Plugin hook modules get more events and organization policy…

Plugin hook modules get more events and organization policy limits

Plugin hook modules can respond to more events, while plugins people install themselves face limits where an organization manages Claude Code

You'll noticeTier: how much it should matter to you

4Useful: my rating, 1 to 5

4Signal: worth watching, 1 to 5

PluginsArea: what it touches

ImprovementsKind: in v2.1.299, 14 Oct 26

What probably matters to youSection of the release

Unclear Whether the remote switch covers all of these changes or only the warning text is not clear.

What

Plugins (add-on packages) built as hook modules can now respond to more events:

prompt.attachment
session.append, with the attachment, hook-context, compaction, tool-message and note options
session.compact
env.get and env.set, for reading and setting environment variables (named values that programs read when they start)
ui.log

Where an organization manages Claude Code through managed settings, plugins a person installs themselves face new limits:

They cannot change protected environment variables.
Their tool names cannot match the name of a managed MCP server, an outside program the organization has set up to give Claude Code tools.

A warning is added saying some hooks do not run in a plugin a person installs where an organization manages Claude Code. This new code is behind a remote switch that is off unless it is switched on remotely.

Why

Organization policy now reaches further into what plugins can do. Plugins that people install themselves on managed machines may find some hooks do not run there.

Read from

Feature flag

tengu_iterative_haven Not enough to say

Nothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.

This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.299: off

These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.

Read once, for one account on one subscription tier, against v2.1.299. It isn't a statement about your account. What a flag value here can and cannot tell you

How sure we are

Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.

The writer flagged doubtWhether the remote switch covers all of these changes or only the warning text is not clear.

Anthropic's release notes agreeAdded a queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent

The name it cites is new in this buildNew in this build: tengu_iterative_haven

See this entry in the whole of v2.1.299 →

The build it came inv2.1.299

14 Oct 2026 · 439 entries, this one is #15.

Use it now28
You'll notice272
Nothing to try yet19
Under the hood120

Either side of it

v2.1.296Older
v2.1.300Newer

Open the release →

Names in this entry

settingprompt.attachment
New prompt.attachment hook lets plugins rewrite or remove text attached to a message
settingappend
Transcript writing can be redirected to a different storage layer, but nothing turns that on here.
settingsession.compact
A new session.compact plugin hook can intercept and rewrite conversation compaction
settingenv.get
Plugins and hooks gain new permission scopes: session.usage, settings.read, env.get, env.set
settingenv.set
Plugins and hooks gain new permission scopes: session.usage, settings.read, env.get, env.set
settingui.log
Plugins can install code that intercepts tool calls and repaints parts of the terminal interface.

Anthropic's note

Upstream's own release notes for v2.1.299 name something this entry names, so the two are probably about the same change. Probably: the pairing is made on a shared name rather than on the words around it.

Added a queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent

Is this right?