Claude Code v2.1.242

Plugin hooks written in code now get an in-process API for talking to the running session: status lines and toasts, asking the user a question, reading session messages and turn count, listing and spawning agents, calling and listing tools, registering new tools, and calling MCP servers. Every one of those is budgeted so a misbehaving plugin cannot flood you. Nothing in this build sets a flag for the surface as a whole, so it is present for everyone on 2.1.242.

A new tier of computer-use tools operates a single application through Accessibility instead of taking over the whole display: app_screenshot, app_click, app_type, app_key, app_scroll, app_drag, app_menu, app_list_windows, app_ax_find, app_batch, app_release, app_bring_to_current_space and list_apps. They only work when the host program running Claude Code provides an app-scoped implementation; otherwise every call returns "Per-app background tools are not available in this build."

Before spawning a subagent, Claude Code now runs an agent.spawn hook carrying the tool use id, prompt, subagent type, model, permission mode, and whether the spawn is background, forked, and its working directory. A deny aborts the launch and is recorded as subagent_spawn_denied_by_hook. The hook may also swap the model the subagent runs on.

The cloud worker gains a large git sync engine that keeps the container's checkout in step with yours: it snapshots the working tree, merges your bundle, replays the agent's unpublished commits onto your HEAD, and parks them under session refs when the replay conflicts. None of it runs unless CLAUDE_CODE_DIR_SYNC_GIT is set, and even then it checks that directory sync itself is enabled before arming.

A new client-side layer can route a tool call, Bash or an attached machine's own MCP tools, to a different machine reached through the device bridge. It negotiates a protocol version, forwards permission prompts back into your session, and reconciles calls that dropped or timed out by asking the host what happened. None of it exists in the previous build.

A large new subsystem lets the machine you launch claude --cloud from register its local hooks with a cloud session and then run them locally when the cloud session fires them, translating paths between the container and your machine. It cannot run here: the code that creates the session is behind a helper that unconditionally returns false in this build, so none of its notices can appear.

A plugin can now ship a JavaScript module that registers hooks in code with register(on, options), instead of only declarative matchers in hooks.json. That file gains a modules key alongside hooks, and either or both may be present. The engine loads and evaluates the module, dispatches each hook event through a chain with next(), reports failures, and reloads or prunes when a plugin is disabled. It is controlled by tengu_plugin_hooks_modules, whose built-in fallback is off, so nothing loads unless server config turns it on.

A plugin can load a hook module that receives a $ object exposing event chains and host capabilities, letting it intercept tool calls, prompts and agent turns, and substitute the props Claude Code uses to draw its own interface. Message rendering was rewritten so that named draw sites can be targeted individually, and modules run inside their own sandboxed globals so host objects and host stack frames never reach plugin code. Nothing switches this on or off, and a site is only overridden when a loaded module declares a handler for it, so a stock install behaves and renders exactly as before.

A plugin's hooks/hooks.json may now name a JavaScript module that registers hooks in code rather than as shell commands, and that module runs in a background worker thread shared by all plugins, with crash containment, a heartbeat and a broad capability object passed in. Nothing loads in this build: the loader refuses with a message saying the rollout flag is off, the flag tengu_plugin_hooks_modules has a built-in value of false, and no plugin bundled with Claude Code declares a hooks module, so even a server-side switch would only enable third-party plugins.

A new application state, set by an incoming control message rather than any local flag, marks sandbox auto-allow as suspended. While set, permission checks treat the session like plan mode, so commands inside the sandbox stop being auto-allowed without the permission mode itself changing.

The command table gained a cloud-plugins entry, absent in 2.1.241, backed by a store that remembers per machine whether your enabled plugins may be used in cloud sessions. A failed read of that store is logged rather than treated as consent.

