Claude Code v2.1.273

When publishing a brand-new artifact (one with no existing slug or create path yet), Claude Code can now call a new step that reserves the artifact's address ahead of time, before the actual publish request is sent. This only happens under specific conditions: no slug or create path already exists, and multi-file artifacts are enabled while another related condition is not.

Claude Code has a "teleport relay" dispatch mechanism that previously only served queries on the main conversation thread. It now has a dedicated branch for forked queries (used by subagents), which checks whether a fork's existing context and tools are unchanged since an earlier relay decision was made, and logs when a fork's request has to leave the relay or is deliberately kept off it.

When the Claude remote-control bridge (which connects the Claude mobile app to a Claude Code session on your computer) spawns a child session, it can default that session to Auto permission mode. The internal flag controlling this default, tengu_bridge_child_auto_mode, now compiles to true instead of false. This flag also decides whether the spawn path fetches session tags before starting, and feeds into whether a spawned bridge child receives the CLAUDE_CODE_BRIDGE_CHILD_AUTO_DEFAULT setting.

When a session is started remotely (via Remote Control), Claude Code now checks that the local installation meets a required minimum version, and distinguishes three ways that check can fail:

• the required version couldn't be retrieved from the server at all
• the value received from the server was malformed
• the local installation is genuinely below the required version

Each case now shows its own distinct message explaining what went wrong.

When Claude Code builds the request to create an artifact, the template field is now included whenever a template is specified. Previously, including it also required an internal feature check to pass; that check has been removed.

A new message has been added alongside the existing "disabled by your organization's policy" message. It explains that once a session has seen a sign-in from an organization with a restricted policy, a feature stays disabled for the rest of that session, even if you later sign in with a different account.

/install-github-app, which installs the Claude GitHub App for a repository, now recognizes when a repository access check fails because of SAML single sign-on (SSO) enforcement. Instead of showing a generic failure, it shows "Single sign-on authorization needed" with instructions to either re-authorize the GitHub CLI login and authorize the organization for SSO, or configure SSO on a personal access token.

When publishing an artifact fails because a file's content type isn't one Claude Code can serve, the error message is now far more detailed. It groups servable content types into categories such as pages, styles, scripts, data, images, fonts, media, and documents, lists which file extensions belong to each, and gives targeted advice, for example pointing out when a rejected type has a close servable alternative, or when the file extension is a recognized but unservable type.

Claude Code also now records refused_ext and refused_type details in its artifact_publish / file_not_servable telemetry event.

When a request to a model provider fails with an authentication error (401/403), Claude Code now shows guidance tailored to which provider you're using, instead of one generic error for all of them:

• Amazon Bedrock: including a new check for when a model simply isn't enabled for your account/region, with instructions to enable it in the Bedrock console
• Google Vertex AI
• Foundry: a new dedicated auth-failure message
• Gateway: a special message for 403 errors

When Claude Code warms up its memory context by prefetching files from a memory directory, it now checks the blockReadsOutsideWorkingDirectories setting (which makes file tools refuse reads outside your designated working directories) before reading a candidate file. If that setting is on, it verifies the file is actually inside the working directory first. If that check itself fails with an error, the read is blocked rather than allowed.

When Claude Code fails to connect because of a certificate verification error (such as an unverifiable or self-signed certificate), the error message now explains that this usually happens because of a corporate proxy that inspects TLS traffic, or a private certificate authority gateway. It points to the NODE_EXTRA_CA_CERTS environment variable as the fix, and links to the network configuration documentation page.

When Claude Code installs its certificate authority (CA) so the agent proxy is trusted by the system, each install method can now also specify an extra symlink location. If provided, Claude Code writes or updates a symlink pointing to the installed certificate record at that additional location, alongside the main certificate file.

Claude Code warns when a compound terminal command changes directory and then runs a version-control tool, because that pattern can pick up untrusted hooks or repository settings from the new directory. This warning previously mentioned git specifically; it now applies its wording generally to any version-control command, not just git.

When Claude Code asks for permission to use an artifact tool action (such as reading, listing, or deleting files or assets), the description shown now includes a bracketed note reading "[outside writer: someone outside the user's organization may have written to this artifact]" whenever that's the case.

