Claude Code v2.1.259

A new sync routine pulls marketplace listings from claude.ai into a local cache keyed by etag. Failures are surfaced through a new MarketplacesSyncFailed error with typed reasons such as bucket_unresolved, root_refused, and denied, along with telemetry including a marketplaces_sync_starting event.

A new helper builds usage warning messages for an artifact's shared database, alerting when it is full ("writes that create a document will fail until some are deleted") or over a threshold percentage full, advising to prune or aggregate existing documents rather than creating one document per item.

If managedMcpServers exist in a cached remote settings payload but haven't been reconfirmed by the current session's live payload, they are withheld from taking effect rather than applied immediately. A status-only warning is shown explaining that the organization's MCP servers are withheld until the server confirms them this session, and they connect automatically as soon as it does.

found() on a workflow run now subscribes to world events and calls this.kill("runaway") if a runaway event is seen for its scope, letting a run self-terminate when it detects it has gone runaway. The subscription is cleaned up on abort or completion.

A new helper computes used and max token counts from the current message history and model, and calls notifyMetadataChanged({ context_usage }) whenever the totals change. This feeds live context-window usage indicators, such as a status bar, rather than being purely internal bookkeeping.

MCP tool resolution has been reworked to walk connected servers and wait up to maxWaitMs before giving up, followed by an absentGraceMs grace window if the tool still isn't found. The resolver now exposes serverState and initialServerState values such as pending, needs-auth, failed, and disabled for telemetry and UX, replacing the previous simpler resolution logic.

When a background or local-shell task finishes, its result can now be appended as a tool_use into the current assistant turn if that turn already made a tool call, instead of always being inserted as a new synthetic turn. This distinction is tracked via a new telemetry dimension recording whether delivery was an append or a new_turn.

When reactive compaction's normal ladder of progressively-preserving-fewer-groups runs out of room, it no longer fails outright with exhausted. It now falls back to summarizing the entire conversation, and if that request is still too long, truncates the head of the conversation and retries, up to a bound, before giving up.

When a permission control_response arrives for a tool_use with no live handler, such as after a reconnect, the queued orphaned-permission entry can now carry initFirst, resumesInterruptedTurn, and sibling tool-use information. This lets the main loop resume an interrupted multi-tool turn more faithfully instead of just replaying the single orphaned permission.

When starting with --sdk-url and --resume, the CLI can now kick off an early hydrate-reads prefetch (startEarlyHydrateReads) concurrently with the rest of startup, to warm session/history state ahead of the SDK connection coming up. The result is threaded through as earlyHydrateReads in the prepared-session config.

PR-tracking heuristics now recognize Gerrit remotes, detected via a googlesource.com host plus a Change-Id trailer, and query the Gerrit REST API for an open change. They also classify glab mr create, update, merge, note, close, and reopen commands, feeding the existing pr_started_announce telemetry with a new provider: "gerrit" branch.

The background-session-fork request builder now passes proactivityLevel into the fork call, wiring the parent conversation's proactivity setting through to a newly backgrounded session. This field was previously absent; the argument slot it now occupies held alwaysDenyRules in the prior build's order. The background-fork flow itself, triggered from the "Background this session?" confirmation dialog, is an existing feature, so this extends already-reachable functionality rather than adding a new gate.

A new permission-context snapshot publisher zeroes out session allow-rules and restricts additional working directories to session-sourced ones specifically for background sessions, giving them a narrower permission footprint than foreground sessions. System prompt snapshotting is also now forced on whenever the session kind is bg (CLAUDE_CODE_SESSION_KIND=bg), in addition to being triggered by the existing explicit systemPromptSnapshot flag.

When a subagent that initiated a live artifact publish finishes, its pending publish subscriptions are now adopted into the parent session context instead of being dropped, via a new queue of "pending subagent arms." The queue is capped, and evictions are reported through a new subagent_arm_evicted telemetry event.

