The application hosting the agent can attach a note after a tool result, and the safety classifier now sees it as its own transcript line. Two kinds exist: host_context_live, attached during this session, which may relay real user input and can satisfy a soft block's consent requirement, and host_context, restored from saved session state, which never establishes user intent. The classifier prompt describes both. Emission of the live variant has a kill switch, tengu_disable_live_host_context.
- Notes reach the transcript from a post-tool hook or an in-process tool return.
- Entries are fed to the classifier as
{ type: "host_context", ..., context, live }. - The prompt text, both keys, and the entry shape are all absent from 2.1.235.
tengu_disable_live_host_context, EVa = "host_context_live"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_disable_live_host_context Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.236: off
Read once, for one account on one subscription tier, against v2.1.236. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
New in this build: tengu_disable_live_host_context