Version 2.1.222

The frames dialog now takes attachedSlugs and an onDetach callback, marks each row with isAttached, and adds an x chord that removes the highlighted frame from the session's list, followed by a confirmation line.

• Each frame row renders with an attached indicator so it is clear which frames are currently in play.
• Pressing x on the highlighted row detaches it from the session rather than deleting the artifact.
• Dismissal is confirmed inline in the dialog.

/artifacts

frame_link_dismiss_dialog

Authors can attach an arbitrary metadata object to command and skill frontmatter and to plugin manifests; it is preserved through parsing but never interpreted by Claude Code.

• Frontmatter parsing keeps metadata when the value is an object; the parsed command shape and its serialization allowlist both include "metadata".
• Plugin manifest validation warns with the fragment "'metadata' must be a free-form object" and states the value will be ignored at load time when it is not an object.
• Both the plugin manifest schema and the skill schema document the field as a free-form map for the author's own use, for example entitlement or catalog fields.
• Metadata keys are no longer folded into the computed declaredFields set.

Free-form metadata for the plugin author's own use (e.g. entitlement or catalog fields). Preserved on the parsed manifest but not read by Claude Code., 'metadata' must be a free-form object

A connected MCP server whose discovery bearer token was rejected now says so in the server list and in the reconnect result, rather than the state being tracked only internally.

• Message directs you to run /login and then reconnect.
• A successful tools/list now clears discoveryAuthFailure in both MCP client implementations, so a recovered server stops showing the warning.

but your claude.ai session token was rejected. Run /login, then reconnect.

ExitWorktree and the session-exit path only move the permission anchor when the target is already covered, so leaving a worktree cannot broaden what the session is allowed to touch.

• the move requires coverage by the session's live launch anchor and witnesses
• a record-derived widening is refused and logged instead of applied

ExitWorktree: not moving the permission anchor to

When a request falls back to another model, the notice explains that only that response came from the other model, and the session model display marks the switch as automatic.

• The old "Switched to X" wording is gone; the notice now says the response was generated or completed by the other model and that the session model is unchanged.
• /status and the model display append a note that the model was automatically switched.
• The fallback notice is carried into the extracted last-assistant-response text with a ⚠ prefix.

This response was generated by ${n} instead. Your session model is unchanged.

When a connectivity check fails and the request went through a configured proxy, the error panel now points at the proxy rather than leaving you to guess.

• The panel names the environment variable the proxy is configured through and asks you to check that it allows the host.
• A docs link is appended alongside the hint.
• The extra line only appears when a proxy is configured and was actually used.

See https://code.claude.com/docs/en/network-config

Worktree re-entry on resume returns a structured outcome that the session reports, instead of quietly continuing without isolation.

• a vanished worktree clears the binding and continues without isolation
• an unverifiable or rejected pin keeps the binding
• interactive sessions show a warning message; headless and print paths write an error to stderr and exit non-zero rather than continuing unisolated
• telemetry tengu_worktree_resume_root_rejected carries the reason and a poisoned flag

The worktree binding has been cleared.

A checked-in project or local settings file can no longer enable Remote Control at startup, closing off a path where cloning a repo changed your startup behaviour.

• The setting is read through the security-sensitive settings path, so only user, policy or flag scope can enable it.
• Project and local settings can still disable it: a false value wins.
• A true value at repo scope is ignored and logged.
• projectSettings is ignored entirely when it aliases user settings.

repo-scoped settings cannot enable Remote Control; set it at user scope (/config)

Authoring a skill, command, plugin manifest or marketplace entry with a non-object metadata value produces a validation warning instead of silent loss.

• The warning names the type actually found and states that the value is dropped or ignored at load time.
• Applies to skill and command frontmatter, plugin manifests, and marketplace plugin entries.

'metadata' must be a mapping (key: value pairs); got

When Claude Code runs under a host that manages the provider, settings-file model configuration is ignored in favour of policy handed down by the parent process.

• Settings resolution gained hostManagedProvider: te.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST.
• With that env var set, model, fallbackModel, modelOverrides and provider env vars are stripped from the policy view.
• A hostModelOverlay built from parent-managed settings is applied in their place; admin modelOverrides are stashed and re-applied to enforcement.
• The managed-settings source enum gained a "parent" value, returned when a parent slice or host model overlay exists.
• Inactive unless CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set.

hostManagedProvider

When the SDK control stream closes with an AskUserQuestion permission request still parked, the request can now be kept answerable instead of being cancelled and denied.

• preserved requests are added to preservedParkRequestIds
• telemetry tengu_auq_park_preserved_at_shutdown, plus tengu_auq_park_preserve_reverted when a hook decision retracts a preserved park
• gated on tengu_cinder_heron with fallback "off"; the helper returns true only when the value resolves to the string "preserve"
• absent a remote value, the old cancel-and-deny behaviour is what you get

Preserving parked AskUserQuestion request_id=, tengu_cinder_heron

The status footer can show a short indicator whose text arrives from the server in the client-data payload.

• Read from the client-data field footer_indicator.
• Text is stripped of control characters, trimmed, truncated to 32 characters and clamped before display.
• Resolves to null when the server sends nothing parseable, in which case nothing renders.

footer_indicator

Plugin skill loading now carries an object-valued metadata frontmatter field through into the loaded skill record.

• Stored alongside declaredFields rather than being dropped during parse.
• No user-visible behaviour attaches to the field in this build.

declaredFields

The rule for wrapping a text/event-stream body in the stall watchdog was widened from a single caller-supplied boolean to name the providers explicitly.

