{"version":"2.1.318","anchor":"remote-io-now-refuses-settings-not-on-an-owner-only-session","canonical_anchor":"remote-io-now-refuses-settings-not-on-an-owner-only-session","heading":"Remote setting changes are stripped unless only the session owner can write","tier":"internal","area":"Sessions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/remote-io-now-refuses-settings-not-on-an-owner-only-session","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### Remote setting changes are stripped unless only the session owner can write\n\nSettings sent through apply_flag_settings are now removed unless the session service confirms only the owner's account can write to the session\n\n**What**\n\nA program that controls a remote Claude Code session can change its settings with an `apply_flag_settings` message. Claude Code now removes settings from that message when the session service has not confirmed that only the owner's account can write to the session.\n\nOther changes in the same place:\n\n- Counts of refused changes are kept separately for each session.\n\n- Log messages about refused changes now give the reason.\n\nBefore, the only thing removed this way was plugins below a minimum level.\n\n**Why**\n\nThis makes it harder for anyone other than the session's owner to change a remote session's settings. Programs that change settings on sessions other accounts can write to will find those settings dropped.\n\n- Area: Sessions\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}