Two separate consents now decide what a cloud session inherits from this machine. /cloud-plugins asks whether cloud sessions may use the plugins you have enabled here. A second prompt, "Use this machine's settings in cloud sessions?", covers CLAUDE.md, rules, output styles, preferences and portable permission rules. Both default to unanswered, and until you answer nothing is sent. A new hidden flag --no-home-settings suppresses the settings copy for a single launch.

Choosing "Anthropic Console account" in /login no longer jumps straight to creating an API key. A second screen offers "Sign in with your Console account (recommended)" or "Create an API key (legacy) - adds a key to your Console workspace", plus "Go back". The sub-menu only appears on the first-party API with no managed policy settings, no pinned login organization, and login not forced to claude.ai; otherwise the old API-key path runs unchanged.

Evaluation runs of a plugin can now swap that plugin's real MCP servers, the external tool servers a plugin declares, for fake ones defined as files under <eval dir>/mocks/, so an eval exercises tool calls without starting anything real. The mode is controlled by a new --mocks flag that defaults to record, and the bundled quick reference for plugin eval now carries a Mocks section describing the whole layout. The commands remain early access.

The effort line now shows "ultracode" as a level, says when an effort setting applies to the current session only, and warns when CLAUDE_CODE_EFFORT_LEVEL in your environment is overriding the effort you chose, telling you to clear it.

The Artifact menu now offers dashboard, report, data-table and explainer templates, with entries like "Publish a dashboard Artifact from a template". New skills add an iterative design workshop that publishes an evolving plan page with decision points readers can answer, a library of reusable page components starting with that decision component, a diagramming skill for inline SVG that reads correctly in both light and dark themes, and a design pass that is now required before writing any Artifact, Markdown included.

An administrator can now supply an ordered options list of {model, label?, description?} rows that appear in /model, and set replaceBuiltInOptions to hide the built-in lineup, gateway-discovered models and ANTHROPIC_CUSTOM_MODEL_OPTION rather than add to them. It is honored from managed settings, --settings/SDK and user settings only, never from a project checkout, and the highest-precedence source wins outright with no merging.

Before a prompt is sent, it runs through two tiers of prompt.submit hooks, core ones and managed ones. A hook can drop the prompt, which shows a warning and runs no query, or rewrite it, which replaces the text in your message.

When your machine runs a tool call on behalf of a cloud session, command, HTTP and MCP-tool hooks are no longer executed blindly. Each is checked for reachability first and can be held, with reasons such as model_hook, project_configured, in_reach and unreadable. A held PreToolUse hook turns the call into a permission ask; other events get a system message instead. This only applies to calls served for a cloud session, not to ordinary local hook runs.

The bundled model catalog and migration guide now state Sonnet 5 at $2 input and $10 output per million tokens. The earlier framing of $3/$15 with an introductory $2/$10 rate expiring on 2026-08-31 is gone. This changes what Claude tells you about cost, not what the API charges.

This build contains a complete client that reads SDK host messages from stdin as stream-json and drives a Claude session running in the cloud, with separate paths for creating a session and attaching to an existing one. It holds incoming frames until the session reports system/init, keeps a ledger of what it sent so echoes can be replayed, forwards control requests and interrupts, and exits with a run status code.

The whole live-room feature is present: joining a room when you publish, room event notifications, sending messages of up to 4 KiB on a topic, and per-artifact consent before joining. The availability check reads a null client, so it always answers no, and the room instructions and schema are left out of the artifact tool description this build assembles.

In Claude Code Projects, a tool result from the project fetch tools can now carry verified rows of messages from the project owner, and those get replayed into the conversation as turns that count as the user speaking. The remote setting tengu_hearth_resolved_rows defaults to "off" and this path requires the value to be exactly "full", so absent server config nothing here runs.

Nine parts of the terminal interface now ask a hook whether it wants to draw them before drawing them the normal way: user and assistant messages, tool calls and results, turn duration, notices, the spinner, the session mode line and the question prompt. Only a plugin hooks module can answer, and those are disabled in this build, so everything renders exactly as before.

