Version 2.1.224

A new slash command, aliased /peers, lists your subagents alongside other reachable Claude sessions: local ones on the same machine, cloud sessions, and Remote Control bridge sessions. Each row shows status, working directory and age. It appears only when peer messaging itself is available.

• Gated by the same check that enables sending messages to peers, so if messaging is off the command is not listed.

/list-agents

List subagents and other Claude sessions you can message

An MCP tool that declares it requires user interaction no longer has its permission re-checked in the background and auto-proceeded when the check returns "allow". Those tools always reach you.

• The background re-check bails out when the tool reports requiresUserInteraction, which comes from the MCP metadata key anthropic/requiresUserInteraction.
• Separately, the permission-prompt telemetry event now records isMcp, distinguishing MCP tools from built-in ones.

anthropic/requiresUserInteraction

Both options are no longer hidden and now appear in help output. --remote stays hidden as a deprecated alias.

--cloud [description|session_id|url]

After cases run, report.html is written into the results directory even without --report, and the report is published to claude.ai by default rather than only with --publish-report. Pass --no-publish to keep it local. --no-publish and --publish-report together are an error. Publish-by-default is controlled by a server flag whose built-in fallback is on, so with no server value it publishes; an explicit --publish-report ignores the flag entirely.

• The JSON result is now computed once and shared between writing, publishing and printing.
• Publishing failures explain that artifacts are turned off for the account, provider or privacy mode, and the failure text names the local copy when one was written.
• --publish-report's help text changed to match the new default.

claude plugin eval ./my-plugin --no-publish

tengu_quartz_thimble, --no-publish and --publish-report are contradictory — pass at most one.

In auto mode, deciding to ask on the AskUserQuestion tool no longer automatically counts as needing a human and halting the run; it can be classified and handled instead. CLAUDE_CODE_AUTO_MODE_CLASSIFY_ASK_USER_QUESTION decides this if set; otherwise the server-side auto mode config's classifyAskUserQuestion value applies and is treated as on unless it is explicitly false, so with no server value the new behaviour is active.

• The old path logged a tengu_auto_mode_fallback_to_ask event and stopped.

CLAUDE_CODE_AUTO_MODE_CLASSIFY_ASK_USER_QUESTION

With the isolatePeerMachines protection enabled, sending a message to a Remote Control session, to a cloud session, or to a name that could not be resolved because the cloud session list was unavailable, now stops and asks for your explicit approval instead of going ahead.

• The three triggering cases are bridge addresses, resolved cloud sessions, and unresolvable names during a failed session-list lookup.

isolatePeerMachines is enabled \u2014 cross-machine message requires explicit approval

A settings key accepting 60s, 5m, 10m or never sets how long a permission or user dialog forwarded to a remote client stays parked awaiting an answer, and how long a held cross-session message waits for approval, before it resolves to its safe default. Without the setting the timeout is 300000 ms (5 minutes). CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS overrides both.

• The setting is read from trusted configuration sources only.
• Prompts answered locally are unaffected; this only applies to dialogs sent to a remote client.

{ "dialogExpiry": "10m" }

Max time a permission/user dialog forwarded to a remote client stays parked awaiting an answer

A settings key controlling what happens when another of your Claude Code sessions sends this one a message. Values are accept, hold and refuse. Left unset, a message is delivered automatically only when the sending session's permission mode is in the same class as yours, and is otherwise held for you to approve.

• Held and refused messages produce user-facing text naming the setting, for example Your "crossSessionInbound" setting is "hold".

{ "crossSessionInbound": "refuse" }

crossSessionInbound

Domain allow and deny rules in the sandbox now parse a host pattern plus an optional port, so a rule can target a single port rather than the whole host.

• Matching fails closed on both sides: a port-qualified rule matches a request with an unknown port when denying, and does not match when allowing.
• Otherwise the port must match exactly.
• Deny rules still come from sandbox.network.deniedDomains plus WebFetch-style domain: permission rules.

sandbox.network.allowManagedDomainsOnly is set and

claude plugin eval now publishes the HTML report by default when your account supports it. --publish-report changed meaning to "require publishing", and explains why if it is unavailable; --no-publish keeps the report local. Passing both is now an error. --report now means the report replaces the results directory, implying a default location.

• Results from the LLM judge on long inputs now append an advisory suggesting a regex grader instead.

Error: --no-publish and --publish-report are contradictory — pass at most one.

When you are not logged in, both the input check and the tool call stop immediately and name the credential source that is standing in the way: the ANTHROPIC_API_KEY environment variable, the apiKeyHelper setting, a token file descriptor, or a Unix socket, each with its own fix.

• for the environment variable the advice is to unset it, or run /logout and decline the API key approval before logging back in

Unset the ANTHROPIC_API_KEY environment variable, or claude /logout then say "No" to the API key approval before login.

In background and async contexts where a permission prompt cannot be displayed, tools requiring approval are now denied with an explicit instruction not to claim success or retry, replacing the generic "Permission to use X has been denied" wording. A structured decision reason is recorded alongside it.

Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session.

A message arriving from another Claude Code session used to show as raw XML. It now renders with an "@ name" header and the body indented, with the wrapper tags stripped. Outside verbose and transcript mode, and when not queued, it collapses to a compact peer marker.

UserCrossSessionMessage

The built-in feedback drafting tool used to be scoped to Claude Code the product. It now explicitly handles model-behaviour reports too, and will offer to draft one when Claude itself goes wrong in the session: retracting a confident answer, stopping short of the task, declining something reasonable, spawning too many subagents, tone problems, over-questioning, or scope creep.

• Report fields are unchanged: type, title, details, area, failure_mode, task_category.

draft product or model-behavior feedback report queue

After accepting a reverse history search, the cursor now lands on the last case-insensitive occurrence of your search term in the recalled line, instead of a fixed position. If the term is not found in the line, the cursor goes to the end.

• Leaving the search without accepting now restores the input to its pre-search state.

history_search_accept

Records of blocked syscalls in the Linux sandbox now carry the actual command text rather than an opaque internal id, using the same lookup macOS already used. This also means ignoreViolations patterns match against the command you wrote.

resolveCommandText

When another Claude Code session sends this one a message, it can now be held instead of delivered. Two new reasons for holding: the sender's permission mode does not match yours, and a sender that never stated its mode into a session that bypasses prompts. Held messages appear with an explanation and, where a permission handler is wired up, an approve/deny dialog with a preview. Approving, denying or letting it expire sends a status message back to the sender.

• Behaviour is controlled by the crossSessionInbound setting, resolved from policy, flag and user settings, then narrowed to the most restrictive of local and project settings.
• With no explicit setting, a session that bypasses prompts defaults to holding messages and every other session defaults to accepting them. An unrecognized permission mode fails closed to hold.
• Hold reasons recorded are explicit-setting, mode-unknown, mode-mismatch, no-mode-asserted and bypass-default; held, accepted and refused outcomes are all reported.
• The sender-mode matching half is additionally behind the tengu_harbor_kite_mode_emit flag, which is off in this build.
• The approval dialog is registered as a new notification type with its own title.

A message from another session needs your approval, The sender did not attest its permission mode and this session bypasses prompts. Review it below, or set "crossSessionInbound" to "accept".

A plugin turned on solely by settings committed in the repository you opened is no longer written into your own plugin installation records. Previously a project or local settings file could get a plugin auto-installed on your behalf. Plugins backed by your own config are unaffected.

• Skipped entries are logged with the reason that they were enabled only by repo-authored settings.

Skipped auto-recording

Losing the Remote Control connection now adds a warning message to the conversation instead of failing silently, with a hint to run /remote-control to reconnect. The hint is omitted when the reason already mentions logging in, remote control, a restart, policy or an update, and an identical message is not repeated twice in a row.

• only reached while the Remote Control bridge is running
• errors now also record whether the cause was the terminal or something else

\u2014 run /remote-control to reconnect

When the sandbox blocks an outbound connection, it records a violation naming the host, the port and a reason instead of silently failing. Reasons include sandbox policy unavailable, malformed host, host is on the deny list, host is not on the allow list, user denied, and permission prompt failed.

• Blocked HTTP requests get their own violation line with the URL query string redacted.
• A per-domain reason override can be supplied through deniedDomainReasons.
• Domain rules can now carry a :port suffix, matched against the port of the connection.

host is not on the allow list

When you send a message to another Claude session and the recipient holds, denies, or lets it expire, your session now prints a warning line and quietly tells the model not to sit waiting for a reply. Receipts arrive in batches of up to 200 per status and are de-duplicated per recipient address.

• Two surfaces per receipt: a visible warning line, and a low-priority note injected into the conversation so the model stops blocking on an answer.
• Covers held, denied and expired outcomes.

[Cross-session delivery notice]

Memory document content is scanned before it is written, and a match refuses the write with a message naming what matched and noting that the store is shared with everyone on the project. The tool's own instructions carry the same rule. Behind tengu_haze_glass, which is false in this build.

Never write secrets or credentials into a memory \u2014 the store is shared with every collaborator on the project, and such writes are refused.

A new subcommand for people running their own Claude Code runner fleet. It polls the server for hints that more runner capacity is needed and runs ${hooks-dir}/spawn-runner once per hint, so autoscaling is handled by a script you write. --hook-concurrency defaults to 4, --hook-timeout to 60s, and --expected-spawn-seconds to 120 (sent to the server as the lease time). --min-idle requests standby capacity, --debug-dir keeps diagnostics.

• Hook exit codes are a contract: 0 is success, 1 is retryable and backs off, 2 or higher is non-retryable and trips a circuit break.
• The tail of the hook's stderr is forwarded to the server as the failure reason.
• It exits non-zero if the poll endpoint returns HTTP 400, 401, 403, 404 or 426.
• It refuses to start when the hook timeout plus the 5s SIGKILL grace period exceeds --expected-spawn-seconds. The hooks directory is required.

/v1/code/runners/self-hosted/spawn-hints/poll

The bundled tool-use reference now documents max_uses, max_tokens and caching on the advisor tool definition, along with the advisor_tool_result_error content variant and its error codes. The cURL guide gains session budget examples: creating one with max_list_cost in minor currency units, raising or lowering it, or removing it, which is one-way. Agent version is now an integer rather than a string.

advisor_tool_result_error

Messages produced by compaction are now marked synthetic in SDK and stream-json output, so consumers can filter them out alongside meta and transcript-only messages.

• The serialiser now calls a shared helper instead of computing the flag inline from meta and transcript-only checks.
• A local-command result that trims to an empty string after its stdout and stderr wrappers are stripped now returns nothing instead of emitting an empty assistant message.

isCompactSummary

--configure-git sets a git identity of Claude <noreply@anthropic.com>, installs an SSH commit signing program and Co-authored-by hook stubs under <base-dir>/.runner, and requires git 2.34 or newer. The signing itself is done by a new self-hosted-runner code-sign subcommand, which sends the commit to the session's signing endpoint using the session access token.

• --use-anthropic-git-proxy routes clones through Anthropic's git proxy using a repo-local credential helper. It requires --capacity 1 and git 2.32 or newer.
• A governed-git configuration delivered by the server can supersede the proxy, mounting repos read-only and resetting remote.origin.url back to the plain upstream address.
• Only SSH-style signing is supported by code-sign; anything else is rejected.

code-sign: only SSH-style signing (-Y sign) is supported; got:

A marketplace entry can now point at a plugin as an archive: an HTTPS URL for a zip file, with an optional sha256 digest. The digest is checked on every download and also serves as the plugin's version identity, so a changed archive is a changed version. This source type is always available, not gated.

• If the zip contains a single wrapping directory, it is stripped so the plugin's files land at the top level.
• Archives must be served over HTTPS.

HTTPS URL of a zip archive containing the plugin.

A marketplace entry can now point at a zip file over HTTPS instead of a git repo or npm package, with an optional sha256 digest that is checked on every download. When no version is declared, that digest is what identifies the version. If the zip contains a single wrapping directory, it is stripped so the plugin lands at the top level.

• The URL is checked against a new guard that rejects loopback, link-local, IPv4-mapped IPv6, unique-local and cloud-metadata hosts, so a marketplace entry cannot make Claude Code fetch from inside your network.
• Authentication headers are inherited from the enclosing url-sourced marketplace only when the origins match.
• The error message for marketplaces configured in settings now lists this type alongside github, git-subdir, npm and url.

Archive URLs must use https:// and must not point at a loopback, link-local, or cloud-metadata host

Claude Code can now list your organization's self-hosted runner pools (machines your org runs itself rather than Anthropic-hosted ones) and target one for a remote session. Availability is decided by your organization's server-side configuration and first-party login; other auth returns an empty list.

• Pools come from /v1/code/runners/self-hosted/pools with the beta header ccr-byoc-2025-07-29, and each entry carries a pool id, name and a count of live runners.
• A pool id prefixed ccpool_ is sent as the self-hosted pool target instead of the usual environment id.
• A pool default coming from an untrusted source is ignored with a warning pointing at /remote-env, and a public Project rejects pools outright: public Projects run on Anthropic-hosted infrastructure only.
• List outcomes are recorded with separate non-200, API-error and unexpected-response variants.

ccr-byoc-2025-07-29, /v1/code/runners/self-hosted/pools

The runner's health server accepts OTLP/JSON metrics on POST /v1/metrics and merges them into its own /metrics output, labelled with session_id and client_platform. When capacity is above 1 and you have set OTEL_METRICS_EXPORTER=prometheus, child sessions are automatically pointed at http://127.0.0.1:<health-port>/v1/metrics instead, so one scrape target covers the whole machine.

• Requests from any address other than loopback get 403. Bodies over 1 MiB get 413.
• Child metric names that collide with the runner's own claude_code_self_hosted_runner_ prefix are dropped.
• A session's series are swept from the output when that session ends.

OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE

Credential entries under sandbox.credentials can now use decode: "jwt" to swap a real token for a structurally valid fake so client-side parsing still works, and maskClaims to mask only named claims and rebuild the token. A new awsPairs setting groups masked environment variables into access-key, secret and session-token trios so the proxy can re-sign AWS SigV4 requests, and a new sigv4 block sets deny or passthrough policy for streaming uploads, presigned URLs and SigV4A.

• For environment variables, combining decode with extract, or with a fail-closed onExtractNoMatch, is rejected at validation time.
• SigV4A signatures are asymmetric, so there is no shared key to recompute; the sigv4 block decides what happens to them.
• awsPairs and sigv4 are only honored from user settings, managed/policy settings, or the CLI --settings flag, and are now forwarded into the proxy's credential block.
• At startup, a masked environment variable whose name uses the reserved synthesized-placeholder prefix produces a warning and degrades to deny.

Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute., awsPairs

Nine new tools let an operator inspect and drive a self-hosted runner fleet: self_hosted_runner_get_pool, _list_runners, _list_sessions, _list_secrets, _spawn_local, _read_health, _read_metrics, _tail_log and _requeue_session. They load only when the CLI's --base-tools names one of them, and never when CLAUDE_CODE_REMOTE is set or the session kind is "bg". Auth reuses the operator's existing OAuth session, and tailed logs are redacted for secrets before reaching model context.

• The enabling latch is one-way in production: the internal helper that turns the operator tools back off is documented as test-only.
• When a runner spawns a session, any tool name starting with self_hosted_runner_ is stripped from the server-supplied tools list before launch, so a spawned session cannot be handed fleet-operator tools.
• If stripping empties the list, the --tools argument is dropped entirely and the default tool pool is used.

[runner:session] Stripped self-hosted-runner operator tool names from the server-supplied tools arg, self_hosted_runner_spawn_local

Rosters accept a new {"type": "advisor", "model": ...} entry, at most one per roster, letting the main thread consult a more capable model partway through a turn.

• Consultations run as a platform-spawned thread under a reserved name and do not count against the 25-concurrent-thread limit.
• Advice arrives as an agent.thread_message_received event, either plaintext or [{"type": "redacted"}] depending on the advisor model.
• Fable 5 is documented as temporarily unavailable in the advisor role.

anthropic.advisor

Reading an org memory document now shows a version token next to the updated date, writes report the version they produced, and a concurrent edit produces a distinct conflict result telling the model to re-read the document and retry with the fresh token. Requires org memory to be enabled for the session.

