Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
SessionsArea: what it touches
Internal ChangesKind: in v2.1.318,
Internal ChangesSection of the release
What
A program that controls a remote Claude Code session can change its settings with an apply_flag_settings message. Claude Code now removes settings from that message when the session service has not confirmed that only the owner's account can write to the session.
Other changes in the same place:
Counts of refused changes are kept separately for each session.
Log messages about refused changes now give the reason.
Before, the only thing removed this way was plugins below a minimum level.
Why
This makes it harder for anyone other than the session's owner to change a remote session's settings. Programs that change settings on sessions other accounts can write to will find those settings dropped.