The local socket that Claude Code sessions use to talk to each other gained yield_artifact_replies, unyield_artifact_replies and artifact_replies_yielded, the wire messages behind moving Artifact comment replies between sessions.

Even with the rollout flag on, the loader filters which plugins may contribute hooks. Two managed settings keys control it: disableAllHooks blocks every plugin, and allowManagedHooksOnly restricts loading to managed plugins.

An organization can replace list-price cost math everywhere Claude Code reports spend: /cost, the status line, the SDK's total_cost_usd, --max-budget-usd and the OpenTelemetry cost metrics. It takes per-model overrides giving input, output, cache-read and cache-write USD per million tokens, plus a global multiplier in the range (0, 1]. It is honored only from managed settings, and a compile failure falls back to list pricing.

Plugins get two new calls, $.audio.play and $.audio.speak. Playback works only where there is a player: a browser host, or macOS via afplay for clips and say for speech. On Linux and Windows terminals playing a clip does nothing and speaking is rejected. Each plugin has a cap on total plays per session and on concurrent plays.

$.prompt.submit lets a plugin put a prompt into the running conversation, tagged as coming from that plugin rather than from you. Text starting with / is refused so a plugin cannot fire a slash command in your name, and attachments are refused. Each plugin has a per-session submission count and a minimum gap between its prompts.

If a plugin rewrites the questions in an AskUserQuestion prompt, the rewrite is re-parsed against the tool's schema and compared with what was actually asked. A different number of questions, a missing question, a flipped multi-select flag, changed option labels or previews, or two questions with the same text all cause the original to be drawn, with a warning naming the specific violation.

Only one session at a time answers comments on a published Artifact automatically, and that job can now move between sessions of the same conversation. A session that resumes the conversation or republishes the Artifact takes replies from the session currently holding them, the permission dialog says plainly that approving takes replies back from the other session, and both sessions get notices when replies move, come back, or were stopped elsewhere. Claude Code is also told to explain the state to you: the other session answers the comments, no comment notifications arrive in yours meanwhile, and asking to publish or calling resume_replies brings them back. The takeover rides on local session-to-session messaging; with that off it does nothing.

Artifact sharing gains an audience where access follows the agent that created the item rather than a named list of people. Claude Code describes it as "everyone with access to the agent that created it", treats it as shared but not live-updating unless a view is explicitly set, and warns when a pinned version has gone stale. There is no flag to turn this on; it appears only when the service reports that audience for an Artifact.

Work parked waiting on a backgrounded shell command is now treated as a live reason to keep the task alive, the same as waiting on a subagent, a monitor or a workflow. Killing a parked agent also cleans up shell tasks it left running. Controlled by the tengu_concurrent_shore remote setting, which defaults to on.

The Bash approval dialog now has a third title form that names a remote host, built as "Bash command (runs on " plus the host name, next to the existing "Bash command (unsandboxed)" and plain "Bash command". It appears only when the tool request carries a host value.

In a Claude Code Project, messages the server says came from the project owner are replayed into the session as your own user turns, each opening with a marker the harness writes. New instructions say such a turn counts as you speaking, but a bare "yes" in one clears no soft block, answers no permission prompt, and never licenses editing settings or CLAUDE.md. Everything else relayed is treated as external content, and asking Claude to do what a sender was already denied is called "permission laundering - BLOCK".

The bundled model guidance adds a note that Opus 5 sometimes thinks before emitting its first visible block, which raises the delay before anything appears in chat and voice, along with a one-line system instruction to reduce it.

When a call arrives with constraints attached, Bash now refuses to run it unless a fully confining sandbox is available, and refuses outright if the constraints carry extra file read/write deny lists, which cannot yet be enforced locally. Both refusals emit sandbox telemetry and the command never starts.

The fallbacks request parameter, which lets the server retry a refused request against another model, is now documented as available on the Claude API and Claude Platform on AWS. It was previously Claude-API-only with AWS support described as still being validated.

