Claude Code v2.1.246

The table mapping short model names to full model ids was refreshed and now includes fable-5, mythos-5, opus-5 and opus-4-8 alongside the existing opus, sonnet and haiku entries. An alias being listed does not mean the model is available to your account.

In the previous build only Bash could be routed to another machine. Read, Write and Edit now each declare remote execution support, and Edit's validation grew a remote-aware branch: when the call is remote and the file is missing, it answers "does not exist on this machine, so nothing was changed." instead of offering the local "Did you mean ...?" suggestion.

A directory that is not a git repository can now seed a cloud session. Claude Code packages the folder into a git bundle in-process, no git binary required, and uploads it as _source_seed.bundle. The seeding step is skipped unless you set the environment variable CCR_ENABLE_BUNDLE or the remote switch tengu_ccr_bundle_seed_enabled is on, in which case starting from a folder refuses with a message saying the feature is switched off.

Unattended replies to comments on an artifact could previously be armed only by publishing it. The watch action can now arm them too, on an artifact you can edit whose link you gave in your own message, and the tool result explains which of those conditions failed when it cannot. The code paths, the per-artifact consent state and the changed permission prompt are all present in this build, but nothing in it turns the capability on by default.

A new headless path can forward the hooks configured on your machine to a cloud session, but only after you have explicitly accepted on this machine. If the machine is unbound, or consent is declined, unset or unreadable, hook forwarding reports off with a reason. With no stored consent at all, the report tells you to run /hooks locally to decide. Forwarding also requires the feature's own enabled check to pass.

The SDK and stream-json initialize request accepts a new boolean saying your client renders a per-task stop control wired to the existing stop_task control request. Set it to true and an interrupt on an interactive stream-json session aborts only the current turn, leaving running background agents and workflows alive.

A new step can swap the model a request asks for before it is sent. The replacement comes from the environment variable CLAUDE_CODE_BREEZY_HORIZON, or failing that from a server-supplied config block that maps each source model to a replacement. With neither set, nothing changes, so this build only substitutes models if you set the variable or the server tells it to.

The whiteboard tool description was rewritten from a one-way board you sketch on for Claude to plan from, into a shared canvas: you publish, the session wakes, reads the scene data plus a picture of the board, and answers by drawing back on the same canvas.

The memory read, write and list tools now describe the stores available in the session rather than connected ones, use flat document paths such as /MEMORY.md in their examples instead of nested project paths, and report whether a result came from your personal store or the project's. Reading content back is prefixed differently depending on which store it came from, so personal notes are framed as reference data rather than instructions.

Two paths that let something else set your permission mode are gone. The inbox poller no longer applies a mode-change request from a team lead, dropping it with a warning like it already did for team permission updates, and the remote hooks that mirrored a local mode change to the host and applied an inbound broadcast were both deleted.

Resuming a session could previously only restore plan mode from a value the previous run recorded. A new path instead scans the transcript backwards for plan markers, ExitPlanMode tool calls and plan-mode user turns, classifies the session as still in a plan, exited, or neither, and re-enters plan mode when a plan is open and no recorded mode exists. It is controlled by the tengu_tranquil_fern gate, which defaults to on when no server value is present.

The binary carries several text assets that were not there before: documentation for managed agents and self-hosted sandboxes, two preambles for an autonomous loop (one of them persistent), and an HTML blob for an artifact workshop.

The build carries a batch of newly embedded assets: managed-agents documentation covering the API reference, client patterns, environments, events, memory, multi-agent use, onboarding, outcomes, overview, scheduled deployments, tools and webhooks; several SKILL.md files; canvas, board and palette validation scripts; and a package build and validate toolchain. Their presence in the bundle does not by itself mean a surface exposes them.

Requests now carry a block of fields describing a fallback used after a model refusal, including the fallback model, its lane, a credit code and mint details, and stamp fields recording the original model, category, trigger and request id. Plumbing for that path; nothing here is user-settable.

When a subagent finishes in permission mode auto, Claude Code normally runs a classifier to decide whether control hands back to you. A host or SDK integration can now set classifyHandoff: false in its config to skip that classifier entirely. It applies to both local subagents and cloud agents run with isolation: 'remote'. The guard only fires in mode auto, so nothing changes unless a host opts out.

In coordinator mode, where one session dispatches work to other sessions, a timer can now inject a note into the coordinator while workers are still running. It lists each worker with its tool-call count and last activity and asks Claude to post a status update or change approach. It is off unless CLAUDE_CODE_COORDINATOR_WORKER_CHECKIN_SECONDS is set, which also gives the interval in seconds.