Artifact tool results can now include publishesRemaining and publishesResetAt fields, surfacing a rate limit on artifact publishes to the client and UI.

The /status panel now shows a separate 'Cloud session ID' label alongside the local Session ID whenever they differ, such as for teleported or remote sessions, instead of showing only a single session id field.

A new refused.sandbox_custody message covers the case where a local sandbox cannot run a command while also protecting its credential files. Claude Code now refuses to run and explains the situation, instead of silently failing or running the command unprotected.

Publish/footer-link rendering now detects GitLab merge request URLs and renders them as "MR !123" badges instead of always assuming a GitHub "PR #123" format, passing a new kind: "mr" to the link component.

The 'Manage marketplaces' TUI screen and the CLI marketplace list output now show marketplaces available from claude.ai that haven't been added locally yet, alongside a browse-only section and the marketplaces already configured.

The publish/update confirmation UI now shows how many artifact publishes remain for the day and when the quota resets, rendering a line like "No artifact publishes left today on your plan · resets ...". New helpers validate the remaining count and reset timestamp before showing this.

A subagent watching a published artifact can now surface a publish_adopted live-subscription state: when the subagent holds no watch on the artifact but the launching session will take over notifications once the subagent finishes, the handoff re-arms the subscription for the parent session and emits subagent_publish_adopted telemetry. This is wired to fire on subagent completion and is consumed by the artifact tool's status text.

When a parked tool-use permission can't be resolved from a persisted control_response, the code now first checks for served or adopted responses and uses one if found, instead of always canceling and re-asking. The outcome is logged as fallback_served_adopted or fallback_reask.

When a served (remote-tools) command runs on a machine with no sandbox filesystem configuration, or with a relaxed sandbox policy, Claude Code now logs a one-time warning that credential files are protected only by permission rules, and suggests enabling strict sandbox filesystem isolation for the additional mask.

When listing artifacts for an account that has pinning disabled (pins_enabled === false), the tool result now appends a note that pin and unpin commands will not work for that account.

The interactive-shell allowlist used for special interactive handling dropped fish, csh, tcsh, rsh, busybox, toybox, cmd, powershell, pwsh, wsl, su, and runuser, and added hush, a busybox-style shell. Shells removed from the list no longer get the special interactive-safe treatment.

When a remote MCP tool call fails because the target host doesn't serve that tool, the error message now lists which tools the host does serve there, making it easier to redirect the call correctly.

Running claude mcp remove on a server with no configured local scope now checks whether it's actually provided by managed or enterprise settings; if so, it refuses with an explicit message saying the server cannot be removed locally, instead of just reporting it as not found. claude mcp get gained a matching message for the same case.

A new wake-up notice clarifies to the model that when a background task's result is delivered in the same turn as a genuine new message from the user, that user message is real input and should be responded to normally.

When a slash-command or skill declares its own model override, Claude Code now checks whether that model is actually supported under the current auto-mode/fast-mode configuration before applying it. If the model isn't supported in auto mode, or if the auto-mode disableFastMode setting (from tengu_auto_mode_config) rules it out, Claude Code logs a warning and keeps the session's current model instead of switching. Previously the override was applied unconditionally whenever a skill or command specified one.

Rows retracted by the new per-scope cap now carry explanatory 'killed (runaway)' text pointing to inspecting retracted facts and fixing the rule that caused the run to exceed the per-run row cap.

If the mode active before entering plan mode was auto but the auto-mode gate is currently disabled, exiting plan mode now shows an immediate notification that it's falling back to the default mode, instead of switching back to auto silently.

The visible model catalog now excludes models listed in dropped_model_ids and dropped_confidential_ids from remote config, on top of previous exclusion logic. A new dropped_unidentified_rows flag can mark an entire served catalog as masking every id.