When Claude Code fetches the design-system guide used for artifacts, it now also looks for a project/README.md file, in addition to the existing store or file-level README it already checked. The lookup also now distinguishes more specific failure reasons: being blocked by a rule, lacking consent, the file having moved, or the file being unreadable.

When Claude lists artifact meta-types (such as design systems) using the list action, the instructions now describe three categories instead of two: types you own, types belonging to your organization, and types specifically shared with you. The formatter behind this listing now labels shared rows more precisely, distinguishing shared-with-you from shared-within-the-organization rather than lumping both under a generic "shared" label.

The status information for a background task now supports a reason field with the value worker_restart. It's used when a task is automatically stopped because the underlying worker process restarted and found the task orphaned (left without a running process to resume it) when it came back up. This always appears together with a status of stopped, and the same value appears in task stop notifications.

When Claude Code can't fully analyze a bash subshell (an 'unparsed command substitution') that also contains a cd, it now separately scans the command and process substitutions inside it, looking for risky commands such as rm or rmdir hidden within them. If there are more than 64 such substitutions to check, Claude Code now denies the command outright with the message 'too many command substitutions to analyze', rather than trying to analyze all of them.

When Claude Code checks whether a tool is allowed to run because it "runs code as" another tool would, it previously only checked for a matching "ask" permission rule. It now also checks first for a matching "deny" rule (not counting rules that come from tool-narrowing). If one is found, the action is flatly refused with the message: "Permission to use <tool> has been denied: it runs code as <other tool> does, and a rule denies <other tool>."

Claude Code can detect whether your terminal is using a light or dark theme by sending a query (OSC 11) that asks for the terminal's background color. Now, if the terminal has already told Claude Code its theme directly through a 'surface' push notification, Claude Code trusts that notification and skips sending the OSC 11 query, logging 'surface override active, skipping OSC 11 query'.

Claude Code can now detect when settings keys are configured in a managed-settings file whose source doesn't apply for those particular keys. When this happens, it shows a new warning that names the specific source file, lists every offending key, and tells the user to either remove them or move them to a settings source that does apply, pointing to /status (the Settings interface, on the Status tab) to see the list of settings sources.

Claude Code's check for whether its GitHub app is installed now has a new helper that parses a 403 error response body. When the error is marked as user-facing and its code is one of github_ip_allowlist, github_app_suspended, or github_saml_sso_required, Claude Code now surfaces GitHub's own error message to the user, truncated to 300 characters. This runs alongside the existing rate-limit detection in the same error handler.

When a tool call is denied or requires confirmation ('ask') because it matched a specific permission rule, the message shown to the user now appends that rule's own associated hint text, including in cases where the match happened on a nested subcommand.

Claude Code's list of recognized API restriction reasons gained three new codes:

• organization_on_hold
• oauth_scope_insufficient
• token_expired

When Claude Code verifies that a file hasn't changed since it was last read (before applying an edit), it now also compares a content digest (a fingerprint computed from the file's contents) against a stored digest. If the digests don't match, it reports the file as changed, in addition to the existing check based on byte offset.

A new helper produces a user-facing message when the application driving a Claude Code session (such as Claude Desktop, or generically "the app driving this session") fails to respond. It distinguishes between two cases: failing to respond during SessionStart (when a session begins or resumes) versus failing to respond partway through a turn.

Two new error messages were added for authentication failures: one specifically for Microsoft Foundry, and one for generic gateway refusals. Both share a new suffix noting that credentials are managed via environment variables.

The mechanism that scrolls the message list to reveal a specific message was reworked. It now returns a promise that resolves once the target message has actually settled into place — matching height and position across re-renders — rather than retrying a fixed number of times regardless of whether the scroll succeeded. It also includes a give-up timeout and a way to cancel the operation early.

The header components that show the idle spinner message, the "Reconnecting"/"Disconnected" banner, and the count of background tasks were rewritten around a shared calculator that works out how much horizontal space the status text and the " in background" suffix should each get. If there isn't enough room, the background-task suffix is now dropped entirely rather than being awkwardly truncated.

When the automatic pull-request-fixing flow can't subscribe a session to GitHub pull-request webhooks (notifications GitHub sends about PR activity), and the reason isn't simply that the GitHub app isn't installed, Claude Code now shows the specific detail explaining why, trimmed to 300 characters, in both the flow itself and its warning banner. Previously it only showed the generic message "Couldn't subscribe this session to PR webhooks."