• The conflict message is "The memory store reported a concurrent change to this document."
• The conflict result also carries the conflicting path taken from the server response.
• The version token is appended to reads in the form [version: ...].

The memory store reported a concurrent change to this document.

New code fetches your remaining free cloud reviews from /v1/ultrareview/quota (3 second timeout) and can show that count in the slash-command menu, plus two one-off tips: a prose pointer, and a hook that fires after a git commit suggesting /ultrareview before you push. Each of the three surfaces, slash_menu, prose_pointer and post_commit, is keyed separately in the tengu_ultrareview_awareness remote config, so with no server value nothing appears.

• CLAUDE_CODE_ULTRAREVIEW_QUOTA_FIXTURE substitutes a fixed quota response instead of calling the API.

Tip: Run /ultrareview before you push to catch bugs with a cloud-based multi-agent review

The tool that publishes artifacts can now read and write a published artifact's document database, through two new actions read_db and write_db. Reads take a db_op of get, list or query; writes take set, update or delete, addressed by collection and doc_id. The actions only appear in the tool's schema when the tengu_umber_lattice gate is on (source fallback is false, real value from remote config) or the CLAUDE_CODE_ARTIFACT_DB environment variable is set.

• A collection is a path of 1 to 31 slash-separated segments (letters, digits, _ - . ~ : @ + per segment), so subcollections nest like boards/b1/columns; doc_id is a single segment. There are byte caps on the composed document path and on serialized data.
• Queries support where comparators including the Firestore-style array-contains, plus order_by, limit and cursor; list results page through a cursor.
• Rows read back are wrapped in a === BEGIN ARTIFACT DB fence and labelled as collaborator-written data, not instructions, and the read-consent prompt warns that collaborator-written rows will be read into the conversation.
• Prompts flag ownership: a suffix of "(someone else's artifact)" or "(ownership unconfirmed)" and a shared-with note, and the consent prompt says the database is written by its collaborators when a share probe fails.
• Consent is recorded per artifact for the session, once for reads and once for writes, with separate handling in plan mode and for notification-triggered reads.
• Transcript lines render as "read database" and "write database"; verbose mode shows the target document and share status on writes.
• Backend errors are normalised to a fixed set (not found, invalid argument, quota or rate, busy, upstream auth, store unavailable, not declared) each with a human remedy.
• Read is treated as read-only and safe to run concurrently; write is not.

Read a published artifact's database \u2014 collaborator-written rows will be read into the conversation, Database operation: 'get', 'list' or 'query' for read_db; 'set', 'update' or 'delete' for write_db. Required for both database actions; meaningless for every other action., database write committed, CLAUDE_CODE_ARTIFACT_DB, Database collection path: 1-31 "/"-separated segments (letters, digits, _ - . ~ : @ + per segment), so subcollections nest like "boards/b1/columns". Required for read_db and write_db.

Startup opens a local socket so other Claude Code sessions on the same machine can send this one messages. In the previous build the call site was empty. It is off unless the tengu_harbor_kite gate is on (in-source fallback false) or CLAUDE_CODE_HARBOR_KITE is set, and it never runs on Windows.

• Startup clears CLAUDE_CODE_MESSAGING_SOCKET and, unless a socket path was passed explicitly, uses the default path.
• Success and failure are reported as agents_cross_session_inbox, with a bind_failed reason; setup time is recorded as setup_uds_messaging_ms.
• Skipped with a log line on remote thin clients and when the gate is off.

[uds-messaging] Skipped: cross-session messaging gate off

The thinking-effort picker gains a description line under each level: the default level is labelled as the default, and the others show an estimated multiple of the default's cost taken from the model's cost index. When shown it replaces the warning about overthinking at the top level. It is behind the remote flag tengu_marbled_teal, which falls back to off in this build, so whether you see it is decided by server config.

The default effort for this model

The fleet view refresh folds in other concurrent interactive sessions found in the local process registry, so sessions started outside its own bookkeeping appear. Needs both the tengu_fleetview_peers gate (in-source fallback false) and the cross-session messaging gate.

• A registry entry qualifies if it is a different pid, has a session id, reports a peer protocol version at or above a minimum, and was seen within the last 24 hours.
• Synthesised entries are keyed off the other process's pid; a locally known newer name or intent wins over the registry copy.

tengu_fleetview_peers

A tool that lists the other Claude Code sessions you can send a message to now exists and is registered, under the name ListAgents with the alias ListPeers. It is off unless the tengu_harbor_kite gate is on (source fallback false, real value from remote config) or the CLAUDE_CODE_HARBOR_KITE environment variable is set, and it never runs on Windows.

• It is read-only and safe to run concurrently, and returns a single formatted list of reachable agents.
• Its channel and q inputs are both documented as "Not available in this build; leave unset."
• Previously only the name existed as a constant; the implementation is new here.
• The cache key for tool schemas now encodes whether the gate is on, so flipping it does not reuse a stale schema.

list agents you can SendMessage to

SendMessage can now target a peer by local socket (uds:) or by session id (bridge:), with failure advice that distinguishes a stale socket from a busy pipe, and it records a send_message_delivery event with the route taken and the time it took. Both address schemes are refused at validation time unless the peer feature is on, which needs tengu_harbor_kite or CLAUDE_CODE_HARBOR_KITE and a non-Windows machine.

• A socket that is gone (connection refused or missing) and a pipe that is busy produce different guidance.
• The delivery event also carries how long the send waited when it was blocked.
• With isolatePeerMachines on, sending to a cloud session now requires an explicit approval prompt.

send_message_delivery

Cloud sessions can now start from more than the git bundle. A new seeding step finds files that are untracked but not gitignored, hashes them and uploads them to the session, with hard ceilings of 192 files, 104857600 bytes (100 MB) and a 60 second deadline. It is off unless the tengu_violin_wood gate is on (it falls back to off, including on any error) and the project setting remoteFileMode is container_sync. Otherwise the session starts from the git bundle alone.

• The file list comes from git ls-files --others --exclude-standard -z at the git root, and dependency directories are filtered out: node_modules, venv, .venv, __pycache__, build, dist, target, vendor.
• Symlinks, hard links, oversize files and files outside the git root are skipped.
• Each file is uploaded to the session's synced_file endpoint along with a manifest listing what was sent.
• You see a per-file progress line and a summary. When the feature is unavailable you get "Cloud file sync is unavailable for this session; starting from the git bundle alone".
• Telemetry: tengu_dir_sync_inventory carries per-reason skip counts including skipped_too_large, skipped_symlink and skipped_over_budget; upload start/complete and tengu_dir_sync_seed_complete record the outcome.

tengu_dir_sync_inventory, tengu_dir_sync_seed_complete

Decodes a session access token and prints its claims, reading it from an argument, from $CLAUDE_CODE_SESSION_ACCESS_TOKEN, or from stdin up to 16 KiB. Signature verification against the published key set and the expiry/not-before check with 60 seconds of clock skew are both on by default.

• --no-verify skips the signature check, --no-check-expiry skips the time check, --header prints the token header instead of the claims.
• --verify still parses but does nothing, kept so older wrapper scripts do not break.
• Only ES256 and RS256 signatures are accepted.

claude self-hosted-runner decode-token --header

decode-token: signature verification FAILED

The self-hosted runner now writes an executable .runner/code-sign script that invokes self-hosted-runner code-sign. It uses the binary named by CLAUDE_RUNNER_CLAUDE_BIN if set, otherwise a built-in path. Neither the script nor that environment variable existed before.

exec "$BIN" self-hosted-runner code-sign "$@"

The skill docs add inference_geo, either "us" or "global", set inside an agent's model object rather than at the top level as on the Messages API. It is checked when the agent is saved, when a session is created, and on every turn, and it cannot change for the life of a session.

• Unlike effort, an inference_geo given in a per-session model override is applied.
• Omitting it in an override clears the agent's pin.
• Every model in a multiagent roster must use the same geography.

Pinning inference geography

The collapsed activity summary now counts writes to workshop documents (files like .workshop.md or .workshop.html outside your working directory) on their own, with lines added and removed, rather than lumping them in with scratchpad writes.

• Counts are merged across collapsed groups.
• A new pass rolls the counts back when the matching tool result comes back as an error, so failed edits no longer inflate the totals.

workshopLinesRemoved

Groundwork for a per-session attention budget, one of "w25", "w50", "w100", "w200" or "unlimited" and defaulting to "unlimited". A cycle handler emits tengu_attention_budget_cycle, a new attachment type carries the budget into and out of the transcript, and two new key actions "chat:attentionUp" and "chat:attentionDown" exist. None of it is reachable: the chat key bindings and handler map both splice in an empty object where those entries would go.

• The attachment renders nothing and its generator returns an empty list, so the budget never reaches the model.
• The cycle callback also returns early behind two condition checks that this build does not resolve.
• A preserveLiveBudget option is passed into session restore and ignored by the function receiving it.

tengu_attention_budget_cycle, chat:attentionUp

When a session is detected as a copy of another that is still live, a one-time note is queued for the model explaining that history up to the fork point is shared, that the two have since diverged, and how to find and message the sibling. Requires the tengu_harbor_kite gate (fallback false) or CLAUDE_CODE_HARBOR_KITE, and is skipped on Windows.

• Suppresses itself if the note is already in the conversation or already queued.
• Reported as fork_source_note, with a parent_gone reason when the original session cannot be resolved.

This session began as a fork (copy) of another session that is still running

The code that prepares a git working copy for runner and bring-your-own-compute sessions is now in the bundle; the previous release only declared its environment variable. It is not reachable from an interactive session. CLAUDE_RUNNER_FETCH_DEPTH tunes clone depth and accepts full, 0, or a positive integer, with an unparseable value logged and ignored in favour of the default.

• Access is validated with exponential backoff, and fetches retry under a cumulative wall-clock cap, degrading to HTTP/1.1 and low-speed timeouts on later attempts.
• Git's progress output feeds a stall watchdog that sends SIGTERM then SIGKILL to a hung fetch.
• Detects empty remotes and refs that have permanently failed, prefers a delta read-tree reset over reset --hard, and manages detached per-session worktrees.
• Command lines, stderr and telemetry are redacted for URLs and credentials: Anthropic keys, GitHub/GitLab/Slack/Square tokens, JWTs, and Bearer and Basic auth headers.

[byoc:git] Repository is empty, skipping checkout

When a cloud session comes from an ultrareview or ultraplan source and the tengu_woven_harbor server flag is on, creation uses a newer endpoint, and only then are grouping sessions under a --project and dispatching to a Kindling agent accepted instead of refused. The flag falls back to off when the server sends no value, so by default the existing refusals still apply.

tengu_woven_harbor

Set CCR_SHR_SSE_HINTS and the runner holds an event-stream connection to the server and wakes its poll loop as soon as a work_available event arrives, instead of waiting out the full poll interval. It defaults to off, and nothing else in the build turns it on.

• Wakes are jittered by up to 200ms to spread out a fleet reacting to the same event, and the wake source is reported back to the server.
• The stream times out after 45 seconds without a read and reconnects with exponential backoff capped at 30 seconds.
• Wakes are suppressed while the runner is already at capacity.

CCR_SHR_SSE_HINTS

Startup now also loads and starts directory sync apply for the current directory, in the same branch that starts the working-file syncer, and logs dir_sync_apply_import_failed if that load fails. The branch runs only when both CLAUDE_CODE_ENVIRONMENT_KIND and CLAUDE_CODE_DISABLE_WORKING_SYNC are unset, which is the normal local case.

dir_sync_apply_import_failed

The record written when re-entering plan mode now notes when the configuration calls for artifacts first, alongside the plan file and doc paths it already stored.

plan_mode_reentry

Restoring a session after a fork or a pre-clear rewind now passes an option to preserve the live budget, and session restore spreads in an attention budget. Neither takes effect: the receiving function ignores that parameter, and the attention budget variable is initialised to null and never assigned.

preserveLiveBudget

Gateway model discovery, the computer-use lock, session-store loading of ~/.claude.json and user settings, the settings-key presence probe and session transcript lookup all gained an optional new storage backend parameter. When none is supplied, the existing filesystem behaviour runs unchanged, and the computer-use lock call sites in this build supply none.

• Uses namespaced keys such as a "gateway-models" cache key and a "computer-use-lock" state key.
• The lock has distinct error paths: an already-exists result means the lock is held, an invalid-argument result is thrown.
• Whether any given call site uses the new backend depends on what the caller passes, which varies across the build.

computer-use lock v5 create failed

Memory goes from read-only to read-write. Alongside memory_list and memory_read, Claude can now create or overwrite a whole document in a connected, writable memory store, and is prompted to check each of your replies for corrections and preferences worth keeping. Writes are refused for read-only stores, empty content, content over the byte cap, or anything a secret scan flags. Requires memory stores to be connected via CLAUDE_MEMORY_STORES, the allow_memory_sync permission, and CLAUDE_CODE_DISABLE_ORG_MEMORY unset.

• Prompt guidance: one topic per file, frontmatter on each document, and a per-store index document kept current.
• Read-only stores refuse with "The memory store ... is read-only in this session; changes will not persist." Store resolution gained a write flag defaulting to false, which drives that refusal.
• Secret-detection refusal notes the store "is shared across the organization's connected projects."
• Written text is sanitised: control characters become U+FFFD, and line separators including U+2028 and U+2029 become plain newlines.
• The whole feature also sits behind the remote-config flag tengu_haze_glass, whose fallback in this build is off, so the real value comes from server config.
• In auto mode a write is routed to classifier review ("Saving a shared memory document requires classifier review."); in plan mode it asks.

The memory store ${JZo(e)} is read-only in this session; changes will not persist., save a document to a connected project memory store

--pool-secret-file and SELF_HOSTED_RUNNER_POOL_SECRET still work on both the runner and the orchestrator but now print a deprecation warning to stderr. Use --environment-secret-file or SELF_HOSTED_RUNNER_ENVIRONMENT_SECRET instead; the error shown when no secret is supplied at all names only the new spellings.

[runner:warn] --pool-secret-file is deprecated; use --environment-secret-file

A new environment variable lets Bedrock users choose which regional inference-profile prefix models resolve to. Accepted values are us, eu, apac, jp, au and global. It is added to the environment passthrough sets used for sandboxed and spawned processes, so child processes inherit it.

• An older seven-entry region list including us-gov is kept separately, used for parsing Bedrock hostnames rather than for this variable.
• Setting a prefix that cannot be confirmed, or models that resolve to a different prefix, produce warnings (see below).

export ANTHROPIC_BEDROCK_REGION_PREFIX=eu

ANTHROPIC_BEDROCK_REGION_PREFIX

The CLI now ships and dispatches a whole self-hosted-runner subcommand tree: orchestrator, setup, doctor, code-sign, decode-token, plus a bare runner mode. None of this code was in 2.1.223. No flag or remote gate sits in front of the dispatch, so anyone who types the command reaches it.

• Each subcommand lazily loads its own module, so startup for everyone else is unaffected.
• Comes with its own usage text, an operator setup and doctor guide, and a /healthz probe on the orchestrator.
• Entering the path fires a cli_self_hosted_runner_path telemetry event first, then dispatches.
• Around 21k lines of runner code are new to the bundle; whether that reflects a new feature or a packaging change is not something the source alone settles.

claude self-hosted-runner doctor
claude self-hosted-runner orchestrator

cli_self_hosted_runner_path, Usage: claude self-hosted-runner [options]

Running Claude Code non-interactively with --environment now creates a cloud session straight from the command line. It prints the title, session id, view URL and a resume hint, or with --output-format json emits an object with ok, session_id, url and pool_id. A prompt is required, as a positional argument or on stdin, and its absence is a hard error.

• previously this path needed an interactive terminal
• new counters tengu_remote_create_session, tengu_remote_create_session_success and tengu_remote_create_session_error are tagged with entry_point: pool_headless

claude --environment my-pool -p "fix the failing test" --output-format json

Error: non-interactive --environment requires a prompt (positional or stdin). Run from a TTY for an interactive cloud session.

