This build carries 25 gated additions that stay switched off. A new 'bashEditDiff' system snapshots the repo around Bash commands to track their file changes, controlled by an env var or config, while a separate 'bash edit diff' mechanism produces its own diff of Bash-command changes. Streaming hook dispatch is now built end to end but only enabled for the 'turn.step' event, and refusing-to-answer fallback model switches can now ask you first with a persisted preference. Other dormant work includes a hidden /output-style command, a tengu_bridge_child_tool_diff setting for showing child-session edits to a parent session, off-by-default version-checked artifact writes, and two flags for skipping resent system prompts on continued server-side threads.
Of the 156 shipped entries, plugin hooks gain real teeth this release: a new turn.step hook lets plugins override or veto which model handles a request, and a new $.tool.check op lets a plugin test whether a tool call would be allowed without running it. The hooks engine also picks up tool.check, config.set, config.describe, session.attach, session.detach, and plugin.register event types, plus streaming (async-generator) hook support and MessageDisplay hooks that can rewrite text already streamed to the screen. A new 'Remote Control' system lets a cloud session dispatch tool execution to your local computer, the Bash tool now shows a diff of files a shell command edited by default, claude plugin eval gains --trust-plugin and --allow-real-servers flags, and a new CLAUDE_CODE_COORDINATOR_EXTRA_TOOLS env var extends the coordinator-mode tool allowlist.
Among the 70 fixes, MCP OAuth sign-in now validates a pasted redirect URL against the expected value before accepting it, and a denial from a tool.check hook now runs back through the normal deny/ask approval flow instead of hard-stopping. Plugin settings migration is more careful too: installed_plugins.json syncing now checks policy before treating a plugin as already installed, and it can heal stale managed-plugin records left over from that migration. Workflow agent() spawns now wait for MCP tool syncing to finish before resolving their tool set, and update checks can now tell a suspended process apart from a genuine network timeout. Claude Code also now blocks direct writes to the settings-review staging store, and plugins calling next.to() with a hooks module name that can't be statically found are rejected.
Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
A new post-turn memory feature can extract memories via an MCP server instead of writing files, controlled by new env vars
Unclear What post-turn memory actually does when triggered (what it writes or where) is not described in the finding.
Plugins/hooks can now react to tool.check, config.set, config.describe, session.attach, session.detach, and plugin.register events
Plugin hooks can be written as async generators that stream chunks, with the first use letting a hook override the model per request
A new bashEditDiffEnabled setting lets the Bash tool surface a diff of files a shell command changed, passed to PostToolUse hooks too
New 'Remote Control' system lets a cloud session dispatch tool execution to your local computer
$.agent.spawn gained fire-and-forget background launches with per-session budgets, a returned agentId, and hook-gated dispatch
A new list_permission_rules control request and SDK method expose the same permission-rule list the /permissions command shows
"/code-review ultra" can post its findings to a GitHub pull request as a single comment, with progress reported in cloud completion notifications
Writes to settings files can be staged in a new settings-review store for owner approval instead of applying immediately, though this build ships with the feature effectively off
MessageDisplay hooks can now rewrite text already streamed to the screen, not just append to it
New CLAUDE_CODE_COORDINATOR_EXTRA_TOOLS env var lets coordinator-mode sessions allow extra tools
claude plugin eval adds --trust-plugin for CI and --allow-real-servers to run real MCP servers without mocks
New plugin hook lets a plugin check whether a tool call would be allowed without actually running it
Plugins can now check if a tool call would be allowed without actually running it, via $.tool.check.
Artifact document writes can now ask the server to reject writes that conflict with a newer version, with automatic fallback
Plugins and hooks gain a session.surfaces (plural) endpoint listing all attached drawing surfaces, plus a matching lifecycle hook event
Unclear What session.surfaces does differently from the existing session.surface event is not specified.
The prompt.submit hook pipeline was rebuilt to let hooks rewrite prompts, add an enter phase, and report drops and queued prompts more clearly
The internal per-session context object gained many new fields covering effort, hooks, tools, and skills
The model-refusal fallback setting is now an explicit 'switch automatically' vs 'ask each time' choice, promptable interactively, with new telemetry
claude plugin eval is now generally available everywhere but requires trusting a plugin directory before it runs, with clearer help text and init delegation
Settings now has a dedicated Plugins category, and permission choices expand from just Allowed/Not allowed to also include Switch automatically and Ask each time
Unclear The finding doesn't specify which permission prompts or settings surface these new choices, or what each one precisely does.
Headless SDK sessions get a new appendMessages method to inject messages
tool.check hook event wired into the tool-approval pipeline#New tool.check hook can override a hook's earlier 'deny' decision on a tool call
Settings screen gains a generic text-input field type for plugin-defined configuration values
OpenTelemetry metrics can now optionally tag data with the project's git repository and provider details.
Permission rules now support real negation patterns layered per source, including a bare ! that negates every path.
Autonomous 'goal' turns get structured pause/retry/stop handling with clear 'Goal paused' messages
Plugin sandbox UI surfaces can now load multiple modules per plugin instead of just one
A new turn.complete hook reports a turn's final answer, refusal, usage and error state, but only when a plugin listens for it
Subagent launching gets a nesting-depth cap, a bypassable concurrency cap, and new teammate/model-inherit rules
claude plugin eval gains a --concurrency flag#claude plugin eval gains a --concurrency flag to run up to 8 test cases at once
Hooks can now directly override how much reasoning effort a turn uses
How long an interrupted turn can be before Claude Code won't auto-resume it is now configurable, and the check now also covers trailing API-error turns
New env vars let a bridge-spawned child session default to auto permission mode and force-enable artifacts
Bash commands on Windows can now run through a dedicated PowerShell/cmd launcher, on by default but switchable off
Continuing a server-side conversation thread can now skip resending the system prompt and tools list, with a fallback if the server disagrees
Unclear Whether the tengu_quiet_heron gate is enabled for any account is unknown; the finding does not say.
New tengu_bridge_child_tool_diff setting controls whether child-session file edits are shown as diffs to a parent session
New /output-style slash command lists or switches output styles, currently hidden behind internal checks
Unclear What the two gating checks require, and whether they are met for any current users, is not stated.
