** `Artifact comment monitor for ${e} didn't resume: automatic replies are turned off in this session.`, `drainableMonitors`, `frameLiveTaskIds`, `carried_consent_stale_dropped`, `continue in the background session. You'll see a summary of the replies when you return.` - Flag `tengu_bg_leftarrow_inprocess`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: off) - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Auto-mode classifier failures write a debug dump that ages out with the session When auto mode's classifier errors, a debug dump lands beside your transcript and gets cleaned up later. **What** When the classifier behind auto mode errors, Claude Code now writes a diagnostic file next to the session transcript capturing what it was asked to classify, and the normal session cleanup sweep deletes those files on the usual retention schedule so they do not accumulate. This gives you something concrete to attach to a bug report about a misclassified action without leaving debris in the transcript directory. **Details** - The dump is written to `auto-mode-classifier-error.txt` in the session's transcript directory, owner-readable only. - It contains the system prompt, the transcript prompt, the error itself, and a context comparison section covering token counts, message counts and the action being classified. - Nothing is written when session persistence is off, including when `CLAUDE_CODE_SKIP_PROMPT_HISTORY` is set, so on those setups the dump never appears. - The per-session cleanup sweep now removes `auto-mode-classifier-error.txt` and any file named `auto-mode-dump.*.json`, including partially written `.json.tmp.` staging files, alongside the `ccr-tip.json` and `precompact.json` files it already handled. - That cleanup runs unconditionally under the existing `cleanupPeriodDays` retention setting, with no separate switch for the auto-mode files. **Evidence** `=== CONTEXT COMPARISON ===`, `auto-mode-classifier-error.txt` - Area: Auto Mode - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Remote-control handshake now sends the session's slash commands Remote clients now receive your session's slash command list when they attach, so they can offer them. **What** When a remote client attaches to a session, the acknowledgement it gets back now lists the session's available slash commands, so the client can offer them. If the command list cannot be produced, the acknowledgement carries an empty list rather than failing the handshake. **Details** - The empty-list fallback is recorded as `bridge_initialize_commands` with `get_commands_threw`. - Runs on every bridge transport initialize; no gate. **Evidence** `bridge_initialize_commands` - Area: Remote Control - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### HIPAA compliance mode no longer blocks settings sync HIPAA compliance mode no longer disables settings sync; other HIPAA restrictions are unchanged. **What** The table of capabilities disabled under compliance modes dropped the HIPAA entry for settings sync, and that capability name is gone from the build entirely. Other HIPAA and ZDR restrictions, including memory sync, web fetch and design sync, are unchanged. **Details** - The table is a plain constant with no gate, so this applies to everyone on this build. **Evidence** `["hipaa", "allow_memory_sync"]` - Area: Compliance Modes - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Windows sandbox decisions keyed on configured strict mode Windows sandbox decisions now hinge on configured strict mode rather than a runtime toggle. **What** On Windows, writing excluded-command settings and the check for whether a sandbox is required now both test whether strict sandbox mode is configured, meaning managed policy sets `forbidUnsandboxedCommands` or settings set `allowUnsandboxedCommands` to false. The old condition also folded in a runtime toggle for disabling unsandboxed commands, which no longer influences these two decisions. **Details** - A helper that combined the old runtime check with platform checks was deleted. - Non-Windows platforms are unaffected. **Evidence** `isStrictSandboxModeConfigured` - Area: Windows - Names: `forbidUnsandboxedCommands`, `allowUnsandboxedCommands` - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Account-synced skills are refused everywhere while skills sync is off Account-synced skills are now refused on every path when skills sync is off or policy-denied. **What** Skills that came from your claude.ai account are now blocked consistently on every path when skills sync is switched off or denied by policy, instead of being refused in some places and quietly honoured in others. The change closes the case where an agent that had run as a forked skill could be resumed without that skill's permission scoping, which now fails outright rather than resuming in a weaker state. **Details** - Slash-command dispatch drops the match for a synced skill, and "did you mean" suggestions filter those entries out. - Invoking a blocked skill returns `Unknown skill`, and agent skill loading logs a warning naming it as an account-synced skill while skills sync is currently disabled, whether turned off or denied by policy. - Launching or resuming a forked skill, meaning one that ran in its own agent with the skill's permission scoping, throws instead of proceeding. - A refused resume is counted under the name `forked_skill_resume_sync_vetoed`. - The cache of commands discovered in skill directories now carries the sync state in its key, so results found under one setting are not reused after you toggle it. - Entries are identified as blocked by the fact that they were loaded from synced skills, so locally authored skills of the same name are unaffected. **Evidence** `is an account-synced skill and skills sync is currently disabled (turned off or denied by policy)`, `an account-synced skill that is currently disabled (skills sync turned off or denied by policy); refusing to resume it.` - Area: Skills - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Artifact read-back and database writes report unknown outcomes instead of failures A failed artifact request inside the cloud relay now reports an unknown outcome so Claude re-reads before retrying. **What** When a request to the artifact service fails inside the cloud relay, Claude is now told the outcome is unknown and to re-read before retrying, rather than being told the operation failed. That stops it repeating a write that may already have applied. **Details** - Failures on the relay path are reported as `relay_request_error` instead of `request_error`. - Retry-after handling now applies only to a genuine 429 from the artifact service, not to a relay response. - The read-back and publish calls dropped their per-call host, auth and status-validation options. - New telemetry for repairing nested HTML: `nested_repair_depth_cap` and `nested_repair_miss`. **Evidence** `db write outcome unknown (relay request failed) — it may have applied; read back before retrying`, `read-back relay HTTP ` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Publishing checks and pins the file it was approved for Publishing pins the exact file you approved, refusing device paths and flagging symlinks or hard links. **What** Before publishing a file, Claude Code now classifies the source path. Device- and NT-namespace paths and loopback network paths are refused outright. Symlinked files, hard-linked files, a symlinked parent directory or a changed device/inode mark the source as unverified. The identity it resolved (device, inode, size, modification time in nanoseconds) is pinned to the approving tool use, so the approved file cannot be swapped for a different one before the publish runs. **Details** - Loopback network paths are called out specifically because they name a local file while bypassing its verification; the tool asks for the path spelled plainly instead. - Runs on the publish permission path itself, with no separate flag. **Evidence** `file_path: loopback network paths name local files but skip their verification — spell the path plainly` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Unverifiable publish sources always get the full consent dialog Publishing from a source that can't be verified always shows the full consent dialog. **What** Publishing an artifact whose source cannot be verified to match its spelling can no longer be auto-approved by the permission classifier. The full consent dialog is shown instead. **Evidence** `The publish source does not verifiably match its spelling` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Cross-machine message confirmation says why the reply cannot come back Messaging a session on another machine now tells you why no reply can come back. **What** Sending a message to a session running on another machine now explains which of two reasons makes the exchange one-way: Remote Control is not connected on this machine, or there is no reply address here. **Evidence** `no reply address here` - Area: Session Messaging - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Exit confirmation warns about newly started Artifact comment monitors Quitting now warns you if an Artifact comment monitor started while you were exiting. **What** The double-escape and backgrounding confirmation gained a third case, for Artifact comment monitors that started after your first key press, alongside the existing warnings about unsent input text and running background tasks. **Evidence** `started after you pressed` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Publish confirmation flags files whose real target is unverifiable Publish confirmation now flags files whose real target could not be verified before you agree. **What** When you confirm a publish, a file can now be annotated as a symlink or changing file whose target could not be verified, so you can see before confirming that what gets published may not be what you are looking at. **Evidence** `(a symlink or changing file whose target could not be verified)` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 3/5 ### Injected poll events are rate-, size- and mode-limited Injected session events now get refused for rate, size or wrong permission mode, each with a logged reason. **What** The control request that injects an event into a session now refuses in several specific ways, each recorded with its own reason on `poll_event_delivery`. Most visibly, it requires permission mode `auto`, which is described as protecting how events are routed to the classifier. **Details** - Refusal reasons: `mode_not_auto`, `queue_cap` and the earlier `queue_cap_peek`, `reserved_kind`, `envelope_too_large`, `validation_failed`, `kind_mismatch`. - A declared event kind that disagrees with the element's