The instructions Claude follows when handing work to a subagent now say to leave the model unset so the worker runs on the same model as your session, and never to move substantive work to a cheaper one. Where the page-publishing tool is available, delegated reports are asked for as .html pages instead of a Markdown file.

Hook entries in settings can carry cloud: "device" or cloud: "skip". A hook whose script lives somewhere the cloud session can write, such as the checkout or a synced directory, is withheld unless the entry is explicitly marked cloud: "device"; cloud: "skip" keeps it local. Part of the device-hooks subsystem that is switched off in this build.

New code decides for each locally configured hook whether it is offered to a cloud session driven from this machine, and /hooks gained a cloud-session panel to review the decisions. Command hooks are pinned by digest and refused when their script sits somewhere the cloud session can write; HTTP hooks have no script to pin.

Reading comments on an Artifact is gated on tengu_onyx_sluice, which falls back to off in this build. With it off nothing is fetched at all and you get "comments are not available on this artifact right now", counted as cp_read_disabled. With it on, transport errors and HTTP 5xx or 499 are retried once after a random backoff and the unavailable message includes the HTTP status.

Syncing your working directory to a cloud session can now run through two new engines instead of shipping file rows one at a time. In a git checkout, each turn packs a snapshot commit into a bundle and exchanges it with the session; in a plain folder with no git root, an archive engine packs the tree into a gzipped tar. The per-file lane remains the fallback and the only always-on path, and the client-side selector is wired up while the cloud-side workers stay off unless separately enabled, so a plain claude in this build still syncs file by file.

Cloud sessions can now be started from an ordinary directory rather than a git checkout, using a second sync engine that applies file archives sent from your machine, keeps a session-side trash for cloud deletions, and tells the model exactly which files never cross. The consent prompt that asks whether to copy your files into a cloud session already picks its title, body and "without sync" wording depending on whether you are in a git repository or a plain folder, so the folder wording is visible in this build. The folder engine itself is only constructed when the environment variable CLAUDE_CODE_DIR_SYNC_ARCHIVE is set and its enabled check passes, so with that variable unset the prompt wording is present but no folder sync happens.

A new screen asks whether hooks from your own settings (user settings.json, a checkout's settings.local.json, or a --settings file) may run on this machine when a cloud session asks for them. It offers three answers and explains that whatever a hook returns, such as a block reason or added context, becomes part of the cloud session's transcript.

When a hook template registered by another device cannot be installed on this machine, the tool calls it was meant to guard are now denied instead of being allowed through unchecked. This sits behind the same gate as device hook forwarding, so it only applies where that forwarding is active.

Return values from a hook are validated per event rather than trusted. A subagent spawn hook may only rewrite the model. A pre-tool-use hook must keep the tool envelope's keys intact. A prompt submission hook may return replacement text or a drop string. The question component is refused as a render target outright, because its answer authorises an action; a plugin can add context around it with a notice instead.

The Hooks settings screen gains a row for deciding whether cloud sessions are allowed to run hooks configured on this machine. The answer is saved on this machine and shown as on, off, or not yet decided. Until you decide, nothing from this machine is offered to a cloud session.

The plugin fetch capability refuses anything but https, refuses URLs with embedded credentials, and blocks private, loopback, link-local, carrier-NAT, multicast and reserved addresses in both IPv4 and IPv6, cloud metadata endpoints, localhost / .local / .internal names, and Anthropic-operated hosts. Calls time out at 30000ms. It ships as part of the plugin hook-module feature, which is off unless the server enables it.

The plugin file capability refuses paths that escape the project root, non-regular files and hard links, and re-checks the opened file against what it saw before opening so a file swapped in mid-check is caught. It arrives with the plugin hook-module feature, off unless the server enables it.

Plugins can read and write a private JSON store that survives across sessions, kept in one file per plugin and guarded by a lock so two processes cannot corrupt it.