Plugin runtime API gains a new 'config' capability alongside turn, tool, agent, fs and others
Unclear The finding does not say what the config capability lets a plugin do.
Subagents spawned as forks can now be given a custom display name and description instead of one derived from the task text
Windows Credential Manager support gains a forced-priming step, still off by default
'claude plugin eval' adds --allow-real-servers and concurrency options, plus separate harness-failure tracking
Cloud code review can now post its findings to a GitHub pull request as one comment and report whether the post succeeded
New CLAUDE_CODE_GATEWAY_MODEL_DISCOVERY_TIMEOUT_MS env var configures the LLM gateway's model-discovery timeout
New pane:close keyboard shortcut closes a plugin pane, bound to ctrl+x x
Workflow tool's concurrent-agent limit can now be overridden with an environment variable
Running a bash or git command now shows a per-command file diff summary of what it changed
Guidance on publishing finished work rewritten to cover Artifacts and document connectors, not just HTML page titles
A new CLAUDE_CODE_SESSION_ATTENDED env var tells spawned Claude Code child processes whether the parent session is an attended, interactive one
Unclear The finding doesn't say exactly what persistence behavior changes as a result, only that the flag gates the probe.
New CLAUDE_CODE_FLAG_FETCH_WAIT_MS env var sets how long startup waits for feature flags on relaunch
Unclear The finding does not say what happens differently if the wait times out versus succeeds.
Plugin-provided settings now appear in /config, with their values redacted in telemetry
'claude plugin eval' no longer auto-publishes reports when the run looks machine-launched rather than started by a person
The CLAUDE_CODE_BG_TASKS_REPORT_RUNNING setting now defaults to on, and its telemetry reflects that
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
The above-prompt and pane display code was rewritten with explicit dock/inline placement and a tab bar for multiple open panes
Unclear The finding does not say whether the tab bar lets you switch between panes or is purely a display of titles.
The artifact and skill system prompts now include Live files (and, when enabled, Live room) sections describing this session's shared state
Unclear What the "Live room" feature is and how a session gets access to it is not established by the evidence.
New prompt text nudges Claude toward committing and opening PRs via /commit and /pr skills rather than raw git/gh commands, though one injection point is currently disabled
Sessions now have an explicit idle status, both in status reporting and in the remote-control bridge lifecycle
The memory settings panel now shows clearer on/off/running status for auto-memory and its background job, and its 'open memory folder' entries were consolidated into shared code
A new admission-control pipeline lets already-loaded plugins refuse to admit or hot-reload another plugin
Database reads and artifact/asset tools now mark results as foreign when they belong to another user's workshop or session
Plugin hooks.json no longer has a top-level surface field; each Client element now names its own module, and multiple surfaceModules can load at once
Several heuristics that judge a subagent reply's meaning now understand Chinese, Japanese, and Korean text, not just English
A headless client acting only as a tool host for a cloud session now notices when it's unlinked and ends with a dedicated tool_host_ended reason
Bridge-spawned sessions can now be set to exit after an idle period, reporting status as idle rather than completed
A new onboarding tip introduces the /focus command to users who haven't set a view mode.
Artifact comments now warn when written by others and explain the meaning of the owner/editor/commenter stamp
Plugin hooks now wait for workspace trust before loading, instead of loading unconditionally
claude eval now separately reports runs that crashed the harness versus runs that were graded and scored
Artifacts now wrap content written by other people in a tag marking it as untrusted, not instructions
Edit tool results can now report a change as 'staged for review' instead of applied, when settings files require owner approval
Edit and Write tool results can now report a change as 'staged' for owner review instead of applied
When automatic history compaction runs out of room, it now keeps recent messages instead of summarizing everything
Agent-to-agent message chains now stop themselves after a set number of self-hops or total posts
Edit and Write tools can now route file changes through a new staged-write path instead of writing straight to disk
Unclear The finding doesn't say what triggers the staged path or what feature relies on it.
Artifact comment threads can now show a commenter's real access level (owner, editor, commenter, viewer) instead of just labeling everyone 'human'
Bash tool's built-in git-safety guidance paragraph removed, replaced by an injected variable
Unclear What the injected ${m} value actually contains, and whether it preserves the same git-safety guidance, isn't shown by this finding.
Claude Code can now drop unused MCP tools from a session's declared-tools list when compacting the conversation
Unclear Nothing has been read yet about whether this cleanup is switched on for any account, so its practical effect is unknown.
The Task/Agent tool now always runs subagents in the background, ignoring the caller's setting
Unclear The finding does not say whether callers can still request foreground execution through any other path, or what user-visible effect this has.
Model-name whitelist helper now recognizes claude-opus-4-5 and claude-haiku-4-5 as current model names
Mid-conversation system prompt injection on tool changes now limited to first-party provider
Claude Code now re-sends a goal check-in prompt if a turn ends before the goal could be evaluated
Unclear The flag tengu_saffron_wren tied to this area has read on for this site's account and for the anonymous baseline, but that reading was not taken under this release.
Auto mode now auto-allows tool calls that a plugin itself originated, skipping the safety classifier
New clear error message when a device-bound session is blocked from an unenrolled device
:name suffix suggestions#Typing a plugin command's short :name suffix now suggests the matching full command
Documentation for the SDK's user_message_uuid now matches its actual behavior across partial and complete assistant messages
Database write, delete, and batch-write tools now give specific guidance when a required if_version was left out, backed by a version_required error code
Terminal feature detection (sync output, extended keys, kitty keyboard) now probes the terminal and settles capabilities from its actual reply, and git object-format detection moved to its own helper
Unclear The finding doesn't say whether Konsole or self-query-dependent terminals are still detected some other way, so it's unclear whether this is a net loss of support for them.