Messages arriving from another session are now sorted into three classes, and a new "coordinator" class (a task notification that carries a peer send-message) is delivered unless you explicitly set crossSessionInbound. Set it to refuse to reject them or hold to buffer them; with no setting at all, coordinator messages are accepted outright.

• The other two classes are peer messages, which follow the existing peer policy, and ungated messages.
• hold puts coordinator messages into the same hold queue as peer messages; the queue drops its oldest entry when full.
• Only an explicit crossSessionInbound value can hold or refuse this class, so an unset config means accept.

Your "crossSessionInbound" setting is "hold".

Set CLAUDE_CODE_MESSAGING_SOCKET to a socket path and Claude Code records it with the session and, when the output format is stream-json, turns on replay of user messages without you asking for it. The variable is also carried through the set of CLAUDE_CODE_* variables Claude Code forwards to what it launches.

• The path is stored on the session registration record as messaging_socket_path.
• Replay is only auto-enabled when it was not already on and the output format is stream-json; other output formats ignore the socket path for this purpose.
• Neither the variable nor the session field existed in the previous build.

CLAUDE_CODE_MESSAGING_SOCKET

A new settings key controls how long a permission or question dialog forwarded to a remote client stays parked, and how long a held cross-session message waits for approval, before resolving to its safe no-action default. Accepts "60s", "5m", "10m" or "never", defaults to 5 minutes, and falls back to the default on an invalid value. Purely local prompts are unaffected.

• Resolution order: the environment variable CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS, then dialogExpiry, then 300000 ms.
• Read from trusted settings sources only, and sits next to the existing askUserQuestionTimeout key with the same enum.

{ "dialogExpiry": "10m" }

dialogExpiry: Ir(["60s", "5m", "10m", "never"]), dialogExpiry

claude --environment <environment_id> starts a cloud session on one of your own self-hosted environments (ids look like ccpool_...). An id that does not parse is rejected with an explicit error. Hidden companions --pool (a deprecated alias), --correlation-id, --ref and --on-branch also exist.

• --bg cannot be combined with --environment; the two are separate backends and you get a dedicated message pointing at direct invocation.
• The --bg argument filter strips --environment and --pool, including their =value forms, before forwarding the remaining arguments.

claude -p "fix the flaky test" --environment ccpool_abc123

Create a new cloud session that runs on the given self-hosted environment (ccpool_...).

Violation suppression is no longer all-or-nothing. A "*" key still applies to every command, and other keys are matched against the command text so you can silence violations for one command only.

• Recorded violations now carry the command, its encoded form and a timestamp.
• The command text is recovered from a bounded cache of encoded commands, falling back to a decode that strips control characters.

ignoreViolations

Incoming messages on the repl bridge were always classified as ungated because the classification was hardcoded, so any text arriving could be run immediately as a command. Messages are now classified from their content, platform, origin and receiver grouping, and the run-immediately shortcut is taken only when that classification really is ungated. Peer and coordinator messages go through the normal accept-or-hold policy.

[bridge:repl] Ran immediate command without enqueue:

In headless runs and async agents, a denial no longer just echoes the request back. The model is now told the action requires interactive approval, that permission prompts are not available in this session, and explicitly not to claim success or retry, with the original request appended.

it requires interactive approval, and permission prompts are not available in this session

Both the periodic history flush and the flush on exit now wait for every pending write to finish before returning, so quitting immediately after a turn cannot drop the last entry.

history_save_exit_flush_failed

The per-session cap on how many forked-skill subagents you can spawn is gone from this build entirely. The rule that only one agent per forked skill runs at a time is now checked both before and after the async write that reserves it, closing a window where two launches could both get through.

forked_skill_live_duplicate

A malformed sandbox.credentials block used to be dropped entirely, leaving no credential protection in place. It now degrades to a deny-everything skeleton: all sigv4 signing modes deny, and implicit AWS credential pairing is suppressed rather than left open.

• Invalid awsPairs entries become non-functional suppressors built from the conventional AWS environment variable names, with a deterministic suffix so the result is stable across runs.
• The sigv4 sub-keys streaming, presigned and sigv4a each degrade individually to "deny".
• allowPlaintextInject degrades to an explicit false, so a lower-precedence settings file cannot turn it back on.
• A single object where a list is expected is accepted as a one-element list with a warning.
• A valid credentials block is salvaged out of an otherwise invalid sandbox value, with every other sandbox field ignored.

The credentials block was salvaged from the invalid sandbox value and stays enforced; every other sandbox field was ignored.

The single "needs claude.ai login" message split into three: sign in to a console account, a remote session whose launching machine is not signed in, and a session running on a credential injected by its host environment that takes precedence and cannot be changed from inside the session.

but this session authenticates with a credential injected by its host environment, which takes precedence and cannot be changed here

Startup registers an internal hook that watches Bash tool output and injects a system message when it sees a completed git commit, so the model is prompted to review what was just committed.

• Registered as an internal PostToolUse callback hook with a timeout of 1, matching the Bash tool names.
• Fires only when the command looks like a git commit and the output matches commit-shaped patterns such as create mode or N files changed.
• Skipped in one mode check; registration sits in the same non-plugin-only startup branch as the session file-access hooks.

registerUltrareviewPostCommitHook

Recalling an earlier prompt from history now restores its pasted attachments, not just the visible text, and each entry records the submit mode it was sent with, such as bash mode. Setting CLAUDE_CODE_SKIP_PROMPT_HISTORY still turns recording off entirely.

submitMode

The self-hosted runner tools now check up front that you are on Anthropic's own API and signed in with claude login. An API key is not accepted. Failures carry the HTTP status, and 401 or 403 responses append a hint pointing at claude login and ANTHROPIC_BASE_URL.

• The API base is ANTHROPIC_BASE_URL with trailing slashes stripped, falling back to the built-in Anthropic API URL.
• These tools are only reachable from the setup and doctor wizards.

Self-hosted runner management is only available on the first-party Anthropic API provider.

When a transcript is too large to share, Claude Code now tries progressively stripped versions rather than giving up. It walks a ladder of candidates (full, without the last API request, raw transcript lines only, metadata only), size-checks each before sending, and posts the first that fits.

• A successful reduced upload records "payload_stripped" so it's visible that content was trimmed.
• Size failures and RangeError during serialisation fall through to the next variant; the precheck reports payload_too_large_precheck.
• Blocked outcomes (essential-traffic-only mode, data residency, auth) still fail immediately with their own reason codes and are not retried.

payload_too_large_precheck

There is no longer any cap on how many subagents one session can spawn. The limit, its error message and the counter that tracked spawns have all been removed. Subagents launched from a forked skill still stop at the nesting depth limit and still refuse to start a duplicate of one that is already running.

• CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION still appears in a list of recognised environment variable names, but nothing in the build reads or enforces it.

forked_skill_depth_cap

The flag now appears in help output with text explaining that it runs the authoring interview, that this is already the default in a terminal, and that it needs an interactive terminal. --interview stays as a hidden alias.

Run the authoring interview (already the default in a terminal); requires an interactive terminal

Two new subcommands re-launch Claude with a fixed system prompt and a restricted tool allowlist to guide an operator interactively. setup goes from creating an environment in the Admin UI to a live runner and writes ./runner-setup/CHEAT-SHEET.md. doctor works through nine diagnostic categories one step at a time and produces a redacted tarball you can attach to a support escalation.

• Both run with --permission-mode default and tools limited to Bash, Read, Write, Todo and Task plus the typed runner admin tools.
• doctor additionally gets tools to list sessions and requeue a session; setup gets the tool that spawns a local runner.
• Outcomes are recorded under telemetry names cli_self_hosted_setup and cli_self_hosted_doctor, including spawn_failed, child_signal and child_nonzero.

Start the self-hosted runner doctor wizard. Greet me, then ask me to describe the symptom or pick from the 8 diagnostic categories. Work through it one step at a time.

CLAUDE_CODE_DISABLE_ARTIFACT, and the managed disableArtifact setting, are now checked first in two more artifact enablement paths. Previously those paths could still report artifacts as enabled with the kill switch set.

CLAUDE_CODE_DISABLE_ARTIFACT

Claude can now prepare a draft feedback report about Claude Code locally. Nothing is sent automatically: the draft waits for you to review and submit it via /feedback, and the model is instructed not to announce it in the middle of a task. Scope covers both product bugs and the model's own behaviour, such as retracting a correct answer, stopping short of finishing, or spawning too many subagents.

• The prompt prescribes a fixed bullet structure for the draft, with a failure_mode field filled in only for reports about model behaviour.
• Whether this tool is exposed in your session is not something the bundle itself decides.

Queue a draft feedback report about Claude Code

The local socket used for session-to-session messaging binds under $XDG_RUNTIME_DIR/cc-socks/<pid>.sock, with the directory created 0700 and the socket 0600, and its path exported as CLAUDE_CODE_MESSAGING_SOCKET. If you pass --messaging-socket-path pointing at a socket something is already listening on, startup refuses rather than hijacking it.

• Falls back to a /tmp path, or $PREFIX/tmp under Termux, when the primary path would exceed the 103 byte limit on socket paths.
• Non-local paths are refused outright.
• Input is line-delimited JSON; any line over 1 MiB is dropped.

--messaging-socket-path points to a live socket:

Marketplaces can now offer a plugin as a downloadable zip. A new source kind archive takes an HTTPS zip URL plus an optional sha256 pin; when the pin is set every download is checked against it and the install is refused on mismatch, and the digest also stands in as the plugin's version when none is declared.

• Downloads are hardened against server-side request forgery: HTTPS only, loopback, link-local and cloud-metadata hosts refused, at most 5 redirects, a 256 MB size cap, a 120 second timeout, and a fixed User-Agent of Claude-Code-Plugin-Manager.
• Headers configured on the enclosing marketplace url-source are only reused when the origin matches.
• Installed plugin records gained a contentSha256 field, and the temp directory used during install has an "archive" naming case.

plugin archive URL policy rejected

The health listener (--health-port, default 8080, 0 disables) now serves Prometheus metrics at /metrics alongside /healthz. The runner exports claude_code_self_hosted_runner_: capacity, active and initializing sessions, per-platform session counts, init duration, poll errors and per-session idle time. The orchestrator exports claude_code_self_hosted_orchestrator_: queue depth, spawn-hook outcomes, spawn-hook and queue-wait histograms, clock skew and connector state.

• Poll-error series are pre-seeded for all five kinds (transport, timeout, 5xx, 429, 4xx) so rate() queries work from the moment the process starts rather than from the first error.
• Whether the listener bound successfully is reported through telemetry named self_hosted_healthz_listen.

text/plain; version=0.0.4; charset=utf-8

Before starting a session, the runner inspects the checked-out repo's .claude/settings.json and settings.local.json for grants that would escape the session workspace and reports or blocks them. --confine-repo-settings (or SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS) picks enforce, warn or off; the CLI defaults to warn, which logs what it would have refused and starts the session anyway.

• What it looks at: permissions.allow paths, sandbox filesystem allowRead/allowWrite, additionalDirectories, bare Edit and Write rules, env set by the repo, and any repo override of the operator's sandbox or hooks posture.
• Symlinks and .. are resolved, and a path that cannot be resolved is treated as a violation rather than allowed.
• An invalid value for the flag fails at startup rather than silently falling back.
• Outcomes are reported through telemetry named self_hosted_confine, with separate reasons for warn and enforce.

self_hosted_confine_violation_enforce

The runner gains a set of flags for managing how long it lives. --retire-at (or SELF_HOSTED_RUNNER_RETIRE_AT, an absolute Unix timestamp in seconds) releases active sessions, stops accepting new work and exits 0. --release-idle-session-min and --startup-timeout-min (default 15) are watchdogs, --kill-session-after-min waits for the current turn to finish first, and --drain-wait-sec sets drain time.

• --drain-wait-bg-tasks-sec is a deprecated alias for --drain-wait-sec.
• --push-outcome-on-release pushes the session's tracked outcome branches to the source remote when a session ends without completing, and fetches them back if that session later resumes on a fresh worker.
• Retirement releases sessions through the same path as idle release.
• Release outcomes are reported through telemetry named self_hosted_release_session, with reasons including released_false_backstop.

SELF_HOSTED_RUNNER_RETIRE_AT

Checkout hooks, post-session hooks and the remote runner environment now export CLAUDE_RUNNER_SESSION_UUID and CLAUDE_CODE_REMOTE_SESSION_UUID, so your scripts can key on the session. Neither existed in 2.1.223.

• The value is derived from the session id by decoding its trailing segment into a canonical UUID; if that does not decode, the variables are left unset.
• Only set on the self-hosted runner and remote session launch paths.

CLAUDE_RUNNER_SESSION_UUID

Passing --scm-connector-host opens a persistent WebSocket to Anthropic and proxies inbound HTTP requests to a GitHub Enterprise server that is only reachable from inside your network. --scm-connector-id is required alongside it, --scm-connector-provider defaults to ghe, and --scm-connector-ca-file supplies a custom CA. The connector is entirely off unless you pass the host flag.

• Requests are checked against a method allowlist, hop-by-hop headers are stripped, and paths that would escape the configured origin are refused.
• Frames asking to open a raw socket or a PTY (wsOpen, ptyOpen) are rejected.
• Close code 4003 means another orchestrator already holds this connector; it retries after 30 seconds.
• --scm-connector-host-rewrite is documented as being for end-to-end testing only.

/v1/code/scm-connectors/{provider}/{id}/tunnel

The bundled claude-api skill, the documentation Claude Code consults when you ask it to write code against the Claude API, now documents a session budget. It is set at create time only, in minor units and USD only, for example {"type": "limit", "max_list_cost": {"amount": "2500", "currency": "USD"}}. A session that reaches the cap pauses idle instead of terminating, and only resumes if the budget is raised or removed.

• A paused session accepts only settle events: user.tool_confirmation, user.tool_result, user.custom_tool_result, user.interrupt.
• Removing a budget is one-way; it cannot be added back to that session.
• Raising the cap must exceed what the session already spent, otherwise the API rejects it.
• Claude Code will generate and explain this shape whenever the skill is in use.

budget.max_list_cost must be greater than the session's consumed list cost

The activity summary after a turn reports workshop writes as their own line, "workshop making/made N page edit(s)" with a diff stat of lines added and removed. If nothing else happened but hooks ran, it adds a line counting how many PreToolUse hooks fired and how long they took in total.

• Workshop write counts and line deltas are tracked per tool call.

hookTotalMs

Claude Code can build a listing of the memory files under a directory and feed it in as an extra memory source, under a virtual path named <auto-memory-index> rather than a real file. The content begins with a generated line naming the directory and noting that the paths below it are relative. It is off unless a server value enables tengu_stone_shell, whose built-in fallback is false, and it is skipped entirely when CLAUDE_CODE_REMOTE is set.

<auto-memory-index>

New read and write operations address documents by page address, collection path and document id, with errors for a bad address, an over-long composed path and a missing document id. Consent is remembered separately for reads and writes, and again separately for approvals given by a person in plan mode.

• The stored consent covers write approval, human write approval, and per-address lists for read consent and human read consent.
• Whether these operations are offered unconditionally or behind a flag is decided by the tool's schema, which is not resolved in this build.

doc_id is required for a get

The effort level slider can label each level with an estimated cost multiplier against the model's default effort, shown as ~2x or ~0.25x, with a distinct note on the default level. It is behind the tengu_marbled_teal gate, which falls back to off, and it also needs per-model cost index data to be present.

the estimated cost of

When another session sends file attachments, they are now checked before Claude sees them: the attachment list is schema-parsed and capped in count, each path must sit inside the transfer staging directory, must be a regular file, and must match the declared size and hash. Verified files are copied into an uploads directory with owner-only permissions. This runs only with peer messaging enabled.

• A file that fails any check is logged with a [peer-file-transfer] prefix and surfaces as a notice, rather than being attached silently.

transfer path is outside the file-transfer spool

A build-gated change to the memory tools makes every write carry if_version: either the 12-character version token returned by the most recent read or write of that path, or the literal word new for a document that does not exist yet. The model therefore has to read a document before overwriting it. Reads now return the token; listing does not. Off in this build unless the tengu_haze_glass gate is on, which defaults to false.