Plugin function hooks can now end the turn in progress through a new turn object on the plugin API surface, sitting alongside the existing tool, agent, fs, store and clock objects. Any tool call still running when the abort lands comes back as the synthetic result "[Request interrupted by a plugin for tool use]", which is distinct from the wording used when a person rejects a tool. Its only verb is abort, and it needs the turn id that the plugin was handed when the turn began.

Two operations are new to the plugin host: one reports whether the request came from the desktop app or a terminal, and one reads a feature flag value. Separately, a plugin asking for the session's working directory or repository now gets the directory of the call that invoked it rather than the directory the process started in.

A plugin hook can now stop the turn that is currently running by calling $.turn.abort({ turnId }). Each plugin is limited to one abort every 2000ms, and the whole session is capped at 50 aborts.

On Windows, Claude Code can keep your credentials in the operating system's Credential Manager instead of its previous store. The choice is made by a resolver that answers once and reuses that answer for the rest of the run, so the backend cannot change mid-session. It stays off unless a remotely delivered feature flag named tengu_windows_credman is cached as true in your config file or you set CLAUDE_CODE_FORCE_WINDOWS_CREDMAN=1, which overrides the flag; with neither, the old credential store keeps being used.

The in-process team runner used to let a lead agent set a teammate's permission mode over the shared inbox. Those messages are now dropped with a warning instead, unconditionally.

The artifact tool now carries per-state explanations for a watch, covering armed, none, stopped, paused, yielded, declined and denied, plus the reasons an auto-reply did not arm: the account cannot edit the artifact, no user message started the turn, or the link did not come from the user. The older combined watch and consent text, and the paragraph listing the asset actions, were removed in the same change.

For providers reached through a gateway or a custom base URL, three consecutive turns of 20,000-plus input tokens with no cache read and no meaningful cache creation now report a cache_coverage_loss outcome, the signal that something between Claude Code and the model is dropping the cache markers.

When an Edit or Write call arrives from another session rather than from your local one, the tools now run an admission check before writing and re-check it after the file path is resolved. A refusal comes back as an invalid_request verdict with the reason served_floor, and nothing is written.

The two thresholds that decide when a session hands off its work fell from 25 and 35 to 10 and 15 for claude-opus-4-8. Sonnet 5 is unchanged at 25 and 35. These are the built-in defaults for the handoff decision and can be overridden by server-side config.

The prompt section that listed the machines attached to your session, explained how to route a tool call to a named machine, and named a default machine for builds and long-running work has been deleted, including its REPL-specific await form.

After a publish returns a read handle, the summary and the [shared-live: unknown] / [shared-live: <mode>] annotation that tells the model how the published item is shared are now produced unconditionally. In the previous build both were behind a feature check that bailed out early, so this awareness is live for all users on this build.

When auto mode hits its classifier denial limits (3 consecutive or 20 total), it can now show a permission prompt that auto-denies after a timeout instead of simply reverting to prompting. The reply tells the model you are likely away from keyboard and not to retry variations meanwhile. It is off unless tengu_ticklish_whisper is enabled server-side or CLAUDE_CODE_TICKLISH_WHISPER is set, and needs a dialog requester. The delay defaults to 120000 ms, overridable via CLAUDE_CODE_TICKLISH_WHISPER_TIMEOUT_MS.

Claude Code can now pull the plugins you enabled on claude.ai onto your machine, installing them alongside the account skills sync that already existed, and cleaning them up again when syncing stops. The whole path is present in this build but nothing in it turns itself on: the setting syncClaudeAiPlugins only works as an off switch, and whether the feature runs at all is decided per account by the remote rollout flag tengu_account_plugins_sync_enabled and the managed org policy allow_account_plugins_sync, both of which the build only reads. Setting syncClaudeAiPlugins to true does not enable it.

On Linux and WSL, child processes started by Claude Code can now be placed into a memory-limited control group, so a runaway server or hook is killed at a cap instead of exhausting the host. This covers stdio MCP servers, LSP servers, hook runners, plugin installs, tmux agent sessions and the background terminal host, all launched through a wrapper that joins the capped group before running the real command. None of it is active in this build: the exclusion list falls back to a set containing every one of those classes, so the wiring is dark-launched unless CLAUDE_CODE_TOOL_MEMORY_CGROUP_EXCLUDE or server config says otherwise.

