Claude Code v2.1.248

A new command-line flag, also settable as the environment variable CLAUDE_CODE_RESTRICTED=1, starts a locked-down session that drops the built-in tools which run commands or code (Bash, PowerShell, REPL) plus WebFetch unless --tools names them, confines the file tools to the working directories, refuses bypassPermissions, and loads no user, project or local settings files. Neither the flag nor the variable existed in 2.1.247, and nothing gates it: pass it and it applies, leave it off and the session behaves as before.

Plugins can now ship background monitors. The schema gains a monitors field that is either a path to a JSON file relative to the plugin root or an inline array, defaulting to monitors/monitors.json when omitted. Monitors run as persistent tasks with the same trust as hooks: unsandboxed, so only install them from plugins you trust.

The tables of recognised model identifiers now enumerate claude-opus-4-7, claude-opus-4-8 and claude-opus-5, alongside a legacy set and a display-name map.

When you hit the five-hour session limit, Claude Code can now clear it immediately, once a week, with the usage still counting toward your weekly limit. It surfaces as a hidden /limit-reset command and a "Reset your session limit now" row in the rate-limit options menu, and on success the local limit state clears so the interrupted turn can carry on by itself. The whole path is gated on the remote config value tengu_nifty_lemur, a server-supplied setting whose compiled fallback is an empty object and which must report enabled true, so in this build with no server value the command stays hidden and the menu row never renders.

A new slash command that records a goal Claude tests before ending a turn. Pass a condition to set one, or clear to remove it.

A hook can now carry a matcher written in permission rule syntax, so it only fires when the tool call matches. Non-matching commands no longer spawn the hook process at all, which cuts startup cost on hooks that previously ran and immediately exited.

Artifact pages can now share a per-tab presence object (what viewers are doing in the page) and Claude sees it, after aggressive sanitizing. Cursor and identity fields are stripped, and the block is framed in the prompt as data produced by the page, not as instructions from your user.

Seven prompts that analyse how you have been using Claude Code ship as plain data: project areas, interaction style, what works, friction analysis, suggestions, on the horizon and a fun ending. Each allows 8192 tokens and demands a strict JSON reply. The suggestions prompt describes MCP servers, custom skills, hooks, headless mode and task agents, and asks the model to prioritise CLAUDE.md additions you have repeated across sessions.

Attaching to a cloud session now opens a second channel that lets the remote worker call tools running on your own machine, and signs the events the session sends back using a key tied to the device you bound to your account. The attach path loads both pieces in parallel and hands the session its served tools, a slot for a single in-flight served call, a callback for served-settings changes and the event signer. None of it runs in this build unless it is switched on server-side.

Two environment variables, CLAUDE_CODE_MEMORY_API_BASE_URL and CLAUDE_CODE_MEMORY_API_TOKEN, now appear where an empty stub previously sat, pointing a memory service at a URL with a token. Separately, a new array enumerates the credential hook settings apiKeyHelper, awsAuthRefresh, awsCredentialExport and gcpAuthRefresh.

The list of hook event names now includes UserPromptExpansion, TaskCompleted and TeammateIdle next to the existing PreToolUse, PermissionRequest and UserPromptSubmit. Separately, a map of reasons to block a plugin ships with manifest_invalid, disabled_by_default and will_not_load blocking, while identity_unverified and archive_not_probed do not: an unverified plugin identity or an unscanned plugin archive is not enough to refuse loading by default.

The family and version table now lists opus 4.8, sonnet 5, fable 5 and mythos 5; display names gain "Fable"; and aliases map fable-5, mythos-5 and opus-5 to full ids. These are naming tables, not availability. Two task-model maps in the same build disagree, one selecting Opus 5 where the other selects Opus 4.8.

The bundled API client adds a compaction content block and streaming compaction deltas, deprecating its own client-side compaction control in favour of the server doing it, and gains sessions and threads, vaults and credentials, skills and versions, and MCP tunnels and certificates, each behind its own beta header. This is library surface inside the bundle; none of it is a Claude Code feature on its own.

The code that turns a loop marker back into a "tick" instruction for the model was previously off unless remote config switched on tengu_kairos_loop_prompt. That flag is gone from this build and the tick prompt is now built for anyone using /loop.

The tool that sets a completion goal (a condition Claude works toward) now takes an ask_user boolean, default true. Set it false and no approval dialog appears; a visible notice is posted in the transcript instead, and you can undo the goal with /goal clear.