When Claude Code asks the model to suggest a follow-up prompt, it used to stop at the very first assistant text reply it found and clean it up with a set of regex rules. Now it first collects all of the assistant's candidate text replies, then runs the same cleanup rules over each candidate in order, stopping only once a candidate actually produces a usable, non-empty suggestion.

When Claude Code can't fetch your account's policy limits (usage/permission rules from your organization) and has no recent valid result to fall back on, it now recovers more aggressively:

• It arms a faster, randomized-timing retry instead of waiting for the normal poll interval
• It also watches for any other successful network call and immediately re-tries the policy-limits fetch when one happens (a "network kick")
• It now tracks how long it went without a valid result, and records that when a result is finally recovered

When permissions.blockReadsOutsideWorkingDirectories is turned on (which makes file tools refuse reads outside your designated working directories), Bash commands that can't be reliably checked against that rule are refused. Previously this only applied to commands flagged as "too complex." Now a table of refusal reasons decides which ones trigger the same refusal, including: too-complex, semantics, multi-cd, shell-operators, cd-git-compound, and process-substitution. Other reasons, like dangerous-path, flag-validation, net-redirect, and sed-dangerous, are explicitly excluded.

When an MCP (Model Context Protocol, used to connect Claude Code to external tool servers) tool call fails because of invalid or expired credentials, the error message now distinguishes four situations instead of two:

• A claude.ai connection needs to be reconnected
• A credential was rejected by the server's headersHelper (with guidance to check the helper and run /mcp to reconnect or authenticate)
• A statically configured Authorization header was rejected
• A generic prompt to re-authenticate

Claude Code connects to MCP servers (external tool providers that plug into Claude Code) and tries to reconnect automatically if a server disconnects. If those automatic reconnection attempts run out without success, a persistent notification now appears telling you to reconnect manually by running /mcp. The notification clears on its own once the server successfully connects again.

When the permissions.blockReadsOutsideWorkingDirectories setting is turned on (which makes Claude Code's file tools refuse reads outside the working directory), Bash commands that are too structurally complex for Claude Code to analyze are now refused outright with a hard "ask" prompt, unless a specific exemption applies. Previously, these overly complex commands fell through to the normal complexity-based approval flow instead.

When Claude Code's safety-check classifier decides a bash command should prompt you with 'ask' and that decision isn't one that can simply be approved by the classifier, Claude Code now runs an extra check on the decision's reason and, where applicable, tries a new fallback that looks at the command's individual subcommands before falling back to the original 'ask' decision. The separate logic for always asking about certain subcommands was also consolidated into one shared piece of code.

A new piece of text is shown when a response is stopped by a safety classifier (an automated system that flags unsafe content), explicitly telling the model not to reproduce that content. An exception is carved out for tool calls that were already running when the stop happened; those are instead marked as "Interrupted."

When Claude Code reports that the Claude GitHub app isn't installed, it now checks for a message sent by the server (serverMessage) and shows that exact text first, only falling back to its generic built-in instructions if the server didn't provide one.

Before Claude Code splits a bash command into subcommands to match it against permission rules, it now runs a new complexity-and-length check first. If the command trips this check, Claude Code stops and declines to reason about it further, rather than attempting to split and match it.

The short status message Claude Code shows next to its spinner while it's processing now falls back to the plain word "Working" when no other message is available. Previously this fallback text was different. Also, the code no longer adds a trailing "..." to the message if the text already ends with one.

When Claude Code reads a design system's token cards (files like api/tokens.md and tokens.json) for a file-backed artifact, it can now look for those files under a project/ prefix, if the design system's own documentation lists a path matching a specific marker.

Claude Code's auto-memory feature (which automatically loads memory files) now checks an additional condition before running. If a permissions setting blocks reads outside the current working directory, auto-memory loading is skipped entirely. A new telemetry field, read_block_fenced, is recorded when this happens.

A new function filters the files AutoMem and AutoMemPinned would scan as pinned memory, keeping only those within the workspace root's allowed paths. This filter runs before file headers are scanned, and is used both when building the AutoMem index and when identifying pinned memory candidates.

The list tool's description of its default scope, when filtering artifacts by type or type_url, now spells out three categories instead of two: artifacts the user owns, artifacts their organization owns, and artifacts shared with them. Previously the wording lumped the latter two together as everything "shared across their organization."