• Now instruments firstParty, gateway and anthropicAws responses.
• Gated on tengu_stream_watchdog_default_on, which falls back to true when the flag is unavailable.
• CLAUDE_ENABLE_BYTE_WATCHDOG overrides the decision, and CLAUDE_ENABLE_BYTE_WATCHDOG_BEDROCK covers Bedrock specifically.

tengu_stream_watchdog_default_on

A connected MCP server whose discovery bearer token was rejected now tells you to re-login instead of showing a generic tools-list failure.

• A dedicated Issue line instructs you to run /login and then reconnect.
• The generic tools-list error is suppressed in that specific case.

claude.ai rejected the session token. Run /login, then reconnect.

MCP connections proxied through the claude.ai connector now surface a specific error telling you to re-login, instead of a generic auth failure that gets retried.

• New ClaudeAiProxyBearerRejectedError class with code CLAUDEAI_BEARER_REJECTED.
• Message: "claude.ai rejected the session token — it may lack connector scopes or be invalid. Run /login."
• Two retry classifiers return false for it, so it is neither retried nor treated as a generic auth failure.
• Added to the known-error name allowlists, alongside McpAuthError and McpError.
• Connection failures report errorCode: "CLAUDEAI_BEARER_REJECTED" on tengu_mcp_server_connection_failed.

CLAUDEAI_BEARER_REJECTED

Forked query tool contexts now default requireCanUseTool to true, so a hook returning "allow" no longer bypasses the permission callback there, and deny rules can now beat a hook allow.

• requireCanUseTool is set to true when the caller does not specify it.
• The hook decision path was reordered so deny and ask rules are evaluated before the "hook allowed but canUseTool is required" fallback, letting a deny rule override the hook even when canUseTool is required.

requireCanUseTool

A can_use_tool answer that names a different tool than the one being asked about is now ignored, so a stale or crossed response cannot approve the wrong call.

• both the SDK control-protocol client and the remote permission bridge record the pending tool name
• the hook and permission response schema gained an optional toolName field
• telemetry distinguishes a match from a mismatch
• in the remote session manager, a mismatch is logged and the local prompt stays up rather than being dismissed, since the worker would drop the answer anyway

bridge_permission_toolname_check, worker will drop it, keeping prompt

Session-store resume tolerates copy failures and strips configuration environment variables from copied data.

• A failed file copy removes the partial destination and logs a skip instead of aborting resume.
• A JSON transformer removes a set of keys plus CLAUDE_CONFIG_DIR from any copied env object, so the resumed session does not pick up the recorded config directory.

sessionStore resume: skipping

A 401 from the claude.ai proxy that a token refresh cannot fix now becomes a typed error telling you to run /login, instead of silently returning the original failed response.

• error code CLAUDEAI_BEARER_REJECTED, recognised by connect, tools/list, prompts/get and skills/list
• sets discoveryBearerRejected on the client and skips the usual "degraded" telemetry
• emits mcp_connect_claudeai_bearer_rejected and mcp_reconnect_bearer_rejected
• the failed entry is evicted from the connection cache so a later attempt retries

claude.ai rejected the session token — it may lack connector scopes or be invalid. Run /login.

When a /btw question is answered by a fallback model after a refusal, the panel shows a warning notice above the answer naming the swap.

• The panel accepts initialFallbackNotice and stores a fallbackNotice alongside each question/response pair in its history
• The notice renders prefixed with a warning sign, above the answer
• Text comes from a refusal_fallback payload returned with the response, carrying original_model, fallback_model and content (truncated)

/btw what does this repo use for tests?

initialFallbackNotice

The frame row layout now reserves space for a browse hint instead of showing a bare "+N" counter when there are more frames than fit.

• The hint names the command that lists everything, so overflow is actionable rather than just a count.
• Layout reserves the room up front, so the hint does not push frames off the row.

/artifacts to see all

A new predicate combines the auto/plan remote mode check with a tool's isDestructive result, so destructive MCP tools still get a permission prompt. It is off in this build.

• When on, an MCP ask-override no longer exempts destructive tools from the prompt.
• Gated on tengu_remote_auto_mode_include_destructive_mcp, fallback value in source is false.
• A new mcpServerAskOverride field was added to four permission telemetry payloads.

tengu_remote_auto_mode_include_destructive_mcp

A third spawn wrapper picked up the same guard as the other two: resolve the command and refuse it if it only resolves inside the current directory.

• The predicate that controls all three call paths is a function that returns false in this build, so no command is refused at runtime.
• If enabled, a command found only in the current directory would be rejected as being in an unsafe location.

not found or is in an unsafe location (current directory)

Session state carries pending branch links alongside pending PR links, with the PR-created path folded into one helper.

• A pendingBranchLinks Map was added to the session state object and to both reset paths.
• Sits next to the existing pendingPrLinks set.
• A new regex matches git, gh, glab and curl in commands.

pendingBranchLinks

Comment threads are now classified per comment into human, agent and unknown lanes, and sending or re-sending a comment to Claude is itself a trigger for auto-reply rather than only a new comment being one.

• each comment carries a lane; a toClaudeAt timestamp marks it as sent to Claude
• new trigger kind redesignated covers existing comments newly toggled to Claude, tracked through a per-thread sentToClaudeAt map
• the composed prompt now explains the row heads [human], [assistant], [human, sent to you] and [unverified lane]

A human sent an EXISTING comment in the thread to you on an artifact you published

Importing a skill from another agent now inspects the source directory and skips the copy with an explanation instead of producing a skill Claude Code cannot load.