Claude Code's kite transport, the network path used to talk to Anthropic's servers, is now enabled by default when the remote config server sends no value for it, on Windows as well as every other platform. Its environment override is also read as a real boolean rather than merely checked for presence, so CLAUDE_CODE_HARBOR_KITE=0 now turns it off instead of on. The remaining kite gates are decided by remote config or by code outside the part of the release examined here, so their compiled fallbacks only matter when the server is silent.

Two settings keys, allowedMcpServers and deniedMcpServers, are now paired with validation schemas in a table, so MCP servers can be permitted or blocked from settings files.

monitors and workflows are now recognised plugin subdirectories, and a plugin's monitor list is checked for duplicate names, with an error you will see rather than a silent skip.

Reasoning effort accepts low, medium, high, xhigh and max, with med accepted as an alias for medium and ultracode as an alias for xhigh.

The set_model control request accepts an internal system_prompt field that replaces the custom system prompt (the same slot as --system-prompt) starting from the next turn. It applies only if the model change itself is accepted and the value is non-empty; older transports report success without applying it.

The sweep that deletes old local .jsonl conversation transcripts now identifies the ones created or last written by a desktop-host surface (Claude Desktop or Cowork) and keeps them instead of deleting them, giving them a grace period for as long as the desktop client still holds them. A new settings key, desktopSessionCleanupPeriodDays, puts a ceiling on that exemption, and kept files are counted separately from deleted ones in the sweep's telemetry. The exemption is dropped entirely when cleanupPeriodDays is set by org policy or the session runs under the hipaa or zdr compliance posture, so those deployments keep deleting on the old schedule.

Claude can now search the skills on your claude.ai account by keyword and get back a ranked list with each skill's id, name, description and whether it is enabled, optionally handing off to a skill-suggestion card.

2.1.247 refused auto mode on non-first-party providers with "auto mode requires CLAUDE_CODE_ENABLE_AUTO_MODE=1". That check is gone. The variable now survives only as a name in the environment-variable registry and is read nowhere in this build, so setting it does nothing. Auto mode can now be turned off by the disableAutoMode setting, by the remote tengu_auto_mode_config (built-in default enabled), by model support, or by the new fast-mode breaker.

The sync worker that mirrors files between your machine and a cloud session can now take in the latest local changes between tool calls, not just at the start or end of a turn. Uploads are recorded with the trigger "between_tools" and a new telemetry event reports the outcome and how long the take-in took.

Before forwarding a tool call to a remote or bridged host, Claude Code pushes your local file changes and asks the peer to take them in. The barrier answers go, go with a note, or hold. On hold the call is never made and comes back as an error with code sync_failed plus an explanation of what would clear it.

The prompts that summarise a conversation when it gets compacted now tell the model that only genuine user turns count as user messages, so transcript-shaped text pasted inside assistant output cannot be laundered into an instruction from you. They also require that security-relevant constraints you set survive compaction word for word.

Harbor "kite", the feature that lets separate Claude Code sessions message each other, now defaults to on when the server sends no value, including on Windows. The gates tengu_harbor_kite, tengu_harbor_kite_win and tengu_harbor_kite_mode_emit all fall back to true in this build. The cloud variant stays off: tengu_harbor_kite_cloud falls back to false unless CLAUDE_CODE_HARBOR_KITE_CLOUD is set.

Writing the host credentials file, writing to memory while memory is paused, writing anywhere under ~/.claude/seed-admin, and writing adopt.json are now unconditional refusals with fixed explanations. These are not prompts you can approve, and no classifier can approve them either.

If a checked-out project's settings, or its local settings, set CLAUDE_CONFIG_DIR to somewhere other than the directory already in use, that override is now detected and refused rather than followed. Without such an override, the usual config directory is used.

Artifacts you publish are no longer required to be fully self-contained. Scripts may load from cdnjs.cloudflare.com (preferred), cdn.jsdelivr.net/npm/, cdn.tailwindcss.com and code.jquery.com; stylesheets only from fonts.googleapis.com and fonts.gstatic.com. Everything else, including unpkg, esm.sh and any non-script request even to an allowed CDN, is blocked silently by the content security policy. Available to anyone using artifact publishing on this build.