When a subagent's transcript shows it read an Artifact written by someone else, Claude Code now warns the caller to treat that content as data, not instructions
Claude Code now disables git's automatic gc/maintenance for most git commands it runs, but not for BYOC fetch retries
Reading an artifact now detects more cases of untrusted or co-written content and prepends a warning to the summary
Telemetry endpoint settings now accept gRPC-style URL schemes like grpc, otlp and tcp, not just http/https
Eval cases with a scaffold_script now warn explicitly when --scaffold wasn't passed instead of silently skipping it
/config now shows which plugin a setting comes from, and organizations can lock those settings
The diff sidebar now shows specific reasons when it can't display a diff, and debounces its file-history lookups
OAuth token validation now reports a specific failure reason instead of one generic error
Artifact lists now warn that shared artifacts' titles are untrusted data, not instructions
Attribution rules now explicitly override any CLAUDE.md or memory instruction asking for attribution lines
Switching output style in /config is now safer for shared sessions and won't let you reselect the current style
Hooks are now loaded as soon as a project becomes trusted, not just afterward
The built-in WebSearch tool now has an explicit permission check that suggests adding an allow rule
The Artifact tool's upload_asset can now explicitly upload stylesheet (CSS) and script (JS) files
Session picker now caps the peer-sessions list with a '(N more not shown)' footer
Posting review findings to a GitHub PR comment now reports whether the comment already existed or was just posted
Artifact comment/message attribution now shows the viewer's display name, not just a short ID
Artifact listings now warn that other users' titles and descriptions are data, not instructions
Compaction summaries now flag when the oldest messages had to be dropped
Custom output styles can't be selected or changed over Remote Control or in relayed sessions
Sessions with a custom system prompt now automatically omit git status from prompt context
Background task output now gets a warning wrapper when it may contain untrusted artifact content
A tool's built-in 'Run test?' confirmation prompt was removed
Unclear The finding does not say which tool this is or whether permission checking moved elsewhere or was simply dropped.
Subagent reports now warn when they relay content from an Artifact someone else wrote
Claude Code now recognizes st and rxvt terminal families for correct key handling
Task notifications now warn when relayed Artifact content may not be trustworthy instructions
Messages delivering queued command results now carry explicit turn/position context used for dedup, telemetry, and history
Claude Code now warns when a governed-git mount's GitHub URL can't be used, and falls back to the machine's own GitHub access
Git branch-update and checkout-apply operations now check for stale locks and re-verify the working tree's layout before writing, failing safely instead of corrupting state
Tools that come back after being hidden or retracted are now tracked as a distinct "restored" group and get their own message to the model
Artifact upload approval now explicitly names CSV, Markdown, JSON and plain-text files as still requiring confirmation
Added a default explanation for when a hook silently drops prompt content
The token-mismatch warning now covers git fetches and gh writes, not just git pushes
Auto-denial telemetry no longer counts Read/Edit/Write calls blocked by a path-scoped deny rule
Sandbox directory-resolution timeout message now also mentions shared temp dirs as a possible cause
Agent and task description/reason fields are now cleaned up and capped at 1024 characters, and tool-use IDs must match a strict pattern
WSL managed-settings warnings can now be flagged as ignored instead of just being dropped
Unclear What consumes the wslIgnored flag or how it's surfaced to a user is not shown by the finding.
Hook-provided context entries no longer need to trace back to an earlier hook that added them
Help text for --max-cost-usd now explains its cost ceiling is checked before each run, not per single run
New built-in prompts tell Claude how to resume after hitting the output limit or being cut off mid-response
Claude Code's doctor/health-check report now lists linked plugin UI modules
New warning text flags tool calls written as plain text that were never actually executed
Absorbing a left-arrow press during the confirm gap now logs telemetry instead of doing nothing
Rate-limit usage reports can now explicitly show an empty per-model breakdown instead of just omitting it
Plugin install error for missing scope now explains access is usually granted automatically instead of telling you to relaunch
Directory and search text boxes now grab keyboard focus automatically, with a new focus context for plugin panes
File-type detection now recognizes .ts, .css, .js, .mjs, and .cjs files by MIME type
Unclear Which specific feature (artifact handling, attachments, or something else) consumes this map is not stated.
The Bash tool now understands the 'tee' command: it's sandboxed, permission-checked, and described in summaries
Composer sidebar background is now always shown when a sidebar is present, removing the fill toggle
Managed plugin entries in installed_plugins.json that drift out of sync with the marketplace or cache are now automatically repaired
Worker and session-client shutdown logic now distinguishes running 'hosted' inside another process from owning the process outright
Pasting a redirect URL during MCP server sign-in is now checked against the expected value before it's accepted
Token refresh can now request a user:plugins OAuth scope, used to gate account plugin sync and plugin/skill search, with automatic retry if rejected
Claude Code now blocks direct writes to the settings-review staging store
Claude Code now checks whether a plugin has actually been admitted (not just loaded) before letting it make cross-plugin calls or keeping its hooks registered
Package integrity checks now catch tampering via file permissions and hard links, not just size or symlinks
Update checks now distinguish a suspended process from a real network timeout
Workflow agents now wait for MCP tool syncing to finish before their tool set is resolved
Conversation compaction now preserves trailing thinking blocks before computing what to strip
Unclear The evidence doesn't say what practical difference in compacted output this reordering produces.