• Skips when SKILL.md is larger than the size Claude Code loads.
• Skips when SKILL.md starts with --- YAML frontmatter, which Codex treats as plain text.
• Skips when the directory contains subdirectories that Claude Code would adopt as plugin components.
• Skips when several case or encoding variants of SKILL.md exist in the same directory, and tells you to copy it manually.
• A copy that proceeds rewrites SKILL.md and removes the destination if the copy fails part way.

skill directory has multiple SKILL.md case/encoding variants \u2014 copy the skill manually

Comment rows carry an explicit label when the comment was addressed to Claude, so it is clear which parts of a thread are a request to you and which are other people talking to each other.

• Rows can show a ", sent to you" label, with an "awaiting reply" variant and a variant for when the status cannot be read.
• Threads containing such comments are sorted to the top of the list, and the header count mentions them.
• The tool description now states that only labelled comments are addressed to Claude.
• The anti-injection preamble gained explicit rules that the attribution bracket only ever appears at the start of a row.

Threads with comments sent to you are listed first; list order is not chronological.

The v2 remote bridge can now detect the case where heartbeats keep failing while the SSE read stream is still delivering data, and tears the session down so the transport is rebuilt instead of sitting in a half-dead state.

• Session state tracks consecutiveHeartbeatFailures and heartbeatStreakStartedAtMs, plus a new onHeartbeatLost callback.
• Liveness is judged by a new isReadStreamRecentlyAlive() helper backed by lastLivenessEvidenceAtMs.
• On trigger the session closes with code 4093 and logs "[bridge:repl] CCR v2: heartbeats failing while SSE healthy — closing for transport rebuild".
• Wired through a selfHealHeartbeats option read from the tengu_bridge_selfheal_heartbeats gate, whose fallback is true; the real value comes from remote config.

tengu_bridge_selfheal_heartbeats

Thread listings sort threads with comments addressed to Claude first, and individual comments now report whether they were sent to Claude and whether they are still waiting on a reply.

• per-comment fields sent_to_claude, sent_to_claude_degraded and awaiting_reply
• size-capped elisions state how many hidden comments were sent to Claude, including a count for those whose addressed status could not be read

addressed-status-unreadable

When a side question falls back to a different model, the answer is now preceded by a warning banner naming the original and fallback models instead of silently switching.

• The side-question flow returns a refusalFallback object carrying the original model, the fallback model and the notice content alongside the response.
• The UI renders the banner above the answer only when a fallback is present.
• The control-request response carries the same information as refusal_fallback with original_model, fallback_model and content fields.

fallbackNotice

The v2 remote-control transport now counts consecutive presence heartbeat failures and, when heartbeats keep failing while the SSE read stream still looks alive, closes with a new code 4093 and rebuilds the transport rather than sitting on a dead connection.

• New close code 4093 with human-readable reason text explaining that presence heartbeats to the server kept failing.
• New internals: resetHeartbeatStreak, onHeartbeatLost, and isReadStreamRecentlyAlive, which is what distinguishes a stalled heartbeat from a genuinely dead read stream.
• Gated on tengu_bridge_selfheal_heartbeats; the fallback value in source is true, with the real value coming from remote config.
• Skipped entirely when the session is outboundOnly.

presence heartbeats to the server kept failing (code 4093)

Recovery from 401, 4091 and 4093 transport closes is now table-driven, and repeated transport rebuilds are capped so a bridge that cannot heal stops retrying and says why.

• each close code maps to its own reconnect detail, cause, diagnostic, terminal-vs-retry fetch failure classification and recovered code
• 4093 rebuilds within a one hour window are budgeted; exceeding the budget stops recovery with an explicit message
• new presence telemetry codes: recovery_exhausted, heartbeat_budget_exhausted, recovery_no_oauth_token, recovery_reauth_required, recovery_credentials_fetch_failed, recovery_credentials_rejected, recovery_abandoned_at_teardown, bridge_connect_died_before_presence

presence heartbeats to the server kept failing after repeated reconnects

In the MCP status UI, a server that is connected but whose discovery failed because the claude.ai session token was rejected gets its own line rather than the generic tools-fetch-failure line.

• rendered only for the bearer-rejected case; other discovery failures keep the existing wording

connected · session token rejected

Rather than guessing, auto-reply now defers when it cannot read who wrote a comment or whether it was sent to Claude.

• new defer notices: activation_read_absent (thread no longer shows as activated), newest_lane_unknown (newest comment's author lane unreadable, or an unknown-lane comment follows a sent-to-Claude human comment), and fresh_trigger_degraded
• each reported once per thread through the existing artifact_comments_autoreact telemetry

artifact_comments_autoreact

Worktree plumbing no longer inherits ambient git environment variables, so a stray GIT_DIR or a repo fsmonitor cannot redirect worktree operations.

• covers create, remove, lock, status, reset, rev-parse and sparse-checkout
• blanks GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, GIT_CONFIG_COUNT, GIT_CONFIG_PARAMETERS, the per-index GIT_CONFIG_KEY_n and GIT_CONFIG_VALUE_n pairs, and more
• all calls go through the shared -c core.hooksPath=/dev/null -c core.fsmonitor= prefix

GIT_ALTERNATE_OBJECT_DIRECTORIES: void 0

The refusals you get when a shell cwd or file edit escapes a worktree now name the right subject.

• picks between "This session is isolated…" and "This agent is isolated…" based on whether the pin is the session's own worktree, with a matching possessive
• shell cwd and file edit paths now share one escape-detection routine

possessive: "a worktree-isolated agent's"

A 403 from the plugin and skill search or list routes returns an empty result instead of surfacing an error, so an unentitled account sees nothing rather than a failure.

• The degraded path logs the route and status and records a not_entitled telemetry code.
• Other 4xx responses still throw.
• The error envelope parser now tolerates a response missing type or message.

[plugin-skill-list] degraded to empty: list-plugins 403

Teardown now gives a pending remote-control operation time to finish before tearing down the rest of the session.