When another machine asks this session to approve a tool call, its answer can now include that machine's own permission rules, which are folded into the prompt the model uses to decide. Allow and environment rules are only honoured when the peer connects as a "session" transport; deny rules always apply, and an allow rule can clear a soft block but never a hard one. No flag: it is live for anyone using remote tool calls in auto or bypassPermissions mode.

A tool that runs on a remote machine can now hand back attached documents alongside its text output, so Claude reads the PDF itself instead of a placeholder line. Only application/pdf is accepted, and each attachment must carry a timestamp, media type and base64 payload. The same tool also gained a message telling the user that an automatic approval does not count for it and that a person must approve from the terminal or the desktop prompt before it runs.

A new prompt surface headed "Claude needs your permission" renders permission requests coming from a sandboxed worker. It appears only when a worker actually has a request queued, and renders nothing otherwise.

On receiving a needs_approval answer from a remote host, the session checks its own permission mode before letting the host's rules count. The host's allow, soft-deny, hard-deny and environment lines are forwarded to the decision prompt only when the local mode is auto, the host marked the call eligible, and the tool is not in ask-first mode.

Claude Code now ships a bundled workflow-authoring skill that is registered at startup alongside cowork-setup, loop, schedule-remote-agents, claude-api and claude-code, and pulls itself into a turn when you mention a workflow keyword or enter ultracode with a full reminder. Script-writing guidance now tells the model to load it before writing a script, and the Workflow tool's own instructions open with a hard rule that multi-agent orchestration only runs when you asked for it. Together this means workflows are written with real guidance in context, and are not started behind your back.

A Monitor tool is now fully described in the build: user-facing name "Monitor", allowed to run code, results capped at 10,000 characters, deferrable, safe to run concurrently, and it tells the model it will be notified on each event so it should keep working rather than poll.

Constants name an MCP server called slack_bot and four of its tools: fetching a thread, fetching a project timeline, posting a status update, and starting a session from a thread. Tool names are built at runtime from the server id.

Claude Code has new code to attach a device attestation to the analytics envelopes it sends, so an event can be tied to a real device and not just an account. The event body is canonicalized to a fixed JSON form, hashed and signed, and the signature travels with the event. Nothing in this build turns it on: there is no flag and no settings key, the signing module is loaded at runtime and the path is inert whenever that load fails, and even with the module present signing only happens if the account has a registered device key, which is decided server-side.

The model tables shipped in this build carry ids for models that are not part of the current lineup, including a Mythos preview and a family of 5-series entries. They are data in constants and mapping tables only, so nothing here makes the models selectable or reachable, and the build ships no setting, flag or menu entry that turns them on.

MCP server config accepts an optional role field marking the server the coordinator uses to talk to the user, and the coordinator's tool filter lets that server's tools through. It is a Claude Code extension to .mcp.json, applied only on your machine, and only takes effect when coordinator mode is on via CLAUDE_CODE_COORDINATOR_MODE.

An agent definition file can declare a prompt cache time-to-live under experimental: { cacheTtl }, and that value is carried into the query as an agent-level override of how long the prompt cache entry lives. It only takes effect when no higher-precedence setting is present, so agents that leave it out behave exactly as before. Nothing like this existed in the previous build.

A new environment variable picks between two remote-tool policies. Unset, or set to parity, gives parity mode; any other value gives interim mode. So the default is parity.

Setting CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL makes spawned workers use the session's model no matter what is requested: the coordinator prompt states the model parameter is ignored, the Agent tool marks its model parameter unavailable, and the spawn path clears any requested model. It only matters when coordinator mode is on via CLAUDE_CODE_COORDINATOR_MODE. Left unset, the prompt merely argues against downshifting workers to weaker models.

The provider setting now accepts first_party, bedrock, vertex, foundry, anthropic_aws, anthropic_google_cloud, mantle and gateway. A matching list of environment variables lets you skip the auth step for a provider, including CLAUDE_CODE_SKIP_MANTLE_AUTH and CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH.

The remote agent proxy tunnel now aborts an upload with a visible reason if the tunnel accepts no bytes for 60 seconds, and pauses reads past a receive high-water mark. Two new environment variables, CCR_AGENT_PROXY_RECEIVE_GATE_DISABLED and CCR_AGENT_PROXY_UPLOAD_GATE_DISABLED, turn each limit back off. Both are unset by default, so the limits are active for anyone running the remote proxy.