Folder sync ships its own git: an append-only object store on disk, packfile encoding and decoding, bundle create and receive, and a cached file-hash index so unchanged files are not re-hashed. It replaces the old row-journal approach. Reachable only for sessions started against a folder, and an internal boolean decides whether the store gets attached at all.

When results come back from coordinated agents, replies that cannot be trusted to match their question are now vetoed and counted by reason: blocked by the delivery gate, duplicate markers, inconsistent copies of the same record, and malformed sources, alongside totals for marked replies and replies that had a coordinator question.

The message shape teammates used to request a permission-mode change, carrying a mode and a sender, was deleted from the set of messages agents can exchange, so such a message can no longer be parsed at all.

The hidden cloud-session flag controlling whether this machine's settings go into the session is now tri-state. You can force forwarding on for one launch as well as off, rather than only opting out. The default is unchanged: with the flag absent, settings are still forwarded.

Hooks written in JavaScript were limited to one file; the entry file may now import other files, which are followed, compiled and parsed as part of the module. Two new ceilings apply, MAX_HOOKS_MODULE_FILES and MAX_HOOKS_MODULE_TOTAL_BYTES, on top of the existing per-file byte cap. Anything outside the import graph is refused. No new flag: this works wherever hooks modules already load.

The artifacts tool now advertises its asset actions: uploading one local media, PDF, font or text file to an existing artifact, listing an artifact's assets, reading one to a local file, and deleting one. Result checking covers asset ids, _blob/<id> urls and content types.

Cloud sessions started outside a git checkout can now sync through a new "folder" engine that seeds a git store from the folder. At the same time the two older engines are gone: the per-file sync that pushed changes file by file and the archive engine that packed changes into tar/gzip bundles. CLAUDE_CODE_DIR_SYNC_ENGINE now accepts only git, always-git, and the off words none/off/0/false/no; CLAUDE_CODE_DIR_SYNC_ARCHIVE no longer exists.

The Auto mode tab of /permissions gains an "Edit environment" action that opens the environment rules as a document in your editor. When you save, the whole draft is re-checked against what the screen loaded and refused with "The environment changed since this screen loaded" if it moved underneath you. Lines starting with ### are treated as section headers, not rules, and cannot be added, edited or deleted through this flow.

CLAUDE_CODE_FORCE_FIRST_LAUNCH makes startup behave as if this were a fresh install. Set it to a version string to pretend that was the last version seen, or to any truthy value to pretend nothing was seen. Unset by default.

In print/headless mode Claude Code now compares the run's cost against --max-budget-usd, and on reaching the cap it writes a notice to stderr and stops any background agents still running rather than letting them keep spending. The check consults shutdown state first, so an interrupted turn or a session already tearing down will not trip the cap or print the notice on its way out.

Set CLAUDE_CODE_EXIT_AFTER_STOP_DELAY to a positive value and Claude Code will now shut itself down once the session has sat idle for that whole window. With the variable unset or non-positive the watchdog never starts, so behaviour is unchanged.

Changing into a directory Claude Code has not trusted now lists what that folder's .claude/settings.json and .claude/settings.local.json would give it: pre-approved tool permissions, extra accessible directories, hooks that run commands, and helpers that supply auth tokens or request headers. A second variant appears after the move when project grants are held back, ending with a note that they apply only if you trust the directory.

Two new instructions tell the model that your CLAUDE.md, permission rules and preferences were sent from your machine but either had not been applied when the turn started, or could not be taken at all, and that it must tell you rather than acting as if they were in effect. So a cloud session running on defaults now says so instead of silently ignoring your rules.

Under the remote session URL, a cloud session now draws three rows (Project files, Settings, Plugins) with a tick or spinner and a plain-English note when something is off, such as "this session was not started from this folder", "sync is switched off on this machine", or "the cloud session restarted without its synced files". The panel refreshes as the session streams, plugins change, and the settings upload and read-back complete.

A cloud session now holds back your first message until the initial upload of your project files has actually landed on the server, instead of sending it against an empty or half-populated workspace. While waiting it prints progress lines, retries the first push on a backoff schedule, and if it never lands it stops with a "seed_incomplete" result. Reached on any claude --cloud session; no flag guards it.

If the API refuses a compaction request and offers a fallback model, compaction now aborts the refused stream and retries on an allowed fallback instead of failing. When your model policy leaves no usable fallback, compaction stops with a message naming the model and pointing at /model.