• Waits up to 30 seconds and swallows the timeout rather than failing shutdown.
• Runs before MCP client cleanup and session state clearing.

remote_control operation still pending at teardown

Detection of a newly created pull or merge request no longer depends on a single check right after the create command.

• Pending checks are tracked per cwd plus branch with an attempt counter, in a bounded map.
• A successful gh pr create or glab mr create clears the entries for that cwd.
• Later matching git commands re-check pending branches until the attempt cap is reached.

tengu_git_operation

The hello-endpoint probe used by the connection diagnostics now runs on fetch with an explicit timeout and reports whether a proxy was involved.

• Uses AbortSignal.timeout rather than the previous HTTP client, and cancels the response body.
• A timed-out probe is reported as a distinct error rather than a generic failure.
• The result records usedProxy so the failure UI can tell whether a configured proxy was actually in play.

usedProxy

The tool for messaging another agent no longer auto-allows in every permission mode; in some modes it defers to classifier review.

• The permission check can now return a passthrough behavior with a message stating that classifier review is required.
• Recipient names must match a single-line pattern.
• Over-long summaries are truncated rather than rejected outright.
• The classifier input string now carries the summary, shutdown reason, request id and plan feedback.

Message to another agent requires classifier review.

When a subagent cannot get the model it asked for, the notify callback now carries a reason distinguishing a same-family step-down from inheriting the parent's model, and the message shown downstream differs accordingly.

• Reason is either family_step_down, meaning a fallback within the same model family was picked, or parent_inherit, meaning the subagent fell back to the parent session's model.

family_step_down

The refusal shown when a git command would escape a worktree now derives the noun and possessive it uses rather than always saying "This agent" and "a worktree-isolated agent's".

• Same refusal behaviour, only the phrasing is now computed from context.

Refusing to run it —

When the model tries to invoke a skill marked as user-only, the returned error now appends an explicit instruction against achieving the same thing another way.

• Applies to skills with disable-model-invocation set.
• The added sentence closes the loophole of the model reading the skill and re-implementing its steps by hand.

Do not replicate this skill's workflow by other means

Summary and failureReason text from teammates now passes through a trim-and-truncate helper before it reaches the teammate XML tag or the status line.

• The tag's color attribute is validated against the known colour list rather than escaped and passed through.
• SendMessage input repair gained a case that truncates an over-long summary instead of rejecting the call.

truncate_summary

The Codex importer now refuses more source files before conversion instead of producing entries Claude Code would not load.

• SKILL.md files above the size Claude Code will load are rejected, checked both raw and after utf-8 re-encoding.
• A new dangling-shell-exec-marker check runs over command bodies.
• The [features] block goes through a shared helper before being listed as unmappable.

Claude Code skips skills over

The temp directory built to resume a stored session now copies settings.json and cowork_settings.json next to .claude.json, with plugin registration stripped.

• enabledPlugins and extraKnownMarketplaces are deleted from the copied settings.
• The projects directory inside the snapshot is created with mode 448.

cowork_settings.json

Diff reads now pass --no-ext-diff and --no-textconv, so a repo's own git configuration cannot change the content Claude sees when computing patches.

• New exported constant RAW_BLOB_DIFF_FLAGS = ["--no-ext-diff", "--no-textconv"].
• Spread into the git diff invocations used for whole patches and per-file hunks.
• Includes the --no-optional-locks diff calls, which previously passed no such flags.

RAW_BLOB_DIFF_FLAGS

The lock guarding OAuth token refresh tolerates slower refreshes and lets the holder find out if its lock was taken away mid-flight.

• Stale window raised from 10s to 60s, with a 5s update interval.
• The callback now receives an object exposing isCompromised().
• Lock contention throws a dedicated error class rather than a bare Error.

Design OAuth refresh lock compromised

The web-ultraplan banner now says the plan is ready and tells you which key to press, replacing the older "Monitor progress in Claude Code on the web" wording.

• Old text was retired rather than kept alongside the new form.

ultraplan ready

The effort label in the status line is computed against the model actually running the turn, so it stays correct after a mid-turn model change or a fallback.

• The agent status store gained turnModel alongside turnEffort
• setTurnEffort(effort, model) is called at turn start with the resolved agent model, and again on query_model_change and on fallback-model events
• Cleared with setTurnEffort(null, null) at turn end
• The spinner/status component takes the new turnModel prop and uses it when computing the label

setTurnEffort

A forbidden response when listing plugins fails fast instead of burning through the retry schedule, and the failure now reports which HTTP status caused it.

• The list-plugins error envelope returns status along with success: !1, and the status is included in the plugins_sync_list_error warning
• The retry wrapper returns immediately when t.status === 403 rather than sleeping and retrying
• A sibling retry helper was simplified to test t.ok only

plugins_sync_list_error

The CCR v2 transport now spots heartbeats failing repeatedly while the SSE read stream still looks healthy, and closes the socket with code 4093 so the bridge rebuilds the transport instead of sitting on a half-dead connection.

• close code 4093 has its own recovery entry reporting reconnectingDetail: "presence heartbeats failing — reconnecting"
• a successful rebuild emits the presence code recovered_heartbeat_4093
• gated on tengu_bridge_selfheal_heartbeats whose in-source fallback is true, so absent a remote value it runs
• additionally requires !outboundOnly

[bridge:repl] CCR v2: heartbeats failing while SSE healthy — closing for transport rebuild

The thread renderer was replaced so the comments that actually caused this turn are never dropped to fit the budget.