Resuming a session can pick up a tool call that was still in flight instead of discarding it, when the pending action names a tool use that is still the last real turn. Both CLAUDE_CODE_RESUME_TOLERATES_CONTEXT_APPENDS and CLAUDE_CODE_RESUME_INTERRUPTED_TURN must be set for this path; with either unset the old behaviour stands.

The computer-use screenshot tool takes a region of four integers naming a rectangle to zoom into, measured against the full-screen screenshot taken before the batch. A scale factor is also documented, with an explanation of its effect on token cost, but both capability profiles shipped here turn adaptive resolution off, so scale is not exposed.

Browser tool calls are inspected before they run: a batch must target exactly one tab, may not act on a page after navigating to it in the same batch, may not contain another batch, and switching browsers must be its own call. Violations are denied with a message explaining the correct shape, and the denial is a safety decision the permission classifier cannot approve. Enabled only when the server-supplied auto mode configuration sets Chrome navigation to true, which nothing in this build does locally.

When a subagent finishes, its report is re-emitted indented under a preamble telling the model the text is model output carrying no user authority, so instructions embedded in it cannot pass as commands. The section list is hashed so the notes and tail split cannot be forged, and a failed split is reported as degraded. Off unless enabled: CLAUDE_CODE_HANDBACK_PROVENANCE is checked first, otherwise the tengu_melodic_wolf setting, which falls back to off.

Tool invocation and turn stepping now go through the same event dispatch that plugins observe, rather than being called in line. This is the plumbing that lets a plugin see and act within a running turn.

--print --cloud was previously refused as interactive-only. It now sends the prompt to an existing cloud session when you identify one, and the error tells you the accepted forms if you pass anything else.

The old setting is now marked deprecated and only still does anything when set to true. The replacement key documents which settings tier wins: an off in managed settings, --settings or your user settings is final, while project and local settings can only turn the feature off, never back on.

Streaming requests, and Bedrock POSTs to the invoke path, are now wrapped in a watchdog that aborts if the first response headers never arrive. The budget is computed from the request body size and API_TIMEOUT_MS, and CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS overrides it. Time the machine spent asleep is measured and reported separately, so a laptop that suspended mid-request is not mistaken for a hung server.

The re-bundle that turned deferred loads into real dynamic imports comes with an opt-out: set CLAUDE_CODE_LEGACY_BUNDLE to true to get the old shape. It must be truthy, so unset means everyone gets the chunked build.

CLAUDE_CODE_USE_GATEWAY is now on the allowlist of environment variables copied into processes Claude Code spawns, alongside the other provider switches such as CLAUDE_CODE_USE_BEDROCK and CLAUDE_CODE_USE_MANTLE, so a session routed through an enterprise gateway hands that routing down instead of dropping it.

/plugin-types generates claude-code-mcp.d.ts in .claude/types, or in a directory you pass, containing an McpToolInputs interface built from every connected MCP server's advertised tool schemas. A plugin checking e.tool === "mcp__<server>__<tool>" then gets that tool's exact arguments typed. It reports how many tools from how many servers it wrote.

Two new settings, promptCacheTtl and subagentPromptCacheTtl, pin the prompt cache to "5m" or "1h". The first covers the main conversation (interactive, -p and SDK turns and the helpers that run inline with it), the second covers subagents, workflows and background requests. CLAUDE_CODE_PROMPT_CACHE_TTL and CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL override the settings. No experiment gate; available to everyone on this build.

When a cloud session's commits sit directly on top of your checkout's current HEAD and your working tree is clean, Claude Code now advances your local branch onto them and tells you your branch has Claude's commits. It waits instead when you have staged changes, an operation in progress, differing files or protected paths, each with a plain explanation. Set CLAUDE_CODE_DIR_SYNC_FFWD to switch this off; it is on otherwise.

When a cloud session is seeded from your local working tree rather than from the remote repository, the first message is now held until the session confirms your changes arrived. If it has not, sending is refused with an explanation that the session would otherwise be working from GitHub's copy of the repository; send again to go ahead anyway.