Plugin settings migration now checks policy before assuming an already-installed plugin can be skipped
Plugins that call next.to() with a hooks module name Claude Code can't find in the code are now rejected
A denial from a tool.check hook now runs back through the normal deny/ask approval flow instead of stopping immediately
Managed-settings deny/ask rules starting with '!' are now dropped with a warning instead of applied
Deny/ask permission rules that start with a negated Read/Edit pattern are now dropped with a warning
Worktree cleanup now checks for redirected symlinks before deleting anything, and refuses if it can't confirm safety
Fixed a bug where the list of enabled MCP servers ignored the caller's actual allowlist and managed-server settings
Claude Code now tracks whether a caller may not be the account owner and uses it to restrict /output-style listing, switching, and error detail
Skills synced from claude.ai are now namespaced under anthropic-skills: so they stop silently overriding or being blocked by local skills and commands with the same short name
Policy limits requests now retry once with a forced token refresh after a 401 error
Diff parsing now correctly handles file paths that git quotes or escapes
Repeated MCP reconnect requests for the same server now wait for the first one instead of overlapping
Typing a slash command now waits for a pending command-list refresh before saying 'Unknown command'
Plugin archive installs now extract to a staging area and swap in atomically, with Windows lock retries
Chrome file-upload path checks now also block NTFS alternate-data-stream syntax and an additional kernel-alias check
.. path segments#A new check blocks reads that hide a '..' path segment behind a glob character to slip past directory restrictions
Plugin sync now locks down and then restores file permissions when unzipping plugin files
A clearer error message now appears when an API request gets a 401 while your login is being refreshed, and Claude Code retries automatically
Bash deny-rule checks now also screen read-only file paths, such as those read by awk's getline
tmux detection now distinguishes 'no tmux' from 'couldn't check' and shells out more safely
Sign-in errors now tell apart a stale callback URL from one that's simply missing an authorization code
Device registration on Mac now reports a clear error when there's no login keychain to store a device key
Fixed a bug that likely prevented apply_flag_settings events from ever firing
Resuming an in-process teammate now rejects a wider range of malformed recorded names
Session events refused with a 403 can now be re-signed by the device and resent instead of dropped
Pinning an artifact now fetches its title live if the cached title lookup comes back empty
Bash tool now checks allowed_domains sandbox compatibility earlier, during input validation
Terminal renderer now detects corrupted frames on resume and forces a full reset instead of a partial repaint
A mismatched OAuth callback state no longer aborts login as a CSRF attack, it's just ignored now
Claude Code now blocks a glob-before-'..' trick that could have escaped read-directory restrictions
Claude Code now detects when it missed an empty-hint signal on artifact review comments and stops auto-actions from firing on them
Git dir-sync cleanup now double-checks a directory's identity before deleting stale files inside it
The list of read-deny patterns for a root no longer includes negation patterns.
Fixed a bug where CEL comprehension expressions could silently swallow evaluation errors
Appending user or compact-boundary messages mid-turn now always runs a cleanup step, even on error
Startup now runs full cleanup before exiting on an invalid security dialog state
Terminal probe queries now wait for input to be attached before writing, closing a race with barrier writes
Remote/background task titles are now sanitized with a fallback of '(remote task)' if invalid or empty
Computing which tools got revoked mid-conversation now fails safe to an empty list instead of throwing an error
Idle teammate agents no longer send a stale notification once someone directly @-mentions them
Cron-scheduled agent tasks with overly long prompts are now skipped instead of adopted
Terminal 'delete' key recognition for one escape sequence now only applies on macOS
Fewer false positives when detecting Anthropic API 'safeguards' errors
Path/URL validation now rejects raw control characters and DEL
Control-protocol requests now fail fast if already cancelled before being sent
Plugin session cache folder is now created with owner-only permissions
rename_session now checks the session id and logs host-initiated renames separately
Using bypass-permissions mode while in plan mode now requires an interactive session
Unclear The finding does not specify what the added condition checks beyond requiring an interactive session, so the exact requirement is not confirmed.
Fixed a bug where the wrong value was checked when clearing a startup-dialog-blocked marker
Unclear placeholder
Fixed a bug in the check that decides whether a cached file is still fresh enough to reuse
Fixed a bug where the design-write permission prompt showed the wrong operation and input
Worker registration stops retrying once the session has already closed
Bug fix: cancelling pending dialogs could log the wrong dialog type in telemetry
Artifact tool schema adds a read_page_data action plus capabilities, contract, and typed-catalog fields
Auto-mode's safety classifier gained a new 'arbiter' mode that can skip some server checks
A dormant new banner layout for agent/tmux hints was added to the prompt input row but isn't active yet
Unclear The finding shows the new render branch exists but does not establish that it can currently be triggered or what it will look like in practice.
Memory extraction can now turn itself on when post-turn-memory config is present, bypassing its usual feature gate
CLAUDE_CODE_ARTIFACT_REPL env var exists and is passed to subprocesses but nothing reads it
auto_open: "after_first_write" combined with certain tool configuration#A new but currently inactive check would reject certain artifact publish configurations combining auto_open with specific tool settings
Auto-replies to artifacts can now be delivered through an alternate, forked/subagent path
Artifact-comment auto-reply gains a fork/handoff path behind the tengu_sorrel_trellis_newel gate
Unclear The tengu_sorrel_trellis_newel gate was read off for this site's account and off for the anonymous baseline, but that reading was not taken under this release, so whether it is on for this version is unknown.
A usage-tracking helper can now report cache-write-sized usage as unknown instead of labeling it 'cache_write'
Unclear Nothing has been read yet about whether this behavior is switched on for any account, so its practical effect is unknown.
New default design-systems guidance for decks and visual designs exists in the code but is currently switched off
Unclear Whether the gating check (G7()) currently evaluates to on or off for any account is not established by the evidence.
A new 'summary' hint for thinking blocks exists in the code but is gated off for now
The turn-tracking and shutdown telemetry for SDK/print mode runs was rewritten, adding a tool-call breakdown and consolidating shutdown reporting
Self-hosted runner sessions now also reconcile 'session git rules' and a governed gh (GitHub CLI) route
Plugin and hook execution was rewritten to stream results and track per-handler timing and outcomes
Unclear The practical, user-visible effect of this rewrite (beyond internal timing/outcome tracking) is not specified in the finding.
New internal edit_hook system lets settings be edited to add, replace, or remove hooks
Unclear Whether a user-facing UI or command already exposes this editor, or it is purely internal plumbing so far, isn't shown by the evidence.
Claude Code adds an internal wake-router and interrupt-latch system for coordinating command queue notifications
Unclear The finding does not say what user-visible behavior, if any, this change fixes or enables.
REPL, SendMessage, TaskCreate, TaskUpdate, feedback-draft, Workflow and Bash tools rebuilt on a shared factory pattern
A background check now validates and times the OAuth login token for first-party sessions
Transcript compaction now keeps host-injected messages next to the conversation turn they belong to
Artifact pinning is now also suppressed for remote sessions when an additional internal check is true
Unclear What the added check (yPt()) represents in practical terms is not stated.
Two new internal feature flags added: artifactReplPathEnabled and serverClassifierShadowEnabled
Unclear What these two flags actually enable, and whether either is active for any user yet, is not stated.