• always keeps the newest comment plus every comment that summoned this turn, budgeting characters across them
• new markers [summoning comment truncated] alongside [newest comment truncated] and [N comment(s) elided]
• summoning_truncated added to the compose_thread_elided telemetry

[summoning comment truncated]

The canned edit-failure replies were reworded to match the send-to-Claude mechanism instead of telling viewers to mention @claude.

• affects the replies posted when an auto-reply edit fails

send a comment to Claude again later to retry.

After creating a worktree, Claude Code checks that the new directory is acceptable as an isolation root and fails loudly if it is not.

• applies to every creation path: interactive, agent, hook-based and resumed
• throws on rejection and records telemetry git_worktree_create_root_rejected

git_worktree_create_root_rejected

Resuming a parked or isolated agent verifies the recorded worktree first and refuses rather than silently landing somewhere else.

• stats and verifies the recorded worktree and touches it
• falls back to a covered directory only when the session's fences cover it
• otherwise raises a terminal error saying the agent cannot be resumed

This agent cannot be resumed: its worktree

A subagent or teammate asking for a model that is not in availableModels now falls to the newest allowed model in the same family rather than straight to the parent or default model.

• Only applies when a same-family allowed model exists; otherwise the old parent/default fallback still runs.
• Emits telemetry code family_alias_stepped_down and a matching warning log.

family_alias_stepped_down

Transcript rows for messages arriving from another session render through a shared component that names the sender and offers an expand chord.

• Shows "Message" or "N messages" followed by "from @<name>" plus the expand chord.
• The name is restricted to letters, digits, dot, underscore and hyphen, and truncated with an ellipsis.
• SendMessage tool labels and teammate summaries use the same sanitizer.

from @

A WebSocket tunnel that never gets its protocol v2 negotiation acknowledged now fails fast instead of continuing in an undefined state.

• Connecting arms a helloAckDeadline; if the server does not acknowledge protocol v2 within the open timeout, negotiation fails with "tunnel protocol v2 negotiation failed" and a reason built from the fragment "no HELLO_ACK within" plus the elapsed limit.
• An ack carrying an unexpected version is rejected, and the connection is closed with a 502 "Bad Gateway".
• The deadline is cleared both on receiving HELLO_ACK and on teardown.
• A new telemetry event agent_proxy_request_v2_not_acked fires on the failure path.

requires tunnel protocol v2; the server did not acknowledge the negotiation (, agent_proxy_request_v2_not_acked

Fallback events now distinguish a session-wide model swap from a one-off fallback in a subagent or side question, so consumers can tell how far the change reaches.

• The SDK schema adds an optional scope enum with values "session" and "local".
• "session" means the main thread swapped models for the rest of the session; "local" means only a subagent, a /btw side question or a background fork fell back.
• The field is absent from older CLIs and should be treated as "session" when missing.
• The event builder sets scope and selects different wording for local fallbacks.

'local': a subagent / side-question (/btw) / background fork fell back

The confirmation shown before importing a plugin or skill no longer talks about allowed-tools frontmatter, and instead spells out that bundled scripts and body instructions become active once imported.

• Warning now asks you to review SKILL.md and its directory, not just the file.
• States that the import is unchecked by default.

bundled scripts and body instructions become active in Claude Code. Unchecked by default; review SKILL.md and its directory before importing.

Handling of the remote_control control request is now wrapped in a single async operation with its own error handling, and it hands off state to the newly created remote session instead of dropping it.

• Old session is torn down only after its callbacks are cleared.
• Pending permission requests and pending user-dialog requests are replayed to the new remote session.
• The initial name supplied in the request is preserved across the swap.

getPendingUserDialogRequests()

Many more git call sites now prepend the frozen safety arguments and run with an environment scrubbed of git overrides, closing off paths where inherited env vars could redirect a git command.

• Newly covered call sites include rev-list, ls-files --others --ignored, worktree remove --force, and config core.hooksPath.
• Sanitized environment strips GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, and the GIT_CONFIG_KEY_n / GIT_CONFIG_VALUE_n family, among others.
• Two additional git diff call sites now also pass --no-ext-diff and --no-textconv.

core.hooksPath=/dev/null

Comment state now records when the server actually handed a comment to Claude, and the client uses that instead of local bookkeeping to decide what has already been shown.

• The comment schema gained sent_to_claude, sent_to_claude_degraded and awaiting_reply.
• The client maps the server's to_claude_at into toClaudeAt and toClaudeAtDegraded.
• A helper parses the timestamp and returns null when it cannot be parsed, so an unreadable value is treated as not-yet-delivered rather than crashing.

to_claude_at

When a turn falls back after a model refusal, the agent's displayed model is rewritten to the model actually used, and the fallback message now carries a scope.

• A new agent event kind propagates turn effort together with the turn model.
• The async-agent reader applies system/model_refusal_fallback by rewriting the agent's model rather than leaving the old one on screen.
• The optional scope field was added at three emit sites and in the parser.

agent-turn-effort

Three new refusal strings spell out why a command was not imported when its body mixes shell execution markers with argument placeholders.

• Covers dangling markers, placeholders combined with backticks or !, and shell blocks containing ! next to argument placeholders.
• Each reason tells the user to port the command manually rather than silently dropping it.

Contains a dangling shell-exec marker that argument substitution could complete into a live command at invocation time. Port it manually.

The attestation notice emitter now keys on event_id and skips events it has already reported, so a single bad event no longer produces repeated warnings.

• The set of seen event ids is bounded.
• The hint about re-pairing a device is no longer restricted to control_request payloads and now shows for any attestation failure.
• A drop-sender notice writer is registered on the remote-io transport and unregistered when it closes.

Re-pair the sending device in Trusted Devices.

Bash and shell execution paths now take an isolationRoot so the checks that keep agent commands inside their worktree have a concrete boundary to compare against.