• A stale token, or new against a path that already exists, rejects the write and returns the current content (when it fits within the read size cap) plus its current version, so the model can merge and retry.
• Rejections are recorded as tengu_memory_tools_version_conflict with the reason.

Every ${lS} needs if_version. Pass the literal word new for a document that does not yet exist.

The new artifact database actions ask before first use, and the prompt spells out how far approval reaches: approving a write covers database writes to any artifact for the rest of the session, approving a read covers that one artifact for the rest of the conversation. Writes persist and are visible to everyone who can open the artifact. The actions are gated behind CLAUDE_CODE_ARTIFACT_DB and the tengu_umber_lattice gate.

• In plan mode the request is always routed to the user rather than the automatic permission classifier.

Claude wants to write to this artifact's database \u2014 writes persist and are visible to everyone who can open the artifact; approving covers database writes to any artifact for the rest of this session.

Teleporting to a cloud session can now inventory your git root and upload untracked working-tree files so the remote session starts with them, reporting progress as it goes. It needs both the tengu_violin_wood gate, whose fallback is off, and the per-project setting remoteFileMode set to container_sync. If the upload times out or is unavailable, teleport falls back to sending the git bundle alone.

• Uploaded files go under a .ccr-seed prefix accompanied by manifest.json and ready.json.
• New telemetry events: tengu_dir_sync_inventory and ccr_dir_sync_seed.

Cloud file sync timed out after

Messages passed between agents now include the sender's permission mode in the message header, drawn from a fixed two-value list, and the parser preserves it when a message is relayed through further hops.

from-mode=

The guidance for writing plugin evals now names the fields that actually exist: suite.plugins for checking the plugin loaded, and costUsd for the cost figure in aggregate-result.json. It previously said plugins and cost_usd.

The pilot's top-level \costUsd\ in \aggregate-result.json\``

On the runner and bring-your-own-cloud execution path, CLAUDE_RUNNER_FAIL_FAST_FETCH makes a git fetch fail immediately instead of retrying, and CCR_DELTA_RESET makes the fetch record HEAD beforehand and treat the "Resolving deltas" 100% progress line as a point that resets the stall timer. Both are read as plain booleans from the environment.

CLAUDE_RUNNER_FAIL_FAST_FETCH

Publishing a review page for the first time now rejects more than 3 unchanged-item entries, more than 3 followups, a bottom line longer than 600 characters, or any concern body longer than 300 characters. Pages already published under the older, looser limits can still be republished as they are.

bottom_line over the first-publish cap

Among the new database errors for artifacts is one for publishing: if the artifact's currently published version does not declare the db capability, the call fails and tells you to republish with it declared. Database access is opt-in per artifact rather than automatically available. Gated by CLAUDE_CODE_ARTIFACT_DB and the tengu_umber_lattice flag.

this artifact's current published version does not declare the database capability \u2014 republish it with the db capability declared, then retry

Creating a cloud session can now build a different request body for the newer session-create endpoint, carrying worker, source, outcome, seed bundle and branch-reuse fields in place of the older single session-context blob. It applies only when an account-level check passes and the session comes from ultrareview or ultraplan; nothing in this build sets that check, so what accounts get is decided elsewhere. --project and agent dispatch still refuse outright on accounts still using the old endpoint.

v1alpha2

A new note injected into the conversation tells the model that this session is a copy of another session that is still running, when the copy was made, and how to find and message the original. It is off by default: the path is disabled on Windows and otherwise falls back to tengu_harbor_kite being false, so it only runs if remote config or CLAUDE_CODE_HARBOR_KITE turns it on.

• The note is wrapped in <fork-source> tags in the prompt.
• Queued and pending prompts are checked first so the note is not added twice.
• Logs fork_source_note, with a parent_gone outcome when the original session can no longer be found.

This session began as a fork (copy) of another session that is still running:

New code builds a memory index at load time by walking the memory directory, taking the most recently modified files and reading each one's name and description header fields, falling back to the filename and first heading. The result is rendered as markdown and truncated at a byte budget. It runs only for stores that ask for a generated index; stores without that keep using an index file on disk.

• The walk skips dotfiles and is capped on depth, number of files and per-file size.
• Emits tengu_memdir_index_assembled with scan counts, how many files needed the filename fallback, whether output was truncated, and whether a disk index was superseded.
• The consolidation prompt has a matching variant that drops the "update the index file" step in favour of keeping each file's header fields accurate.

tengu_memdir_index_assembled

The Artifact tool can expose a pr_review option that publishes a composed pull request review page from a JSON payload you author, rendered through a bundled template. It is backed by a large new review format covering diagrams, flows, before-and-after comparisons, concerns with visuals, and followups. The helper that decides whether the option is offered returns false unconditionally in this build, so the option never appears.

Publish a composed PR review page: file_path names the structured payload .json the artifact-pr-review skill had you author, and the page is built from the bundled review template at publish time.

Main-session assistant messages are now checked for text that looks like Claude Code's own internal control markup, including system reminders, harness envelopes and token-count, session-context, wake and role-turn shaped lines. Nothing is rewritten; the matches are only counted and reported.

• Runs for main-session, non-error assistant messages only, with no flag involved.

tengu_assistant_output_harness_content

Four entries in the bundled model list now carry a cost multiplier per effort level, for example low: 0.47, medium: 0.74, high: 1, xhigh: 2.41, max: 5.59 on one and a gentler xhigh: 1.6, max: 1.7 on others, alongside the existing default effort of high. The remote config schema was extended to match, each level an optional positive number, so a server can override them. No code in this build reads the values back.

• The data is present in every build, which points at cost-aware effort selection landing later.

effort_cost_index

Resolving whether remote control is on at startup now returns the origin of the value as well: managed policy, a command-line flag, user settings, an older global config value, a project or local setting turning it off, or nothing set. The warning that repo-scoped settings are ignored is unchanged. Nothing in the build was found reading the origin.

legacy_global_config

A session flag for "wizard operator tools" ships defaulting to off, and its setter refuses to be passed false outside tests. Once something enables it during a session, nothing in normal operation turns it back off. No code in this build turns it on.

setWizardOperatorToolsEnabled(false) is test-only: the wizard latch is one-way in production

A failed transcript share now shows in the dialog rather than only in telemetry. You get the line "Couldn't share the transcript." and, unless DISABLE_FEEDBACK_COMMAND or DISABLE_BUG_COMMAND is set, a dimmed hint "You can share details with /feedback instead." The dialog auto-closes after the usual delay.

• Previously a failure produced only a transcript_share_failed telemetry event and no on-screen change.
• Implemented as a new share_failed UI state with its own render branch.

You can share details with /feedback instead., Couldn't share the transcript.

If you have a default self-hosted environment configured and start a session without picking one explicitly, Claude Code fetches your org's environment list in the background and logs a warning if the configured id isn't there. The id is still sent, because the server validates it when the session is created.

• Warning text ends with "is not in the org's environment list".
• A pool fetch that fails outright is logged separately rather than blocking the session.

is not in the org's environment list

Whether the remote-control bridge starts, and whether it runs full or outbound-only, is now decided by a single resolver that weighs the CLAUDE_CODE_REMOTE environment variable, the --remote-control flag, the explicit setting, a built-in default, and the CLAUDE_BRIDGE_REATTACH_SESSION and CLAUDE_BRIDGE_REATTACH_OUTBOUND_ONLY variables.

• The outcome is reported as tengu_rc_autostart_resolved, carrying the explicit setting and where it came from, the default and its source, and the mode that won.

tengu_rc_autostart_resolved

If inference-profile discovery is unavailable, setting a region prefix now warns that it is being applied without an availability check. If discovery works but some models resolve to a different region, a second warning names how many and states that the prefix is a preference, not a residency guarantee.

• Warning text is assembled at runtime around the fixed fragment "is being applied without an availability check (inference-profile discovery is unavailable)."
• Both warnings only appear when ANTHROPIC_BEDROCK_REGION_PREFIX is set.

This is a preference, not a residency guarantee.

The session details list gains a "Peer address" row showing the messaging socket as uds:<path>. It appears only when cross-session messaging is enabled and CLAUDE_CODE_MESSAGING_SOCKET is set; this slot was previously always empty.

• Cross-session messaging is gated by tengu_harbor_kite or the CLAUDE_CODE_HARBOR_KITE environment variable.

Peer address

Calling the prototype skill yourself now marks prototype mode as started, as invoking it any other way already did. This does not happen when the skill is only being preloaded or when the model scheduled the invocation itself.

prototype_started

Bridge failures now record whether they were an auth problem or a terminal one, and auth failures show the /login hint. The token-refresh failure message changed from "re-authenticate, then re-enable Remote Control" to text ending "run /login to re-authenticate".

• App state gains an error-kind field alongside the existing error, set to "auth" or the default "terminal", and cleared wherever the error is cleared.

run /login to re-authenticate

When an MCP server's OAuth flow fails because the server echoed back the wrong issuer, the failure is now reported with a specific reason rather than a generic one, making misconfigured servers easier to identify.

• Three new failure reasons: issuer_echo_denied, issuer_echo_mismatch and issuer_response_mismatch, each raised from its own error class and checked ahead of the existing reasons.
• One authorization-server metadata discovery path now skips the library's built-in issuer check and validates the issuer itself afterwards, throwing the existing "AS metadata discovery failed: issuer mismatch" error.
• MCP connect telemetry gains a sibling-probe field, computed only in auto negotiation mode, on both the success event and tengu_mcp_server_connection_failed.

issuer_echo_denied

Commands run in the sandbox now pass an identifier through to the sandbox wrapper, where it appears as a command id in the macOS and Linux sandbox configuration, so sandbox activity can be traced back to the command that caused it.

• A new sandbox attribution id option is threaded through the bash and PowerShell exec path into both sandbox wrapper entry points.
• The macOS sandbox log watcher was reworked to decode its command marker through a caller-supplied resolver, defaulting to identity, instead of a pre-built ignore map.

sandboxAttributionId

When the untracked files at your git root exceed the seeding budget, the upload is refused and you are told why instead of quietly starting from the git bundle alone. There are two messages: one counting files against the 192-file budget, one counting bytes against the 100 MB transfer budget, and the byte one suggests adding a .gitignore entry.

• Same gating as the seeding feature itself: the tengu_violin_wood gate plus remoteFileMode set to container_sync.
• The fallback is bundle-only seeding, and the existing seed telemetry records a too_many_untracked outcome.

untracked files exceed the v0 seed budget of, of untracked files exceed the v0 seed transfer budget of

A new docs section describes loading skills from a mounted repository's root .claude/skills directory. Skills are discovered once per session from the code as it stood when the session started, and this works in cloud sandboxes only, not self-hosted.

• Carries an explicit warning that repository skills are agent instructions running inside your trust boundary, so anyone who can commit to the repo can change agent behaviour.

Skills from a GitHub repository

The setup wizard's spawn tool starts a detached self-hosted runner process, defaulting its working directory to ./runner-setup/workspace, its log to ./runner-setup/runner.log and its pid file to ./runner-setup/runner.pid. Companion tools read http://127.0.0.1:<port>/healthz and /metrics on port 8080 by default (0 disables the listener). The permission prompt warns that the runner will keep running after this session ends.

• The spawn passes --environment-secret-file, --capacity, --base-dir, --api-url, --health-port and --log-file.
• The metrics tool reads only gauges prefixed claude_code_self_hosted_runner_, skipping histogram buckets, per-session idle seconds and poll error totals.
• Tail-log reads the trailing bytes of the log and redacts secrets before showing them.
• These tools are only available inside the setup and doctor wizards.

claude_code_self_hosted_runner_

Bad marketplace entries in your settings are now reported instead of quietly accepted. A non-object extraKnownMarketplaces value is deleted outright, and each entry is validated, with a mismatch between the map key and the marketplace name it declares called out by name. Offending entries are removed and surfaced as warnings against the settings file and path.

• The warning text is "Invalid marketplace entry was ignored: " followed by the reason.
• Entries with an unrecognised source kind, or that carry plugins, are skipped rather than dropped.

Invalid marketplace entry was ignored:

When your organization ships managed settings, consent to the dangerous ones can now be recorded against the org rather than only against the local payload you saw. Consent is stored in a new remote-settings-consent.json, capped at 20 organizations and rewritten at most once a day per org, and you are not re-prompted while the org record's hash of the dangerous settings still matches.

• Requests now carry the organization and account ids so the response can identify which org the consent belongs to.
• Without an org record, the previous behaviour applies: the locally consented payload is compared directly.
• Consent is not recorded if the signed-in identity changed part-way through the fetch.
• A login or logout during a fetch discards that fetch's result, reported as reset_during_fetch.

Remote settings: Cache was reset (login/logout) during this fetch; discarding its result, remote-settings-consent.json

A network request blocked by the sandbox is now recorded as a violation with its method, sanitized URL, reason and the command that made it, instead of only being dropped. Filesystem violations on Linux and macOS also gained command text.

• Applies only while the sandbox proxy and platform monitors are running.

deny http-request

When the sandbox blocks an outbound connection, the violation record now includes the shell command responsible, so you can tell which command tried to reach the network rather than only seeing that something did.

• The proxy's auth check returns a result object carrying an encoded command instead of a plain yes/no.
• The proxy Basic credential username may now be srt or srt.<suffix>; the SOCKS path previously required an exact srt match. The suffix decodes to the command identity, set from SRT_ENCODED_CMD when a command id is supplied.
• The decoded command is passed to the allowlist filter and to the denial callback, and violation records carry both the encoded form and a resolved command string.
• Requests failing the auth check still get the existing 407 and 403 responses.

SRT_ENCODED_CMD, encodedCommand

Publishing a plan now requests a plan template from the HTML publisher and records the resulting page under a plan storage namespace, in the same registry used for prototypes. Existing plan pages are enumerated so a new plan does not reuse an existing address.

namespace: "plan"

Remote Control now separates auth failures from other disconnects. When the worker token expires or is rejected, the session closes with a dedicated code and the message points you at /login, instead of the previous generic re-authenticate wording.

• New close code 4094, "worker credential expired or rejected (code 4094)", used for token_expired and auth_exhausted.
• epoch_conflict, epoch_stale and session_not_found keep close code 4090 and recover through the poll loop.
• The cause-based mapping applies only when the transport is built with causeTypedCloseCodes; both v2 bridge call sites pass it as true, so it is live.
• The 404-exhaustion path now names its cause explicitly as session_not_found.

worker credential expired or rejected (code 4094)

Writes to workshop files are now tracked separately, with a per-turn count of writes and lines added and removed, and the status display shows the write count.

• Tool classification gains a workshop-write flag; the turn summary accumulates write count plus lines added and removed.
• Edits are keyed by tool use id so a rewind subtracts exactly the right amounts, and counts merge when summaries are combined.
• The status component reads all three values and includes the write count when deciding whether there is anything to display.

isWorkshopWrite

A message sent between sessions now includes whether the sender was running in bypass or prompting permission mode, so the receiving side can see how permissive the sender was.

• Rendered in the message envelope as from-mode="...", limited to the two values bypass and prompting.
• Parsed back out on receipt and preserved when a message is re-encoded.
• Both the local socket peer client and the bridge sender accept the mode as their final argument.

["bypass", "prompting"]

Claude Code emits two new events around prototype artifacts: one when a prototype run starts, and one when a prototype is published, carrying the artifact's slug and whether it was the first publish.

• The publish event records artifact_slug and is_first_publish.
• Neither event name exists in the previous build.
• The functions that emit these events are new; which artifact flow calls them was not traced, so it is not clear from the build itself which user actions trigger them.

prototype_publish

claude plugin eval --json now checks its result against the expected shape before printing. If validation fails the JSON is not printed at all and a warning goes to stderr instead; if it merely differs from the expected shape a warning is printed and the result is still emitted.

• On drift, a result_schema_drift counter fires and the result is still printed.
• On outright validation failure, output is withheld entirely and stderr carries the explanation.
• New outcome telemetry records pass and fail counts, how many cases hit run errors, and separates exits caused by a cost ceiling from exits caused by a case that failed to load.

warning: --json result withheld because it failed schema validation

A message delivered to one session from another of your sessions, sent by the model through a coordinator SendMessage, now carries subkind: "peer-send-message" on its origin instead of being indistinguishable from a scheduled trigger. Anything reading origin.subkind should expect this additional value alongside scheduled-trigger.