Web search tool's model choice now goes through a feature-flag check instead of always using the main model
The Bash tool's internal implementation was refactored into a create() factory, a structural change with no new capability
Eval workers now share a token gate that serializes login/credential refresh and was threaded into a simplified single-run eval loop
Unclear The finding does not say what change in behavior, if any, this produces for someone running claude plugin eval.
New internal API validates and applies add/remove edits to permission rules
New checks more reliably detect genuine git worktrees, including broken links on Windows
Artifacts can now be flagged as 'authored by others' when Claude isn't their sole author
Turning a skill on/off now correctly distinguishes synced skills from local ones with the same name
Cloud sessions now reconcile server-sent messages and wait for pending tool calls to settle before proceeding.
Write-permission checks gain a dedicated claudeSettingsFile circuit breaker, separate from the Windows-path check.
Plugin UI panes now track which ones you've already been asked about, and use terminal width to decide when to ask again.
Claude Code can now detect when it's running nested inside another Claude Code session, plus faster process-start-time checks on Windows
Remote headless session attach can now get a device link directly instead of waiting on polled session state
Unclear The finding does not specify what condition triggers the direct device-link path.
get_memory_dialog remote request subtype#A new remote-control request type fetches memory-dialog data, but is blocked over headless connections
Unclear The finding doesn't explain what a 'memory dialog' or a 'dream' task is or does.
The engine driving interactive and headless sessions was rewritten as separate classes instead of one big function
Artifact publishing can now verify a source file's bytes against a given SHA-256 hash before publishing
Artifact publishing now factors in whether the destination is a "live room" before skipping confirmation
Unclear What a "live room" is and exactly how it changes the confirmation prompt for publishing an Artifact isn't established by the finding.
ToolSearchTool now builds a fresh instance per turn with its own isolated MCP client state
create() instance pattern with new renderToolUseMessage and prompt hook#The WebFetch tool moves to the newer create() internal structure and gains a verbose-mode message and prompt hook
SDK control-request rename_session refined with remote/host distinction and a get_memory_dialog request added
Permission-allow decisions now record which UI surface granted them
Tool-use summaries now include a display hint, a team-memory-write flag, and a search target classification
AskUserQuestion now logs detailed completion stats and shows a transcript line for itself again
A new claudeSettingsFile safety category is added, restricted to the host person only
Sessions can now carry an auto_mode_environment description from the dispatching service into context, config, and telemetry
A background 'memory pass' can now call a restricted set of tools, but only through a CCR memory server and under strict conditions
Claude Code now tracks which UI surfaces a plugin's components render into and can hash a plugin's linked files
Unclear What user-facing feature uses this surface-tracking and hashing is not specified.
IDEs can now see the org-level default for Remote Control auto-connect separately from the user's own setting
The agent/tool proxy can now add extra git config includes and prepend a directory to PATH
Unclear The finding does not say what triggers the new git include.path entries or what directory gets prepended to PATH.
Remote-agent permission requests can now retry with a fresh device signature when auth is stale or unattested
Synced skills are now referenced by an anthropic-skills: identifier instead of a GitHub URL
Remote control, Ultraplan, and Claude-in-Chrome now map to named permission policies
Structured-output tool can now run a callback when it completes
Unclear The finding does not say what feature or consumer uses this new callback.
Claude Code now specifically recognizes its built-in 'memory' MCP server by name and URL shape
Unclear The finding doesn't say what specific behavior differs once the memory server is recognized this way.
Resuming an agent now validates its worktree branch and name before proceeding
Unclear what new resume feature this worktreeBranch/name validation is groundwork for
Remote-agent transcript output can include a harnessHead excerpt built by a new helper
Session-event signing now delegates to an external signer instead of signing locally with an in-process key
Edit tool's 'always allow' rules now track when they came from a host permission dialog
Built-in hooks module IDs starting with 'mods/' now resolve to a vendor claude-code-mods directory
Skills-sync resync ticks now record why they fired and report when one is skipped after the machine slept too long.
Signed-cache validation now also resolves an identity and reports it via a new telemetry event
Unclear What the resolved identity represents or is used for is not described.
focusView flag threaded into app initialization#App startup now computes and passes a new internal focusView flag
Unclear What focusView does or which UI behavior it enables is not shown by the evidence.
Auto-mode's GrowthBook setup call now passes caching and telemetry parameters and reuses its result
extendedQuestions telemetry field on session init, tied to a host launch option#Session-start telemetry now records whether extended questions are enabled, via a new host launch option
Unclear What 'extended questions' refers to as a feature, and what the earlier field being replaced by focusView was, are not stated in the finding.
New startup telemetry tracks managed-config readiness and an optional live identity check
Unclear Whether the tengu_brass_lantern gate or the live-identity check is switched on for any account is not known; no reading of either gate has been taken.
New helper functions can check circuit breakers for bypass-immune or local-projection-only flags
Unclear What specific checks use bypassImmune or localProjectionOnly, and what calls these new helpers, is not stated.
New tengu_quiet_heron gate feeds a breaker-tripped check with no found caller in this code
Unclear Nothing has been read about the tengu_quiet_heron gate, so whether it is on or off cannot be said; it's also unclear whether this function is used anywhere yet.
New CLAUDE_CODE_BRIDGE_CHILD_ARTIFACT env var signals artifact settings to bridge child sessions
Auto-memory/auto-dream settings now have a validated editor function and a refactored settings-screen status display
The SendMessage tool's cross-machine and team-mailbox permission checks now go through a detached ask callback and accessor functions instead of passed-in state objects
Validation of custom settings entries now blocks a wider set of literal template placeholder tokens, plus a new helper distinguishes template tokens from cc_automode region tags
Unclear body was cut off; regenerating properly below
A new turnCompanion flag on user messages now decides whether they're filtered out or grouped with preceding tool results
Unclear What sets turnCompanion to true, and which processing path excludes these messages, aren't shown in the finding.
The remote settings and GrowthBook clients now detect process exit and stop their periodic background refresh
A new internal classifier labels how each session is authenticated, for telemetry purposes
The internal 401 (unauthorized) recovery routine can now report its result back to the caller
Waiting for a spawned subagent to register now uses a separate, configurable timeout after it first appears.
New internal flag tracks whether a 'tool result screening OK' signal has been sent this session
Unclear The finding does not say what feature or behavior this tracking flag controls or enables.