When building the sandbox policy, Claude Code now checks whether each settings source is enabled. Permission rules and sandbox.filesystem entries from a disabled source are skipped and logged; disabled project and local sources also have their sandbox.credentials entries dropped. Previously those entries were applied anyway.

Pressing interrupt mid-turn now marks the pending tool results as interrupted rather than reusing the "user rejected this" wording, so the model is told the turn was stopped instead of being told you refused that particular tool.

The memory write tool now separates your personal store from a shared project store. In automatic mode, saving to your personal store inside the standard memory directory goes through without a prompt, where previously every save went to classifier review. A personal save that would land outside that directory now always asks you, and is marked so the automatic classifier cannot approve it on your behalf.

If a streaming reply dies after the model has already produced output (idle timeout, mid-stream server error, dropped connection, laptop sleep), a claude -p run now re-sends the turn with a note telling the model its response was cut off and to resume from where it stopped, up to a fixed number of attempts. Controlled by tengu_truncated_response_recovery, which defaults to on. Interactive sessions are unchanged and still show the partial reply plus the error line.

A subagent that stops because it ran out of turns no longer looks like one that finished. Its returned result is prefixed with a note marking the text as incomplete, the completion notice names the turn count it hit, and where the agent type supports it you are told to send that worker a message to continue rather than treating the output as final.

Before sending telemetry, Claude Code now compares the credential it holds against the endpoint host and, if they do not match, removes the auth headers with the reason misrouted_credential. Pointing OpenTelemetry metrics at a third-party collector no longer leaks your Anthropic credential to it.

A directory whose cloud-session record was written by the older rows or archive sync engines will no longer resume syncing. Attaching to such a session shows a line beginning "File sync is off for this session here" and tells you to start a new cloud session from that directory. This applies to everyone on this build; no switch guards it.

Adding an allow rule such as Bash(git ) now warns that the wildcard also matches options placed at that position and approves them without prompting, and suggests putting the after the subcommand instead. git is called out because options like -c and --exec-path can run arbitrary commands.

Claude Code now watches whether prompt caching is actually taking effect. After three turns in a row with 20,000 or more input tokens and essentially no cache being written or read, it logs a warning that a custom endpoint is discarding the cache, which shows up as slower, more expensive turns.

Key bindings pointing at your own commands must now be named command:<name> rather than x-<name>. The name after the prefix is used as the binding's description in the UI. Bindings still using the old x- prefix will no longer validate.

Claude Code can now read where a plugin came from, either from a JSON file placed next to the plugin or from a map in the CLAUDE_CODE_PLUGIN_ATTRIBUTION environment variable. It yields a server-side plugin id (plugin_ plus letters and digits), a marketplace name and an installation preference. The variable is unset by default, and it is now stripped from the environment handed to spawned subprocesses so it does not leak into tools.

Before creating a headless cloud session, Claude Code can now ask "Sync this project directory to the cloud?", explaining that syncing lets Claude keep working if your computer sleeps or disconnects. The choices are to sync, to use device tools instead, or not now, defaulting to not now. The whole path sits behind a server-side flag check that is treated as off when it fails, so it is not reachable by setting anything locally.

A new setting controls an "act first" behaviour for Bash commands, read from CLAUDE_CODE_GORSE_PLOVER. It has no built-in default, so with the variable unset and no server-provided value it stays undefined and the behaviour is off.

The plugin host API gains three verbs: one reporting whether the caller is the desktop app or a terminal, one aborting a turn, and one reading a feature flag as $.flag.value(name, fallback). All of this sits behind tengu_plugin_hooks_modules, whose in-source default is false, so plugin JS modules do not load at all without a server value and the loader logs that it skipped them and names the flag. The flag reader is doubly off: it refuses unless an internal-build check passes, and that check is a constant false here.

All four ripgrep spawns (search, file counting, streaming search, version probe) and several git spawns now spread in options from a shared factory. What that factory sets is not visible in this build, so whether it changes environment, scheduling or sandboxing is unresolved; the same call shape is absent from the previous version.

The system prompt for Claude Code Projects gained a block on the one relayed owner reply that arrives without a marker, shown as an assistant entry starting with "Coordinator session's message". It sets out how much such a reply authorises.

The worker client used by remote-control sessions gained a batch upload and a cursor-based paged fetch for internal events, along with schemas for the returned rows and explicit refusals when the client is closed or not yet initialized. Requests can now carry a caller's cancellation signal with a linked timeout instead of only a fixed timeout.