When an assistant's response is stopped partway through by a safety classifier (an automated check that can halt a reply), Claude Code now detects this specific case, identified by a 'refusal' stop reason. For any tool calls that were left not run or were interrupted by the stop, it now generates proper error results explaining what happened:

• A 'Not run' message for tool calls that never started
• An 'Interrupted' message for tool calls that were cut off partway through

After recording these results, Claude Code issues a retry nudge that notes a safeguard was triggered.

When Claude reads a file, Claude Code now checks a per-session record of files already 'held' from an earlier write to that same path. On macOS specifically, it goes further and computes the file's real on-disk identity (its device and inode numbers, the operating system's way of uniquely identifying a file even if the path changes) for the resolved path and for a fallback path used when a file isn't found, and passes that identity along with the read.

The function that computes a sub-agent task's token usage, used for cost and usage display, now skips iterations of type advisor_message or compaction when looking for the most recent usable iteration to report on. If no valid message iteration is found, it falls back to the running totals instead. Numeric validation on each token field is also stricter than before.

Claude Code's Web Standard Streamable HTTP MCP (Model Context Protocol) server route handles incoming requests. Previously, if a request used the wrong HTTP method, it was treated the same as a request to a route that doesn't exist at all, both returning a 404 'not found' response. Now the handler checks whether the route and session are valid first, and if the only problem is the method (i.e. it isn't POST), it returns a proper 405 'method not allowed' response with an Allow: POST header.

Claude Code's detector for shell commands that might behave differently across bash and zsh has a new case: a (...) group that appears directly attached to the end of a preceding word or statement, on the same line. Bash rejects this kind of command outright, but zsh instead reads the glued parentheses as a glob-group word and expands whatever follows it. Previously, this specific pattern only triggered a generic 'statement follows statement' message.

When Claude Code syncs a plugin marketplace's list of plugins page by page, a failure on a later page (after at least one page already loaded successfully) is now handled differently: instead of letting the raw error propagate, it returns a structured result containing success: false, an error, and a kind.

When Claude Code creates a forked or background session, it now treats writing the fork point (a marker recording where the fork branched off, along with the last prompt) as required, separate from the fork briefing text, which stays optional. If the required fork-point marker fails to write, forking now fails with an explicit error. Previously, a failed write here only logged a warning and the fork went ahead anyway.

The internal function used to spawn a background agent or fork a conversation now accepts a resumeAtLeaf option, letting it resume from a specific message rather than the latest one. If the conversation no longer actually contains that message as a valid fork point, it now returns a clear error: "Couldn't fork - the conversation no longer contains the fork point," instead of proceeding incorrectly.

When Claude Code fetches your list of plugins or skills and the request fails, it now falls back to showing an empty list (with a warning logged) instead of throwing an error in one more case: a 404 "not found" server response. Previously this graceful fallback only applied to 403 (forbidden) or "no scope" permission errors, and skill listing specifically only handled the 403 case. Both plugin and skill listing now share the same check, including the new 404 case.

The total token count reported at the end of a run (shown in the run summary as usage.total_tokens / usage.totalTokens) is now calculated by comparing two separate token totals and taking the larger of the two, instead of relying on a single calculation.

When the permission mode changes during a session, a new helper now forwards that change to the bridge child session (used for remote control / mirroring) via noteModeChoice. If the bridge child isn't mounted yet at the time of the change, the mode choice is now held onto and delivered once the bridge child does mount, instead of being lost.

Two points in headless session startup, firstCommandMountJoin and turnMountJoin, previously did nothing. They now, when a 'projects mount' is still pending, actually wait for it to finish via joinProjectsMountBeforeFirstCommand, bounded by timeout settings (PROJECTS_MOUNT_FIRST_COMMAND_WAIT_MS and a related floor value). turnMountJoin additionally waits for any pending 'grants' before letting the first turn proceed.

Claude Code has an internal route used to look up a live MCP (Model Context Protocol, the system that lets Claude use external tools) transport connection by secret and ID. If a request to a valid, known connection used the wrong HTTP method (anything other than POST), it used to get the same generic "not found" response as a request to a connection that doesn't exist at all. Now it gets a proper "method not allowed" response, with an Allow: POST header telling the caller what method it should have used.