When Claude Code picks its own local socket path for inter-process messaging, it now probes the existing file first: a leftover from a dead process is deleted and retried, and a socket a live sibling is using causes a bind at a randomised nearby path, up to three attempts. Sockets moved aside on earlier runs are cleaned up. A socket path you specify explicitly still fails hard if it is in use.

If the cached auto mode configuration said disabled and that value came from disk rather than a live override or server payload, it is now read back as enabled, and startup re-checks the killswitch against the remote config service before deciding. A stale local file can no longer keep auto mode switched off indefinitely.

When you answer a permission prompt, dialog or hook for a session running in the cloud, the answer is now kept if it cannot be delivered, re-posted with a 1s, 5s, 15s and 45s backoff, and re-sent on reconnect. If it is finally lost you get a message naming which kind of answer went missing and suggesting you interrupt and retry.

wait now polls in slices and stops on interrupt, and typing, key repeat, hold-key and drags re-check for interrupt before each keystroke or movement. In computer_batch and teach_step each inner action is wrapped so a throw becomes an executor_threw tool error for that action instead of failing everything.

When lower-priority ("fast") work stops, a new reason says extra usage is now covering your requests. The status line can show a remaining-allowance note with the percentage filled in, and the "no room for lower-priority work" message now suggests when to re-run the slash command.

A page that declares which MCP servers it needs is now validated against the servers this session is actually connected to before it can be published, with each failure named rather than a generic error. Pages declaring the Claude app's own built-in servers (cowork, scheduled-tasks, session_info, workspace) are refused.

A new module scores Bash commands as destructive, covering cases that simple pattern matching misses, and recursing into sh -c, eval and backtick subcommands. It carries no flag of its own, and where its verdict is consumed is not visible in the added code, so it may not affect any prompt you see yet.

Mock files can declare a responder that is answered by a prompt rather than a fixed body, with an abort_when: condition, but the code path is behind a constant that is false in this build. Any mocks file using type: agent fails and is told to use a fixed body for now.

The mocking docs describe a mock type where a small model plays the server for the run, with conditions for aborting, but the loader refuses it in this build.

Besides granting named applications, there is now a mode that treats every application as granted at the full tier except those a denylist excludes, and it skips the step that hides windows before acting.

Publishing an Artifact gains a live-paths concept throughout: publish results carry live paths and a born-live marker, share status stores the paths and when they were issued, and the publish request sends a live-files flag that is also passed to publish telemetry. The visible part is extra top-level fields spliced into the Artifact tool's input schema, and that only happens when three conditions all hold.

Two tools, request_full_control and release_full_control, let a session ask permission to move from controlling one application to controlling the whole screen, and hand that control back. Escalation needs the host's takeover handler and an explicit user approval; during scheduled or unattended runs it is refused with the reason code unattended_no_approver.

A new sign-in path writes an OAuth login into configs/<profile>.json plus an active_config marker under the Anthropic config directory, with the profile name taken from ANTHROPIC_PROFILE (letters, digits, underscore, dot and hyphen only). Whether it is reachable is decided by a flag the login screen is handed, whose source is not visible in the bundle, so treat it as off.

A new component wires a cloud session's hooks back to your machine, so hook callbacks raised remotely can be answered and released locally. It is constructed at exactly one place, and that place returns nothing unless the session is not view-only and a second condition holds.

A pattern was added that recognises the openings of a refusal ("I can't", "I cannot", "I'm unable", "I'm sorry", "I apologize", "Sorry,"), and the streaming handler gained an onRefusalFallbackBanner slot that is still an empty stub. A retry check was narrowed at the same time: it now retries only when the failure reason is absent or is a full lane, rather than anything that was not a refusal.

The layer that maps transcripts, sessions, tasks, mailboxes, jobs, memory, logs, recordings and daemon state to files now decides per data type whether to follow symlinks and what file mode to use. It only runs when tengu_hover_rest is on, which is off unless the server enables it or CLAUDE_CODE_HOVER_REST forces it.