Reads driven from another session now resolve the file through an admission check that must return "admitted", otherwise the read is refused back to the caller as an invalid request. After the bytes come off disk the path is checked again, and if it no longer points where it did, the cached read state is dropped and the caller is told to read again.

A new helper can compress an outbound request body, first appending a newline and between 0 and 256 random spaces or tabs so the compressed size does not reveal the exact payload length, and setting Content-Encoding: gzip. It does nothing unless a compression-decision function is supplied at the call site and picks gzip for that URL; otherwise the request is sent as before.

The field naming how a bundle travelled changed from a fixed choice of two values to any short string, normalised to "row", "direct" or "unknown", with size caps looked up per transport. A newer server transport now passes through an older reader instead of invalidating the whole record.

SDK assistant messages can now carry user_message_uuid, the id you passed as options.uuid when you sent the prompt. It is stamped on the turn's first reply frame only, so a consumer can bind a reply to the send it answers without waiting for the result message.

When forwarding your machine's hooks to a cloud session (claude --cloud), each hook is now checked for whether its script or its config file sits somewhere the cloud session could itself write to. Hooks that cannot be pinned, because they are not a single script, are unreadable, hard-linked or oversized, or live inside the checkout, get a notice saying so and are not run. Successful registrations went quiet.

--forward-home-settings (used with --cloud or --environment) no longer just flips a boolean. Startup resolves a consent value and passes it through to session creation, so the fact that you consented is tracked separately from whether forwarding is allowed at all, and a settings-upload status feed now sits alongside the existing file-sync one.

Hook processes now take their shell prefix, MCP shell prefix and MCP path from the context of the call that triggered them. For a call served from elsewhere, hooks run with the serving side's prefix and environment; locally the fallback is still the CLAUDE_CODE_SHELL_PREFIX environment variable.

The Linux and WSL feature that caps the memory of processes Claude Code spawns was rebuilt. It stays off unless CLAUDE_CODE_TOOL_MEMORY_LIMIT names a limit or the remote flag tengu_tool_memory_cgroup reads true; the in-source fallback is false, so with no server value nothing is capped. Setting the env var to none disables it outright.

Changing a session's directory, via /cd or through the SDK, now runs a single routine that re-points the transcript, background session state, settings watcher, hooks, skills and the skill watcher. Each step is wrapped individually, so one failure logs and the move continues rather than aborting halfway.

Hooks and commands shipped by a plugin can now point at files inside the plugin itself, using $CLAUDE_PLUGIN_ROOT or ${CLAUDE_PLUGIN_ROOT} at the start of the path.

claude plugin enable and claude plugin disable now register built-in plugins first, so bundled plugins can be enabled or disabled by name. Their counters are awaited before the process exits, where previously events could be dropped by the immediate exit.

Artifact assets were limited to images and fonts. The asset type table now also covers .csv, .md, .markdown, .json and .txt, with those four text content types tracked as their own group.

A run that is not interactive and produces text output, or json output without --verbose, now omits thinking from the output entirely. Interactive runs still show summarised thinking.

The exit-to-background dialog and the fork/background confirm dialog now count workflow subagents separately and tell you that any still running will restart from the beginning, while finished ones are kept. The confirm button label changes to match.

When a client changes the session working directory, plugin and MCP configuration is re-read for the new location. Servers whose config no longer applies are marked stale and their cache cleared, then servers reconnect or disconnect with the reason set_cwd.

Deletions applied from a cloud session already went into a per-session trash folder on your machine. Now you are told, with an info line naming a few of the paths and stating plainly that the files were not erased.

Status lines streamed into a remote or cloud session (directory sync, home settings, hooks, plugin availability) now carry a level, and only the important ones reach you. info shows as a notice, warning still raises a high-priority notification, debug goes to the debug log only, and anything else is dropped. Previously every line was surfaced as a notice or a warning, so cloud sessions were noticeably chattier.

Changing permission mode in a cloud session now sends the change to the session and retries on a 1000/3000/9000 ms backoff if it is not delivered. If it never lands you get a notification saying the mode may be out of sync and to press shift+tab to retry; if the session rejects it outright, your local mode rolls back to the last mode the session confirmed.

An MCP call aborted mid-flight used to come back as an empty error. It now returns a result marked as interrupted with text warning that the call may or may not have completed on the server and should be verified before you assume it did not.