When /update or a restart is refused, for example because the session was resumed from a different project directory or a background task is running, the message no longer checks whether an artifact 'comment monitor' task is active and no longer adjusts its wording for that case. The messages for transcript-path drift and for background tasks running are now fixed text, without the earlier note that restarting would stop auto-replies to artifact comments.

The tool that attaches a design system's documentation file to the conversation used to always assume that file was called README.md. It now reads and reports the actual file path instead.

Claude Code's bash safety checker gained two new internal helpers:

• One recursively checks whether a command or variable assignment contains a nested subshell (a command run in its own sub-process, e.g. via parentheses).
• Another walks a parsed command looking for =( array-literal syntax hidden inside words, regular expressions, or expansions, falling back to treating the command as unsafe by default if parsing fails or the input is too long.

Claude Code has an internal bridge that receives messages for its interactive session (REPL). It now checks incoming messages early and, if a message is identified as a 'fork display frame', logs 'Ignoring fork display frame at ingress' and drops it immediately, before the usual de-duplication and telemetry logic runs.

When Claude Code fetches a design-system guide README for use with Artifacts, it can now distinguish between a real fetch failure and a 404 response that carries no specific error code. When a new parameter is set and the response is such a plain 404, Claude Code now silently treats the document as simply absent, rather than reporting it as 'could not be fetched'. The function also now returns a failed field alongside the existing why field.

When /tui (which sets the terminal UI renderer and relaunches) is refused because background work is running, it used to give a distinct message and telemetry label when the background work was specifically an artifact-comment monitor auto-replying to comments. That distinction is now gone: any active background work is reported the same way, with a single generic message telling you to wait or stop it via /tasks before running /tui again.

When Claude Code tallies up token usage during an agent's turn, it now checks the shape of the usage data first: it requires input_tokens to be a number, and treats a missing or null output_tokens as 0. Only after this check does it sum input, cache-creation, cache-read, and output tokens, instead of summing the raw values directly.

When the Artifact tool's upload_asset rejects a file for being too large, the error it throws now includes a sizeBytes field carrying the exact byte size of the file that was rejected, in addition to the existing error message.

Scrolling a viewport in Claude Code used to only disarm (turn off) an active search. It now also releases a separate "hold" indicator at the same time, and the app now watches that indicator so this happens reliably.

Claude Code's normalizer for AWS server errors now checks details?.error_code on the error response before falling back to the older error_code/code fields. This means error payloads that nest their error code inside a details object are now correctly recognized and mapped to a known server error code.

The internal message shown when Claude is denied permission to read a file ("cannot read file ... the file could not be examined") used to always refer to a hardcoded file_path field. It now accepts a parameter name, defaulting to file_path, so the same message can be reused when a different parameter is the one that failed.

When Claude Code logs telemetry for an MCP tool call that failed with a 401 authentication error, the logging call was accidentally wrapped in a throw, which meant it threw an undefined value instead of just recording the telemetry and letting normal error handling continue. That stray throw has been removed.

The hearthbot bridge, which lets Claude operate in chat and project channels, can now auto-allow a much larger set of actions without asking for permission first: the list grew from about 11 entries to 25. New auto-allowed actions include:

• fetch_thread, fetch_project_timeline, fetch_messages
• search_channels
• list_thread_sessions, list_project_members, list_project_artifacts, list_project_prs
• react, unreact
• get_channel_session_id, get_project_session_id
• read_memory

A new project-level mount path for the underlying MCP (Model Context Protocol, which lets Claude connect to external tools and data) server, and a new gating flag tengu_webagent_mcp_bridge, were also added.

Headless sessions (used for print mode or the SDK) can now, when a bridge SDK URL is present and parseable, set up something called a 'headless hearth mount' via createHeadlessHearthMount. It's wired up with storage, credentials, the session's bearer token, and configuration for reading the projects binding. This is controlled by a feature gate.

A new internal plugin now describes the /diff panel, the view showing changed files and their edited sections (hunks) beside the transcript, as a plugin-based pane that refreshes as Claude makes edits, rather than being wired in as fixed built-in UI.

When a session includes the Cowork publish tool, the prompt given to a delegated worker can now include extra guidance that things like slide decks, presentations, or visual designs are not just plain .html pages. In that case, the worker is instructed to first list the published Cowork types available and start from a matching type before falling back to authoring plain HTML.

