Version 2.1.225

The Artifact tool's comments action takes a thread_id to read a single thread and a cursor to continue a listing that was cut off by the size cap. Results echo back thread_filter and cursor so the model knows which view it is looking at.

• thread_id and cursor are mutually exclusive and both must be lowercase UUIDs, each with its own validation error and error code
• when a requested thread is not in the result, the model is told to re-run comments without thread_id for the full list
• truncated listings carry a hint to re-run with cursor, and resumed listings carry a "Resumed from the cursor:" note; threads are listed newest first
• the tool-use line renders counts such as "read 1 comment thread (filtered)"
• available to anyone who can use the Artifact tool; neither field existed in 2.1.224

` thread_id (read one thread) and cursor (continue the list) cannot be combined — pass one. , thread_filter`

A 401 no longer causes Claude Code to swap in a credential from disk when you explicitly supplied CLAUDE_CODE_OAUTH_TOKEN.

• When the token came from the user's environment, and this is not a remote child session or a unix-socket setup, an explicit error is logged and the supplied token is kept
• The disk-recovery path now additionally requires the stored credential to be unexpired
• The whole env/disk recovery block is skipped when credentials are host-managed via CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST
• The recovery failure reason gained a third value for the skipped-user-env-token case, alongside background-worker and interactive no-refresh-token

OAuth 401: keeping the user-supplied CLAUDE_CODE_OAUTH_TOKEN instead of adopting the stored credential., oauth_401_skipped_user_env_token

A settings defaultMode: "bypassPermissions" is now honoured in a VS Code-owned session when the corresponding VS Code consent setting is enabled.

• allowDangerouslySkipPermissions is now a parameter of the startup permission-mode resolver and is forwarded into the resolver's cli block
• previously the resolver was called without it, so the mode was rejected with 'Permission mode bypassPermissions from settings was ignored — enable the "Claude Code: Allow Dangerously Skip Permissions" setting in VS Code to consent to it' even when the setting was on

allowDangerouslySkipPermissions

Publishing an artifact through /api/frame/deploy/direct now retries transient failures instead of failing outright, and shows the retry state while it happens.

• A 429 is retried once after the retry-after delay, capped; 503s are retried with backoff up to a maximum attempt count.
• Retries honor the abort signal, logging "[artifact] /deploy/direct retry cancelled by user".
• A new progress event type renders "Publish service temporarily unavailable" or "Publish service busy" followed by " — retrying (attempt N of M)…".
• Telemetry deploy_503_retried / deploy_429_retried carries deploy_attempts and deploy_final_status.
• onRetry and signal are threaded through the publish call chain. None of this existed in 2.1.224.

artifact_publish_retry

The prompt shown when another Claude session sends a message now pre-selects the safe option, so an accidental Enter drops the message instead of delivering it.

• "Deny — drop it and tell the sender it was declined" is listed first and "Deliver this message to Claude" second.
• The select is given defaultFocusValue "deny" plus hideIndexes; previously delivery was first with no default focus.
• The payload builder no longer emits its truncated field.

Deny — drop it and tell the sender it was declined, Deliver this message to Claude

A watcher now runs while a REPL bridge session sits in the "auth" failure state and turns Remote Control back on once valid credentials reappear, instead of leaving the session dead until manual intervention.

• Re-checks credentials every 300000 ms; on finding a fresh credential for the same account it clears replBridgeError, flips replBridgeEnabled back on and fires telemetry tengu_bridge_repl_auth_revive.
• Refuses to revive across accounts, logging "credential belongs to a different account — disarming".
• In non-interactive sessions a brake applies unless an in-process /login bumps the new authChangeGeneration counter.
• Close code 4094 (worker credential expired) is treated as auth-recoverable only when this gate is on.
• Gated on tengu_bridge_auth_revive, fallback true absent a server value; with the gate off the code still logs "kill switch off — still polling, no unattended revive".
• authChangeGeneration and the "\x00baseline-pending" sentinel are new in this build.

[bridge:repl] Auth-revive watcher: fresh same-account credential — re-enabling Remote Control

When a comments listing is truncated by the size cap, the result now tells the caller how to fetch the rest rather than only pointing at the web page.

• A cursor is computed from the last listed thread.
• The truncation message instructs the caller to re-run the "comments" action with that cursor.

comments with cursor "<cursor from the previous truncated result>"

re-run action "comments" with cursor "

CLAUDE_CODE_ENTRYPOINT is stripped from derived environments when it holds an IDE or desktop value, so spawned commands do not misreport where they came from.