In the policy-limits fetch/cache loader, a 404 or an unsolicited 304 response with no local cache is no longer treated as a hard fetch failure. The client logs Policy limits: ${n.httpStatus} with no cache, no restrictions for this session (not persisted), applies an empty restriction object for that session, and records telemetry as route_missing_fail_open or unsolicited_304_fail_open. This fail-open path is gated by tengu_rustling_orbit, which defaults to off in the resolved gate table, so failing open is the default shipped behavior; turning the gate on remotely falls back to the old failure-closed path instead.

Bash path-restriction checks now follow directory changes across a compound command. A new walk tracks cd, chdir, pushd, and popd (including popping the pushd stack) through a command's statement list, so later commands in the same line are evaluated against deny rules relative to the resolved working directory. If a cd target can't be resolved, subsequent reads are denied rather than silently checked against the wrong directory.

Path-restriction deny rules now reach further into command arguments: file-like arguments are extracted from -e/-f/--file flags, key=value pairs, @file tokens, colon-separated tokens, and combined short flags, and denied if the resolved path matches a Read() deny rule. Separately, grep, egrep, fgrep, rg, diff, git, cp, and mv get this same path check, falling back to an 'ask' prompt when the path can't be resolved after a cd.

Before launching the GitHub App install flow, /install-github-app now checks the repo's git remote provider. If the remote is GitLab or Bitbucket, it shows a specific explanation instead of proceeding; for GitLab, it also points to CI/CD docs.

The sandboxed git command allowlist now parses -C, --work-tree, and --work-tree= flags before the subcommand and resolves relative paths against that worktree. It also adds a full handler for git grep, alongside the existing expanded handling for git diff. This applies to everyone using the restricted git wrapper.

When a background or sub-agent's artifact watch is inherited by the launching session because the agent finished normally, the live-subscription status now reports a dedicated publish_adopted state explaining the handoff, instead of leaving it unexplained.

Successful artifact/database write and batch-write tool results now include a usage field from the server response alongside version info, and this usage is appended to the human-readable confirmation text shown to the model.

The internal grep argument parser now recognizes -d/--directories alongside the existing recursive flags -r, -R, and --recursive, and defaults the search path to . when any of these flags are present.

The CLI help text for the review-wait timeout option now states a default of 45 minutes, up from 30.

If initialize is re-sent specifying a different timeout for an SDK MCP server that's already registered, Claude Code now logs a warning that the timeout change is ignored until the server is removed and re-added, rather than silently applying or dropping the new value.

The bash command-safety analyzer that decides whether a command is safe to auto-run now understands ANSI-C quoted strings like $'...\n...' and unescapes them to their literal value, instead of treating them as opaque dynamic content.

The shell-command safety checker, which determines whether a bash command could reach git, now treats sudo the same as env when scanning for prefixed environment-variable assignments. It also adds checks for commands run via a variable or file descriptor and for git-naming text piped into other commands.

The error message shown when a repository can't be uploaded to a cloud session because it's a partial or sparse clone no longer suggests starting the cloud session from the repository's GitHub source instead; that workaround sentence was removed.

The status computed for spinner/turn display no longer distinguishes 'requesting'/'responding'/'thinking'/'tool-input' as separate streaming vs tool-running states; these now collapse into a single 'turn_running' state. 'subagent_running' remains a distinct state for delegated work.

The bash-command risk analyzer that decides whether a command needs approval now flags cd and pushd invocations that target a path under /dev or /proc as unsafe, in addition to its existing checks.

The option-argument-taint heuristic for detecting dynamic/unsafe option arguments, previously applied only to set and rg, now also covers shopt, setopt, unsetopt, and sort.

The hint text shown when a background command is still running was reworded from warning against "repeated ... calls" with a placeholder metric to simply warning against "checking on it repeatedly." The underlying advice about foreground versus background waiting is unchanged.

Rewind now checks whether its target message is a tool_result for a still-in-progress poll, and rejects the rewind with a specific reason for that case as well as for a target whose poll events have already landed later in the transcript. Previously these cases could silently corrupt state; now the rewind is refused outright.