SDK memory usage sampling for child processes now runs asynchronously and in parallel
The title bar's agent name and tmux hint are now computed as two separate, independent pieces
Detaching a background shell command can now wait for a handoff step to finish first
Background git operations now also disable custom git hooks, not just content filters
Interrupt handling for canceling queued messages was refactored into two shared helper functions
Self-hosted runner sessions now also confine a 'gh route dir' path for the spawned process
suspended outcome and unified payload builder#Skills-sync telemetry gains a 'suspended' outcome for rounds delayed by the process being asleep
Plugin hook loading drops an internal "surface" tag while gaining a new unused parameter
Unclear It isn't clear what the removed surface field was used for or what effect the new parameter has on plugin hook loading.
WebFetch's permission logic is now a reusable function that can re-check permissions after a redirect
Artifact comment auto-reply flow now tracks whether a page is 'foreign' to the current session
Unclear What behavior changes when a page is flagged as foreign is not shown by the evidence.
Tool-unavailable error messages now resolve MCP server info before falling back to older logic
New internal helpers clean up stale git worktree registrations
Plugin eval mock runs can now flag an MCP server as 'withheld' in results
Unclear What causes a server to be marked withheld, and what practical effect it has on the eval, isn't stated.
Claude Code now throttles Bun's JIT policy 10 seconds after startup outside fast-path launches
Unclear What effect JIT policy 1 has on performance or behavior is not stated in the evidence.
Governed-git session setup now also reads a REST mount base URL from the work item's config
Unclear What restMountBaseUrl is used for once threaded through is not stated in the evidence.
Remote managed-settings fetches now log detailed telemetry and a clear outcome for every attempt
Assistant 'thinking' text is now cached per message along with a reserved slot for a future summary
Unclear The summary slot is reserved but the finding doesn't say what will populate it or when.
Startup delays caused by managed-settings and MCP policy checks are now measured and recorded
Claude Code's internal async response tracker now records when each response was settled, not just its value
Edit-tool permission denials now carry an explicit deniedByPermissionRule flag used to trigger a callback
Cloud scheduling tool's availability check simplified to a single feature-gate lookup
Plugin host calls are now blocked if the hooks module behind them hasn't been fully admitted yet
Removing synced skills now strips the 'anthropic-skills:' prefix before comparing names
Tool-decision telemetry now records which UI surface an accepted tool call came from
Session state now tracks pending goal re-prompts and a streak of goal interruptions
Unclear What the reprompt and interruption-streak fields actually trigger in the session isn't shown, only that the state now tracks them.
Claude Code can now detect a specific 'bound_unattested' auth error to trigger device re-enrollment
Stdin writes queued before input was ready are now flushed once input attaches
A new internal checklist spells out what artifact metadata should document
Viewer-comment attribution text now varies by the viewer's access level
New methods let a session hold and later release batches of delivery acknowledgements
Unclear What triggers holding versus releasing acks, and what problem the batching solves, is not stated.
get_memory_dialog SDK requests are now rejected in cloud-hosted sessions
The 'summarized all' compaction telemetry event now fires under broader conditions
Two new internal identifiers added: settings_quarantine and shell_windows_launcher
Unclear What functionality these identifiers correspond to, and whether it is active, is not stated.
Three new control-request message types added to the SDK's client-to-loop request schema
Unclear What the three new control request types represent or enable is not stated.
Managed-settings parse errors now report whether the file is user-writable
Unclear What consumes this new field, or whether it changes any user-facing error message, is not stated.
Message-history schema gains an optional attached_by: "server" field
Unclear What content or feature actually sets attached_by, and how it is used once present, is not stated.
Telemetry event list adds eight new events and drops three, including control_plane_publish
Replayed events now carry an isSynthetic flag when their source event was meta
Eval mocking now supports 'withheld' mock servers that are excluded from without-server checks
SendMessage and SendFile tools were rebuilt internally to share permission/session state through a common factory
Unclear The finding describes an architectural refactor but does not state any resulting behavior change for users.
New helper sorts unrecognized API error messages into overloaded, rate_limit, server_error, or other
Permission bypass-mode check consolidated into one shared helper across three call sites
Unclear The finding does not say what effect the moved isNonInteractiveSession check has in practice at either call site.
A new .device-keys.json file is now tracked among Claude Code's config files
Unclear What the .device-keys.json file actually contains or is used for is not stated.
Demo mode now also settles focus requests when CLAUBBIT is set
Unclear What 'focus request settling' controls in practice, and what CLAUBBIT represents, are not explained in the finding.
Synced content now carries a new 'foreign' flag alongside cowritten/typeLocked metadata
Unclear What determines whether content is marked 'foreign', and what consuming that flag changes, is not stated.
Comment/thread listings gain a new 'authoredByOthers' field
Unclear What authoredByOthers actually represents or how it affects the listing shown to a user is not stated.
Several new internal event and telemetry names have been registered
Unclear What triggers each new event and what data it carries is not described in the finding.
Skill definitions now track two new fields: skillDir and bareNameReserved
Unclear What skillDir and bareNameReserved are used for is not stated in the finding.
Plan-mode bypass-permissions gating now checks one more condition before treating bypass mode as active
Unclear What the added condition (referred to only as a function call) actually checks is not identified.
Internal eval-test reporting now recognizes 'concurrency' and 'withheld' as valid result fields
The check that enables scroll-region terminal rendering (DECSTBM) was rewired to new guard functions
Unclear The new guard functions are unnamed beyond minified identifiers, so what they specifically check is not established; nothing has been read yet about the tengu_marlin_porch gate for this release.
New telemetry tracks how long startup waits on remote feature-flag fetches
Eval mocking now gives specific errors when a plugin's MCP servers can't be enumerated for mocking
Eval mocks now explicitly check managed MCP server policy before starting
Eval sandbox on macOS blocks writes to more per-user socket and daemon directories
SendMessage tool adds a suppressesAlwaysAllowRule flag and a richer permission-context object
Unclear Since suppressesAlwaysAllowRule always returns false right now, it's unclear what practical effect this has yet.
SendMessage tool result formatting gets a new path for inline handback content
Unclear What the new formatting looks like or why it was needed compared to the previous formatting is not stated.