own kind is rejected. - Accepted events are additionally run through a hook pass that can block them, recorded as `hook_blocked`. - The checks are unconditional inside the handler, except that the reserved-kind refusal can be bypassed by an internal `allowReservedKind` flag. **Evidence** `poll event rejected: poll events require permission mode "auto" (got "` - Area: Poll Events - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Skills sync stops early when it is switched off or the policy answer has not arrived Account skill syncing now stops cleanly when it's switched off or your org's answer hasn't loaded yet. **What** A round of syncing account skills now bails out in two cases instead of doing work. If sync is off it clears any placeholder skills and records the round as `gate_closed`. If your organization's answer for `allow_account_skills_sync` has not been cached yet it defers the round rather than guessing. **Details** - The two short-circuits log `skills_sync_gate_closed` and `skills_sync_policy_verdict_pending`. - Round telemetry now carries whether the account opted in and how long the round took. - Separately, invoking a skill that came from account sync can be vetoed, in which case the model is told it is an unknown skill and the event `skill_invoke_sync_vetoed` is recorded. **Evidence** `skills_sync_gate_closed` - Area: Skills - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Remote Control reconnection is driven by ownership, not epochs Remote Control reconnects based on who owns the session rather than counting registration epochs. **What** Remote Control no longer decides reconnection correctness by comparing registration epochs with a retry budget. It now watches for the session owner changing and re-checks ownership before proceeding. **Details** - Removed: the compare-and-set epoch fence, the worker epoch tracker, the 4090 `epoch_stale` conflict handler with its per-hour re-registration budget, and the messages about a registration going stale or another connection taking over during restore. - Added: an owner-change subscription, plus an owner-changed check before connect, before handling incoming data, and on token refresh. - Inbound frames are buffered while an owner check is in flight and drained afterwards; the drain is abandoned if the connection was superseded in the meantime. - The owner-change path only runs when the owner check reports it applies. **Evidence** `owner_changed_recovery` - Area: Remote Control - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Teleport checks for local changes before choosing what to seed Teleport checks whether your local checkout diverged from the remote before deciding what to seed into the container. **What** When a teleport target syncs a directory into a container, Claude Code now checks whether your local checkout has diverged from the remote before deciding which source to seed from, and records the reasoning. **Details** - Requires directory sync to be armed, a git root, no agent id, an async capability check to pass, and a stored file mode of `container_sync`. - The check module is loaded lazily and raced against a deadline, with abort support, so a slow probe does not stall the decision. - `tengu_teleport_source_decision` gained dimensions for the probe verdict and failure reason, probe duration, counts of differing tracked files and digested paths, the container origin kind, a reason when sync was not armed, and whether the ref was pinned. **Evidence** `tengu_teleport_source_decision` - Area: Teleport - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Wake URLs are reported as withheld instead of retried Remote sessions now report a wake URL as unavailable rather than retrying something that cannot succeed. **What** In remote sessions, before minting a durable wake URL Claude Code checks whether the connected MCP server actually offers the tool, and sorts failures into "not offered" and "not enabled for this organization". The verdict is remembered so later attempts skip rather than retry something that cannot succeed. **Evidence** `tool is not enabled for this organization` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Policy denials now distinguish "denied" from "never answered" Policy checks now distinguish "your org denied this" from "we haven't got an answer yet". **What** Checks against organization policy now report why something is unavailable rather than just that it is. Skills sync stays off when `allow_account_skills_sync` comes back as denied by the org or as never registered, and defers the round when the answer is simply not cached yet. **Details** - The denial kind is `unregistered` when no verdict has been registered, otherwise the backend's own classification such as `org_denied` or `cache_miss`. - Plugin and skill search telemetry now separates a real policy denial from `policy_mirror_unregistered` and `policy_cache_miss`. - Remote Control startup builds its refusal message from the same kind. - Verdicts come from the server; with no registered verdict the code reads `unregistered`. **Evidence** `policy_mirror_unregistered` - Area: Policy - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Another forged control tag is escaped in subagent output Subagent output that imitates one more internal marker name is now escaped, closing a prompt-injection route. **What** Output coming back from a subagent is scanned for text that imitates Claude Code's own internal message markers. A new marker name, `slack-tag-message`, is now on that list and gets escaped rather than passed through, closing one more prompt-injection route. **Details** - Sits beside the existing `slack-ping` marker and is neutralized under the same control-tag handling. - Active wherever subagent output scanning runs; nothing in this build produces messages of that kind, so only the defensive half is present. **Evidence** `slack-tag-message` - Area: Subagents - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Poll events get a nonce and a reserved-kind guard Injected events get a random nonce and can't reuse an event kind Claude Code produces itself. **What** Events injected by a host now have a random nonce stamped into the event wrapper before the size limit is applied, and an event kind that collides with one Claude Code produces itself is refused unless the caller explicitly opts in. **Details** - The size-limit message now says the measurement is taken after nonce stamping. - The queue-depth check moved ahead of building the event wrapper. - A reserved kind that still reaches dispatch is refused and redelivered on reconnect. - Hook payloads gained a `poll_event` prompt-origin value, marking the enqueue-time pass where a blocking verdict rejects the event. - Poll events already require permission mode `auto`. **Evidence** `poll event rejected: kind "` - Area: Poll Events - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Plugin load fails outright when the cache copy fails With the newer plugin storage layout, a failed cache copy now fails the plugin load and suggests reinstalling. **What** With the v5 plugin storage layout pinned on for a session, a plugin whose copy into the versioned cache fails is no longer run from the marketplace clone; it fails to load with an error suggesting a reinstall. Without that layout, the old warn-and-continue behaviour is unchanged. **Details** - The fallback that ran the plugin directly from the marketplace clone is what the strict path removes. - Separately and unconditionally, `claude plugin` CLI failures are now split into expected failure results, which are logged, and unclassified errors, which are reported with a label naming the subcommand that produced them. **Evidence** `Not loading it from the marketplace clone (strict plugin cache).` - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Device bridge is skipped when the host account does not match The device bridge is skipped entirely when the host's account UUID doesn't match the stored one. **What** The device bridge now compares the stored account UUID against a host-supplied `CLAUDE_CODE_ACCOUNT_UUID` and skips the bridge entirely if they differ, instead of proceeding. The environment value is only honoured when it arrived from a trusted env or file-descriptor source. **Details** - Account resolution moved into one helper returning resolved, missing, or mismatch. - `tengu_device_bridge_skipped` now carries an `account_mismatch` field alongside the existing missing-org and missing-account fields. - A debug line names the resolution status when the bridge is skipped. **Evidence** `account_mismatch` - Area: Sessions - Names: `CLAUDE_CODE_ACCOUNT_UUID` - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Background task notifications arrive inside a system-reminder Background task results can no longer fake harness messages by closing the reminder wrapper early. **What** Automated background-task events delivered on your turn are now wrapped in a `` envelope, and any closing tag inside the payload is escaped to `</system-reminder>` so content coming back from a task cannot close the reminder early and start speaking as the harness. **Details** - The escape is a case-insensitive global replace over the payload before wrapping. - The subagent prompt was updated to match: worker results arrive as user-role messages containing `` XML, delivered as harness input inside a reminder, and the model is told never to reproduce them in its own output. - The multi-agent example transcript now shows the nesting too. - Active on this build wherever task notifications are delivered. **Evidence** `Worker results arrive as **user-role messages** containing \`\` XML, delivered as harness input, normally inside a \`\` that opens with`, `` - Area: Background Tasks - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### MCP change notifications can be turned off per server Claude Code can now skip subscribing to an MCP server's list-change notifications. **What** On a successful MCP connection the client no longer always subscribes to list-changed notifications. For servers on the modern protocol the subscription can be skipped, and a log line records that change-notification delivery is off for that connection. **Details** - The skip is decided by a denylist consulted at connect time; nothing in the CLI's own settings populates it, so which servers are affected is decided outside this build. **Evidence** `subscriptions/listen suppressed by the listen denylist; list_changed delivery is off for this connection` - Area: MCP - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Saved loop state is checked before a session resumes it Resuming a session now validates and trims stored loop state before reusing it. **What** When a session resumes, the