Background and managed agents are now classified by scanning their output for state lines. Recognised prefixes are needs input:, failed:, blocked: and I'm blocked:, each accepting a colon, em dash or en dash, and a separate detector matches "Giving up" and "The task is not actionable" to mark an agent as having stopped.

Reporting repo access through the token synced from your gh CLI login used to sit behind a remote flag that defaulted to off. That check is gone, so the token-sync access method is now reachable for anyone the remaining local check allows.

Four instruction fragments were added: the model must not use AppleScript, System Events or shell commands to fake clicks and keystrokes, must not save files into shell startup files, ssh keys or launch agents, must not claim it is editing an artifact page, and must not make tool calls during an analysis or summary step.

Two new org-policy keys, allow_usage_transcript_scan and allow_skill_doctor_transcript_scan, control the "Usage patterns" and "Skill token counts" views. Both views are built by reading the session transcripts saved locally on the machine, so accounts under HIPAA-regulated org policy see an explanation in place of the data. Whether you get the views is decided by the account's server-supplied policy document, not by any local setting or anything in the bundle.

A tool can search your claude.ai plugin catalog by keyword to find plugins relevant to the task. Its prompt tells the model to render an install card through SuggestPluginInstall when the results fit that format, relay them as plain text otherwise, and stay silent when nothing is relevant. Whether the tool is offered in a given session depends on its own enablement, which is not decided in this code.

The system prompt describing tools that act on an attached machine now says those calls run under that machine's own permission rules, rather than describing the target as files in its project folder. This changes what the model is told about where edits land and which approval prompts apply.

The format for a remote host's "needs approval" answer gained an optional block of its own permission rules. Each line is cleaned up and whitespace-collapsed, and both the count and the length of lines are capped: the allow and environment lists keep the first entries, the deny lists the last. A block that cannot be read is dropped and the request is still judged, rather than failing.

The tool that lets a long-running /loop schedule its own next wake-up used to refuse and log a gate_off event when a server-side switch was off. That check is gone, so the tool works for anyone who can call it, and it now only declines once the loop has hit its maximum duration.

A new /stop command ends a background session immediately while keeping its transcript and worktree. It is behind an availability check, and what turns that check on is not decided in the command definition itself.

A group of tools for inspecting self-hosted runner setups now exists: read pool state, list runners, sessions and secrets, tail logs, start a local runner, and one write action that moves a session onto a different runner. Their descriptions state that secret values are never returned and that they authenticate with the operator's existing login. Whether these are reachable by ordinary users is not settled by the tool definitions themselves.

A complete in-memory version of the new v5 storage backend now ships as its own chunk: a tree of directory, value and stream nodes with appends, tombstones, record replacement, leases, change subscriptions, scope listing and deletion, and per-log-channel byte budgets. Whether any of it is used depends on the CLAUDE_CODE_HOVER_REST environment variable, or otherwise the tengu_hover_rest flag, whose compiled fallback is off.

Sending your local plugins and hooks into a remote session is now controlled by a consistent set of checks, and when plugin forwarding does not happen the session records the reason rather than a bare failure flag. Both kinds of forwarding depend on two server-side feature flags that compile with a fallback of false, so in this build neither is on unless the server turns them on.

The engine that syncs a directory to a cloud session over git is fully present here, including a writer lock so only one window syncs at a time. The losing window shows "Another Claude Code window took over syncing this session; this one stopped". Whether sync runs at all for a directory depends on a per-directory consent read that can come back unknown, in which case you see that the setting could not be read because the feature flag did not answer; the flag's name is not resolvable from the build.

Behind the existing live-edit gate, the artifact tool now offers a sync operation next to live-edit, its description gains a clause explaining sync, and session state tracks live replicas including which are unavailable or opening, plus transport, engine, render level and whether the head moved.

The artifact tool gains a sync action next to live-edit. It pushes edits you made to a local copy of an already-published artifact page up to the page, with those edits going live immediately, and pulls other people's changes back down into your file. It is only mentioned in the tool prompt when the live-edit gate is open and the tool schema carries operations support, a server-driven condition.

Two new tools are present but deferred: one shows a card of org, shared and Anthropic skills you have not enabled yet, the other shows an inline plugin install card from plugin search results. The skill tool has a proactive prompt that offers skills unprompted and a conservative one used only when you ask; the gate tengu_saddle_lantern picks between them and its built-in fallback is off, so absent a server value the conservative prompt applies.