• The stripping helper deletes the variable for IDE/desktop values such as claude-desktop-3p.
• It is now called from the env builders for the spawned-command environment and for the sandbox/scrubbed environment; previously only one spawn path applied it.
• CLAUDE_CODE_REMOTE_SESSION_ID was added to the set of remote-session variables stripped from derived environments.

claude-desktop-3p

A disconnect caused by authentication now tells you to re-login instead of offering the generic reconnect hint.

• The disconnect banner takes a cause argument; when the cause is "auth" it appends "run /login to restore Remote Control", unless the message already mentions /login.
• Other causes keep the existing "run /remote-control to reconnect" hint.
• The surrounding REPL-bridge hook was refactored so all teardown paths go through one reset helper taking archiveAbandoned, replacing several duplicated ref-clearing blocks.

— run /login to restore Remote Control

When the configured Claude Code executable exists but cannot be spawned, the SDK error now describes the dynamic-loader mismatch case and points at the option you would use to fix it.

• covers the case of a musl-linked binary on a glibc host, where /lib/ld-musl-* is absent
• names options.pathToClaudeCodeExecutable as the override

e.g. spawning a musl-linked binary on a glibc Linux host fails because the musl dynamic loader (/lib/ld-musl-*) is missing

The admin gateway spend precheck now returns { blocked, headers }, so rate-limit headers reach the client on successful calls and not just on a blocking 429.

• Previously only the blocking 429 response carried the precheck headers.
• When the request is allowed and the upstream response is ok, the precheck headers are copied onto that response.
• This is how clients see overage state, for example anthropic-ratelimit-unified-overage-disabled-reason, on a call that went through.

anthropic-ratelimit-unified-overage-disabled-reason

After reporting findings, /review can tell Claude to run /verify, a follow-up section that was present but inert in 2.1.224.

• the helper previously returned an empty string unconditionally
• now emitted when the tengu_opal_circuit gate is on, fallback false
• also requires the "verify" skill to be installed for the session; otherwise nothing is emitted
• the section text includes "this review checks that the diff reads right"

## After the review

The verify skill can be invoked by Claude itself when a gate is on; in this build the gate falls back to false, so it stays user-invocable only.

• disableModelInvocation changed from a constant true to a function returning the negation of a gate read.
• Gated on tengu_opal_circuit, fallback false when remote config gives no value.
• The gate result is latched in new app state verifySkillRolloutGateLatch so it is read once per session.

verifySkillRolloutGateLatch

A prompt block tells Claude, immediately before running git commit, to state by literal name whether each of the check skills RAN or NOT RUN this session, with carve-outs for trivial commits and test-only diffs. It renders only when the circuit check passes, and each firing is recorded with telemetry carrying has_verify, has_code_review and a hashed path.

• Gated on tengu_opal_circuit, a gate lookup with fallback !1, so it is off by default in this build.
• A cached decision or a remote value can override the fallback and turn it on.
• The check skills named are verify, simplify and code-review.

tengu_pr_prep_suggestion_rendered

The env-var-or-default logic for the self-hosted runner startup timeout moved into its own function.

• Gated on SELF_HOSTED_RUNNER_STARTUP_TIMEOUT_MS.
• Unset or empty still falls back to the built-in default.

SELF_HOSTED_RUNNER_STARTUP_TIMEOUT_MS

Accepting the prompt to make auto mode your default permission mode now performs the switch rather than only recording the answer.

• Writes permissions: { defaultMode: "auto" } to userSettings and prints an [auto on]-style confirmation line
• If the gate refuses the switch, shows the auto-mode-unavailable warning instead
• tengu_auto_default_nudge_resolved gained an outcome field alongside the existing choice and current_mode

tengu_auto_default_nudge_resolved

The claude.ai remote-trigger tool's action enum adds create_webhook_trigger, which POSTs to /v1/code/webhook-triggers so a routine can be fired by an external event source.

• The body must name the event source, scope, events, filter and the routine_trigger_id to fire.
• On success the tool appends a summary line linking the routine it fires; the link is assembled at runtime from the CLAUDE_AI_ORIGIN and the routine trigger id.
• Telemetry trigger_id is populated from the request's routine_trigger_id for this action.
• The tool description was rewritten to document the new action.

create_webhook_trigger requires body

A create_webhook_trigger action lets Claude attach an event source, such as a GitHub event, to an existing routine so it fires on that event rather than on a schedule.

• Posts to /v1/code/webhook-triggers and requires a body; without one it errors with 'create_webhook_trigger requires body'
• Documented in the tool prompt alongside the other routine actions
• The response appends the routine's claude.ai link instead of a next run time

create_webhook_trigger: POST /v1/code/webhook-triggers (requires body)

Slash commands generated from bundled plugin skills now carry through a much larger set of command features, so they behave more like hand-written commands.