stored state for a running loop is now parsed and rejected unless the condition is a string and the iteration count, timestamp and starting token count are all non-negative whole numbers. Valid state is truncated before use: the condition to 4000 characters and the last-reason text to 512. **Evidence** `tokens_at_start` - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 ### Artifact comment replies no longer report a relay failure as a clean failure Comment replies that hit a bad relay now say the outcome is unknown instead of failed. **What** Posting a comment reply, resolving a thread and resolving a session now detect a response that did not come from the artifact service and return a `relay_error` outcome saying the result is unknown, instead of turning the HTTP status into a definite error. **Details** - The message tells Claude to re-read the comments before retrying, so a reply that did post is not duplicated. - This applies unconditionally on the relay path. **Evidence** `it may have posted; re-read the comments before retrying` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 3/5 ### Publishing re-verifies the source file between approval and publish A file you approve for publishing is re-checked before its bytes are sent, so it can't be swapped. **What** A file you approve for publishing is now pinned and re-checked before its bytes are read, closing the window in which the file could be swapped after you approve and before it is sent. **Details** - Approval records the file's device, inode, size and nanosecond modification time. - At publish the file is reopened refusing symlinks (when the approval saw a non-symlink), the stat is compared, the content read, then the stat taken again to catch a write during the read. - A mismatch, a symlink appearing where there was none, or a missing pin aborts with a retry message and the error codes `source_changed` or `source_unverified`. - Reached whenever a tool-use id is present; the older direct read path remains for network-sourced pins. **Evidence** `file_path: the source file changed between approval and publish — retry the publish` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Escape and Ctrl+C are now distinguished when interrupting Escape and Ctrl+C now interrupt differently, and Escape is ignored while you edit a queued entry. **What** Interrupt handling was rebuilt around the specific gesture used, so escape, Ctrl+C and the kill-all-agents chord can behave differently. Escape while you are editing a queued entry is now ignored outright, and repeat cancels arriving very soon after the previous one are suppressed. Not gated. **Details** - The cancel path takes options including whether to leave background agents alive and whether the key press landed on actual work, replacing a single true/false argument. - Interrupting while a rate-limit automatic resume is armed cancels that wait and says `Automatic continue cancelled \xB7 /rate-limit-options to re-arm`. - The kill-all-agents chord now also stops Artifact watches carried over from a previous session as part of the same gesture. **Evidence** `Automatic continue cancelled \xB7 /rate-limit-options to re-arm` - Area: Terminal UI - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Clearer guidance on what saving a skill means Claude is told that skill files on disk are a read-only cache, so editing them won't change your saved skill. **What** Claude is now told explicitly that skill files on disk, including synced copies of your account skills, are a read-only cache and that editing them does not change the saved skill. Three variants of this guidance exist for different session shapes. **Details** - One variant points at a tool for creating or updating a skill directly, one says to propose the skill with a different tool, and one says to produce a `.skill` zip or a single `SKILL.md` and hand it over. - That last variant warns there is no signal about whether you saved the file, so Claude should report the skill as delivered and never as saved. - A separate fragment carves out plugin-owned skills, which are customizable through their plugin. - Which variant applies depends on the session type; the selection logic is not part of this change. **Evidence** `report the skill as delivered, never as saved` - Area: Skills - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Sending files and messages to other sessions fails early on unreachable targets Sending a file or message to an unreachable session is denied while asking permission, not silently at send time. **What** SendFile and SendMessage now work out which session you are aiming at while asking for permission, rather than at send time, and deny outright when the target is a Remote Control session that a cloud session cannot reach. If working out the target throws, you get an ask that says so instead of the send quietly proceeding. **Details** - The resolved target is cached against the tool call, so the permission answer and the send agree. - When peer machines are kept separate, the SendFile prompt now always includes the warning that file contents travel via Anthropic's servers to another machine. **Evidence** `If the recipient is a Remote Control or cloud session, the file contents travel via Anthropic's servers to another machine.` - Area: Session Messaging - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Secret redaction covers more Slack tokens and any length of private key Secret redaction now catches more Slack token shapes and private key blocks of any length. **What** Slack user-token matching widened from `xox[pe]` to `xox[a-z]`, a new `slack-rotation-token` rule catches `xoxe` refresh tokens, and private keys are now found by pairing BEGIN and END markers rather than one regex, so a key block of any length is redacted rather than only bodies long enough to match. **Details** - Applies wherever secret redaction runs; no gate. **Evidence** `slack-rotation-token` - Area: Secret Redaction - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Sending a session to the cloud cancels the pending resume at the usage-limit reset Handing a session to the cloud now cancels a pending auto-resume at the usage-limit reset and tells you. **What** If you hand a session off to the cloud while it is waiting to auto-continue after a usage limit resets, the pending resume is now cancelled and you are told, instead of a resume firing on a machine you have moved off. **Details** - A new cancellation reason `cloud_handoff` joins the existing background, desktop, relaunch and process-exit reasons. - The notice reads "Automatic continue cancelled · sending this session to the cloud, so the task will not resume here on its own when the usage limit resets (continue it in the cloud session)", and is appended to the usage-limit error text. **Evidence** `Automatic continue cancelled \xB7 sending this session to the cloud, so the task will not resume here on its own when the usage limit resets (continue it in the cloud session)` - Area: Cloud Sessions - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Failure to start the background session for artifact comments is now reported If the artifact comment watcher can't start, you're told automatic replies stopped instead of it failing quietly. **What** If the background session that watches your published artifacts for comments cannot be started, each affected artifact gets an explicit message telling you automatic replies have stopped and to publish again to re-enable them, instead of the replies stopping silently. The failure is counted as `adopt_spawn_failed` on `artifact_live_subscribe`. **Evidence** `The background session didn't start, so automatic replies to Artifact comments stopped. Publish the Artifact again to turn them back on.` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Secret scanner detects Anthropic OAuth tokens The secret scanner now always flags Anthropic OAuth tokens starting sk-ant-oat or sk-ant-ort. **What** A new built-in high-confidence rule, `anthropic-oauth-token`, flags `sk-ant-oat…` and `sk-ant-ort…` tokens, joining the existing rules for Anthropic API keys and admin API keys. Always active. **Evidence** `anthropic-oauth-token` - Area: Secret Redaction - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Rejected images are reported instead of silently dropped When the API rejects an attached image, you're now told rather than getting a silent picture-free answer. **What** When the API rejects an image or document attachment and Claude retries the request without it, that stripping is now reported to the caller. The plugin eval judge uses this: if a case's attached image was rejected, the failure message says so and a dedicated error is raised, instead of the judge quietly grading a prompt with no picture. **Details** - The retry classifies the query as `main_thread` or `other`. - Errors thrown by the observer are logged as warnings and the retry continues. **Evidence** `onMediaStripped` - Area: Attachments - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Plugin eval runs are isolated from project settings and take prompts over stdin Plugin eval prompts now go over stdin and runs ignore project settings, so long prompts survive intact. **What** Each eval case's prompt is now written to the child process's standard input instead of being passed as a command-line argument, so long or shell-awkward prompts survive intact. The runner also passes `--setting-sources user`, so project and local settings cannot perturb a run. **Details** - The child is spawned with `stdio: ["pipe", "pipe", "pipe"]`; errors writing to stdin are ignored. - Model, allowed tools and appended system prompt are now passed in `=` form. - The `--ablation` help text was rewritten: the default is the with-without comparison whenever a plugin resolves by name or from the target path, and under that mode graders marked with-only signal that the plugin fired rather than counting toward the score. **Evidence** `stdio: ["pipe", "pipe", "pipe"]`, `Run a no-plugin baseline arm and report the score delta` - Area: Plugin Evals - Names: `--setting-sources user` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Windows sandbox refusals now say why an exclusion did not apply Windows strict sandbox refusals now explain that an exclusion needs an available permission prompt to apply. **What** On Windows in strict sandbox mode, a refused command used to give one message regardless of cause. There are now two: the existing one for an exclusion that matched only part of the command, and a new one explaining that an exclusion only exempts a command when a permission prompt could approve running it unsandboxed, and no such prompt is available here. **Details** - Both paths still refuse the command with the `windows_policy_refusal` outcome. - Applies only on Windows, with sandboxing enabled in settings, the platform in the enabled list, and strict sandbox mode configured. **Evidence** `exclusions only exempt a command where a permission prompt can approve the unsandboxed run, and none is available here` - Area: Windows - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Slack workflow tokens and webhook URLs are scrubbed Slack workflow tokens and webhook URLs are now scrubbed from text before it leaves your machine. **What** The credential scrubber applied to text before it leaves the client now catches Slack workflow tokens beginning `xwfp-` and Slack webhook URLs under `hooks.slack.com/services`, `/workflows` and `/triggers`, replacing them with a placeholder instead of letting them through. **Details** - Tokens are replaced with `[REDACTED-PAT]`; webhook URLs are replaced with their own placeholder. - Both patterns were added to every scrubber in the build, including the token table that already handled bearer and Basic headers, `sk-ant-` keys, GitHub and GitLab tokens and Slack `xoxb-` tokens. **Evidence** `hooks.slack.com/`, `[REDACTED-PAT]` - Area: Secret Redaction - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Clearer error when an Anthropic profile login has expired An expired profile login now gives a clear message, sometimes offering /login with your claude.ai account. **What** Two messages join the authentication error table for an expired profile-based login. One tells you to re-authenticate the profile; the other offers `/login` with your claude.ai account instead. Which you see depends on whether claude.ai login is available to your account. **Details** - Selected by the auth-source check at the point the error is mapped to text, with no separate gate. **Evidence** `Anthropic profile login expired \u00b7 Re-authenticate your Anthropic profile` - Area: Auth - Names: `/login` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### GitLab merge requests show as MR !N in the status footer The status footer now labels GitLab merge requests as MR !N instead of calling everything a PR. **What** The review link in the status footer now labels GitLab merge requests "MR" with a `!` before the number, instead of always saying "PR" and `#`. Link behaviour and colours are unchanged. **Details** - Depends on the review data reporting itself as a merge request; there is nothing to configure. **Evidence** `prefix: n ? "MR" : "PR"` - Area: Terminal UI - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Secret redaction handles private keys and stops firing mid-word Private key blocks are fully redacted and secret rules no longer fire inside longer identifiers. **What** The redactor that masks secrets before they leave your machine now detects PEM private key blocks by scanning for matching BEGIN and END lines with at least 64 characters between them, replacing the whole block with `[REDACTED]`, and loops so several keys in one text are all caught. High-confidence rules now require a non-word character on both sides, so they no longer trigger inside a longer identifier. **Details** - The private key detector is added to the rule list as its own rule and reports as "Private Key". - Candidates that look like a shell fragment or a path/URL are now left alone instead of being masked. **Evidence** `[REDACTED]`, `{ ruleId: "private-key", label: "Private Key" }` - Area: Secret Redaction - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Publishing an artifact can now report that the outcome is unknown An unconfirmable artifact publish now says the outcome is unknown and to check before republishing. **What** When a publish attempt cannot be confirmed, Claude Code says so instead of reporting a flat failure, and tells you to check the artifact list before publishing again. Relay HTTP errors, thrown requests, replies about the wrong artifact and malformed replies all land here. **Details** - The automatic comment-edit pipeline maps this to a distinct failure kind with its own reply text and its own thread notice, separate from the existing failure wordings. - No flag gates the wording; it is reached whenever the publish reply does not come from the expected frame or the request throws. **Evidence** `it may have published; check the artifact list before publishing again` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Safeguard and refusal notices now name the category and validate the request ID Safeguard and refusal notices now end with a Details line naming the refusal category. **What** When the API flags or refuses a message, the notice now ends with a `Details:` line naming the server-supplied refusal category. This applies to the safeguards notices, their switched-model and same-model variants, and the invalid-request path. **Details** - The category is stripped of backticks and square brackets and length-capped before being shown; if the response carries no category, or it is not a string, no line is appended. - The Request ID appended to refusal messages is now only shown when it matches `^[A-Za-z0-9_-]{1,255}$`. - The cyber-refusal fallback latch re-arms on a `sawCyberRefusal` flag as well as on the category, and takes its request id from an entry that is genuinely categorised as cyber. **Evidence** `'s safeguards flagged this message. `, `tengu_refusal_fallback_resume_latch` - Area: API Errors - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Startup prefetch failures no longer surface A bad skill or command directory no longer produces a startup error; workflows are pre-warmed too. **What** The startup prefetch now calls a dedicated cache warmer instead of building the full command list. Skill and command loads run together and every failure is swallowed, so a bad skill or command directory no longer produces a startup error. The warmer also pre-loads workflows. **Details** - The loads run under a settle-all wrapper inside a try/catch, and the skills load time is still recorded as a startup phase. - Workflow warming short-circuits when workflows are off: the `enableWorkflows` setting set to false, the `CLAUDE_CODE_WORKFLOWS` environment variable set to false, or the `tengu_workflows_enabled` gate (fallback true) off. **Evidence** `warmCommandSourceCaches` - Flag `tengu_workflows_enabled`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: off) - Area: Startup - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Publishable artifacts are no longer described as org-only Artifact guidance no longer wrongly says declaring publish capability limits a page to your organization. **What** The artifact review and workshop skill prompts were corrected: declaring publish capability on a page does not restrict it to people inside your organization. Only a page wired to a live connector-backed signal still cannot be shared externally. **Details** - The choice presented to users is now "live signal (org-only)" versus "no live signal", rather than interactive versus static. **Evidence** `the artifact-publish capability alone carries no such limit` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Network and Windows device paths refused in more places Windows device paths and network automount roots are now refused in more places, like memory files and edits. **What** Paths in Windows NT object-namespace form (`\??\`, `GLOBALROOT`, `DosDevices`, `Device`) and network automount roots (`/net/`, `/Network/`) are now rejected alongside UNC shares when loading memory files, applying edits, adopting a remote session's working directory, resuming a session home, and resolving a workflow script path. **Details** - The workflow error text was broadened to name all three shapes. **Evidence** `Network (UNC, NT-namespace, or automount) paths are not allowed for workflow scriptPath` - Area: Path Safety - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Git subprocesses get a more thorough environment scrub Your shell's git environment variables are scrubbed more thoroughly before Claude Code runs git. **What** Before running git, Claude Code strips inherited git variables from the environment so your shell's settings cannot change what git does. The matching is now case-insensitive, covering the numbered `GIT_CONFIG_KEY_n` and `GIT_CONFIG_VALUE_n` pairs and the fixed list including `GIT_DIR`, `GIT_WORK_TREE` and `GIT_ALTERNATE_OBJECT_DIRECTORIES`. **Details** - Any inherited variable whose name collides case-insensitively with one Claude Code sets itself is also unset, so a differently-spelled duplicate cannot survive. **Evidence** `GIT_ALTERNATE_OBJECT_DIRECTORIES` - Area: Git - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Plugin eval reference rewritten around a tighter sandbox Plugin eval runs now happen in a tighter sandbox with their own git repo and home directory. **What** The bundled reference for `claude plugin eval` describes a redesigned sandbox: the working directory sits inside the sandbox home, an empty git repository at the sandbox home root stops git from walking up into your real repo, and the child process is started with `--setting-sources user` and the prompt passed on stdin instead of the command line. Enterprise managed settings are called out as the one policy that still applies inside a run. **Details** - Adds exit code 143 for a run killed by SIGTERM, and an `auth_failed` reason for a partial run. - Per-plugin failure codes appear under the suite's plugin list, and individual cases can carry advisories. - Image and binary grading moved from "upcoming" to shipped. - This is documentation text; the eval harness itself remains early-access gated. **Evidence** `--setting-sources user` - Area: Plugin Evals - Names: `claude plugin eval` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Published artifacts can now load Google Fonts Published artifacts can now load Google Fonts, the one external host allowed. **What** The guidance for published artifacts dropped its blanket ban on external hosts and names Google Fonts as the one allowed exception, so generated pages can use real webfonts. **Details** - The prototype and artifact-design skills were updated to match: link the stylesheet directly, keep a genuine fallback font stack, and inline everything else. - Everything other than fonts is still blocked by the strict content security policy on published artifacts. **Evidence** `strict CSP blocks requests to external hosts` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Session and branch naming prompt tightened Session and branch naming now produces short noun phrases, with branches still prefixed claude/. **What** The prompt that names a coding session and its branch now asks for a two-to-five-word noun phrase in sentence case, bans request verbs such as fix, add and update, and