Relayed agent messages can be wrapped in id-tagged system reminders, with escaping so text cannot fake one (tengu_whimsical_elephant)

What

A system reminder is a block of text Claude Code adds to the conversation, marked with <system-reminder> tags, that Claude treats as coming from Claude Code rather than from a person. This release adds reminders that carry a random id, and escaping so other text cannot pass itself off as one.

• A new gate, tengu_whimsical_elephant, controls the feature, and the new environment variable CLAUDE_CODE_WHIMSICAL_ELEPHANT is checked first and overrides it. The fallback is false. The variable was also added to an internal list of environment variables.
• When the feature is on, queued messages from a forwarded turn, a peer (another Claude session, unless it is an activity observation) or a coordinator get a random reminderId.
• Those messages are then wrapped in <system-reminder id="..."> ... </system-reminder id="...">, where the id is 16 to 32 hex characters, instead of being passed through unwrapped.
• Inside the wrapper, any </system-reminder in the content becomes </system-reminder, so the content cannot close the reminder early.
• User or queued-command text that begins with <system-reminder followed by a space has its leading < rewritten as <. Text sent with a valid reminder id is exempt, and a queued command's text is merged into the previous user message when it matches that command's reminder id.

Why

This changes how messages passed between agents are framed to Claude, and it closes a way for tool output, typed text or relayed messages to pose as a message from Claude Code itself.