Teammate plan-approval now reads permissions and proactivity through the shared context object
Internal rework of the sandbox 'reads outside working directory' deny dialog, same message and behavior
Unclear what the new host_dialog tag is used for beyond being passed into the dialog flow
Accepting a diff in the IDE extension now tags the permission decision as coming from the IDE
Artifact edit checks now also report whether an artifact is 'foreign'
New readAtMs timestamp tracks when an artifact comment thread was last read
Unclear The finding does not confirm exactly how readAtMs is used, only that it is likely for staleness or elision decisions.
Artifact permission checks now detect co-authorship and flag artifacts as foreign-owned on pages
Unclear The finding doesn't say how pageForeign or the co-authorship signals are used in the interface.
Edit tool permission checks gained an additional safety category before falling back to normal rules
Unclear The finding doesn't say what condition the new check tests for or what decision it produces.
Auto-mode classifier can now retry via a callback instead of always blocking on unavailable results
Logged permission decisions now include a 'surface' field for config-based tool approvals
Unclear The finding doesn't say what values surface holds or what part of the system it identifies.
Remote-session commands now use a single visibility check instead of two combined checks
Unclear Whether the simplified check changes visibility outcomes in any real scenario, versus just consolidating the same logic, is not stated.
Eval/mock testing tool's managed-mcp.json config now fully overrides other mock MCP servers, erroring if a required one is skipped
/settings-review now recognizes more plugin-related settings file locations for its exemption rules
Claude Code now waits briefly for cloud/remote session tools to finish attaching before proceeding
Per-skill override lookup refactored to use a single new resolution function
A new gate string, tengu_iridescent_crystal, appears in the code with no visible use yet
Unclear Nothing has been read about this gate, so whether or how it will be used is unknown.
Eval-mocks testing tool now respects managed-mcp.json lockdown by withholding mock MCP servers
Auto-accepted tool-permission log entries now record a surface field
Unclear The finding does not say what values surface can take or how it's used downstream.
Command and feature restrictions (like HIPAA/ZDR compliance limits) now read their label, verb, and compliance requirement from one shared policy table
Inbound message paths, including the session.receive hook, now use a disposable queueing handle to track whether a message was actually enqueued
A Skill-invocation cleanup helper was renamed internally, likely with no behavior change
Unclear The evidence only shows a renamed function call, so it's not fully certain there is no behavior change.
Minor internal rework of how the transcript view memoizes and hides advisor tool result messages
Unclear Whether this changes what appears on screen, versus being a purely internal memoization detail, isn't clear from the evidence.
A gRPC status-code restriction call was inlined, with no behavior change
Workflow agent retry and remote-agent code shows only renamed identifiers between builds, no functional change found
A terminal mode-reassertion internal constant was renamed with no behavior change
Self-hosted runner session-spawn code was only renamed internally, with no behavior change
An internal rule-target schema pipeline gained one extra wrapping layer
Unclear What the added wrapping function does and whether it changes any observable behavior around ruleTargetInput is not established.
Settings search list UI updated with internal renames only, no behavior change
Sessions drift-watch timer code reformatted, no logic change
Design tool's internal call handler restructured, no behavior change
Auto-mode's no-classifier-input check moved into its own helper function
CLI startup code re-minified with renamed variables only, no behavior change
Internal cleanup of the CEL expression evaluator's function-call style, no behavior change
create() factory#ExitPlanMode tool internally restructured into a factory pattern, no behavior change
Collapsed read-search transcript summaries now take their include-fields decision as a parameter
Git worktree creation now reports symlink safety failures as structured data instead of throwing an exception
Claude Code's build metadata was bumped to version 2.1.269 for this release
Terminal mode tracker gains resetAll() to fully clean up on app exit
Switching the terminal's alternate screen mode now also writes a native cursor escape sequence
Unclear The finding does not say what visible cursor problem this fixes or which terminals are affected.
Internal 'pointer press' tracking in the terminal UI was renamed to 'click' tracking and made asynchronous
Unclear The finding does not say what effect the deferred dispatch or the extra null argument has for a user.
Documentation for per-model weekly usage data now spells out what 'missing' means versus 'empty'
Some plugin-provided tools now build their call handler through a create() factory instead of a plain object
Extraction handling now tracks in-flight work per directory
Plugin pane runs no longer mark a surface as 'asked' before handing off
Unclear What behavior or check relied on the 'asked' marker being set is not stated.
Subagent fork lookup no longer returns the original spawn payload alongside the matched agent
Unclear What consumed the dropped spawn field, and whether its removal has any visible effect, is not stated.
Worker status now starts from a configurable initialWorkerStatus instead of always defaulting to idle
Unclear What passes this option in practice, and what other status values are used, is not stated.
The internal isPasted marker on keypress events has been removed
Unclear The finding does not say what, if anything, changes in observable behavior now that pasted input is no longer marked separately.
Path/id matching now normalizes text, with extra Unicode handling on macOS
A new helper checks whether a path is a symbolic link
Unclear Which feature or code path now uses this symlink check is not stated in the finding.
The note about bash task results being delivered to Claude no longer depends on an extra availability check
Unclear What the removed Yk() check was verifying, and thus exactly which additional cases now show the note, is not established.
Internal renaming and rewrite of terminal renderer pool logic and console/stderr patching, no behavior change
exportName renamed to module throughout host/client wiring#Plugin rendering internals rename 'exportName' to 'module' and simplify cleanup logic
Orphaned-thinking-message telemetry no longer fires duplicate events for the same message
The internal border-drawing renderer now wraps each line through a new formatting step before writing it
Unclear The finding doesn't say what the new wrapping call actually does or why the extra parameter was added.
GrowthBook config cache now skips disk writes when nothing changed
New regex detects invisible and control characters in permission-rule text for safe display
propose_skills and the internal ClaudeDesign tool were rebuilt on the same factory pattern as other tools
Async REPL's queue-depth limit logic moved to a new internal function, same behavior
Internal list of allowed API request fields switched from an array to a Set
Unclear The finding does not say where this allowlist is used or what request handling it affects.