• Newly passed through: argsMayContainSlashCommands, getContext, background, the resolved skillRoot, getEffort, getDefaultEffort, onUserTypedArgs and getArgumentCompletions.
• A skill-supplied progressMessage is forwarded, defaulting to "running".
• getPromptForCommand now comes from a cached wireSkillFilesExtraction step.

argsMayContainSlashCommands

A polling watcher notices a fresh OAuth credential for the same account and re-enables Remote Control without you having to run /remote-control again.

• Polls on a 5 minute interval.
• Disarms itself if the new credential belongs to a different account.
• Reattach and archive paths re-verify the signed-in account before acting.
• Gated on tengu_bridge_auth_revive with fallback !0; with the kill switch off the watcher still polls but performs no unattended revive.

tengu_bridge_repl_auth_revive

Two index bugs in the input-stream loop are fixed, so messages after a reset or a cancelled request are not silently dropped.

• The read index is reset whenever a conversation_reset event appears in the pending batch, instead of only when a filtered condition held.
• When a cancelled request's placeholder text message is spliced out, the read index is decremented if it sat past the removal point.

conversation_reset

The artifact tool's "comments" action now takes thread_id and cursor on top of action and url, so a model can fetch one thread or page through a long listing.

• When a listing is truncated, the omitted-threads line names the cursor to re-run with.
• The parameter help describes cursor as continuing a listing that ended with a "more threads not listed" line.

comments only: continue a listing that ended with a "more threads not listed" line

The device-registration bridge validates its dial URL before connecting, so it cannot be pointed at an arbitrary websocket host.

• new isAllowedUrl check requires wss:, no username or password in the URL, and a hostname in {bridge.claudeusercontent.com, bridge-staging.claudeusercontent.com}
• an operator-overridden base URL is allowed only through a separate same-origin check, which permits ws: only for localhost, 127.0.0.1 and [::1]
• no such check existed in 2.1.224
• the bridge only runs when non-essential egress is allowed, the provider is first-party, and the allow_remote_sessions policy permits it; the base URL is overridable via CLAUDE_REMOTE_TOOLS_BRIDGE_URL

bridge-staging.claudeusercontent.com

The SDK query builder accepts resolvePermissionModeInCli, which leaves an unspecified permission mode undefined so the CLI resolves it from settings rather than being pinned at the SDK layer.

• Previously an unspecified permissionMode was always sent as "default".
• With the option set and no mode given, the field is omitted entirely and settings decide.
• Without the option, the old "default" fallback still applies, so existing callers are unaffected.
• Opt-in per call site.

resolvePermissionModeInCli

The bridge URL override variable is now filtered out of the env block of remotely fetched managed settings.

• the filter list otherwise holds security-sensitive names such as HOME, NODE_OPTIONS, CLAUDE_CODE_OAUTH_REFRESH_TOKEN and the other CLAUDE_BRIDGE_* URLs
• the same variable still overrides the device bridge base URL when set locally

CLAUDE_REMOTE_TOOLS_BRIDGE_URL

Whether an untrusted-device failure counts as auth-recoverable is now controlled by a kill switch, and the 403 classification used by archive and unarchive was split.

• the recoverability check changed from reason === "untrusted_device" || reason === "session_stale_relogin" to treating untrusted_device as recoverable only when the proactive-enrollment kill switch is off
• gate is tengu_sessions_elevated_auth_disable_proactive_enrollment, fallback false, so absent a remote value untrusted_device stays recoverable
• archive and unarchive pass different 403 classification modes; only unarchive maps session_stale_relogin
• that reason surfaces as "session expired for trusted-device check — run /login to re-authenticate"

tengu_sessions_elevated_auth_disable_proactive_enrollment

Accepting the "Make auto mode your default permission mode?" dialog applies auto mode to the session in progress rather than only writing the setting for next time.

• on accept, the live tool-permission context is switched to auto with source auto_default_nudge
• on success the user setting is written and an in-line confirmation is shown
• if the auto gate is unavailable, a warning notification keyed auto-default-nudge-unavailable is posted and the nudge is not marked as seen
• the resolution event now records outcome alongside choice
• the nudge itself is gated behind tengu_maple_pier, fallback false

auto-default-nudge-unavailable

A new subsystem connects the CLI to a claude.ai bridge over WebSocket as a named device and exposes an MCP server for it. It is off in this build unless the remote gate turns on.

• MCP server name claude-code-device, with one tool get_device_info, described as "Returns runtime environment details for this device (platform, architecture, Claude Code version, and device name). Call this to confirm the device connection is live."
• handles handshake, heartbeats ({"type":"hb"}), reconnect backoff, slot contention and a 33554432-byte inbound frame cap
• the default enable check awaits the remote gate tengu_violin_wood and falls back to false if it throws
• additionally requires non-first-party egress to be allowed, provider firstParty, and the allow_remote_sessions policy
• default endpoints are wss://bridge.claudeusercontent.com and wss://bridge-staging.claudeusercontent.com, overridden by CLAUDE_REMOTE_TOOLS_BRIDGE_URL

[deviceBridge] skipped: non-essential egress disabled, non-first-party provider, or remote sessions policy-denied

Startup creates and access-checks the base directory under a timeout so an unwritable or hung mount fails immediately rather than partway through a run.