• isolationRoot is resolved from the agent worktree, falling back to the session worktree path.
• Used by the checks that block commands whose cwd escapes the isolation worktree, and those that redirect git into the shared checkout.
• Blocked commands log with isolationRoot= in the message and report tengu_agent_worktree_cwd_escape_blocked.
• The field itself is new in this build.

isolationRoot

In screen-reader mode the renderer can now erase trailing characters instead of repainting the line, cutting redundant output for assistive tech.

• Diffing tracks a new prevScreenReaderParkDeclared flag.
• The flag guards a new branch taken when the previous frame had an explicitly declared cursor park.
• Only active in screen-reader mode, under INK_SCREEN_READER / CLAUDE_CODE_ACCESSIBILITY.

prevScreenReaderParkDeclared

Collapsed teammate status panels now show a generic label when no specific one is available, instead of rendering an empty descriptor.

• Two collapsed-panel renderers pass fallbackLabel: "teammate" to the count component.

fallbackLabel: "teammate"

A refusal-driven model swap that happens inside a subagent or other non-main thread now surfaces a banner, where previously only main-thread swaps did.

• The refusal-fallback result gained bannerScope, set to "session" for main-thread swaps and "local" otherwise
• Non-main-thread turns emitting local scope now show the banner
• The emitted model_refusal_fallback system message uses different wording depending on the scope

bannerScope

Dated model ids that carry a 1m-context suffix are now reported verbatim in telemetry instead of being replaced with "nonconforming".

• The gate regex widened from ^[A-Za-z0-9._:[\]-]{1,91}@\d{8}$ to allow an optional trailing [<digits>m] group
• Model identifiers that still fail the pattern continue to report as "nonconforming"

nonconforming

A refresh that loses the cross-process lock race is now reported as contention rather than as a failed refresh, and a compromised lock can still succeed.

• New DesignOauthLockContendedError marks the case where another process holds the refresh lock.
• On a compromised lock the stored token is re-read and accepted if it is still fresh.
• New telemetry codes: design_oauth_refresh_lock_contention, _lock_compromised, _lock_error.

Design OAuth lock contention: another process is holding the refresh lock

A thread that returns the same comment id twice no longer renders that comment twice.

• The comment-collection loop keeps a set of already-seen ids and adds each id as it is collected.
• Repeats are skipped rather than appended.

g.add(v.id)

The watcher checks the error listener count before emitting, so a watch error or an error during a pending write can no longer surface as an unhandled 'error' event.

• Check sits alongside the existing ENOENT/ENOTDIR filtering and the ignorePermissionErrors option.
• In the pending-write path, when no error listeners are registered the pending write is discarded rather than emitting an ERROR event.

_pendingWrites, ignorePermissionErrors

A new error class marks a resume that will never succeed, so the retry machinery gives up instead of looping.

• AgentResumePermanentlyRefusedError sits alongside AgentResumeTransientError.
• The observer restarts fresh on it and logs the error name.
• The wake router drops queued events for the affected agent.
• The resume subscriber no longer swallows the error silently.

AgentResumePermanentlyRefusedError

The keep/restore-cwd path now detects a UNC or network-spelled original working directory and throws instead of changing into it.

• The recovery loop falls back to the home directory when the original cwd is network-spelled.
• The path is screened and never touched.

network-spelled original cwd (screened, never touched)

An isolated agent whose worktree was deliberately removed no longer warns on resume that the worktree "is not recorded for this isolated agent". The removal is recorded in the agent's metadata instead of looking like missing state.

• Agent metadata gained worktreeCleanlyRemoved: !0, written at the point the worktree is removed
• The flag is inherited from the parent agent record, so child agents do not re-trigger the warning
• Consulted on resume, and suppresses the git_worktree_resume_binding_missing telemetry event
• Applies to everyone, no gate

worktreeCleanlyRemoved

A message whose summary is only whitespace is no longer treated as having a summary, so it renders in full instead of collapsing to an empty summarized form.

• Message rendering and filtering now pass summary through a trim/normalize helper rather than testing truthiness
• A whitespace-only value no longer counts as present and no longer forces the summarized render path

summary

Stale MCP attribution no longer survives a conversation reset, so a later error or event is not tagged with the server and tool from a previous turn.

• The query loop's tool-state object gained an onReset hook
• The hook calls a new helper that clears activeMcpServer and activeMcpTool on the options object, guarded by try/catch
• The same helper is also invoked at the start of the API loop

activeMcpServer

Removing the last listener for a watched entry whose watcher never started no longer throws.

• Both unsubscribe paths check for a watcher object before calling close or unwatch.

mku(a.listeners) && a.watcher

Resolving the last pending permission or dialog request no longer unconditionally flips the session back to "running" when a park was preserved at shutdown.

• If a park was preserved, the session re-tees waiting-on-user and republishes the surviving pending action instead of reporting running.

hasPreservedParkAtShutdown

A permission response whose tool name does not match the pending request is now rejected with a warning instead of resolving the wrong tool call.

• New helper hasCanUseToolNameMismatch guards three paths: injectControlResponse, the resolve path, and the transcript-side matcher.

does not match pending

The local tunnel now treats data arriving before HELLO_ACK as a protocol error and tears the socket down.

• Error and close paths destroy the socket rather than half-closing it.
• This applies whether or not the connection negotiated v2, so a stuck half-open socket is no longer left behind.

server sent data before HELLO_ACK

The check for an outstanding admin request now looks only at pending requests.

• Previously a request that had already been dismissed also triggered the "already sent" notice, leaving no way to ask again.

You've already sent a usage credit request to your admin.

Leaving or cleaning up a worktree session now returns you to a directory resolved from a recorded anchor, rather than potentially failing when the original cwd is gone or unsafe.

