Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
CCRArea: what it touches
Internal ChangesKind: in v2.1.277,
Internal ChangesSection of the release
What
When Claude Code Remote refreshes its authentication token, the session token it receives can now be one of three things: a decodable JWT (checked as before for expiry and staleness), a non-JWT "gateway placeholder" token that must match either the token currently held in the process or a previously verified JWT, or a token that gets rejected outright. When a placeholder token is adopted, it's logged in the cli_worker_auth_refresh_adopted event with a new session_token field describing which of these cases matched.
Why
This lets remote authentication refresh handle a wider range of valid session token formats without weakening the checks that reject tokens that don't match anything trusted.