Interrupting a session from mobile, Slack or the desktop bridge used to abort only the current turn. It now aborts with an explicit "remote-cancel" reason and then sweeps the background task registry, so in-flight background tasks are stopped rather than left running. Live for any session with Remote Control enabled; no feature flag guards it, only the pre-existing check that a turn is in flight.

A permission rule can now refuse a forwarded tool call when it names any of the tool's alternate names, not just the exact name the call arrived under, so rules you wrote against one spelling take effect on the others.

Session cost is now saved into the conversation transcript and read back when the session loads, so a resumed session continues from its existing spend instead of restarting the counter at zero.

Claude Code now rings the terminal's accessibility bell the first time a turn's completion time is recorded, and the "Network request outside of sandbox" permission dialog now announces "Claude needs your permission" to screen readers like the other permission prompts already did.

MCP and plugin tools whose input schema omits type on a property were receiving stringified JSON where the model intended structured data. Such properties are now treated as accepting any type, and a string that decodes to a boolean, number, array or object is parsed.

The trust-this-directory prompt was rewritten and now has a second form used when you /cd into a directory whose own settings want to grant project permission rules or extra directories. Its title is "Now in a new directory:", and the buttons read "Yes, trust it and apply them" / "No, keep them off". Both forms now ignore a confirm or cancel that arrives within a short window of the dialog appearing, so an Enter or Esc already in flight cannot answer it for you.

The background sweep that removes finished job worktrees now refuses to delete one unless it finds Claude Code's own creation marker, so a checkout you made yourself is never reaped.

MCP connection handling now fires events when authentication is lost mid-call, when a reconnect after re-authenticating reaches the connected state, when a cached connection is adopted, and when dialling a cached connection fails. Nothing in the build subscribes to any of them.

The shared collection of event emitters, which already held the OAuth callback listeners, submitters and in-flight flow maps, now also carries emitters for losing authentication, reconnecting after re-authenticating, adopting a cached connection, and a cached dial failing.

Path resolution, key validation, child and descendant lookup, directory listing and scope enumeration in the storage key layer all check whether a marketplace key carries a relative path, and take the file-tree route if so. Writes through the tree interface are refused because trees are produced by cloning or publishing, and generic key resolution does not accept a marketplace tree yet.

Coordinator worker check-ins are wired in as their own check-in type next to the existing idle goal check-in, with separate stored state that is cleared on conversation reset and its own interval variable, CLAUDE_CODE_COORDINATOR_WORKER_CHECKIN_SECONDS.

Resolving a comment thread, or replying and resolving, now stops with an explanation to pass on to you when the session is authenticated with an organization service key that has no Claude agent grant, rather than failing obscurely. Artifact comments as a whole require the environment variable CLAUDE_CODE_ARTIFACT_COMMENTS or the tengu_teal_corbel gate, which falls back to off, so this is unreachable in a default build.

Artifact publish, upload, comment and blob requests now go through a wrapper that first tries a direct tunnel and falls back to the existing gateway route when the tunnel is declined, refused, never opened, or errors. The tunnel is only offered when the environment variable CCR_AGENT_PROXY_FRAME_HOSTS is set and parses as a hostname list. Nothing in Claude Code writes that variable; it is supplied by the runner environment, so ordinary local runs keep the old path entirely.

The self-hosted pool option that keeps a number of idle workers warm now accepts 0 to 200, up from 0 to 100. A comparison bug in the same validation, where the trimmed input was checked against the wrong variable, was fixed at the same time.

Publishing a data file with an artifact by path now fails up front if the file's extension has no known content type, and the error tells you to rename it to something recognised or list it under files in map form with an explicit contentType.

When you have a paired machine whose bridge has connected but not yet announced itself, /status now says "connecting" or "not_connected" rather than showing nothing, and the tool listing keeps retrying until the machine is adopted instead of settling on an empty list.

The scheduled-runs command no longer hides one-time runs behind a flag; every session sees that a routine can be scheduled to fire once, and that a run reported as having ended for reason run_once_fired can be re-armed by setting a new one-shot time.

If the MCP server that supplied the tool named by --permission-prompt-tool is no longer connected in the session, permission checks are now denied with a message saying so, instead of being resolved against a stale tool.

The routine-creation instructions now always list run_once_at as an alternative to a cron expression, exactly one of which is required. Claude therefore always knows a routine can fire a single time at a future UTC timestamp and then disable itself.