Subagent, skill, and monitor launches now check a stopPendingAgentIds registry before starting. If the invoking agent's stop is still completing, launching a new subagent, skill fork, or background monitor is refused with an explicit error instead of racing the in-flight stop.

Saving or deleting global and project config (saveGlobalConfig, saveCurrentProjectConfig, deleteProjectConfig, deleteCurrentProjectConfigFields) now retries lock acquisition with exponential backoff when the config lock is already held, instead of failing outright. Fallback writes skipped or suppressed due to lock contention are now tracked with distinct telemetry, including tengu_config_fallback_skipped_contention.

Resuming a local_workflow is now blocked not only when it is still running, but also when it has ended while its run process has not yet exited. This avoids running two copies of the workflow's agents against the same journal, with the refusal message: "Resuming now would run two copies of its agents against the same journal."

Both the workflow-spawning tool and the send-message tool now throw an error if the calling agent has been stopped and its stop is still completing, instead of letting the action proceed mid-teardown: "This agent has been stopped and its stop is still completing; it cannot launch workflows or act on existing runs."

The helper that reconstructs a --permission-mode CLI flag for a resumed or replayed session now recognizes default, plan, dontAsk, and bubble, in addition to the previously supported bypassPermissions, acceptEdits, and auto. Sessions using these modes now round-trip correctly when replayed.

Stopping a task whose record already shows it ended, but whose execution loop hasn't actually exited, now re-signals the loop: it aborts the loop's abort controllers and kills its process groups, and returns a note explaining that the record stayed listed because the loop was still live. Previously this case was a silent no-op.

The propose_skills tool's description field now enforces a hard maximum length, rejecting overly long descriptions with an explicit error message. Guidance for the field now asks for descriptions under 200 characters and never exceeding 1024, where previously no limit existed.

If the server responds with HTTP 304 Not Modified to a request that was not conditional (no cached ETag was sent), this now surfaces as an explicit error, "Unexpected 304 Not Modified", with skipRetry set, instead of silently falling back to cached remote settings.

If the org policy-limits check returns a 404, for example when going through a proxy or gateway, Claude Code now shows an explicit error explaining that the proxy must forward /api/claude_code/policy_limits rather than failing silently.

Publishing a PR link now validates the PR URL against a strict pattern before linking a session to it, returning url_rejected instead of proceeding when the URL doesn't match. The underlying call also now returns explicit outcomes no_session and linked instead of nothing.

resumeAgentBackground now guards against resuming an agent whose stop is still in progress. If the agent attempting the resume has itself been stopped and that stop hasn't finished, the resume throws immediately. Separately, if the target agent's previous run was stopped but hasn't fully exited yet, the resume is blocked with a message telling the user to re-run the stop tool or wait for it to exit. This closes a race where an agent could be resumed, or could resume others, mid-teardown.

Before spawning a shell command, Claude Code now checks whether the owning agent has a kill pending loop settlement in progress, and refuses to run the command if so instead of executing it.

When partial compaction starts from a point in the transcript where earlier assistant thinking content had already been stripped, the compaction logic now inserts a synthetic thinking_stripped attachment marker so the summary boundary correctly reflects that stripped state. The set of thinking-stripped responses is also passed into the summarization call.

The helper that normalizes command/process names for detection, used in bash-safety and permission logic, used to unconditionally strip trailing version digits (e.g. python3 → python). It now only strips the suffix if the resulting stripped name is in a known-binary allowlist, otherwise it keeps the original name intact.

An unconditional (non-etag) request to the policy-limits endpoint that unexpectedly receives a 304 Not Modified response is now treated as a hard failure instead of being accepted as valid cached data. The 404 'no restrictions found' fast path has also been removed from this handler.

When a managed plugin is listed in both prependPlugins and appendPlugins, Claude Code now warns about the conflict and prepends the plugin instead of silently picking one placement.

Reading Windows proxy settings from HKLM/HKCU via reg query now checks the value size before reading. Oversized values surface an hklmUnreadReason explaining that the value exceeded a size cap, given in MiB, instead of failing silently or hanging.