The Bash tool's instructions are now built with the session's proactive level as an input, so how eagerly Claude is told to run shell commands can differ between sessions.

A limits table keyed by surface gives claude-sonnet-5 a 500,000 context default on the remote-cowork and local-agent surfaces and 1,000,000 everywhere else. Nothing visible gates the table itself.

A permission decision can now be allow, soft_deny or hard_deny rather than a plain allow/deny, and the accompanying reason list includes read_denied and rules_unreadable for cases where the rules themselves could not be read.

A tool description covers listing the direct children of a directory exposed by an MCP server. The listing is not recursive; subdirectories are marked by their content type so the tool can be called again to go deeper, and it only works against servers that declare support for it.

When a question times out because you are away, Claude now re-checks staleness before submitting the automatic answer and bails out if you interacted in the meantime, if the pending questions changed, or if the answer is rejected. Previously the answer was delivered unconditionally. Only active when a timeout is set, via afkTimeoutMs or the CLAUDE_AFK_TIMEOUT_MS environment variable, and not in screen-reader or background sessions.

Sandbox startup moved into its own step that can decline to launch. If the setting sandbox.failIfUnavailable is on and no working sandbox is found, Claude Code writes an error to stderr and exits with code 1. The setting defaults to false, in which case it logs a warning and records one setup issue instead. Remote sessions skip the check entirely.

The allowlist that decides which env keys in a settings file are applied to the process gains CLAUDE_CODE_TEAM_TEARDOWN_PARK_TIMEOUT_MS, MCP_CONNECTION_NONBLOCKING, CLAUDE_ENABLE_BYTE_WATCHDOG, CLAUDE_ENABLE_BYTE_WATCHDOG_BEDROCK and CLAUDE_ENABLE_STREAM_WATCHDOG. Previously these could only be set in your shell before launching. Set them once in settings instead, for example { "env": { "CLAUDE_ENABLE_STREAM_WATCHDOG": "1" } }.

At startup MCP servers are now connected in batches rather than all at once. The batch size is 3 unless MCP_SERVER_CONNECTION_BATCH_SIZE is set.

MCP_TOOL_TIMEOUT is now read through the central environment reader rather than parsed inline, and two new environment variables control how many MCP servers are connected at once: MCP_SERVER_CONNECTION_BATCH_SIZE (default 3) and MCP_REMOTE_SERVER_CONNECTION_BATCH_SIZE (default 20).

The permission-mode field is now a described enum listing all six modes, so SDK and tooling that read the schema see what each does: auto uses a model classifier to approve or deny permission prompts, and dontAsk never prompts and denies anything not pre-approved.

The data passed to a PostToolUse hook now includes an optional duration_ms, the tool's own execution time. It excludes time spent on permission prompts and on other hooks, so it reflects the tool rather than the wait around it.

The check that decides how session options such as permission mode, model, fallback model, effort, agent list, settings and appended system prompt are handled now also trips when CLAUDE_CODE_RESTRICTED is set in the environment, not only via --restricted. A new message states that cloud sessions cannot be created from a restricted session because they would not enforce the restriction.

CLAUDE_CODE_DISABLE_MEMORY_RO_UNSAVED_NOTICE suppresses the notice about unsaved edits to read-only memory. CLAUDE_ASYNC_AGENT_STALL_TIMEOUT_MS overrides the async-agent stall timeout, which otherwise defaults to 600000 ms (10 minutes). CLAUDE_CODE_COORDINATOR_WORKER_CHECKIN_SECONDS sets the coordinator worker check-in interval. All three are unset by default.

CLAUDE_CODE_TOTAL_TOKENS_REMINDER_BUDGET, which sets the token count at which Claude Code reminds itself about context usage, was being read through a stale variable on its final branch, so a value you set could be ignored. It is now checked correctly and falls back to the built-in default when unset or not positive.

The fleet list's keyboard hint bar now offers "ctrl+enter to start and open", shown when you can switch views and the dispatch-and-open capability is available for the current backend.

In a restricted session, file tools now refuse paths outside the working directory with a dedicated message, and an unsafe path is marked as not approvable rather than offering the usual classifier-based approval prompt. Restricted sessions also lose the leniency that remote mode previously granted to the path safety check.