• Active worktree sessions carry liveLaunchAnchor, stripped out before the session is persisted into app state
• On leave/cleanup, a new helper resolves the chdir target; when the original cwd is unsafe it falls back to a repo root inferred from a .claude/worktrees path shape, and failing that to the home directory
• The anchor is also part of the accepted path set when validating changed files

liveLaunchAnchor

When an agent-proxy tunnel closes before a response arrives, the socket is now destroyed in all cases, removing a path where non-v2 connections could linger after a graceful end.

• The branch that ended the socket gracefully for non-v2 connections was removed from the teardown path
• The socket is destroyed unconditionally after "tunnel closed before response"

tunnel closed before response

The import argument handling was rewritten into a parser plus a rewrite decision, but the command itself is not wired up here and prints a message instead of starting a session.

• Gated on a config-derived availability flag; when unavailable it prints the message below and exits.
• If the config cannot be read at all it prints a recovery message instead.
• The --yes help text now mentions a digest taken from the /import preview.

claude import is not yet available in this build. Run claude and use /mcp or edit ~/.claude/settings.json directly.

Several stores now have a v5 backend path sitting alongside the existing file path, taken only when a backend is supplied.

• Covers theme listing and saving, MCP task metadata (write, delete and list under an mcp-tasks sidecar), scheduled-task status, user settings writes, and ranged transcript reads.
• Settings write failures now raise a distinct error naming the failure class.
• Each path is inert unless a v5 backend is passed in; what supplies it could not be determined.

settings storageV5 write failed

The status footer computes an indicator element rendered in the "ide" color with a lozenge glyph, and the compact-footer width maths now reserves space for it. Whether it renders in this build could not be resolved.

• Thresholds deciding whether the compact footer fits add the indicator's width plus five.
• An extra check hides content below 48 columns when the indicator is present.

"footer-indicator"

Reading a foreign agent's Codex config during import now uses Bun's native TOML parser through a one-line wrapper, before the config is mapped.

• The wrapper calls Bun.TOML.parse(e) on the config file contents
• Reachable only via the import path, which is behind tengu_import
• A filename/label normalizer was added alongside it: NFKC normalize, lowercase, strip trailing dots and spaces

Bun.TOML.parse

The first-party event exporter gained a path that stores failed-event batches as append-only v5 streams keyed by run id and retries earlier runs in the background.

• Leftover flat JSON batches are migrated into streams using deterministic record ids of the form flat-migration.<index>.<hash>, and the flat file is deleted afterwards.
• Only taken when a storageV5 backend is passed to the exporter; what enables that backend could not be determined.
• Without a v5 backend the existing flat-file path is unchanged.

1P event logging: failed to persist failed-event queue to v5 stream

Transcript append, truncate and read helpers can now be pointed at a v5 storage backend instead of the filesystem, but only when a backend handle is passed in.

• The helpers take an optional backend handle; when present they call backend.append, backend.delete, backend.readText and backend.stat with a key rather than touching files.
• Failures throw Error("transcript stream append failed") or Error("transcript stream delete failed").
• The exporter class gained a storageV5 field.
• storageV5 existed in the previous build but only on the read path; the write path is new here and inert without a handle.

transcript stream append failed

The control client can remember pending can_use_tool requests for a parked tool when the input stream closes, so they survive shutdown instead of being dropped.

• Preserved ids live in a preservedParkRequestIds set.
• While any are preserved the session is not flipped back to "running".
• Ids are cleared as responses arrive or when the park is retracted.
• Guarded by two internal predicates evaluated at shutdown time that could not be resolved to a flag name.

preservedParkRequestIds

Failed heartbeat POSTs are no longer fire-and-forget; the client tracks a failure streak and reports it upward once it is long enough to matter.

• a set of statuses is ignored outright
• checks isReadStreamRecentlyAlive() before counting, then increments consecutiveHeartbeatFailures
• fires onHeartbeatLost only once the streak passes both a count and a duration threshold
• a successful heartbeat calls resetHeartbeatStreak()
• the onHeartbeatLost handler is only installed when selfHealHeartbeats is on

this.onHeartbeatLost?.()

The wrapper text applied to messages from peer and coordinator sessions, including the permission-laundering warning, now lives in a module of constants rather than inline.

• The wording of the guidance itself is unchanged.
• The list of legacy prefixes stripped before re-wrapping now also matches an alternate "A peer session sent a message…" header.

A peer session sent a message while you were working:

The embedded build-metadata blocks move to 2.1.222 with a fresh build time and git sha.

• VERSION goes from 2.1.221 to 2.1.222 across all four embedded copies of the version banner.
• BUILD_TIME is 2026-08-04T01:24:05Z, with a new GIT_SHA.
• This accounts for the bulk of changed strings in this area: user-agent strings, /status, --version, updater messages and telemetry payloads.

BUILD_TIME: "2026-08-04T01:24:05Z", "2.1.222"

The first user message containing a tool_result in a remote session now emits a dedicated event.

• Fires once, on the first such message, per remote session.
• Tagged with whether the session is viewer-only.

tengu_remote_tool_result_rendered

Two marketplace entry fields no longer validate their shape, so malformed values now pass parsing instead of being coerced away.

• features moved from a typed record with .catch(void 0) to w.unknown().optional().
• project_doc_fallback_filenames moved from a string array with .catch(void 0) to w.unknown().optional().
• Consumers no longer get a guaranteed shape from the parser for either field.

project_doc_fallback_filenames: w.unknown().optional()

The debounced comment scan stores its running promise and clears it on completion, so overlapping scans can be detected rather than the scan being fire-and-forget.