The skill-files templating helper now only performs model-variable substitution on files ending in .md; other skill files pass through unmodified.

When a rewind targets a message but a later, unobserved turn exists past it, the CLI now picks between two more specific rejection reasons: an "unseen later turn" case and a separate "stale target" case, depending on whether the target message itself is still known.

Sending a message to another agent via send_message now checks whether that agent has been stopped but hasn't finished settling. If so, the send is refused with a dedicated error instead of proceeding against an agent mid-stop.

Cloud and ultrareview session timeout messages ("cloud session exceeded ...") now report the actual configured wait duration via a minutes parameter, instead of always saying "30 minutes". If no duration is available, the message falls back to "its wait".

Session shutdown now wraps the session-end hook timeout lookup in a try/catch, falling back to SESSION_END_HOOK_TIMEOUT_MS_DEFAULT if the lookup fails, and adds an extra await step before the session-end hooks run.

The generic backoff-retry helper and the tools/list retry loop now check for cancellation both before throwing and again after the backoff delay, so a cancelled operation stops retrying instead of continuing through its backoff window.

Idle-task eviction for local_workflow tasks now also requires that the task is not still a live local agent, in addition to having passed its evictAfter timestamp. This prevents evicting a task whose agent is still considered local/active.

When the agent targeted for resume is still stopping and hasn't reached a terminal status, the resume attempt is refused with guidance to re-run the stop command or wait for it to exit, rather than racing the in-flight stop.

The artifact tool's input schema construction now computes whether pinning is enabled, stores the result on ue().frozenArtifactPins, and logs it. When active, a pin-related description clause is appended to the schema.

A new gated function resolves tengu_mcp_discover_projection_prior to one of "legacy_only", "all", or "off", defaulting to "off" for any other value.

A new gated boolean check, tengu_hidden_frog, was added, defaulting to false.

When starting a new process, the harness can now reconstruct which deferred/lazy-loaded tools a previous process had already surfaced, using deferred_tools_delta attachments, and seeds references to them in the new process so those tools don't need to be re-announced. This is logged as Dynamic tool loading: seeded N tool reference(s).

Workflow world facts now carry one of five statuses as part of their lifecycle. A new schema also rejects any fact whose keys collide with reserved keys, preventing accidental overwrites of internal state.

New code fetches an organization's marketplace list from claude.ai via /api/oauth/organizations/:orgUUID/marketplaces, validates and dedupes the entries, and caches them to disk with an etag and parserVersion. This exposes both available marketplaces and browse-only, claude.ai-hosted marketplaces for plugin discovery and sync.

The Glob and Grep tools' auto-classifier input can now return a structured object with pattern, path, and a computed field instead of a bare pattern string, feeding permission-rule auto-classification. Both tools also now report suppressesAllPermissionUpdates, affecting how their calls interact with permission rule updates.

A new deferred_tools_record attachment type now also records full tool input schemas (toolEntries) and name-only announcements (nameOnlyAnnouncements) alongside the existing per-turn deferred tool descriptions. These are diffed turn-over-turn so only new or changed entries are re-emitted.

canUseTool construction now checks whether the permission-prompt-tool server name is the literal sentinel "none". When it is, or when no MCP prompt tool was configured, requests can go through an ask-based fallback path that resolves ask behaviors via a new resolver before falling through to normal permission-denied handling.

The internal fact/rule engine backing agent() / parallel() / pipeline() workflows now tracks how many rows accumulate under each scope. If a scope exceeds a per-scope cap, it emits a 'runaway' event and automatically retracts that scope, rather than relying solely on the existing global maxRows cap.

The CCR (client-side reporting) client can now hold back durable/internal event uploads for a configurable duration, via noSubscriberUploadHoldMs, when no subscriber is watching the session, instead of uploading immediately. Held events are flushed later, with a log of how long and how many events were held.