• These deliveries keep the same prompt authority as task notifications but are now distinguishable on the wire.
• The classifier stamps the new value when an inbound message arrives over the coordinator path, so the receive-side crossSessionInbound setting can apply to it.

so the receive-side crossSessionInbound setting can apply to it

When you approve remote settings that can run shell commands, set environment variables, install hooks or write CLAUDE.md, that approval is now written to a remote-settings-consent.json file so you are not asked again for the same content.

• Records are keyed by organization uuid and store the account uuid, a hash of just the dangerous portion of the settings, and a timestamp. If that portion changes, the hash no longer matches and consent is requested again.
• The file is written with 0600 permissions and the number of records is capped.
• If the file is unreadable or was written by a newer version, it is left alone rather than overwritten.

Remote settings: Consent records file is

The permission prompt for publishing a file no longer describes it as rendering to an "Artifact". It now says the HTML or Markdown file is published as a page on claude.ai, on Anthropic's servers, private by default, and the prompt says whether it goes to a new page or a named existing one.

Publish an HTML or Markdown file as a page on claude.ai (Anthropic's servers), private by default.

Uploading a session transcript to the remote side no longer decides what is new by comparing a stored index against the message count, which could miss or duplicate work after a compaction. It now anchors on message ids and tracks which it has already seen, logging when it detects that history was rewritten.

• Messages are counted as seen without being uploaded once the session binding has detached.
• Uploads of compaction pairs are skipped entirely for sessions carrying history-backfill suppression, with a log line saying so.

[persist-remote] Skipping compact-pair upload: session carries history-backfill suppression

Claude Code now records, for each enabled plugin, whether it came from this session's own config. Lockfile freshness checks only require a matching lock entry for those plugins, so plugins inherited from elsewhere no longer trigger a relock.

fromOwnConfig

A remote bridge session that gets a 401 during startup now refreshes the OAuth token and tries again, instead of failing. The refresh runs at most once per access token, and if it lands on the final attempt an extra call is made with the fresh token.

• Reports bridge_repl_v2_init_401_refresh with a flag saying whether a token was actually refreshed or no refresh was available.
• Disconnect reasons "untrusted_device" and "session_stale_relogin" are now classified as auth problems rather than terminal failures, so they take the recoverable path.

bridge_repl_v2_init_401_refresh

Finding the right project folder for a session no longer depends only on the folder name. Claude Code reads the working directory recorded inside the transcript files and compares it, optionally ignoring case, which disambiguates project folders whose names were truncated.

• Reads a relocated path ("relocated" / "relocatedCwd") from the end of the file, falling back to "cwd" via a fast per-line scan of the head.
• The recorded path is sanitised the same way project folder names are before comparison.
• Transcript lookup by session id now also walks worktrees.

relocatedCwd

Passing both now says the two are different backends and shows the direct command to run instead, rather than reusing the older --cloud wording.

--bg and --environment are different backends. Use claude -p '<task>' --environment <id> directly to start a session on the environment.

When the server rejects a worker registration with HTTP 409, Claude Code reads the reason from the response and reports either a stale registration with no live successor or being superseded by a newer worker, instead of one generic conflict.

• The two outcomes log separately as cli_worker_epoch_stale and cli_worker_epoch_mismatch.
• Reading the response body is skipped when the client has already closed.

cli_worker_epoch_stale

The automatic classification of an AskUserQuestion prompt now sees each option's label, description and preview, the header, and whether multiple selections are allowed, instead of only the joined question texts. Malformed payloads are handled rather than throwing.

• A payload that cannot be read is substituted with [malformed AskUserQuestion input] and classification continues.

[malformed AskUserQuestion input]

Listing memory stores now includes an index field giving the path of each store's index document, and reading a memory entry can return a version alongside the content.

• The list tool's parameter description was updated to mention the index document path.
• version on read output is optional and absent when the store does not supply one.

and the path of its index document

Feedback bundles now include the most recent API request, giving more context when a report is investigated.

• The captured bundle gained a lastApiRequest field.
• Raw transcript capture no longer takes the shortcut of reading the whole file when it is small enough.

lastApiRequest

Saving to a memory store that is read-only in the current session now fails immediately with the reason read_only and a list of the stores you can write to, instead of appearing to succeed and not persisting.

• The system prompt describing the memory index now names the store that owns each entry and marks read-only indexes.
• Only reached when connected memory stores are in play; which flag enables those is not settled by anything in this build.

is read-only in this session; changes will not persist.

Messages addressed to another session skip the usual validation: plain text is accepted without the normally-required summary, and structured object messages are rejected outright with a note that only plain text can cross sessions.

• Applies to recipients addressed through the two cross-session transports; ordinary in-session recipients are unaffected.
• Requires cross-session messaging to be available in the session.

structured messages cannot be sent cross-session — only plain text

A reattaching bridge can now install only the live transcript writer and skip syncing the historical conversation, which avoids re-sending a transcript the remote client already has.

• The REPL passes the suppression flag through and marks that suppression was applied; the skip is logged.

[bridge:repl] Persistence backfill suppressed — installing live writer only

After forking, Claude is now told that the fork runs as its own session, that its work is invisible to the current conversation, and that it can be reached by name through the session roster. This branch previously attached nothing.

• The message is produced only when cross-session messaging applies; otherwise nothing is attached.

The fork runs as its own separate session

When you name a peer session that is not found, the refusal now adds a note if the listing of sessions reachable over the remote bridge timed out or failed, explaining those sessions can only be replied to from this machine and cannot be addressed by name.

• Backed by a marker recording why the listing failed, with values timeout and fetch_failed.

and files can't be sent to it by name from this machine.

Host entries controlling which credentials get injected into a sandbox are now normalized to a bare host pattern and de-duplicated before matching, so an entry written with a port or scheme still matches, and repeated entries collapse.

• Applies to the environment variable, AWS key-pair and masked-file credential resolution paths.
• Only affects the sandbox credential configuration path.

degradeToUnsetNames

A plugin installed from a downloaded archive with no pinned checksum now gets a 12-character version derived from the hash of the content that was actually downloaded, rather than reporting "unknown". The log line says whether the hash was pinned or downloaded.

Using archive sha256 version for

The message shown when there is no terminal dropped its "(or pass --interactive)" suggestion, since the interview needs a terminal either way. It now just says to re-run in a terminal.

No TTY available \u2014 writing a blank template. Re-run in a terminal for the authoring interview.

When a plugin archive's declared entry paths do not exist under the directory install picked, it now retries against the archive's single wrapper subdirectory, and can fall back to the archive root instead, logging which one it used.

• Covers the common case of an archive whose contents sit one level down inside a single folder.

Plugin archive entry paths resolve at the archive root; using it instead of the promoted subdirectory

Each command validated from a skill's preamble now gets its own tool-use ID rather than sharing the caller's, so results and permissions no longer collide between them.

• IDs take the form parent id + :preamble- + index; the Bash tool finds that marker in the id and recovers the parent id from the text before it.
• The separate :inner suffix keeps its existing meaning.

:preamble-

The environment picker now shows your configured self-hosted pool even when the server's pool list does not include it, so a freshly configured pool is selectable straight away.

• Applies to pool ids beginning ccpool_; the synthesized entry reports zero live runners and no creation date.

self_hosted_pool

When a clone fails, the repository URL is redacted out of the error and stderr text. Redacted URLs containing $&-style sequences are now inserted literally instead of being expanded into surrounding text.

--filter=blob:none

When Claude Code cannot list the other sessions it can reach, the failure is now recorded as a failure instead of coming back as an empty roster. This matters for the ListAgents tool, which only records what the model saw when the listing actually succeeded.

• Failure is set when auth preparation throws, when the list request throws, or when the server returns a non-200 status.
• Logs [bridge:peers] auth prep failed:, [bridge:peers] list request failed: and [bridge:peers] list failed.
• The population fetch carries the failure flag through and logs a "FAILED, not recordable" marker.

[bridge:peers] auth prep failed:

Downloading an inline plugin now uses the shared retrying rename when moving the finished download into place, which should cut spurious failures when the destination is briefly locked.

• Replaces a direct rename of the partial download file, immediately before the "Downloaded inline plugin from" log line.
• Plugin manifest load failures now report through a helper bound to the span name, taking only the reason (plugin_load_manifest_read_failed, plugin_load_manifest_json_invalid), and reuse the already-resolved manifest lookup.

plugin_load_manifest_read_failed

The description of the feedback tool now says it covers Claude Code the product or the model's own behaviour in the current session, so complaints about a bad answer are in scope rather than just product bugs.

• New text: "Queue a draft feedback report about Claude Code — the product OR the model's own behavior in this session — for the user to review and send later."
• Still controlled by the feedbackDrafts setting: notify (default), quiet, or off, where off disables the tool entirely.

Queue a draft feedback report about Claude Code \u2014 the product OR the model's own behavior in this session \u2014 for the user to review and send later.

When a conversation is compacted, the marker for that boundary is now eligible to be emitted in streaming output alongside local command messages.

• The filter accepts system messages with subtype compact_boundary; previously only local_command passed.
• A predicate can be registered to suppress them; with nothing registered it defaults to allowing them, so in this build they are emitted.

compact_boundary

When your project has no writable team memory location, the instructions telling the model how to save memories are dropped from its prompt entirely, leaving only a statement that access is read-only.

• The removed block is the "## How to save memories" section.
• What remains: "You have read-only access to team memory synced from your project. You cannot persist new memories in this session."
• A shorter one-step variant of the save instructions is used when no index is required.

You have read-only access to team memory synced from your project. You cannot persist new memories in this session.

If a pasted block is no longer available when you submit, it is now removed from the prompt and you get a notice saying so, instead of a literal placeholder being sent to the model.

• The old placeholder text "[Pasted text #N — content no longer available]" has been removed.
• Pastes flagged as unavailable are excised from both the shortened and fully expanded prompt.
• The notice is built from "is no longer available and was removed from the prompt", with a plural form "are no longer available and were removed from the prompt", and labels the item either "Pasted text" or "Truncated text".

is no longer available and was removed from the prompt

The file named by CLAUDE_CODE_HOST_CREDS_FILE is now run through the same path normaliser as sandbox allow/deny entries and permission deny rules, so a trailing slash no longer changes whether the rule matches.

• Sandbox deny and allow filesystem entries, permission deny rules and the host credentials path all share one trailing-separator-aware normaliser when sandbox rules are built.
• Previously each of these handled paths its own way.

CLAUDE_CODE_HOST_CREDS_FILE

Sandbox violation lines are normalized and have < and > removed before being stored, so violation text cannot smuggle tag-like markup into anything that later displays it.

addViolation

The memory read and memory-list tools now report empty search text, so their contents are excluded from transcript search indexing. Read results also carry a version derived from the document's content.

extractSearchText

The shared command-running helpers now pass through stdout and stderr options when a caller supplies them, so child process output can be redirected instead of always being buffered in memory.

preserveOutputOnError

Installing a plugin whose marketplace entry has a source kind this version does not recognise now fails with a direct message telling you to update Claude Code, instead of a generic error.

• Message: "This plugin uses a source type your Claude Code version does not support. Update Claude Code and try again."

This plugin uses a source type your Claude Code version does not support. Update Claude Code and try again.

Sending a message to another agent no longer goes through the auto-mode permission classifier, so it avoids classifier input parsing and does not count toward denial totals.

SendMessage

When Claude Code cannot read back a page to verify a live edit, republish or publish, the message now branches on the HTTP status. Any 4xx other than 408 and 429 is reported as permanent with advice not to retry, 403 adds a note to retry at most once because a concurrent republish can cause it, and reads blocked by the environment's network allowlist say so.

An HTTP ${zt.status} failure is not transient, so retrying this live-edit cannot succeed \u2014 WebFetch the page to check its state.

The sandboxed network proxy now copies a request body only for methods that carry one, or when a content-length or transfer-encoding header is present, and tears down both streams when a request is malformed or denied. Deny messages were reworded and encrypted-tunnel requests are now filtered against a decoded command name.

denied by sandbox policy

Asking for the interactive authoring interview when there is no real terminal attached now prints an explanation and exits 1, instead of trying to run the interview. The message tells you to either run it in a terminal or drop --interactive and pass a case name to get a blank template. There are two wordings depending on whether you supplied a case name.

The authoring interview requires an interactive terminal (TTY). Run claude plugin eval init in a terminal, or drop --interactive and pass a case name (e.g. claude plugin eval init my-case) to write a blank template instead.

claude plugin eval init my-case

When listing Bedrock inference profiles throws, an error-level log now says it is falling back to the built-in model list and includes the underlying error text. Previously the failure was silent and you only saw the fallback models.

Failed to list Bedrock inference profiles, falling back to hardcoded models:

Path rules for permissions and sandbox filesystem access now strip trailing separators the same way everywhere, with separate handling for Windows paths and for UNC network paths. A new internal option controls whether that cleanup is also applied to the part of a path after a glob.

evenAfterGlob

The multiagent docs gained a step-by-step section with Python examples: start with a roster of just {"type": "self"}, move reading-heavy sub-tasks to a cheaper worker model, and only then add dedicated specialists. The overview and skill entry point now point fan-out shaped work here.

• The URL fetched for live docs was wrong and is corrected from multi-agent.md to multiagent-orchestration.md.

https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration.md

The docs previously said each agent update produced a version numbered with a timestamp, and gave a timestamp example. They now say versions start at 1 and increment by one on each update.

• Also tightened: effort is the only field exempt from full replacement when you supply a model object, and supplying model without inference_geo clears any pinned geography.

a sequential integer, starting at 1 and incrementing on each update

When a request is denied or AWS SigV4 re-signing fails, the proxy now destroys the client socket and, if the original socket is a different one, fails that too, instead of leaving a half-open connection.

• Separately, if an incoming request declared a body but neither content-length nor transfer-encoding survives into the outbound headers, the proxy sets transfer-encoding: chunked.

AWS SigV4 re-signing failed:

If you message a session name that does not resolve, Claude now says which of three things happened: the name matches a Remote Control session that can only reply to you from elsewhere, the name genuinely does not exist, or the list of remote sessions did not load in time, in which case it hedges rather than claiming the name is wrong.

bridge population not ready within

Proxy settings injected into the sandbox (HTTP_PROXY, ALL_PROXY, CLOUDSDK_PROXY_USERNAME, and the socat/ssh ProxyCommand) now use a username with an instance suffix rather than the fixed srt, so concurrent sandboxes no longer share one identity. If the suffixed name would exceed 255 bytes it falls back to plain srt.

CLOUDSDK_PROXY_USERNAME=

Cached OAuth discovery details for MCP servers are now re-checked against policy before reuse and kept only for a fixed window. If the cached authorization server fails the check, stored credentials are invalidated and the cached entry is cleared instead of being reused, so a server that has moved or been disallowed no longer silently authenticates against a stale endpoint.

Returning cached discovery state (authServer:

A memory path longer than 1024 bytes is now rejected, and callers that ask for unsafe segments to be rejected also refuse reserved directory names such as skills, commands, agents and hooks. The refusal message was rewritten and no longer echoes the raw path unescaped.

and are not reserved names (skills, commands, agents, hooks, and similar

Marketplace fetches now enforce a maximum response size and inspect redirects before following them, and errors redact the fetched URL out of the technical details shown to you.

• Plugin entries are checked for declared component paths, limited to 32 entries and rejecting URLs and traversal-style segments.
• Archive extraction can now descend into a single wrapper directory when that directory contains a .claude-plugin directory.

beforeRedirect

Memory tool results no longer flood the terminal. At most 10 lines are shown, each line is cut at 200 characters with an ellipsis, and a dimmed "+N more lines" note is appended. Running in verbose mode disables both limits.

• Errors are unwrapped from their <tool_use_error> wrapper, with the first line shown in the error colour and the rest clamped the same way.
• Wired in for the memory_write tool family.