When auto mode blocks an action, Claude is now told to first try an unblocked alternative (a feature branch, sanitized data, a narrower scope), and otherwise to hold the request and batch all consent asks until parallel work finishes, each phrased as one sentence with the item needing consent in bold and an invitation to approve them all at once.

New instructions tell the model that a backgrounded command's result comes back on its own, "between your tool calls if you are still working, or by starting a new turn if you have already replied", with variants for when the turn ends and when the session ends. It is told to wait using one blocking foreground command rather than repeated status checks.

When a background or local shell task finishes, its output is now stitched into the conversation as a tool call and matching result attached to the last assistant message, instead of appearing as a bare user turn. It carries a fixed note telling the model this is not a message from you and not approval of anything it proposed earlier, which removes a common source of the model acting on stale suggestions.

When claude --cloud syncs files from your machine into a running session, the agent is now given a list of the files that were updated in place and told to re-read any it had already read before editing them. The list is capped in length.

Slash command and skill names now go through a single escaping helper wherever they appear in text that reaches the model or your terminal, so a name supplied by a plugin or MCP server cannot inject markup, control characters or instructions. This is always on, with no flag or setting to disable it.

When the sync engine supports them, two background pumps now run between tool calls: one pulls down what remote commands changed, one performs uploads that are due. After a command runs on a remote machine, the files it changed are pulled back and summarised in a note such as "3 files updated here from ...".

The edit and write confirmation dialog now works out whether the operation targets a different machine. If it does, the title names that machine and the "always allow" options are removed, so a standing approval cannot be granted across machines.

Loops that let the model set its own pace now keep rescheduling by default. The gate tengu_kairos_loop_keepalive ships with a built-in default of on (it was off), and the per-schedule check that bailed out early has been removed, so a loop runs until the budget is spent rather than stopping at the gate.

The MCP context and token breakdown now compares the full tool list against the set actually sent to the model. Tools that are held back report zero tokens and show as not loaded, and their tokens are removed from the total. If every MCP tool is held back, the total is 0.

The managed-settings security prompt records when it rendered and ignores accept or reject until that window has passed, so a keystroke already on its way cannot approve your organization's settings.

Approve and deny responses now carry the id of the tool call they belong to, and the code that collects them refuses any response aimed at a different call, logging "answered for a different tool use". This closes a window where a late or misrouted approval could be applied to the wrong tool call. Always on, with no flag or setting to turn it off.

A worker process that handles remote-control sessions now tells its parent daemon whether it has active sessions, sending busy and idle transitions plus a repeating keepalive while work is in flight. The daemon uses this to defer restarting for an upgrade until the worker goes idle, rather than interrupting live sessions.

If you try to resume a conversation that another process already holds, Claude Code now checks every holder rather than one, prefers an interactive one, and shows a message naming that case: the conversation is already open in another running Claude session, so use that one or close it. Failures also return an explicit resume_session_live_elsewhere code.

The pattern that hides credentials before text leaves your machine now also matches connection strings, cookies, session ids, bearer tokens, passwords and a family of *_key names, on top of the api key, secret and token forms it already caught.

The per-session cache of resolved feature switches now declares a field called tetherLiveGate, replacing one that previously held a plan-mode resume guard. The name occurs exactly once in the whole build, as the declaration: nothing writes it and nothing reads it, so whatever "tether live" is, its plumbing shipped ahead of the feature.

Confirmation dialogs and selection lists now refuse keys, including Enter, Escape, digits and typed characters, that land within a short window anchored to the moment the dialog renders. A stray Enter typed a beat before a permission prompt appears no longer answers it; the dialog remounts instead of acting on the key. This is unconditional in this build, with no flag, setting or environment variable around it.

A new onboarding prompt introduces Cowork's skills, connectors and plugins, then shows a row of clickable role chips to ask what you do. If the picker is not available in the session it falls back to a plain text list of roles.

The bundled skill that answers questions about how Claude Code works now triggers on Claude in Slack and Claude Tag, with a Claude Tag doc bundled alongside it.

A command for listing, creating and deleting loops exists in the build but declares itself permanently disabled, so it cannot be invoked.

The config layer can be put in a mode where saving global or project config returns without touching ~/.claude.json, keeping the change in memory only and logging a warning that it will be replaced the next time a real save or refresh rebuilds config. Entering the mode requires being handed writersWithoutBackend: "memory", which no code in this build passes, so it is reachable only from an embedder.