• Promise is held in inFlightScan for the duration of the scan.

inFlightScan

The temp-file writer gained a create-only mode that publishes via link plus unlink instead of rename.

• In this mode an existing destination file is left intact and the write fails rather than overwriting.
• Rename remains the default publish path.

create_only

The message converter no longer branches on a viewer-only mode, so tool-result behaviour is consistent for every caller.

• It now always converts user messages carrying tool_result, and always honours convertUserTextMessages.
• The several callers that passed viewerOnly or convertToolResults were simplified to drop the option.

convertUserTextMessages

Shell adoption picks its schema based on a new option, and exit handoff now works with multiple merge roots.

• The adoption schema is chosen from an extraShellOutputRoot option.
• Exit handoff passes a list of merge roots rather than a single one.

extraShellOutputRoot

A policy view with no model keys sourced from "parent" is treated as cascade-trusted instead of triggering enforcement.

• The availableModels enforcement check previously accepted only the "hkcu" source in this case.
• It now also accepts "parent", returning { state: "inactive", cascadeTrusted: !0 }.

cascadeTrusted

The per-agent UI state updater no longer materializes a store entry for a no-op write.

• The updater takes a materialize option.
• It skips creating an entry when both the effort and the model being set are null.

materialize

The pinned warning shown for pre-filled and deep-link prompts is now built as plain text segments rather than a rendered element. Nothing visible changed.

• The notification is pushed as segments produced by a small helper instead of a JSX element
• A JSX segment-list component was removed
• User-visible strings are unchanged, including "Prompt from an external link" and the scroll/review suffixes

Prompt from an external link

The helper that pulls values like command, file_path, prompt and args out of tool input no longer trusts the shape of the object it is given.

• Rejects Proxy objects outright.
• Reads own property descriptors rather than invoking getters, so extraction cannot run attacker code.
• Bails on array-like values whose length is not a safe integer or exceeds the cap.

OYa.types.isProxy(e)

Detached shell handoff accepts a root to re-anchor output files, so an adopting process can read outputs that would otherwise sit outside its tree.

• Takes a rerootOutputsTo root; outputs resolving outside the task-output tree are dropped and the shell is killed.
• Escaping but known outputs are hardlinked, or copied when linking fails, into <root>/rerooted/<id>.output, with inode identity checks.
• Task output paths and the handoff payload gained an adopt root plus mergeShellOutputReadRoots.

mergeShellOutputReadRoots

Three prompt bodies were relocated into different lazily-initialised modules with no visible change to their wording.

• The multi-agent code-review angle text, the /simplify cleanup prompt and the Batch parallel-work orchestration prompt all moved.
• One call site now returns a short bullet line rather than the full batch prompt.
• Prompt wording itself appears unchanged; only placement and one call site differ.

# Batch: Parallel Work Orchestration

Notification producers now hand back plain data instead of React elements, so the notification layer owns rendering.

• Each producer emits a list of {text, color, dim, bold} segments.
• Affected producers: the option-as-Meta hint, the idle /clear hint, the Remote Control disconnect and unsigned-attestation warnings, the closed-issue notice and the prefilled-prompt warning.

idle-return-hint

A repl-bridge connect timeout now records which path triggered the attempt, so timeouts during recovery can be told apart from those during a token refresh.

• recovery_connect_timeout is used for the auth-401, init-4091, and heartbeat-4093 recovery paths.
• refresh_connect_timeout is used for a proactive token refresh.
• The existing tengu_bridge_repl_connect_timeout event still fires.

recovery_connect_timeout

The agent-workflow system prompt now substitutes the cap constant into the sentence describing how many items one parallel() or pipeline() call accepts, instead of hardcoding the number in prose.

• Keeps the prompt text and the enforced limit from drifting apart.

A single parallel()/pipeline() call accepts at most ${soe} items

The remote-io transport writes an attestation drop notice through the CCR client and now logs a warning if that write fails, rather than dropping the failure silently.

• New handler on the transport; the warning text is "[remote-io] drop sender-notice write failed".

[remote-io] drop sender-notice write failed

Persisting an agent record no longer loses the worktree lineage fields that were set by an earlier write.

• A new persistence wrapper reloads the previous agent record before writing.
• It carries over parentAgentId, inheritedWorktreePath, spawnedWithWorktree and worktreeCleanlyRemoved.
• worktreePath and worktreeBranch are deleted when the prior record had none.

inheritedWorktreePath

The parent-slice settings reader also derives a model overlay from the host-managed provider, and reports it as a source of truth.

• The source-of-truth lookup returns "parent" when either the parent slice or the hostModelOverlay is present.
• Only reachable when a host-managed provider is configured; state otherwise unresolved.

hostModelOverlay

The terminal color name list is now an object literal, with the lookup Set derived from its keys.

• Moved into a separate module init.

magentaBright

Task output writing resolves its file path once per task and creates the containing directory only when the file is opened, replacing an upfront directory-creation step.

• <taskId>.output is resolved through a per-task path cache
• The parent directory is created at open time with mkdir(dirname, { recursive: true })
• The previous upfront directory creation helper was removed
• The cache entry is dropped when the task output is flushed, cleared or cleaned up

.output

The stream converter no longer emits a visible system message when a permission_denied event arrives, so that line disappears from output.

• Previously the event became a warning-level system message naming the tool and the reason.
• The handler now returns an ignored result unconditionally, with no mode or flag that restores the old line.

Permission denied:

Resuming a session no longer stats the recorded worktree, no longer falls back to the parent cwd with a log line when it is missing, and no longer bumps the directory's mtime.

• The fallback block and the associated worktree chdir and restore helpers are gone from this build.

no longer exists; falling back to parent cwd