Remote callers can start background shell tasks with start_shell_task

What

A program controlling a Claude Code session from elsewhere (a remote caller) can now ask it to run a shell command in the background. The request is called start_shell_task. A background command keeps running while the session carries on with other work.

• start_shell_task is a new control-request type. It is handled in the same place as turn_handoff and rewind_conversation.
• The request carries a command, args, cwd (the folder to run in), env (environment variables) and a description. Each is checked and shell-quoted, which means wrapped so the shell reads it literally.
• The command runs as a Bash tool call with run_in_background set. It goes through the same permission checks as any other Bash command.
• The answer is started with a task_id, or denied.
• Requests sent before the worker started are refused with "start_shell_task: the request was sent before this worker started; send it again". Requests that are too old are refused too.
• A new capability string, start_shell_task_v1, is listed alongside sdk_mcp_manifests and interrupt_requeue_taken_v1. A capability string lets a client tell whether a session supports a feature.
• Cloud-hosted sessions reject start_shell_task. They already reject poll_event the same way.

Nearby changes add a copy option to an executor schema, and the working-dir parser now reads copy_of. Separately, a list of plugin-hook names that held only command.describe and env.get now also holds agent.offer, attribution.text and prompt.section. Nothing shows that this list is related to start_shell_task.

Why

A remote host can now start long-running shell commands in a session without typing them in. Those commands still need the same permission as a Bash command Claude runs itself. Integrators who target cloud-hosted sessions should expect the request to be refused there.