bans trailing abstract nouns. The title follows the language of the session description while the branch name stays English and still begins with `claude/`. **Details** - The description is treated as untrusted data, including any instruction inside it about what the title should be. **Evidence** `the title in the language of the description, the branch name in English` - Area: Session Titles - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Stopped artifact watches stay stopped Once you stop watching an artifact, re-attaching it stays stopped and Claude won't restart it. **What** Once you stop watching an artifact in a session, by unwatching, stopping the task or pressing Ctrl+C, re-attaching that artifact now reports it as not watching and tells the model not to start it again on its own. **Details** - Remote sessions get their own `remote_unsupported` explanation instead of being reported with unrelated skip reasons. - The list of watches now annotates each entry with its auto-reply state: armed, stopped, or disarmed. **Evidence** `Attached ` - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Cloud sessions say why your local changes were left behind Starting a cloud session from a diverged repo now says why it began from GitHub, not your working tree. **What** Starting a cloud session from a repo that has diverged from its remote now prints the specific reason the session began from GitHub instead of your working tree, rather than starting silently. **Details** - Reasons computed: an operation already in progress, pull not supported, bundling unavailable, repository too large, or an explicit ref was requested. - Each reason produces its own sentence, including one stating that file sync is off for that session. - Windows gets a separate line saying syncing files back is not supported yet. **Evidence** `and bundling is unavailable here, so the session started from GitHub without your local changes and file sync is off.` - Area: Cloud Sessions - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Every session now gets the `cd` permission warning in the Bash tool Every session now gets the Bash guidance preferring absolute paths and warning cd can trigger a prompt. **What** The working-directory guidance in the Bash tool prompt is no longer conditional. All sessions now see the wording that prefers absolute paths and warns that `cd` inside a compound command can trigger a permission prompt; the variant without that caveat was deleted. **Evidence** `but prefer absolute paths — `cd` in a compound command can trigger a permission prompt` - Area: Bash Tool - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Stream schema explains multi-block assistant messages Stream output docs now explain why one reply arrives as several messages sharing an id. **What** The assistant-message schema now states that one message is emitted per completed content block, that consecutive messages can share the same `message.id`, that `stop_reason` is null and usage is not final on those, and that `parent_tool_use_id` is set inside a subagent. **Evidence** `the turn's stop reason and total usage arrive on the result message` - Area: Streaming Output - Names: `parent_tool_use_id`, `stop_reason` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Wrong-account device token now gets its own message A token from the wrong account now says so and tells you to log out. **What** Device binding compares the stored account uuid against the host account uuid and reports a distinct mismatch failure telling you the token belongs to a different account and to run `claude /logout`, rather than a generic binding error. **Details** - Adds an `account_mismatch` failure kind with its own explanation text. - A new `tengu_device_bind_account` event records which source the account uuid was read from. **Evidence** `the host's token is for a different account than this machine's (claude /logout)` - Area: Auth - Names: `claude /logout` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Control protocol schema now documents itself The SDK's control protocol schema now describes its own message types, so client authors can read it directly. **What** The stream-json control protocol used by the SDK now carries full descriptions of its own wire contract, so anyone building a client against Claude Code can read the schema instead of inferring behaviour from traffic. No behaviour changed in this build; every message type, direction and success payload that was already there is simply now explained. **Details** - Request ids are documented as chosen by the sender and echoed back on the response, and hook callback ids follow the same client-chosen round trip. - A late `initialize` from a client joining a session already in progress is answered with the current state rather than repeating one-time setup. - Closing the stream is documented as telling the CLI to finish the current turn and exit. - User, assistant and stream-event messages are described in terms of the Anthropic Messages API rather than being left as undocumented pass-throughs. - MCP messages are documented as flowing in both directions, and responses gained a success payload. - Success payloads were added for setting permission mode, which echoes the mode back, for registering a repo root, which returns the resolved absolute path, and for background tasks, which return a `backgrounded` boolean when a tool use id was named. - Cancel-request and keep-alive gained prose on who is allowed to send them and what a receiver must do on arrival, with the keep-alive described as a liveness heartbeat carrying no payload. **Evidence** `Liveness heartbeat with no payload.`, `Closing the stream tells the CLI to finish the current turn and exit.` - Area: SDK - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Model names are cleaned up before being shown Model names are stripped of odd punctuation and control characters before being shown in pickers. **What** Model labels now pass through a sanitizer that strips backticks and angle brackets, neutralises markdown link punctuation, removes control characters, collapses whitespace and truncates, falling back to the literal "unknown model" if nothing is left. This covers both the plain label and the ` ()` form in pickers, which matters because model ids and labels can arrive from settings, environment variables or remote config. **Details** - Labels and descriptions fetched from the gateway's model list, and cached extra model options, go through the same defusing and truncation. - Gateway-sourced picker entries are computed once per fetched payload rather than on every render. - Model options can now carry a disabled flag and a promotional list price. **Evidence** `unknown model`, `[Bootstrap] Gateway /v1/models`, `From gateway` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Agent and session lookups now say when the list was too long to search Session and agent lookups now say when the list was truncated, so "not found" no longer misleads. **What** Looking up another session or agent by name used to look identical whether the search was complete or cut short. Listings and refusals now say so explicitly, so "no agent by that name" no longer implies the peer does not exist. **Details** - Listings append "(session list too long to fetch completely — sessions beyond the first pages are missing from this listing)". - Not-found refusals append "Your session list was too long to check completely, so a session by that name may exist beyond what was searched." - Ambiguous matches append "your session list was too long to check completely", and same-name warnings append "; your session list was too long to check completely, so a same-named session beyond what was searched would not have been seen". - A truncation flag (`searchTruncated`) is carried from the cloud and bridge session caches through name resolution; a pinned send target is no longer reported as stale when truncation could explain the miss, and `send_message_prefix_match` telemetry gains `search_truncated`. - A cloud session list that times out is now reported as `"timeout"` rather than a generic fetch failure. **Evidence** `; your session list was too long to check completely, so a same-named session beyond what was searched would not have been seen`, `searchTruncated`, `your session list was too long to check completely`, `Your session list was too long to check completely, so a session by that name may exist beyond what was searched.`, `session list too long to fetch completely` - Area: Session Messaging - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Messaging a peer a cloud session cannot reach is refused before delivery Cloud sessions refuse up front to message peers that require a trusted device, with an explanation. **What** Sending to a peer that requires a trusted device from a cloud session is now refused up front with an explanation instead of being attempted and failing. **Details** - Resolution of a `bridge:` target checks a cached "unreachable from here" marker and returns a refusal with reason `unreachable_elevated`. - The message says the target is "not reachable from a cloud session — that session requires a trusted device, which a cloud session never has; message it from one of your own machines instead". **Evidence** `not reachable from a cloud session \u2014 that session requires a trusted device, which a cloud session never has; message it from one of your own machines instead` - Area: Session Messaging - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Softer wording when the date rolls over mid-session The midnight rollover note no longer tells Claude to hide the date change from you. **What** The internal note injected when the calendar day changes during a long session dropped its "DO NOT mention this to the user explicitly" instruction. **Details** - It now reads "The date has changed. Today's date is now ${e.newDate}. No need to announce the new date — the user's own clock shows it." **Evidence** `The date has changed. Today's date is now ${e.newDate}. No need to announce the new date \u2014 the user's own clock shows it.` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Memories panel tells "none recalled" apart from "all rated" The recalled-memories dialog hides entries you already rated and shows a proper empty state. **What** The "Memories recalled this session" dialog now filters out entries you have already rated, showing a distinct empty state when there is nothing left to rate, and counts the filtered set in the header. **Details** - The all-rated empty state reads "Every recalled memory is rated". - Merging in pinned sources keeps each entry's existing rated state instead of overwriting it. **Evidence** `Every recalled memory is rated` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Filenames and MCP content types are escaped in the transcript Filenames and MCP content types are escaped in the transcript, closing a text-injection route. **What** The message recorded when you open a file in the IDE now escapes the filename, and the content type reported by an MCP server for binary results is escaped before being shown as `[Binary content: …]`. This narrows a path by which a crafted filename or server-supplied metadata could inject text into the conversation. **Evidence** `The user opened the file ` - Area: Transcript - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Conversation listings include creation and update times Past session listings now include creation and update times, and skip projects with bad directory names. **What** The listing of past projects and sessions now returns creation and update timestamps alongside session ids, titles and transcript file paths, and projects whose directory name fails validation are dropped rather than listed. **Details** - New `createdAts` and `updatedAts` fields on the listing result. - Each project is passed through a directory-name resolver; entries that do not resolve are omitted. **Evidence** `createdAts` - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Ambient Artifact comment monitors hidden from the tasks row Artifact comment watchers Claude started on its own no longer clutter the tasks row. **What** Artifact comment monitors that Claude started on its own no longer appear in the tasks row; only watches marked as explicitly requested are listed. **Evidence** `e.type === "monitor_ws" &&` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Previews redact less aggressively than logs Tool-input previews now mask fewer harmless values than full log redaction does. **What** Object keys shown in tool-input previews now go through a separate `redactForDisplay` pass that applies only the redaction rules marked high confidence, so fewer harmless values get masked on screen than in full redaction. **Evidence** `redactForDisplay` - Area: Secret Redaction - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Git remote hostnames validated more strictly Hostnames pulled from git remotes are validated more strictly so a crafted URL can't look like a flag. **What** A hostname parsed out of a git remote URL must now consist only of letters, digits, dots and hyphens and must not start with a hyphen, on top of the existing checks for a dot and an alphabetic top-level domain. This stops a crafted remote URL from producing a host that later looks like a command-line option. **Evidence** `/^[A-Za-z0-9.-]+$/` - Area: Git - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Chart support is dropped from an artifact if it cannot be cleanly removed again Chart embedding is abandoned if the injected block can't be cleanly stripped back out again. **What** Publishing an artifact embeds a charting library plus an init script. That combined block is now run back through the code that strips it out, and if it does not come out cleanly the whole embed is abandoned and reported with a new telemetry reason. The same self-check already guarded the syntax-highlighting embed. **Evidence** `chart_block_unstrippable` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### The CLAUDE_CODE_OAUTH_TOKEN login warning can arrive as its own message The warning about a set OAuth token env var can now arrive as its own message after login. **What** Logging in while `CLAUDE_CODE_OAUTH_TOKEN` is set no longer always glues the warning onto "Login successful". A three-way choice now picks no warning, an inline one, or a separate notice; when the session is about to auto-retry the query that failed, the warning is delivered once as its own message. **Details** - Triggered when `CLAUDE_CODE_OAUTH_TOKEN` is set in the environment and the gateway is not active. - The login result formatter takes an explicit flag saying whether to include the warning, so the two paths cannot both emit it. **Evidence** `includeEnvTokenWarning` - Area: Auth - Names: `CLAUDE_CODE_OAUTH_TOKEN` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Explicit Artifact watches now count as running work Freshly armed artifact watchers now show as running work; quiet background ones stay hidden. **What** Background Artifact watchers that Claude armed on its own used to never count as active work. Now a watcher counts as active if auto-react is enabled and it is still inside its freshness window, so explicitly requested or freshly armed live watches show up as running; quiet background ones stay invisible. **Details** - A separate list filter keeps automatically started watchers out of the visible task list unless the watch was marked as explicitly requested. - This depends on whether auto-react is enabled in the session, not on any build flag. **Evidence** `monitor_ws` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Resolving an artifact comment falls back when the server refuses the session token Resolving an artifact comment now retries the plain endpoint when the session token is refused. **What** Marking an artifact comment resolved is attempted first against the session-scoped endpoint, and a server refusal of that token no longer fails the action. The client retries the plain resolve endpoint, and the telemetry now tells a refused token apart from a route that was never there. **Details** - The refusal is a 403 whose response body carries the marker "CCR agent tokens cannot call this route", and only that case triggers the new path. - Refusals are logged under `artifact_comment_session_resolve` with the outcome `session_route_ccr_denied`. - A 404 from the session route still falls back as before and still logs the older outcome `session_route_fell_back`. - The fallback request sent to the plain resolve endpoint is itself unchanged; only the trigger condition and the reported outcome are new. **Evidence** `CCR agent tokens cannot call this route`, `session_route_ccr_denied` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Publishing tells relay failures apart from real service answers A publish answer that didn't come from the artifact service is reported as a relay error with its status. **What** When a publish, deploy or upload answer did not actually come from the artifact service, it is now reported as a relay error carrying the HTTP status and a message saying the publish was not completed, instead of being parsed as if it were a deploy result. **Details** - Responses carry a marker recording whether they came from the artifact service itself. - New telemetry reasons: `relay_error`, `upload_relay_error`, `prepare_upload_relay_error`. - The related HTTP call sites dropped their per-call host, auth and status-validation options. **Evidence** `prepare_upload_relay_error` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Publish checks the server's answer matches the artifact you targeted A publish response naming a different artifact than yours is now rejected rather than accepted. **What** Deploy responses are now validated against a strict schema, and a response naming a different artifact than the one you published is rejected instead of adopted. **Details** - Slug and version are pattern-checked and the read/shared visibility fields are normalized, replacing scattered field checks; any malformed response now produces one consistent error message. - A mismatched slug is refused with "the server answered for a different artifact than the one targeted, so its answer was not adopted" and records a `deploy_slug_mismatch` event. **Evidence** `the server answered for a different artifact than the one targeted, so its answer was not adopted` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Published artifacts verify their injected setup scripts can be removed again Published pages only bundle highlighting, Mermaid or charts if the injected block can be removed again. **What** When a published page bundles syntax highlighting, Mermaid diagrams or charts, the publisher now also checks the small setup script it injects alongside the library, and confirms the injected block can be stripped back out of the page afterwards. If it cannot, the injection is refused and the page publishes without it. **Details** - Covers the highlight, Mermaid and chart initializer scripts, each checked before it is written into the page. - The removability check is what gates the injection; failing it means no injection rather than a failed publish. **Evidence** `hljs_block_unstrippable` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Clearer messages when sending to another session Sends to another session now report a rewritten message separately from an outright denial. **What** Messages sent to another session now go through the permission handler, which may rewrite them; a rewrite is reported separately from an outright denial. One-way sends distinguish "Remote Control is not connected" from a remote container that has no address to reply to. **Details** - The recipient is passed to the permission handler as a label, so the ask names who the message is going to. - Sending to an unnamed remote session adds a note that the receiver can only answer using the address carried on the message. **Evidence** `this session has no reply address` - Area: Session Messaging - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### File reads reject device paths before touching the disk File reads reject Windows device paths before touching disk, including the Chrome extension's uploads. **What** The file-read helper and the Chrome extension's file upload now test both the raw and the normalized path for Windows NT object-namespace form and throw before any filesystem call, each with its own diagnostic string. The check is unconditional. **Evidence** `read_file: NT-namespace path rejected before filesystem access` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Backgrounding is cancelled if Artifact comment monitors started after you pressed the key Backgrounding is cancelled if new artifact watchers started while you were confirming; press the key again. **What** If new Artifact comment monitors appeared between your first press of the background key and the confirmation, the session cancels the backgrounding, prints how many monitors started, and asks you to press the key again to review and confirm. **Details** - No flag guards this check; it applies whenever monitors start during the confirmation window. **Evidence** `Press \u2190 again to review and confirm.` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### The Claude API skill now says its referenced files are not already included The Claude API skill now tells the model to actually read the files it cites instead of guessing. **What** The bundled "Building LLM-Powered Applications with Claude" skill gained one sentence telling the model that the file paths it cites are not inlined and must be read on demand, which should cut answers invented from a path name alone. **Details** - The paths covered are the per-language, `shared/` and `curl/` directories, all relative to the skill's own base directory. - The rest of the skill prompt is unchanged. **Evidence** `Read each one on demand before relying on what it covers.` - Area: Skills - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### One approval path for sending files and messages to peer machines File and message sends to peer machines share one approval path and refuse altered answers. **What** SendFile and the message-send path now share a single permission routine when isolation between peer machines is turned on. It re-asks for permission, and refuses the send if the answer comes back altered. **Details** - Refusals name their reason: `recipient_changed` when the permission handler points the send at a different recipient, `bad_shape` when it returns something the tool cannot accept, and `non_text_message` when it rewrites the message into a non-text form. - Only runs when peer-machine isolation is on and the permission phase has not already happened for that send. **Evidence** `The permission handler changed the recipient (from ` - Area: Session Messaging - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Automatic edits separate "unknown" from "unrecognizable" An automatic artifact edit that couldn't be confirmed is now reported separately from an unparseable result. **What** An automatic artifact edit whose publish could not be confirmed is now reported as its own case, with distinct wording in both the summary and the withheld-note detail, rather than being lumped in with a publish result Claude Code could not parse. **Evidence** `could not confirm whether its publish landed, so it is UNKNOWN whether the artifact was changed` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### SDK reports where an API key actually came from The SDK now reports where an API key really came from, like the env var or an apiKeyHelper. **What** The credential-source values in the SDK schema now lead with what current CLIs really emit: `ANTHROPIC_API_KEY`, `apiKeyHelper`, `/login managed key` and `none`. The previous set (`user`, `project`, `org`, `temporary`, `oauth`) remains only as documented legacy so existing types keep compiling. **Evidence** `'user' | 'project' | 'org' | 'temporary' | 'oauth' are legacy members that current CLIs never emit` - Area: SDK - Names: `ANTHROPIC_API_KEY`, `apiKeyHelper` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Hosts must stay silent on dialog kinds they never declared SDK hosts must stay silent on dialog kinds they never declared instead of replying cancelled. **What** The dialog protocol docs for SDK hosts were corrected. A host that receives a `dialog_kind` it did not declare must now leave the request unanswered rather than replying `{behavior: "cancelled"}`, because cancelled is a real settlement meaning the user dismissed the dialog. **Details** - A kind is only sent to sessions where a client declared it in `initialize.supportedDialogKinds`. - On multi-client transports the request still reaches every attached client, so an undeclared kind can legitimately arrive at a host that cannot show it. - Dialogs left unanswered are cancelled by the CLI itself once the deadline passes. **Evidence** `which is a real settlement treated as the user dismissing the dialog` - Area: SDK - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Grader focus files can now be images Grader focus files can now be images or binaries, not just UTF-8 text. **What** A focus file handed to the plugin-eval grader is now detected by content: images are passed through as bytes with their media type, and anything else is read as text with a preview of the leading bytes if it looks binary. Previously every file was decoded as UTF-8. The size cap and its error message are unchanged. **Evidence** `grader focus file exceeds the size cap` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### MCP idle timeouts are classified as unreachable, not generic failures MCP servers that go silent are now reported as unreachable rather than a generic error. **What** When an MCP server sends neither a response nor progress before the idle timeout, the resulting error now carries `mcpErrorSource: "downstream_unreachable"`, joining the existing `"downstream_error"` and `"user_auth"` sources. Both MCP client code paths are covered. **Evidence** `mcpErrorSource: "downstream_unreachable"` - Area: MCP - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### New wording for an unconfirmed artifact edit An artifact edit that can't be confirmed now asks you to check the artifact yourself. **What** Artifact edit reporting gained a message saying the edit was attempted but publication could not be confirmed, asking you to review the artifact. It sits alongside the existing "no result" and "unexpected result shape" wordings. **Evidence** `I attempted the requested edit, but could not confirm whether the update was published, so I cannot say whether the artifact was changed. Please review the artifact.` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Artifact asset actions get their own fail-closed message Failed artifact asset permission checks now give the right explanation for where they happened. **What** When a permission check for an artifact action cannot complete, the action is still refused, but the explanation now depends on where it happened: inside the shared cowork frame it keeps the consent-floor wording, and outside it reads as an asset-action message instead of a misleading cowork one. **Evidence** `Artifact asset actions fail closed when their permission check cannot complete` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Hooks returning a skill listing are validated more strictly Skill listings returned by hooks are now length-checked so malformed entries are rejected. **What** A hook that returns a `skill_listing` must now return an array whose length is capped and whose entries are strings under a length cap. Previously any array was accepted, so malformed entries reached the rest of Claude Code. **Evidence** `skill_listing` - Area: Elsewhere - Names: `skill_listing` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Editing a queued command keeps its mode and refuses on a dirty draft Editing a queued entry keeps its mode, and a queued shell command only comes back if the input is empty. **What** Pulling a queued entry back into the input box now restores the entry's own mode instead of always switching to prompt mode. A queued shell command can only be pulled back when the input is empty; otherwise you get a two-second notice saying "Clear the input to edit this queued shell command" and nothing is pulled. **Details** - The refusal is recorded as `bash_needs_empty_draft`; a pull that targets an entry that is no longer there is recorded as `stale_index`. Both go to the `input_queue_pop_to_edit` counter. - Pulling an entry also clears the stored queue-edit position. - A separate new path lets a queued message be sent right away by interrupting the running turn, recorded as `input_send_queued_now` with `no_live_controller` as its failure reason. That path needs an enablement check, prompt mode and an active query. **Evidence** `Clear the input to edit this queued shell command` - Area: Input Box - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Escape and navigation keys no longer wipe a selection Escape and page/arrow navigation no longer wipe your text selection or get swallowed by the scroll view. **What** Escape used to clear the current text selection and be swallowed by the scroll view. It now falls through to whatever else handles Escape, and the same exemption covers page up, page down, Ctrl+Home, Ctrl+End and shifted or modified arrow keys. **Details** - Ordinary typing still clears the selection, as does the `selection:clear` binding. **Evidence** `selection:clear` - Area: Terminal UI - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### /permissions opens straight away /permissions now opens its dialog immediately instead of waiting in the message queue. **What** `/permissions` (and its `allowed-tools` alias), which manages allow and deny tool permission rules, now dispatches to its dialog on submit instead of waiting its turn in the message queue. **Details** - Unconditional for `/permissions`. - The generated "this moved to /config" alias commands got the same immediate flag, but as a getter checked at read time: it is on only when the gate `tengu_immediate_model_command` (fallback false) is on and the terminal supports flicker-free rendering. **Evidence** `Manage allow and deny tool permission rules` - Flag `tengu_immediate_model_command`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.234; this account: on, anonymous baseline: on, compiled default: on) - Area: Permissions - Names: `/permissions`, `/allowed-tools` - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Token screen reports actual remaining validity The token screen now shows how many days your credential actually has left instead of always "1 year". **What** The OAuth token display previously said "valid for 1 year" no matter what. It now computes the remaining days from the credential's own expiry and formats them, with special wording for under a day and for exactly 365 days. **Details** - Runs unconditionally on that screen, with no flag involved. **Evidence** `less than a day` - Area: Auth - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Event attributes are checked against the event kind Event markers now reject attributes that don't belong to that particular event kind. **What** Parsing and writing of `` markers now rejects attributes that are valid in general but not valid for that particular kind of event, instead of accepting them. **Evidence** `invalid poll event attribute` - Area: Poll Events - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Claude data-export import validates what it reads Importing a Claude data export now gives a clear error on a corrupt file instead of failing deep inside. **What** Importing a Claude data export now checks the file shapes up front, so a corrupt or partial export gives a clear error instead of failing somewhere deep in the import. **Details** - Input that is not JSON, and a conversations.json that will not parse, each raise their own explicit error. - A missing manifest is rebuilt from the parsed conversations and projects rather than guessed from loosely typed fields. - Project directory