Claude Code can now strip out certain junk entries from the conversation transcript: a stray empty assistant message that appears right after a given point, and a message that is immediately followed only by system messages and matches a specific pattern. This is a new, more general cleanup step than the one covered before, and it only runs when a setting called tengu_silly_waterfall is turned on for the account.

The flag was off for both this site's account and the general population, and no reading has been taken under this release yet.

AutoMem (Claude Code's automatic memory-file handling) now runs an extra condition check before scanning for pinned or automatic memory files, in addition to its existing checks. It also now filters candidate files against a computed list of allowed directories, so only files whose path falls under that allowed set can be scanned as memory headers.

The function that emits a "verdict changed" event when policy limits change now checks a new condition first and, if it's true, returns early without emitting the event at all. This is controlled by an experiment flag called tengu_lovely_umbrella.

For sessions spawned as a 'project thread child' under Remote Control, two new capabilities can now be granted:

• artifact behavior, controlled by a new check
• inheriting machine-level settings, controlled by a separate new check

Both are added alongside the existing auto-mode-default and auto-over-settings capabilities that this kind of child session could already be given.

Claude Code can now redact certain attribution fields before sending out metrics: agent.name, skill.name, plugin.name, mcp_server.name, and mcp_tool.name. The first time one of these values would differ from a shared baseline, it gets replaced with a common placeholder value instead, unless a setting allows the real, unredacted values to be sent.

The context object handed to tool-execution hooks (code that runs around a tool call) was rebuilt. It no longer includes credentials, isNonInteractiveSession, persistedToolResultFiles, artifactRead, or signal. In their place it now carries a much larger set of fields, including agentId, agentWorktree, taskRegistry, readFileState, getFileHistoryState, applyFileHistoryOp, sessionEnvVars, markPrResolvedThisSession, userTypedShellDispatch, emitToolProgress, shellPermission (bundled with abortController and toolUseId), mainLoopModel, effort, effortLayerOverride, unlayeredPermissions, abortController, remoteCall, and innerCall.

When a new flag, extractPromptAttachments, is set on parsed input, Claude Code now runs an additional processing step that builds extra messages from the input and inserts them into the message list immediately after the first message.

Claude Code now sends three new HTTP headers on some requests: x-claude-code-compaction, x-claude-code-context-compacted, and x-claude-code-prev-tool-durations. The last one carries a compact, size-limited list of recent tool names and how long each took to run. These headers are only attached when the connection is related to a Remote Control bridge session.

When Claude Code registers a name for a session, it now also records whether that name was given at launch. A new capability lets the current registered name be set aside into a per-conversation list, capped at a fixed number of entries (the oldest one is dropped once the list is full), which clears the session's active name.

Claude Code now has a tracker that follows cumulative token usage separately for the main conversation and for subagents (helper conversations spun off from the main one). It supports "rolling over" unused budget and re-anchoring the tracker, and it logs an event each time the remaining budget crosses 75%, 50%, 25%, 10%, or 0% of the total, along with how many rollovers have happened and how long since the tracker was last anchored.

Claude Code has an internal relay mechanism, using markers embedded in a transcript, that hands off session state (including prompt cache data) during an /update. It now has specific, named refusal reasons for when this hand-off can't proceed, such as a marker not being in an inactive state, a missing marker line, an unexpected marker line format, or an anchor point not being in view. It also now checks that a "thinking strip" isn't owed, and checks that the resuming session hasn't already answered a turn of its own before arming the relay.

The background process that powers Remote Control (letting Claude Code be controlled from elsewhere) now initializes its GrowthBook feature gates as part of startup, running this in parallel with the rest of its startup work. If this initialization fails, it logs an error but keeps running, falling back to a cached copy of feature gates stored on disk.

When Claude Code reads from an artifact's shared database using the read_db action, the result now includes a new outside_writer true/false field, computed from a new check, in addition to the existing foreign flag that already detects when a document was authored by someone else.

The function that publishes an artifact now accepts a pre-reserved slug (the short identifier used in an artifact's URL), letting a publish attach to that slug specifically. Its telemetry also now records is_redeploy, has_base_version, and a reserved flag when this path is used.