New machinery re-seeds tool references for MCP tools that a prior worker process had already announced with defer_loading: true, by scanning transcript attachments of type deferred_tools_delta. It logs Dynamic tool loading: seeded ${n} tool reference(s) to ${k} deferred tool(s) the previous process sent and is wired into the query-preparation path, guarded by Oe.readsTranscriptRecord.

The artifact-editability check used by the comment auto-reply/auto-edit pipeline now accepts an extra flag that, when set, marks an edit as not editable even after it was already judged eligible. This rejudgment logs a new edit_rejudged_by_auto_mode telemetry breadcrumb, letting auto mode veto an edit late in the pipeline.

Session state cache invalidation now also clears a new githubWebConnectionStatusCache alongside existing caches like autoCompactWindowsCache, indicating a new cached lookup for GitHub web connection status.

After a successful direct (non-relay) pin, the client now fetches /api/oauth/account/settings and PATCHes artifact_pins_by_org to mark the organization as having used pinning, with the stored org list capped in size.

The device-hooks-serve session constructor now accepts a new isMuted parameter, which is forwarded into the hook servicer config when provided.

The managedSettingsSourcePolicy 'merge' mode now explicitly covers managedMcpServers: server names union across sources, but if two sources define the same server name, the higher-priority source's whole entry wins.

The session-activity announcement schema gains an optional branch field, populated only for providers whose changes lack their own head branch, currently Gerrit, so a host can place the change on the right checkout.

Outgoing headers for claude.ai MCP calls now also include an anthropic-mcp-discover-protocol-version header, added when the mode value is not "off". The existing client-capabilities header is now skipped only when both a renamed check and mode === "off" fail, whereas previously it was skipped whenever a single check failed.

A new function compares recorded input_schema for tools during prompt-snapshot replay and emits strict_mismatch, schema_differs, or success telemetry under the prompt_snapshot_tool_replay event.

The Grep tool and a Search tool now declare remoteExecution: { supported: !0 }, joining other tools that already had this. This feeds into the dispatcher logic that, combined with a separate remote-capability check, decides whether a tool call is routed to a remote host instead of run locally.

The remote-control (CCR) worker connection gained two new tuning gates: a hold delay, tengu_ccr_no_subscriber_hold_ms, before dropping uploads when there's no subscriber, and a switch to skip sending redundant heartbeats.

MCP cold start now has an added wait stage for a case where managedMcpServers is withheld from the unverified cache: it logs a wait on remote managed-settings confirmation and awaits the settled-fetch promise before falling back to the older managed-settings-load check. A parallel code path gained the same fallback.

Whether destructive MCP tool calls are allowed under remote auto mode is now decided by either of two checks: the existing gate, or a new one controlled by the tengu_modular_mochi flag.

The retained-binary reverification flow now tracks manifestAuthenticated and signatureVerified as separate fields returned from the verify call, rather than conflating both under a single signatureVerified field as before.

The remote MCP tool-call dispatcher now accepts optional onFirstSend and onAddressed callbacks, fired when a tool call is sent over the transport and when a recipient acknowledges it.

The headless/SDK session loop now handles a command_lifecycle event, calling noteCommandStarted when a command starts, and records attachment events via noteAttachment. Result and error telemetry payloads are enriched accordingly.

Skills sync now compares old and new skill rows by backingPluginId to detect when a skill's attribution moved between plugins, persisting and re-syncing metadata when that happens even if no files changed.

PR-lifecycle telemetry now recognizes glab (the GitLab CLI) alongside gh and git. glab mr create, update, merge, note, close, and reopen map to pr_create, pr_edit, pr_merge, pr_comment, pr_close, and pr_reopen respectively.

Pruning of history.jsonl under retention rules now runs a lock-free scan first, verifying the file's identity (inode/birthtime) hasn't changed, and only takes the retention lock and rewrites the file if there's actually something to prune. If the file changes underneath the scan, pruning is deferred rather than erroring, logged as History retention prune deferred: history.jsonl changed under the scan.