Repeated tool-call groupings in the transcript are now cached instead of rebuilt each render
Terminal cleanup on exit now sends one combined escape sequence instead of several separate writes
Session and agent state accessors consolidated into shared factory functions
Goal idle check-in timer logic refactored onto shared helper functions
Skill tool now dispatches through the shared runEngine executor used by Agent, REPL, and Artifact tools
Sandbox network classifier's internal enable-check was simplified from several conditions to two
Unclear Whether this changes which sessions actually get the network classifier applied, or is purely an internal refactor, is not stated.
Path-safety check behind read_asset/read_file save-location errors was renamed internally, with no behavior change
Built-in changelog text shown by the CLI now includes the 2.1.267 release notes
written url alongside asset_upload#upload_asset responses now also include a written url field alongside the existing asset_upload data
Inference-provider config field definitions were internally reorganized with no behavior change
Repeat asset uploads to an already-approved artifact no longer skip the approval prompt automatically.
Control-plane telemetry events and related state were removed from the app
Published verbatim by Anthropic for v2.1.269. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 98 bullets, 14 name something an entry on this page also names, 19 name something no entry here does, and 65 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude plugin eval: run a plugin's eval suite against Claude Code and get scored, reproducible results (JSON + HTML report); see claude plugin eval --help
Probably claude-plugin-eval-ga-text-and-its-server-side-kill-switch, plugin-eval-cli-help-text-expanded-with-sandboxingtrust-dis, claude-plugin-eval-gains-a-concurrency-flag, new-cli-flags-for-the-plugin-eval-command-trust-plugin-an, claude-plugin-eval-init-can-delegate-the-authoring-intervi, claude-plugin-eval-now-requires-explicit-trust-confirmatio, new-trust-gate-before-piloting-an-untrusted-plugin-directory, claude-plugin-eval-skips-auto-publishing-its-report-when-t, claude-plugin-eval-gains-allow-real-servers-and-concurre /output-style [name] to list and switch output styles, including over Remote Control and in cloud and other headless sessions
Probably output-style-now-checks-whether-the-caller-may-be-a-non-own, new-output-style-style-list-local-command bashEditDiffEnabled)
Probably new-basheditdiffenabled-setting-controls-bash-tool-file-chan, bash-tool-can-now-show-a-diff-of-files-it-edited OTEL_METRICS_INCLUDE_REPOSITORY to tag OpenTelemetry metrics and events with vcs. repository attributes; commit events get vcs.ref.head. with OTEL_LOG_TOOL_DETAILS
Probably opentelemetry-metrics-can-optionally-include-vcsrepository CLAUDE_CODE_GATEWAY_MODEL_DISCOVERY_TIMEOUT_MS to extend the LLM gateway /v1/models discovery timeout (default 3s)
Probably gateway-model-discovery-request-timeout-is-now-configurable /focus for a view with just your prompt, a one-line work summary, and the response
Probably new-onboarding-tip-advertises-a-focus-command-tied-to-an CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS (1–256) to raise the Workflow tool's per-run concurrent agent limit for inference-bound fan-outs
Probably workflow-orchestration-adds-a-configurable-concurrent-agent CLAUDE_CODE_BG_TASKS_REPORT_RUNNING=0 to restore the old behavior)
Probably background-tasks-report-running-flag-now-defaults-to-on ^[[?1;2c) appearing as stray text at startup in some terminals
No entry names this ! applying beyond the settings source that wrote it; such a rule now applies only within its own source, and a bare ! negation is ignored
Nothing to match on headersHelper consent prompts showing a URL path that could be misread as a different host
No entry names this [redacted URL] in place of a relative Windows path with a folder name that starts with @
No entry names this /fork receipt, each under a second apart, never backgrounding the session right away while it waited for the current tool to finish
No entry names this shutdown params (e.g. rust-analyzer) being left running at session end; exit is now sent even if shutdown fails
Nothing to match on permission_denials in --output-format stream-json results omitting Read, Edit and Write calls blocked by a path-scoped deny rule
No entry names this /insights failing on Bedrock, Vertex, Foundry, and gateway deployments whose account can't reach the default Opus model by using the session model there instead
No entry names this /goal runs silently stalling after API errors, network drops, or token limits: the goal now retries with backoff, or pauses and says why, including until a usage limit resets
Probably new-structured-pauseretrystop-classification-for-autonomou /btw answers that contained made-up tool calls and output: the side question is now told not to write them, and any that appear are flagged as not executed
No entry names this CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a turn that had failed with an API error over 6 hours earlier, or longer ago than CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS when set
Probably interrupted-turn-resume-staleness-window-is-now-configurab Edit() deny rules and the write-path check not applying to the file a Bash tee command writes; a Bash(tee:*) allow rule no longer covers destinations outside the working directories
No entry names this 22c, or a terminal's color or version reply, being typed into the prompt at startup over slow connections (ssh, browser terminals)
No entry names this /diff panel to open fully rendered in one step instead of showing a loading state first
Probably new-basheditdiff-snapshotdiff-tracking-system-for-the-bas alwaysLoad MCP server that finishes connecting mid-conversation is usable on the next turn without a tool-search round trip
No entry names this /ultrareview --post to post the PR comment directly when the findings arrive and print the comment link, instead of starting a second cloud session to post it
Probably claude-code-can-now-post-code-review-findings-as-a-pr-commen anthropic-skills:<name>, matching Claude Desktop; the bare name still works when nothing else uses it
Probably synced-skills-now-get-namespaced-under-an-anthropic-skills, skills-now-addressable-via-an-anthropic-skills-uri-scheme CLAUDE_CONFIG_DIR is set in a settings file or the environmentVariables setting
No entry names this /model default in a cloud session leaving every later message failing in organizations that restrict which models Claude Code can use
Probably subagenttask-launch-pipeline-agent-tool-substantially-rew, gateway-model-discovery-request-timeout-is-now-configurable @Claude !restart at the top level of a channel where Claude isn't active starting an unrelated conversation; it now privately says there is nothing to restart
No entry names this The appended system-reminder blocks moved: 1 line added, 1 line removed.
Claude Code, interactive mode
No prompt capture for v2.1.269, so this release's prompt surface is unknown.
810 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 95 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?