A hook is a script you configure to run automatically at certain points in a session. The internal function that runs SessionStart hooks (which fire when a session begins or resumes) and loads plugin hooks now also accepts and passes along a new agentContext parameter, alongside existing options like credentials, the cancellation signal, and whether the session is orphaned.

When Claude Code automatically names a session and the session's id changes mid-conversation, the logic that decides whether to adopt the new derived name has been reworked:

• It now tracks an adoptions counter
• It can set aside a previously-registered name and restore it later (setAsideRegisteredName / restoreSetAsideName)
• It passes a new givenAtLaunch flag when registering a session name

This is meant to prevent multiple concurrent resume/restore operations from overwriting each other's session name.

When Claude Code applies configuration from a bridge server, it can now be told to explicitly strip out the auto_mode_environment setting from the incoming config via a new dropAutoModeEnvironment option. Separately, it now tracks and records whether you had already configured your own auto-mode environment before the bridge's config was applied.

New internal functions compute a hashed 'scope' value that identifies the current login. For logins backed by a stored account (or the CLAUDE_CODE_ACCOUNT_UUID source), the scope combines the organization's UUID with a lowercased, hashed, and truncated account UUID. For logins based on an environment variable or file-descriptor auth source, the scope is a hash of the access token instead. A related companion function currently always returns {scope: null, reason: "not_claude_ai_auth"} because the code path that would compute something else is disabled (guarded by a permanently-false condition).

The code handling the remote-control mirror session (the "bridge" that lets a remote session shadow a local one) was substantially reshuffled internally, mostly renaming variables from a rebuild. It also gained a new onForkConversation control operation: a remote bridge session can now request forking the conversation, using a snapshot of the messages, the current turn-activity state, and the length of any queued commands, and the resulting child bridge session is then recorded.

The session builder used for remote and headless REPL sessions (the Remote Control v2 transport handler) now passes two new items into each connection's configuration: an onForkConversation callback, and a hasPendingPrompts() function that reports whether there are prompts still waiting to be handled. These sit alongside the existing onMcpSetServers, outboundOnly, and writeFrame fields.

A new function classifies authentication or network errors into three states: dead (the credential is truly no longer valid), live (the error is likely transient), or unknown, based on error codes, HTTP status, and the outcome of OAuth token refresh attempts. A companion helper reports whether a proxy is being used and whether that proxy is a loopback (local machine) proxy.

A new small list was added internally pairing the values required and egress. There's no surrounding context showing exactly where this list is used.

A new function sends an experiment_gates message, carrying a set of experiment flags ("gates"), over the connection Claude Code uses to talk to its VS Code extension. If sending fails, it logs a warning rather than failing silently.

Claude Code has an internal "teleport relay" mechanism related to prompt caching (a way of reusing previously processed prompt content to save time and cost) that comes into play when a session is forked. New bookkeeping was added to it:

• A boot-time check arms or disables the relay based on whether a cache marker is present, logging a message like "prompt-cache relay stays off: boot had no marker" and firing telemetry events upgrade_teleport_cache and cli_teleport_arm_verdict.
• Tracking of which forked request lines went "direct" (bypassing the relay), so later requests on the same fork skip the relay too.
• A comparison of a captured tools baseline's model and fingerprint, to determine whether a forked request's tool set is still "intact" or has "changed".

Two new internal helper functions each decide whether a plugin-style feature is available before it runs. One covers a module called 'diff', the other a module called 'tips'. Each check requires that the session isn't remote, that the module itself reports it's ready (isAvailable()), that a second internal readiness check passes, and that the module is listed among the currently enabled plugins.

When publishing files that were copied from another artifact, Claude Code normally requires prior approval to read the copy source, and otherwise throws a copy_source_unverified error and records a copies_unpinned telemetry event. There is now an additional condition, checked with a permission function called with copySource: true and action ask, that when true skips both the error and the telemetry event.

When Claude Code exports metrics using OTLP (OpenTelemetry Protocol, a standard format for sending metrics to monitoring systems), datapoints that share the same set of attributes are now grouped together and their numeric values summed into a single row, using the most recent timestamp among them. Previously, each raw datapoint was emitted as its own separate row.

Requests the CLI sends to Anthropic's API now include two additional headers: x-claude-code-request-class and x-claude-code-agent-type. Both are computed by helper functions that classify the request, for example as compaction, workflow, teammate, or custom, and are added to the default headers sent with every model call.