names are checked against a name pattern and a length cap; ones that fail are skipped rather than aborting the import. - Directory entries inside the zip are excluded from the extracted file map. - Array contents are parsed leniently: a single malformed element is dropped instead of failing the whole list. **Evidence** `export conversations.json is not valid JSON` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### "Watch ended" notices now say whether re-watching is worth it "Watch ended" notices now say whether re-watching is worth it instead of always suggesting it. **What** The message that fires when watching an artifact ends now ends differently depending on why. A stop the session itself made says watching was stopped earlier in this session, with guidance not to start watching again; a failed resume says the earlier stop still stands. Previously every one of these messages ended with the same suggestion to re-watch. **Evidence** `watching this artifact was stopped earlier in this session` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Plugin cache link materialization rewritten Turning plugin symlinks into real files now survives interruption and refuses unsafe targets. **What** The step that turns symlinks inside installed plugins into real files was reworked to survive interruption and concurrent runs, and to refuse targets it cannot safely copy. **Details** - Has separate install and migrate modes; refuses network targets and Windows reparse points. - Recovers entries left parked by an earlier interrupted run, keeps a scratch directory that is re-verified before every swap, and touches a heartbeat so a concurrent run can see it is alive. - Only after all that does it write the marker recording that links were materialized. - Copies use a stream pipeline opened refusing symlinks and without blocking, preserving the exact file mode. - Dependency installs must first withdraw the marker and record liveness, otherwise the install is refused. The storage-backed liveness marker path is gated on `tengu_hover_rest`. **Evidence** `plugin cache staged copy replaced before the swap` - Flag `tengu_hover_rest`: Off in both readings (read for one account on one subscription tier against v2.1.234; this account: off, anonymous baseline: off, compiled default: on) - Area: Plugins - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Clearer and stricter checks on published artifact file paths Invalid file paths in a published artifact now name the actual problem instead of a generic error. **What** The error for an invalid file path inside a published artifact now names the actual problem: an empty segment, a segment made only of dots and spaces, a path separator, a NUL byte, or a reserved name shape. Absolute paths that normalize into a reserved shape are rejected outright rather than accepted after normalization. **Evidence** `expected a non-empty array of segments, none empty or made only of dots and spaces, with no path separator, NUL or set-aside shape` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Failed artifact publish tells you a slug was already reserved A failed artifact publish now tells you a name was already reserved, so you retry against it. **What** If a publish fails after reserving a name for the artifact, the result now tells you to retry against that reserved name rather than publishing fresh, instead of keeping the reserved value silently. Applies when the publish reserved a slug and none was supplied. **Evidence** `A slug WAS reserved` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Reopening a pull request shows up in session summaries Reopening a pull request now shows as "reopened" in your session activity summary. **What** `gh pr reopen` is now recognised by the command classifier and rendered as "reopened" in the session activity summary. Previously it left no trace there. **Evidence** `pr_reopen` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Listing an artifact's assets runs as a read Listing an artifact's files now counts as a read, so it runs alongside other reads without waiting. **What** Listing the files attached to an artifact is now treated as read-only and safe to run alongside other reads, so it does not block on write permission or serialise with other tool calls. **Evidence** `list_assets` - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Echoed prompts no longer turn issue references into links Echoed prompts show text like org#123 exactly as you typed it instead of turning it into a link. **What** When Claude Code echoes back the prompt you typed, text like `org#123` is now shown as you wrote it rather than converted into a hyperlink. A new render mode is threaded through the whole markdown renderer and switched on by the prompt-echo components. **Details** - In this mode text nodes skip the post-processing step that builds those links and return raw text. - Horizontal rules now emit a trailing newline. **Evidence** `promptMode` - Area: Transcript - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Assorted small behaviour changes Small fixes, including permission prompts falling back to a tool's registered name when the display name is empty. **What** A handful of unrelated touch-ups, none of them behind a flag. The one you might notice: a permission prompt now falls back to the tool's registered name when the tool produces an empty display name. **Details** - GitHub PR events gained `reopened` alongside `auto-merge-enabled`. - Adoption telemetry reports a new `adopted_frame_live` count; message-send records carry an optional `source`; artifact file metadata gained `rendered_locally`. - Publish-denied errors truncate the underlying error to 300 characters rather than including all of it. - A settings module exports a reporter for an SDK inline setting dropped because the inline settings blob failed to parse. It is exported but nothing in this build calls it. **Evidence** `adopted_frame_live` - Area: Permissions - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### PEM private-key redaction rewritten to avoid pathological scanning Private-key redaction no longer stalls on large or malformed input. **What** The secret scanner that strips private keys out of text before it leaves the session no longer uses one large regex spanning the whole key block, which could stall on big or malformed input. It now finds BEGIN and END lines separately and splices out what lies between them. **Details** - Two case-insensitive global patterns, one for the header and one for the footer, matched in sequence with a minimum 64-character gap between them. - Each matched region is replaced with `[REDACTED]`. **Evidence** `PRIVATE KEY(?: BLOCK)?-----` - Area: Secret Redaction - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Script detection in published pages handles HTML tokenizer edge cases Script-tag scanning in published pages was reworked so hand-crafted markup can't slip past. **What** The scanners that look for script tags in artifact pages, both in-page and in the CLI, were reworked as a matching pair so hand-crafted markup can no longer slip past them. **Details** - A comment-open followed by a script-open, which would leave the HTML tokenizer in an escaped state, is now refused outright. - Tag-end scanning walks attributes, so a `>` inside a quoted attribute value no longer looks like the end of the tag. - Whitespace skipping uses only the five ASCII whitespace bytes HTML defines, instead of JavaScript's broader `String.trim()`. **Evidence** `KEEP-IN-SYNC: goCp isFrameAssetInjection` - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Task output file copies refuse suspicious paths Copying a task's output file now refuses if the file changed or isn't an ordinary single-link file. **What** Copying a task's output file now verifies it is an ordinary file with a single link before and after opening it, and refuses if anything changed in between. **Details** - Checks for a regular file with link count 1, opens refusing symlinks and without blocking, then re-verifies device, inode and link count through the open handle. - Refuses on ELOOP, EISDIR, ENOTDIR, ENXIO and EOPNOTSUPP, or on any change between the first check and the open, with a logged error. **Evidence** `task output swap refused` - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Pull request announcements say what the session did Pull request announcements now say what action produced them, including reopening. **What** Announcements about a pull request now carry the action that produced them, and `gh pr reopen` is recognised as reopening a PR. **Details** - Action values: created, edited, merged, commented, closed, reopened, ready, draft, auto-merge-enabled, auto-merge-disabled, pushed, checked-out. - The UI has matching verb strings such as "enabled auto-merge on" and "marked ready". - The GitLab merge-request URL matching was consolidated into one shared pattern. **Evidence** `auto-merge-enabled` - Area: Git - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Unused-plugin nudge now tells you to disable them The occasional unused-plugin reminder now tells you to disable them and why. **What** The periodic reminder about plugins you have not used now plainly says to disable them and why, replacing the passive suggestion to review them with `/plugin`. It still appears no more than once every 30 sessions. **Evidence** `to free up context and speed up startup.` - Area: Plugins - Names: `/plugin` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Regex graders explain themselves when handed an image Pointing a regex grader at an image now explains what to use instead. **What** A regex grader pointed at something that resolves to an image now fails with a message naming the media type and what to do instead: use an LLM grader focused on that file, or, if you are asserting something is absent, write a text rendering of it first and match against that. **Details** - The eval authoring documentation now tells authors to set `allowed_tools` on every case alongside `timeout_seconds`. **Evidence** `is an image (` - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### `claude setup-token` rejects extra arguments `claude setup-token` now errors on extra arguments instead of ignoring them. **What** The command now errors on excess arguments instead of silently ignoring them. **Usage** `claude setup-token` **Evidence** `Set up a long-lived authentication token (requires Claude subscription)` - Area: Elsewhere - Names: `claude setup-token` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Script-only HTML detection rewritten The check for script-only artifact HTML now parses markup properly instead of string-matching. **What** The check for whether a piece of artifact HTML is nothing but `