A table now maps each of these command-line tools to the credential environment variables it reads and to stand-in values for them, covering GH_TOKEN and GITHUB_TOKEN, the full AWS set including container credential URIs, and the Google Cloud SDK token and application default credentials path. A startup step primes these and logs without failing if it cannot. What decides when the placeholders are substituted is not settled by the code that defines them.

Before a plugin's hook file runs, its source is parsed and walked, and anything that does not match a narrow permitted shape is refused with the file name, the line and an excerpt. This makes what a hook can do checkable before execution rather than after.

A new adaptive-resolution capability adds a scale parameter to the screenshot and batched computer-use tools and switches to a richer batched schema with a region for zoom. Both places in this build that supply the capability set it to false, so absent a server-supplied config, no user sees scale.

Artifact types (listing and describing available types, filtering by type, both treated as read-only for permissions) remain behind CLAUDE_CODE_ARTIFACT_TYPES or the flag tengu_cobalt_plinth_larch. New here is a second switch specifically for creating an Artifact from a type while in a cloud session: CLAUDE_CODE_ARTIFACT_TYPE_CLOUD_CREATE or the flag tengu_cobalt_plinth_hazel. Both fall back to off, so on a stock cloud session this is closed.

Two read-only actions are added to the Artifact tool: list_types takes a type_query and returns published types this account could start a new Artifact from (title, url, description, tier), and describe_type takes a type_url and returns that type's files, instructions file, capabilities and whether it is creatable. Both are switched off here. Availability is read from CLAUDE_CODE_ARTIFACT_TYPE_CATALOG, falling back to the flag tengu_cobalt_plinth_rowan, whose built-in value is false, and neither exists in the previous build.

A remote host can now be asked to contribute an attachment notice, both when attachments are gathered for a turn and when they are rebuilt after a conversation is compacted, in the latter case tagged with the trigger post_compact. The call is skipped entirely when no remote host is attached, and both call sites sit behind a condition that is not decided anywhere in this build.

Every interactive turn now opens a turn id, emits turn.start with the text you submitted, and on finishing emits turn.complete with the last real assistant message, elapsed milliseconds, whether it was aborted, and the turn id. A module handler that returns text differing from the model's answer has that text appended to the transcript as a system notice prefixed with the names of the handlers that contributed. turn.step exists as a third event.

When two live sessions of the same conversation are both set to reply to artifact comments, the old behaviour was a warning that every comment would get answered twice. This build adds a real handover protocol with wording for all three outcomes: one session took over, one yielded, or they are still doubling up. The step that actually makes a takeover stick is behind tengu_cobalt_plinth_thistle, which falls back to off.

The metadata block carrying the version, build time and commit now also carries a path to a bundled worker script for plugin function hooks, present in every copy across the bundle, meaning hooks can run in their own entry point rather than inline.

A new parser reads a hook's shell command and works out whether it ultimately runs an identifiable script file, which lets Claude Code reason about a hook without executing it.

A new table labels each hook event with where it belongs: session start, session end and notification hooks run locally; permission requests are deferred; setup, compaction, teammate-idle, task and elicitation hooks are marked low value; and config, worktree, instructions, directory, file-change and message-display events are marked internal to the container.

The loader now reads a JSON file sitting next to a plugin and accepts a server_plugin_id from it, letting a plugin be tied back to a server record.

Validating a plugin's hooks.json now loads each JavaScript hooks module it names, refuses any path that points outside the plugin directory, and reads the module to report which events it hooks and which plugin APIs it calls. A capabilities field in the file is now reported as ignored and safe to delete.

Claude Code now points you at /web-setup to connect GitHub for running sessions on the web. The one-off tip appears only when the gh CLI is signed in locally, the repo remote is not GitLab or Bitbucket, and the web connection currently reads as not connected.