<tool_use_error>

If you log in or out while a remote settings fetch is in flight, the result is discarded instead of being applied over the newer state. The refresh snapshots an auth version before fetching and returns early if it changed.

• Logs "Remote settings: Refresh superseded by a login/logout reset; not notifying".
• A pending reset callback now also runs on the failure path, and chains onto an in-flight refresh when one exists.

Remote settings: Refresh superseded by a login/logout reset; not notifying

A remaining plugin install call site was brought in line with the others, so installing from a marketplace entry now looks up its source and forwards the archive credentials and the component paths declared in the manifest. Authenticated archive sources work on that path too.

entryDeclaresComponents

The session/environment picker now shows a labelled divider row above your self-hosted entries instead of a blank spacer, so it is clear where that group starts.

— Self-hosted environments —

A marketplace entry that fails validation is still listed as unsupported, but now carries the validation reason, and an install attempt reports it. Entries that genuinely declare a source type Claude Code does not support keep the old generic message.

This plugin's marketplace entry is invalid:

Writing into a directory that belongs to a project memory store now gives one of two messages. If memory stores are configured through the CLAUDE_MEMORY_STORES environment variable you get the existing overwrite warning; otherwise you get a new message saying the directory is a leftover local copy that nothing syncs or recalls.

• Which message you see is decided entirely by whether CLAUDE_MEMORY_STORES is set.

This file's directory is a leftover local copy of a project memory store that is no longer synced.

The sandbox's HTTPS proxy now logs each denied request with its method, URL and the reason it was denied, so a blocked network call is traceable rather than silently failing.

• The proxy takes a denial callback; the log message is assembled at the time of the denial.
• When an incoming request has a body but the outgoing headers ended up with neither content-length nor transfer-encoding, the proxy sets transfer-encoding: chunked so the body is still framed correctly.
• If either side of the connection died while the request filter was running, the proxy now tears the connection down cleanly.

onFilterRequestDenied

On WSL, the periodic settings refresh now reads the inherited Windows settings file asynchronously and awaits it, instead of doing a synchronous read on the interval.

• Disposal is rechecked after each await so a refresh in flight does not act on a torn-down poller.

wslWindowsFile

Sending a message to a name that only matches a reply-only remote session now explains that specifically, rather than returning a generic not-found. The text states that the Claude Code Remote send_message connector cannot reach these sessions and that the "untrusted device" error it produces is misleading.

• When the peer list itself fails to load, the fetch is now marked as failed so the caller hedges instead of flatly refusing.
• Only reachable when cross-session messaging is active in the session.

it cannot reach these device-gated sessions, and its "untrusted device" error is misleading

Rate-limit state now reaches a connected remote client immediately. On bridge connect the current state is written to the peer, and later rate-limit events are written to the bridge channel as well as the local stream. Forwarding failures are logged, not thrown.

• The connect-time send is skipped if a rejection window has already elapsed, and is recorded as bridge_rate_limit_forward.
• Both paths build the event through one shared helper.
• The connect-time send is also guarded by an internal predicate whose source of truth sits outside this code path.

bridge_rate_limit_forward, rate_limit_event forward failed

Giving --cloud a task description while also passing --environment and piping stdin is now rejected instead of letting stdin quietly win. When an environment is given, creating the session also prints its id.

• The error for public projects now tells you to drop --environment instead of mentioning Anthropic-managed environments.

Error: --environment with --cloud <description> cannot also take piped stdin. Pass the task as the description, or drop --cloud.

OAuth failures against an MCP server now classify issuer-echo problems separately from generic auth errors, so logs and telemetry can tell them apart from cases like a redirect URI mismatch or a Microsoft Entra specific failure.

• The token refresh path can now fail with the distinct reason mcp_oauth_refresh_issuer_echo_denied.

issuer_echo_mismatch

Listing peer sessions used to return a partial list silently once it exhausted its page budget. It now tells the caller and the log line that more sessions exist.

pages (more sessions exist)

When you reattach to a remote bridge session that no longer exists, Claude Code mints a fresh session instead, and that session is now flagged to skip backfilling history it does not have. The replacement also gets a neutral fallback title rather than inheriting the old one.

• The flag is threaded through the transport options, the bridge-session transcript entries, the session-state maps and the clear/save helpers, so it survives save and restore.
• Triggered by a reattach-target-gone callback; nothing else in the build sets the flag.

noHistoryBackfill

Generated evaluation reports now elide the middle of the evidence block shown to the judge above roughly 20000 characters, keeping the first 16000 and last 4000 and leaving a marker that points at the full text in the JSON artifact on disk. The judge prompt uses the same elision.

• The aggregate results file is now written with a trailing newline.

aggregate-result.json, full text in aggregate-result.json

A dropped repl bridge connection now records an error kind alongside the error message, and close code 4090 distinguishes a session worker registration that has gone stale with no active worker holding it from a session the server does not have, instead of showing one generic message for both.

the session worker registration went stale \u2014 no active worker holds it (code 4090)

Deny-mode credential masking rules now discard a decode value that is not "jwt", and discard maskClaims unless it is an array of strings, on top of the existing cleanup of the extract, no-match and duplicate-masking options.

maskClaims requires decode \u2014 without a decode format there is no token to read claims from. Set decode, or omit maskClaims.

When SendMessage cannot find a teammate, the teammate has left, the roster has duplicate or unreadable entries, the failure is now tagged as not reachable. A new case covers the recipient's inbox write returning nothing, and tells you the message was not sent.

Failed to write to ${e}'s inbox \u2014 nothing was sent. Try again, or message the lead.

On Linux under Wayland, copying no longer writes the clipboard and the primary selection at the same time. The clipboard write completes first, and if a newer copy has begun in the meantime the primary-selection write is skipped.

• Applies when WAYLAND_DISPLAY is set and wl-copy is on PATH.
• Both writes have their output discarded.

wl-copy

Pasted content whose data can no longer be read is now marked unavailable rather than left in an odd state. Text pastes count alongside images and audio when clearing out abandoned pastes, and their placeholders are removed from what you see, shown instead as "Pasted text" or "Truncated text".

unavailable: !0

The Memory tool's list of connected stores now ends each line with the store's index, after the id, description and writable or read-only marker.

• Appears under the existing "Connected memory stores" header; the index is assembled into the line at runtime.

Connected memory stores

When a request is refused by a network proxy allowlist, Claude Code now recognises the block from either of two response headers, so more environments get the proper "blocked by egress policy" handling instead of a generic HTTP 403.

• An HTTP 403 counts as blocked when x-proxy-error is blocked-by-allowlist or when the new x-deny-reason header is host_not_allowed.
• Previously only the first header was checked, and only at the GitHub comments call site; the check is now a shared helper.

host_not_allowed

An artifact shared publicly now reports its audience as "anyone with the link" instead of falling through to the unrecognised-sharing fallback.

• Share-mode parsing gained an explicit public case that reports the artifact as shared and live.
• Previously this mode hit the "others (unrecognized share mode — treating as shared)" branch, which treated it as shared but described it vaguely.

anyone with the link

Activity messages originating from a peer session with no identified sender are now displayed by default rather than hidden by default.

• The display check's boolean argument now falls back to true instead of false, so a caller must explicitly pass false to hide one.

observer-activity

The Bash tool description now states plainly that command output is shown to the model but not reliably to the user, which should push the model to summarise results rather than assume you saw them.

• Added line: "- Command output is displayed to you, not reliably to the user."
• It replaces one of the fragment lists previously spread into the assembled description.

- Command output is displayed to you, not reliably to the user.

The two places that substitute pasted text back into your input now skip entries flagged unavailable, so a dropped or expired paste is not inlined.

• Previously only non-text entries were skipped.
• The input component now receives getPastedContents and getInputMode, image ids are minted through a shared allocator with an onMinted callback, and the command handler surface gains getCurrentInput.

getPastedContents

Shutdown now drains a queue of pending analytics tasks, raced against a 200 ms timeout, before the event logging, Datadog and error-tracking sinks are closed. The first user of this is the MCP tripwire event, so an event fired on a crash path now has a chance to be sent instead of being dropped at exit.

registerPreFlushTask

Two MCP client setup paths now set the same issuer-metadata-validation skip that the other paths already used, so OAuth-backed MCP servers behave consistently across transports.

skipIssuerMetadataValidation

A plugin whose cache directory is a 12-character hex name used to be treated as tracking a git ref, which meant it was re-fetched on every load. That check now also requires the plugin to come from a git source, so zip-archive plugins, whose cache directory is the first 12 hex characters of the archive digest, keep their pinned version.

sourceHasPinnedSha

The new memory write tool was added to the list of memory tools blocked for subagents and custom agents, so only the main conversation can save documents to a memory store.

["memory_list", "memory_read", "memory_write"]

Sending a message or file to a name that matches a Remote Control session on your account no longer just fails. The tool now says such sessions are reply-only from here and can be messaged only after they message you first, and that the Remote send_message connector cannot reach these device-gated sessions. A hedged version of the message appears when the list of sessions could not be fetched.

• The ListAgents tool now also advertises ListPeers as an alias.
• The cross-device recipient schema variant behind this sits on the remote-config flag tengu_harbor_kite, whose fallback here is off, or the CLAUDE_CODE_HARBOR_KITE environment variable.

only in reply, after it messages you first

The publishing prompt and the artifact-design guidance now treat the viewer as having three theme states rather than two: explicitly dark, explicitly light, and an unstamped default where only the browser's prefers-color-scheme decides. Generated pages are told to define a full light palette on :root, guard the dark media block so an explicit light choice wins, add a dark override, and set an explicit background on body so a transparent page does not pick up the host's colour.

guarded as \:root:not([data-theme="light"])\``

Artifact fetches now treat a 403 carrying x-deny-reason: host_not_allowed as a network allowlist block, alongside the existing x-proxy-error: blocked-by-allowlist, and other failures append the proxy's deny reason to the error text. The message makes clear the artifact itself is still accessible.

not reachable through this environment's network allowlist; your access to the artifact itself is fine (the boot check passed)

Importing an exported .zip only requires conversations.json now. If the combined projects.json is missing, projects are read from the individual projects/*.json files instead, and the archive summary is rebuilt from users.json plus per-conversation message counts rather than being required in the file.

export zip missing required entry

Passing both --no-publish and --publish-report now stops the run before it starts with an error, rather than starting and then behaving ambiguously.

Error: --no-publish and --publish-report are contradictory

After you set a default environment the confirmation says either "remote environment" or "self-hosted environment", and self-hosted entries in the list now show a dimmed count of live runners next to them.

alive_runner_count

The skill's client-patterns guidance changed its advice for loops that poll a session: break on any stop reason that is not requires_action, rather than only on terminal ones. budget_reached is listed as resumable only by changing the budget.

• The sample loop comment moved from // end_turn or retries_exhausted - both terminal to also name budget_reached.

break // end_turn, retries_exhausted, or budget_reached \u2014 see list below

Session update docs now state that vault_ids is rejected on update even though the SDK exposes it as a parameter, so only agent.tools, agent.mcp_servers, title, metadata and budget can change mid-session. Deployments gain an UpdateDeployment endpoint and deployments.update SDK method.

• A deployment can carry a budget that is copied onto every session it fires; it can be cleared and added back at the deployment level.

` vault_ids is create-only (rejected on update) `

The skill's quick reference and its feature-support notes now warn that the Messages API task_budget is advisory and counted in tokens, while a Managed Agents session budget is a hard, dollar-denominated cap enforced by the platform.

• The model-tier restriction (Opus 5, Fable 5, Sonnet 5, 4.8, 4.7) applies only to the Messages API form; session budgets have no tier restriction.

Not the same thing as Managed Agents session budgets

When a marketplace entry uses a source type Claude Code knows but gets its fields wrong, the entry is kept along with the validation error instead of looking identical to a source type this version simply does not recognize.

• The message is compacted before storage: unrecognized field names are listed and sanitized, the text is truncated with an ellipsis, and extra items are rendered as "(+N more)".

Placeholder for source types this Claude Code version does not recognize, or a known type whose fields failed validation (then error

The sandbox's forwarding of AWS credentials via credentials.awsPairs now resolves conflicts predictably and warns about risky setups. Later entries override earlier ones with the same target, each environment variable can fill only one slot, and the losing slot is disabled with a placeholder rather than silently taking the wrong value.

• Deliberately empty "suppressor" entries are preserved so they keep implicit AWS auto-pairing switched off.
• Pairs whose key id or secret are not masked as whole values are either dropped or forwarded with a warning.
• New warning when SigV4 re-signing is configured without injectHosts, because the real secret is then in scope at every entry in network.allowedDomains.
• New warning when a session token belonging to a forwarded pair is not itself forwarded.

SigV4 re-signing with the real secret is in scope at EVERY host in network.allowedDomains

Installing a plugin from an archive URL now re-applies the URL policy at each redirect, and refuses the install if any hop fails it. Headers inherited from the marketplace are stripped when a redirect crosses to a different origin, and a sha256 that does not match aborts the install.

• Marketplace catalog redirects must stay on the same origin, or be https to a host that is neither loopback nor a cloud metadata address.
• An archive that does not actually contain the component paths its marketplace entry declares is rejected, with advice on repackaging.

plugin archive redirect policy rejected

On submit, pasted entries that are no longer available are removed and you get an immediate notification rather than a prompt that quietly lost its attachment. If nothing is left after stripping, or the input was a bash or slash command, the submit is aborted and your original text is restored.

• Editing across multiple inputs also renumbers colliding pasted-text ids, so pastes from different inputs no longer overwrite each other.

pasted-text-unavailable

If the configuration controlling which bridge events are accepted fails to parse, verification now falls back to the strictest setting (accept only fully verified events, no other statuses allowed) and reports "malformed_config" once, rather than proceeding on a partial config.

• Unverified events that are not control requests are dropped with a warning that classifies the payload as control_request_other or other_payload_type.
• Drops are reported as bridge_stray_event_attestation, deduplicated to once per class per process so a flood does not spam telemetry.

bridge_stray_event_attestation

Sending a direct message by typing @name in the REPL now shows a 5 second notification when the write to the recipient's mailbox fails, instead of quietly doing nothing. Success shows the same confirmation as before.

• Both paths now run through one shared helper, so the success and failure cases cannot drift apart.

Couldn't write to @

When the bounded queue of task events fills up, it no longer evicts a conversation reset. Resets and null-status system frames are skipped as eviction candidates and the next eligible entry is evicted instead, so a reset cannot be lost under load.

• Tearing down the remote-control bridge while a reset is still undelivered now reports that fact and resets the bridge's own state.

bridge_conversation_reset

Invalidating stored OAuth discovery data now bails out instead of clearing it when the stored entry has no authorization server metadata, which is the signature of another save writing just the URL at the same time. This prevents a race that could throw away working discovery state.

• Invalidating discovery no longer clears the step-up scope along with it.

invalidateCredentials('discovery') preserved: concurrent URL-only re-save

Errors from validating an extension archive (unsafe path, oversized file) now show the entry name cut to 120 characters, so a hostile archive cannot flood your terminal with one enormous name.

Unsafe file path detected:

Writing to a teammate's mailbox could fail while the caller reported success. Plan rejection now returns failure with a message saying nothing was sent, sending a message to a teammate returns the error write_failed, and permission forwarding emits a mailbox-write-failed degradation instead of an unconditional success event.

Failed to write the plan rejection to

Resuming a session with pasted text or images no longer drops entries whose content is gone and rewrites the visible text around them. Each missing paste now becomes a placeholder record with empty content, marked unavailable, so the rest of the conversation still lines up.

• New paste ids are minted by a session-wide allocator that scans existing text and image paste references, including the stored image paste id list, so a restored session cannot reuse an id that is already taken.

pastedContents

Writes to another agent's inbox can now fail visibly. Submitting a plan for lead approval throws a dedicated error when the write does not land, shutdown requests and shutdown rejections return a failure result naming the target, and the shutdown-approval confirmation is marked degraded. Previously all of these carried on as if the message had been delivered.

Failed to write the plan approval request to the lead's inbox \u2014 plan not submitted; try again

The refusal you get for passing a relative memory path now quotes a correctly joined suggested path instead of gluing a prefix onto it.

• Memory conflict errors now also carry the conflicting path.
• Pre-creating the team-memory directory for team-scope stores was dropped from the load path.

Memory paths are absolute and start with "/"

When a self-hosted pool is selected, the cloud-session flag conflict error now blames --environment rather than --cloud, and drops the claude.ai/code reattach hint that did not apply.

--environment

When a write to a teammate's inbox fails, callers now check the result and tell the model the delivery did not happen, for example that a confirmation could not be written. Previously most of these call sites ignored the failure.

• The degraded-outcome path for a failed mailbox write went from one call site to nine.
• Lock releases are wrapped so a failed release logs a warning instead of escaping the surrounding cleanup block.
• Inbox write errors are now logged at error level and filtered before being surfaced.

The confirmation could not be written to team-lead's inbox.

Typing a !-prefixed line that also contains pasted text is no longer recorded as a shell command, and the bash history no longer offers back entries whose pastes were not images. Pasted content that is unavailable is preserved rather than dropped.

[Image

Messages forwarded to a connected SDK client are now tracked by message id in a set rather than by position alone, so nothing is sent twice, and a failure in one pass is logged instead of stopping forwarding. A conversation reset rewinds the offset, and reconnects that ask for no history backfill skip the replay.

[bridge:sdk] transcript forward failed:

The local sandbox proxy now attaches error handlers to client requests, responses and upstream responses, so a stream error is logged instead of crashing it. Malformed client requests get 431 Request Header Fields Too Large when headers overflow and 400 Bad Request otherwise, then the socket is destroyed after a one second timer that does not hold the process open.

431 Request Header Fields Too Large

The retention sweep that deletes old plans previously only matched files ending in .md, so a plan write interrupted partway through left a temp file behind forever. When invoked with a store handle it now also matches files containing .md.tmp..

tengu_retention_sweep

When a teammate's permission request cannot be written to the lead's mailbox, the failure was previously ignored and the request appeared to be in flight. The result is now awaited and a message tells you the mailbox write failed and to retry the tool call. Two call sites use slightly different wording, one of which adds "or ask the lead directly".

The permission request could not be delivered to the team lead (mailbox write failed). Retry the tool call.

Clearing the conversation no longer tears down the REPL bridge. The bridge now repoints onto the new session, carrying its session id, last sequence number, dialog kinds and grouping id, and flags that history should not be backfilled.

• It also subscribes to reset, resume and spare-claim transitions.
• Archiving the old session changed from an immediate call to a deferred, error-logged one that can be cancelled.
• New telemetry records when the bridge disables itself automatically (tengu_bridge_repl_auto_disabled) and when a compaction happens while it is disabled.
• Queued SDK events are forwarded with their own error logging rather than being lost silently.

tengu_bridge_repl_auto_disabled

When an MCP server started over stdio is torn down, Claude Code now records whether its process had already exited or was still running, and the reconnect path reads that back on the next automatic connect. This gives reconnection a view of whether the previous server died or was killed mid-flight.

• Keyed by a hash over the command, working directory, sorted environment and arguments, so each distinct server configuration gets its own record.
• Recorded only if the transport had finished starting; the outcome is stored as "hard_closed" for an already-exited child or "survived" for a live one.
• The entry is deleted once consumed. The map is capped and evicts oldest-first.

hard_closed

Restrictions on which AWS credential forms the sandbox may use now survive merging of managed settings into child settings, instead of being dropped at the merge boundary.

• Inheritance now carries the sandbox.credentials.sigv4 deny list, whose values are streaming, presigned and sigv4a.
• A normalized awsPairs list of allowed AWS key pairs is carried through the same merge.

sigv4a

When input is restored from history or a resumed conversation, pasted-content markers whose numbers clash with ones this session already issued are re-numbered, and the visible text is rewritten to match. An old paste marker can no longer point at the wrong attachment.

• Each session now tracks which paste ids it minted, which is what makes a collision detectable.

allowCurrentEpochSkip

Sending an approval to a teammate's inbox can fail, and callers now notice. The approve-plan path returns failure with a retry hint saying the teammate is still awaiting approval, the inbox poller logs the error and re-queues the request, and the sandbox permission sync records a mailbox write failure rather than a success.

• The write now returns the message id, or nothing on failure, which is what the three callers check.

the teammate is still awaiting approval

The check that warns about wildcard patterns in Read and Edit permission rules now strips trailing slashes from deny rules and absolute paths before looking for wildcards, so /foo/bar/ and /foo/bar behave the same. Allow and deny rules are walked as tagged pairs. Linux and WSL only; other platforms produce no warnings.

Failed to get Linux glob pattern warnings:

When a stored session is streamed back, a local command whose output is blank once trimmed now produces nothing instead of an empty assistant message. Compact summaries are also now treated as synthetic entries, matching how meta and transcript-only entries are handled.

local_command

When the proxy's request filter blocks a tunnelled request, it now reports the method, url, reason and the encoded command to the denial handler instead of failing quietly. Once the upstream connection resolves, the socket is destroyed if either end has already gone away, rather than continuing to write to a connection that no longer exists.

onFilterRequestDeny

A status message produced inside a nested session used to be dropped. It is now re-emitted to the outer session along with the permission mode and the result or error from compaction, so a compaction that happened deeper down is visible where you are.

• The compaction error is only attached when an internal check allows it, so it can be stripped before the message leaves the session.

compact_result

If you log in or out while a background remote-settings refresh is still running, that stale refresh no longer applies its result.

Remote settings: Background poll superseded by a login/logout reset; not notifying

Sending a message to another session's mailbox now catches and logs a failure to create the inbox directory rather than failing silently.

• The failure is logged at error level and the write returns without proceeding.
• Marking messages as read now releases its lock through a shared helper instead of inline unlock-and-log code.

[TeammateMailbox] writeToMailbox: failed to ensure inbox dir:

Errors while listing peer sessions were only recognised as server-side when formatted as "HTTP 5xx". Any message containing a 5xx status code now matches too, so these are correctly treated as not your fault and bucketed as a server error rather than surfacing as an actionable failure.

bridge_http_5xx

If the initial instructions cannot be written into a new teammate's inbox, the spawn now throws rather than launching an agent that would sit doing nothing, and records an error counter.

subagent_teammate_prompt_write_failed

Messages arriving from another session are checked against the peer and coordinator policy before their attachments are fetched and before they are queued, so a refused message is logged and skipped instead of being half-processed.

bridge:repl: dropped before attachment materialization

Rate-limit tracking now carries a version marker that increments when login state resets, so a response that was already in flight when you logged in or out cannot overwrite the fresh state. The reset also returns status to allowed and clears overage flags.

anthropic-ratelimit-unified-grace-status

When a conversation reset is still queued and undelivered, the bridge now stops writing messages and stops forwarding queued events until it lands, instead of writing into a conversation that is about to be cleared. If the process shuts down with a reset still undelivered, that is logged with an undelivered_at_teardown outcome and bridge state is torn down.

undelivered_at_teardown

Images pasted into an AskUserQuestion prompt were numbered from a counter local to that dialog, starting at 1, so their ids could clash with pastes made elsewhere in the same session. They are now allocated from the session-wide paste id pool, seeded with the ids already attached to that question.

• Text being typed into the question's inputs is registered as another source of in-use ids while the dialog is open.
• Auto-advance when you are away, and skip/accept telemetry, are unchanged.

ask-user-question-text-input

When memory stores are connected, the automatic memory prompt now builds a per-store view describing each index as a memory index inside a named store, including read-only ones, instead of the older team-mount path phrasing. Without connected stores it falls back to the previous prompt.

• A separate memory-tools prompt variant exists, reported in telemetry as memory_tools.
• Prompt-load telemetry now carries how many stores are connected, whether an index loaded, whether the tools are writable, and which prompt variant was used.

memory_tools

A message sent from another session is displayed as an "@ sender" header with the body indented below, instead of the raw wrapper tag. Only reachable when cross-session messaging is enabled (tengu_harbor_kite gate or CLAUDE_CODE_HARBOR_KITE).

• The renderer strips the <cross-session-message ...> wrapper and reads the sender from its from= and from-name= attributes.
• Sender addresses are humanised: a uds: address becomes the socket file's basename with .sock removed, a bridge: address becomes "(untitled)", and anything unresolved shows as "peer".

</cross-session-message>

During MCP OAuth discovery Claude Code now validates itself that the issuer a server echoes back matches the URL that was asked for, at three points: the RFC 9728 chain, the legacy path fallback and refresh rediscovery. Controlled by tengu_mcp_issuer_strict_echo, whose in-source fallback is "observe": mismatches are recorded and the connection proceeds. Only a remote config value switches it to enforce, where a cross-origin echo fails the connection.

• The SDK's own checks are turned off (skipIssuerMetadataValidation, skipIssuerValidation) in favour of the in-house comparison, on SSE and HTTP transports.
• Mismatches emit tengu_mcp_oauth_issuer_echo_mismatch with site, mode, outcome, an origin relation of same_origin, cross_origin or unparseable, the differing parts (scheme, host, port, path, query, fragment, userinfo, normalization_only) and hashed issuers.
• In enforce mode the failure raises IssuerEchoCrossOriginError, surfaces as a new issuer_echo_denied outcome for token refresh and revoke, and is excluded from retry.

tengu_mcp_issuer_strict_echo, Issuer echo cross-origin mismatch (RFC 8414 \xA73.3): expected

A new loader builds an automatic memory context block listing every memory file under the user memory directory, with paths relative to it and flagged as differing from disk, alongside the existing single-file version. It returns nothing when CLAUDE_CODE_REMOTE is set or the session is a cowork one; which of the two is used is decided by those same environment checks.

AutoMem

Status strings for a large workflow are added, built from a prefix constant plus fixed text, with the longer form pointing at /workflows to stop it. Nothing in this group shows when it is displayed.

Large workflow

Arguments the server hands to a self-hosted runner session are now checked against a name pattern and a blocklist before becoming CLI flags. Rejected ones are skipped and logged as "malformed" or "blocked", and the count of arguments actually applied is logged.

• Values starting with - are passed as --name=value so they are not parsed as a separate flag.
• Log lines are assembled from a template beginning "[runner:session] Skipping ".

[runner:session] Skipping

When connecting to an MCP server over OAuth, Claude now compares the authorization-server address it asked about against the issuer value the server returns in its discovery metadata, catching a server that points authentication somewhere else. In this build the check only records telemetry: the gate tengu_mcp_issuer_strict_echo decides the mode and its in-source fallback is false, so absent a remote value the result is observe-only.

• In observe mode a mismatch is logged with outcome proceeded and the connection continues.
• In enforce mode the connection raises an issuer echo cross-origin error and authentication fails with reason issuer_echo_denied.
• Mismatches are classified before reporting, including same_origin and unparseable plus a reason per differing part of the URL.
• None of this exists in 2.1.223; the whole check is new.

tengu_mcp_oauth_issuer_echo_mismatch

The memory-extraction prompt has a new mode that tells the model the project-shared memory tools are unavailable and that only personal-directory memories should be saved. It is switched by a flag passed in by the caller, and nothing in this build shows what sets that flag.

• Related team-memory prompts dropped the branch saying a private directory would still persist.
• The memory upkeep prompt can now skip its "Read the index" step.

so skip anything the scope guidance marks as shared with the project

Code review can append a line suggesting /ultrareview for a deeper cloud-based review, with a matching post-commit tip and a count of free reviews in the slash menu. Nothing shows without remote configuration: the tengu_ultrareview_awareness flag defaults to nothing, which is read as no surfaces enabled. It also requires the remote-sessions entitlement.

• Skipped for skill preloads and model-scheduled runs, and suppressed once you have run /ultrareview yourself.
• Each surface is capped at a few impressions; impressions are reported as tengu_ultrareview_awareness_shown.

Tip: For a deeper cloud-based review, try /ultrareview next time

The chat keybinding map, between the cycle-mode and image-paste bindings, and the confirm-dialog shortcut list each contain an empty placeholder where a conditional entry was removed at build time. Whatever shortcut belongs there does not exist in this build.

chat:imagePaste

Two new flags, tengu_luminous_seal and tengu_composed_quail, each falling back to on in this build. The first decides whether conversation reset events are emitted and forwarded and whether they survive the task-event filter; the second decides whether rate limit events are forwarded. Nothing in the build sets either one, so the real values come from server config.

tengu_luminous_seal

While a cloud session uploads the files it starts from, you see a progress line built from how many uploads have settled out of the total. On finish you get one of four outcomes: a summary, a timeout note, an unavailable note, or a could-not-finish note. Each of the failure cases ends by saying the session starts from the git bundle alone. This only appears on the container-sync file path behind tengu_violin_wood.

Cloud file sync is unavailable for this session; starting from the git bundle alone

Listing memory stores previously returned each store's id, description and whether it is writable. It now also returns the path of that store's index document, the pointer file the model is asked to keep current with one-line entries. Behind the tengu_haze_glass gate, which is false in this build.

whether each is writable or read-only, and the path of each store's index document

The system/init message sent to SDK and stream-json consumers now carries messaging_socket_path, read from the running cross-session messaging module rather than from the environment. It is only set when that messaging inbox started, which is itself gated off by default.

messaging_socket_path

Incoming connections on the cross-session messaging socket can now be attributed to the process tree that sent them. New helpers read /proc/<pid>/stat for the process start time, used as a liveness token, and walk up to 12 ancestor pids; the pid and chain are captured once per connection and passed into message handling.

• The /proc paths are assembled at runtime, so on non-Linux the reads simply fail and the values come back undefined.
• Connection handling sits inside the cross-session messaging path, which is off by default.

[peer-cred] peer pid unavailable (fd=

The lookup for loop.md gained an async variant that, after checking .claude/loop.md in the config directory, falls back to a stored loop-file value, trimmed and ignored if empty. The stored path only runs when a storage handle is passed in; otherwise the plain file lookup is used.

loop.md

A new schema for the language-server tool splits it into a separate strict object per operation (goToDefinition, findReferences, hover, documentSymbol, workspaceSymbol, goToImplementation, prepareCallHierarchy, incomingCalls, outgoingCalls), each with its own field descriptions, so arguments are validated per operation instead of against one flat shape. The old flat schema is still in the build and nothing in this group decides which one the tool presents.

• The workspaceSymbol variant drops the "(workspaceSymbol only)" qualifier from its query description, since the field now exists only there.

The symbol name or partial name to search for. Most language servers return no results for an empty query.

When a storage store is available, the scheduled-task fire path queues fires one after another and awaits an asynchronous resolution of loop.md default content. If that resolution fails, the fire is logged and skipped rather than running with unresolved content. Without a store, the existing synchronous resolution runs.

• The skip is logged with the prefix "[ScheduledTasks] loop.md v5 expansion failed; fire skipped: " followed by the error.

[ScheduledTasks] loop.md v5 expansion failed; fire skipped:

The tool that lists other agent sessions now describes remote bridge sessions as ones you can only reply to, and states that no connector can reach them by name. This wording is only reachable when the cross-session feature is on, via the tengu_harbor_kite server flag or CLAUDE_CODE_HARBOR_KITE.

reply-only

A new startup tip suggests the cloud multi-agent branch review and appends your remaining free-review count when it is known. It shows at most once every 8 sessions and is skipped once you have run ultrareview.

• Requires ultrareview eligibility and the allow_remote_sessions capability.
• Per-surface visibility comes from the tengu_ultrareview_awareness gate, whose fallback is empty, leaving the tip off unless a value is supplied remotely.

for a cloud-based multi-agent review that finds and verifies bugs in your branch

Sending a message to another session now returns a specific reason instead of quietly failing: one refusal when the feature is off in this session, another when a cross-machine send would have to route through Anthropic servers. Cross-session messaging is gated on tengu_harbor_kite (off by default) or the CLAUDE_CODE_HARBOR_KITE environment variable, and is off entirely on Windows.

• The cross-machine route additionally requires a first-party provider and that nonessential traffic is not disabled; failing either gives the second refusal.

Cross-session messaging is not available in this session.

The prompt used for memory consolidation runs picked up two options. One replaces the index-maintenance step with a pure prune step and drops the instruction to read the index file. The other adds a note that the memory tools are not available during the run, so it should only touch the memory directory. The second is requested only when the session is not running under CLAUDE_CODE_REMOTE.

• Which variant is used is decided at runtime by the caller; the underlying feature is otherwise unchanged.

# Dream: Memory Consolidation

Three replacement messages explaining why artifacts need a claude.ai login are defined, covering the plain case, a remote session authenticating through the machine that launched it, and a credential injected by the host environment that takes precedence and cannot be changed. Only the definitions and the module export table appear in this build, with no call site, so the old single message is still what you see.

• A fourth builder interpolates the name of the competing credential source into the message.

Artifacts need a claude.ai login, but this session authenticates with a credential injected by its host environment, which takes precedence and cannot be changed here. Start a session that is signed in to claude.ai to publish or read artifacts.

New code lets a question fall back to the interactive dialog when the auto-mode classifier is unavailable or the conversation is too long for it, instead of failing. The condition negates a helper that always returns true here, so the branch is unreachable as shipped.

• the separate classifier switch remains, readable from CLAUDE_CODE_AUTO_MODE_CLASSIFY_ASK_USER_QUESTION or the classifyAskUserQuestion field of the auto mode config

Auto mode classifier transcript too long for AskUserQuestion, falling back to the question dialog

The remote file store's create call takes an options argument that can attach a not_exists precondition, so a create fails rather than overwriting, and both create and update now accept an abort signal. Nothing observed in this build requests the precondition, so whether any caller uses it is not settled here.

"not_exists"

New logic waits for a list of files to seed into a directory, creates each one under a destination whose real path is checked, and then records a summary of what happened. It only creates files: anything already present is skipped and anything escaping the destination path is rejected. Nothing in this build was observed turning it on.

• Polls for the file list, applies mode bits to each created file, and writes a ready record counting files applied, skipped and missing.
• Outcomes are reported as complete, timeout, or bad_manifest when the file list is malformed, each with a matching telemetry event.

tengu_dir_sync_apply_start

The schema describing a memory store now carries a path, a read-write or read-only mode, a kind and a grouping id, plus optional visibility and prompt-index fields bounded to 64 and 512 characters. Both new fields fall back to undefined on bad input, so a malformed value degrades instead of failing the whole parse.

grouping_id

Extracted PDF page images are now listed and read back through the shared storage abstraction rather than direct filesystem calls, with a guard that fails if the extraction directory sits outside the session's tool-results store. Model-capability caches and the closed-issues cache gained the same storage-backed paths; all of them fall back to the previous filesystem path when no storage handle is supplied.

PDF extraction directory is outside the session tool-results store

The helper that tagged MCP events with a server's base URL was replaced, in both of its copies, by one that also carries a hashed server key. Server identity in telemetry no longer depends on the raw URL.

• The hash is attached to tengu_mcp_listen_reopen events and is the preferred key for per-server rate limiting when forwarding logs, with the base URL used only as a fallback.

mcpServerKeyHash

When the MCP runtime resolves to one client generation but the loaded module is from the other, a once-per-process tengu_mcp_tripwire event is emitted, carrying the expected and loaded generations (normalised to v1, v2 or other), immediately before the existing error is raised. The event name was added to the allow-listed list.

tengu_mcp_tripwire

The rules that neutralize control tags and permission-escalation phrasing in subagent output are now one shared list, reused with fresh pattern copies by a new scanner for assistant output. Subagent behaviour is unchanged.

• The escalation set covers settings JSON, bypassPermissions, --dangerously-skip-permissions and permission allow/deny phrasing.

escalation-pattern

Registration and heartbeat payloads sent by the remote-control bridge now include a bridge_epoch value identifying the current bridge lifetime.

• The special case that pushed thinking_tokens system messages straight into the bridge SDK stream, along with its dedicated error log, was removed; those messages now go through the normal enqueue path.

bridge_epoch

Tool input and output schemas across the product were mechanically converted to shorter schema helper calls. Descriptions and constraints are unchanged and no behaviour differs.

Processed result from applying the prompt to the content

When the remote-control connection hits a terminal request-path condition, the close code now reflects the cause: session or epoch problems close with 4090, expired or exhausted tokens with 4094.

• Both places that build the client opt into typed close codes, so the mapping is what runs; the untyped path still closes with 4090 for everything.

terminal request-path condition

Dozens of tool input and output schemas were rewritten to use short shared schema helpers. Descriptions and validation look unchanged; this is a size and consistency refactor.

project_search: knowledge-base query

When tool search is skipped, the event now reports the mode actually in effect, derived from the ENABLE_TOOL_SEARCH environment variable and one of tst, tst-auto or standard, rather than always reporting standard. It also tells apart a request with no tools from one where the search tool is not registered.

no_tools_in_request

Tool input schemas, skill frontmatter, the Chrome install dialog and GitHub session schemas were rewritten to import validation helpers directly instead of through a namespace. No behaviour or message changed.

Unsupported schema:

Session metrics now count workshop document writes and their added and removed lines separately, reported only when non-zero.

• Plan-mode end-of-turn guidance now takes the publish wording from its caller rather than using a fixed string.

workshopWriteCount

A large set of schema definitions was rewritten from the builder style onto short internal helpers. Shapes are unchanged; this is bundling only.

MCP tool execution result

Conflict responses are now attributed from an x-ccr-conflict-reason header, falling back to parsing the reason out of the JSON body, which separates being superseded by a live worker from a stale registration with no successor.

x-ccr-conflict-reason

Loading a plugin manifest now reports success, and reports failures separately for an unreadable file, invalid JSON and a manifest that does not match the expected shape. Success is not reported when the caller is only probing for a manifest.

plugin_load_manifest_schema_invalid

The settings validator is now given the file path as well as the warning collector, so warnings can name the settings file they came from.

skipMcpServerEntryFilter

Two auto-mode events, subsequent approval and malformed tool input, now record whether the tool came from an MCP server, defaulting to false when the tool does not say. The malformed-input event also runs the tool name through the sanitiser.

tengu_auto_mode_malformed_tool_input

Every schema in the bundle, covering tool inputs and outputs, plugin manifests, settings, memory and artifacts, was rewritten from the namespaced schema builders to standalone functions. Field names, descriptions and validation behave the same; this is a bundle-size change.

• The previous build has 1486 uses of the namespaced string builder and 569 of the namespaced object builder; this build has none of either, with roughly 963 direct object builder call sites.
• Example: a hook type that was a namespaced literal with the description "MCP tool hook type" is now a bare literal call, and its server field a bare string call described as the name of an already-configured MCP server to invoke.
• The error instance check switched to the corresponding direct class. Several hunks in this group are only the resulting reformatting.

w.object(, MCP tool hook type

Dozens of schema definitions were rewritten from the bundled validation library's object API onto short internal builders. Shapes and descriptions are unchanged, so nothing behaves differently.

• Covers object, strict object, string, array, enum, custom, boolean constructors and instance checks.
• Descriptions are byte-identical, for example the MCP refresh tool's field still reads "Optional server name: refresh only this server. Omit to refresh all connected servers."

Optional server name: refresh only this server. Omit to refresh all connected servers.

The telemetry event for a failed MCP server connection carries one more field describing the probe, giving more detail when a server will not connect.

• probeSibling joins the existing negotiationMode, probeFellBack, errorCode and errorClassName fields.
• The field name does not appear in the previous build.

probeSibling

Remote and cloud git operations no longer write a helper script to disk. They pass an inline shell function on the command line that emits a fixed username and reads the password from a named environment variable, after clearing any existing credential helper for the remote.

printf 'username=unused

The short names reported for where the remoteControlAtStartup setting came from (policy, flag, user) now come from one table instead of scattered strings. The warning that repository-scoped settings cannot enable Remote Control is unchanged.

policySettings: "policy"

All 686 namespaced schema calls were replaced with direct helper functions. Behaviour is unchanged, but it accounts for the very large number of one-line schema diffs in this release.

w.custom(

Auto-mode decision, fallback-to-ask and denial-limit events now carry a flag saying whether the tool came from an MCP server, defaulting to false, alongside the existing tool name and denial counts.

tengu_auto_mode_denial_limit_exceeded, tengu_auto_mode_fallback_to_ask

The runner now writes its session ingress token to a file named with an epoch suffix instead of one shared file. The write is best effort, and a failure logs that staged-file fetches are degraded.

.session_ingress_token.e

The check for whether a key such as cleanupPeriodDays is written explicitly in a settings file is now asynchronous and can be given a reader, in which case user settings come from the newer store instead of the file on disk. A read failure is logged and treated as unknown rather than as absent, and the retention cleanup gate became async to match.

rawSettingsKeyPresence: v5 user-settings read failed

A separate error counter is now emitted when a managed settings fetch is thrown away because the cache was reset while it was in flight.

reset_during_fetch

ISSUER_ECHO_DENIED was added to the recognised error codes of both MCP client generations, alongside the existing rejected-auth-header and rejected-bearer codes.

ISSUER_ECHO_DENIED

When a storage handle is supplied, session registration writes its process-id file through that store and throws on failure; without one it falls back to writing the file directly to disk as before.

v5 pid-file write failed

The plugin ZIP extractor now returns the list of relative paths it extracted rather than just logging a count, so callers can act on the exact files.

Extracted ZIP to

The message, hook payload and control protocol schemas are now built from directly bound helpers rather than one shared namespace object. Field names, defaults, optionality and descriptions are unchanged.

Controls Claude's thinking/reasoning behavior. When set, takes precedence over the deprecated maxThinkingTokens.

The tool that sends messages between agents now reports a delivery outcome to telemetry instead of failing silently, using not_reachable when the recipient is not in the roster or cannot be resolved and mailbox_write_failed when the write itself fails.

mailbox_write_failed

The prompt behind persistent memory no longer asks the model to state a save or no-save verdict to itself before acting. The requirement to save in the same reply is unchanged.

did the user's latest message teach you a durable, applicable lesson?

Forwarded events for MCP-style tools now pass through a sliding window per event and server; over the limit, events are dropped and counted, and the next event that gets through reports how many were dropped since the last one.

• The window map is size-bounded and evicts its oldest key.
• Any tool name beginning skill__ is reported as "skill", and feature names starting tool_skill_ collapse to "tool_skill", except tool_skill_tool.
• A denylist of fields is stripped from every payload before it is sent.

droppedSinceLastForward

Nearly every declared schema in the build, covering tools, hooks, settings, MCP config and message envelopes, plugin manifests, browser listings, LSP operations and sandbox settings, was rewritten from the zod-style object/string/enum/array/union/discriminatedUnion/preprocess/strictObject calls onto compact internal equivalents. Field names, description text and validation messages are unchanged, so validated shapes and error output stay the same.

• Some explicit unions became a helper call, and strict objects moved to a strict-object helper.
• The MCP v1/v2 module tripwire is untouched by the rewrite.

protocol must be an RFC 6455 token, url contains control characters that would be hidden in the approval dialog

MCP events are now admitted to log forwarding, and every payload has its identifying fields deleted before send. Forwarding is skipped entirely when analytics are disabled.

• Newly allowed: tengu_mcp_degraded, tengu_mcp_list_changed, tengu_mcp_listen_reopen, tengu_mcp_sdk_generation, tengu_mcp_server_connection_failed, tengu_mcp_server_connection_succeeded, tengu_mcp_tripwire.
• Stripped fields include the server name, base URL, hashed server key, attribution hashes, hashed error details and a server digest.
• Five of the MCP events are capped per event-and-server pair at 10 per 60 seconds, tracked over at most 200 keys; the number of suppressed events rides along on the next one that gets through as droppedSinceLastForward.

PEER_RATE_BOUND_EVENTS

Most schema definitions were mechanically switched from a namespaced validation object to directly imported helpers, and several initialiser blocks were relocated intact. Validation messages, limits and defaults are unchanged, so nothing is visible from the outside.

segments must match [A-Za-z0-9._-]+ and must not be . or ..

Bridge failures are now tagged as either an authentication problem or a terminal one, alongside the existing error. Missing OAuth token, missing organization and unenrolled trusted device count as auth; everything else defaults to terminal. Nothing user-visible changes yet.

replBridgeErrorKind

Caches for the closed-issues list, model capabilities, gateway models and the changelog now look themselves up by a namespaced key and read from a storage backend when one is available, falling back to the previous plain-file reader when it is not.

• Whether the backend path or the file path runs is decided by whether a backend is present at runtime.
• Failures coming from the backend are now reported distinctly from unexpected errors.

closed-issues cache read failed (v5 backend error)

The embedded version is now 2.1.224, with a new build time and git SHA, updated everywhere they are printed: version output, user agents, update messages, feedback bundles, the daemon start log and version warning, and the control-protocol binary version response.

BUILD_TIME: "2026-08-06T01:05:53Z", 2026-08-06T01:05:53Z, VERSION: "2.1.224"

Deciding whether a stored session has any history now scans raw record bytes for the user and assistant type markers instead of decoding every record to text, and pages more aggressively: 64KB for the first page, 4MB for later ones.

• The filesystem transcript locator gained an optional store backend, so it can also find transcripts held in a session store rather than only on disk.

"type":"assistant"

The close event for the v2 remote bridge transport now carries a cause alongside the numeric close code, and the deferred-close path stores both.

tengu_bridge_repl_ws_closed

The remote settings fetcher now returns the identity used for the request on every path, including a cached 304, an empty 204 or 404, a parsed settings body and the caught-404 fallback. The caller hands it to the consent-recording step, so a recorded consent is attributed to the identity that actually fetched the settings.

consentIdentity

The autostart decision now reports both its value and where the value came from, so the reason a session did or did not start in remote-control mode is recorded.

• The event records the explicit setting and its source, the default and its source, plus mirror, reattach and the resolved result of off, mirror or full.
• The default still comes from the tengu_cobalt_harbor flag, which is off unless remote config says otherwise.
• One of the possible sources, a persistent remote session, cannot be reached: the check that would select it always returns false in this build.

persistent_remote_session

The operation that removed messages from conversation history was replaced with one that simply drops the named messages and appends, without the earlier filtering and trim-to-boundary step.

remove-uuids-and-append

Fatal exits now pass a reason such as session not found, token expired, auth exhausted, or an epoch conflict or stale epoch, instead of terminating with no explanation.

• The remote bridge maps auth-related reasons to WebSocket close code 4094 and the rest to 4090, so recovery can pick the right path.

causeTypedCloseCodes

On Linux, sandbox write paths have trailing slashes stripped before binding, with a bare / preserved, and allowed write paths are matched against both their literal and fully resolved forms so symlinked directories are shadowed consistently.

• Applies to the bubblewrap sandbox only.
• The path lists, including directories considered for read-denial, are now computed on demand rather than upfront.

allowedWritePathsBothForms

Collecting settings-file warnings now waits for the retention configuration to be determined before deciding whether to show the notice that transcript retention cleanup is paused.

Transcript retention cleanup is paused until the settings errors above are fixed

Schema definitions across the bundle were rewritten from long-form builders to compact helpers, covering tool inputs and outputs, dialog payloads, plugin manifests, scheduled job arguments, todo lists and lock files. Field names, descriptions and accepted values are unchanged.

Job ID returned by CronCreate.

Message delivery telemetry can now flag that the caller waited synchronously for completion, alongside the existing route and duration fields.

• Agent-resume branches report on both success and failure under the route resume.
• The evicted-agent mailbox path sets the blocked-wait flag.

blocked_wait

Plans and session files are now addressable through Claude Code's keyed storage layer rather than only as raw files on disk.

• Two namespaces were registered, plan (keyed by name) and session (keyed by file), both classified as plain.
• Priming plan slug collisions lists entries from the store, but only when a store handle is passed and the plans directory is the default one; otherwise it still reads the directory directly, and it also falls back to that on a store error logged as "primePlanSlugCollisions: v5 list failed: ".
• The old raw-file reader for plan workshop documents was deleted.

primePlanSlugCollisions: v5 list failed:

Evaluation grader output now carries an explicit flag for whether each criterion was actually scored, derived as the negation of the existing "with only" flag.

• The result schema gains an optional boolean scored alongside withOnly, judgeVotes and evidence.

withOnly