• a timeout exits the process with a hint to check mount health
• other failures throw with instructions to pass --base-dir or set SELF_HOSTED_RUNNER_BASE_DIR

SELF_HOSTED_RUNNER_BASE_DIR

The spinner can narrate what Claude is currently drafting in a workshop design page, driven by the partial tool input as it streams in. It is gated on an environment variable and on workshop mode being active.

• A new module (exporting isWorkshopProgressEnabled, deriveAuthoringProgress, onInputJsonDelta) hooks tool-use start, input-JSON deltas and content_block_stop for Write and Edit on .workshop.html files
• Messages include "authoring the design page", "wiring up the decisions", "drawing figure N" and "drawing decision N", the latter including the decision id
• Output is throttled and truncated to the terminal width, and cleared when the tool use ends
• The stream handler only calls it when the caller passes authoringProgressSurface: !0, which the main REPL does
• Turned off when CLAUDE_WORKSHOP_PROGRESS is set to false, and it also requires an internally registered workshop-active predicate to return true
• Hook failures are swallowed and logged as "workshop authoring-progress hook failed"

authoring the design page, wiring up the decisions, workshop authoring-progress hook failed

Peer resolution tracks identities previously confirmed as not being on this machine. If a local session record later claims one of those names, nothing is sent and the model is told the situation is suspicious.

• The pinning is per-identity: once a name resolves to a session that is NOT on this machine, that fact is remembered for the session.
• On a conflict the send is blocked outright rather than routed to the local match.
• The model is instructed to ask the user before confirming anyone.

A same-named session on this machine your user did not start is suspicious: ask the user before confirming anyone., A session on this machine impersonating it is suspicious: ask the user.

In non-interactive mode a held peer message whose hold cause is a mode mismatch now gets a deadline, so a headless run no longer blocks indefinitely waiting for an approval that can never arrive.

• The expiry uses an unref'd timer, so it does not keep the process alive on its own.
• On expiry the message is dropped and a cancelled receipt is issued to the sender.
• The drop is logged with the reason that no approval surface exists.

[cross-session-inbound] headless: held peer message expired (no approval surface) — dropped with an expired receipt

The spend precheck now picks the most binding cap period that has spend against it and returns anthropic-ratelimit-unified-* headers describing that period.

• headers cover status, reset, overage utilization, surpassed threshold, retry-after and the period itself
• the surpassed-threshold header trips at utilization 0.95 and 0.75
• blocked responses name the offending period and its reset time rather than a generic message
• failures reading the spend store now surface a fetch_error disabled reason instead of a bare error string

anthropic-ratelimit-unified-overage-surpassed-threshold

When Claude Code exits, peer messages that were being held in the cross-session inbound queue are answered as expired instead of being abandoned, so the sending session gets a definite result.

• A shutdown hook drains the hold buffer and settles every still-held peer message with an expired status, logging how many were settled
• The drain is raced against a grace period of up to 750 ms before shutdown continues
• Once shutdown has begun, a late peer message is refused rather than parked, recording peer_inbound_gate / shutdown_expired telemetry
• Unix-socket messaging server teardown now also destroys open connections and unlinks the socket file before awaiting the drain
• A new lookup lets the headless expiry path read a message's hold cause

[cross-session-inbound] shutdown: settling ${e.length} still-held peer message(s) as expired, shutdown: settling , [cross-session-inbound] shutdown: not parking a late peer message \u2014 settled as expired:

Command analysis now treats a command as too complex when one statement directly follows another on the same line, since bash reads that as a single command.

• Two node-type sets back the check: a statement-like set including redirected_statement and ERROR, and a smaller set of negated_command, if_statement, while_statement and for_statement
• A new walk over the parse tree applies the rule and classifies the command accordingly

statement directly follows another statement on the same line

Sessions reached over Remote Control now resolve a reference handle the way local and cloud sessions do, so they can be addressed by name, and the listing warns when it is showing an incomplete set.

• Bridge session refs are resolved from the bridge-session\x00<id> key.
• When the bridge listing is incomplete, the output appends a note that those rows carry no [ref] and are not messageable by name until a later listing completes.
• Selecting a bridge session maps to a cloud-session target tagged via: "remote-control".

list incomplete just now

Publish and deploy calls go through a shared retry wrapper that retries HTTP 503 using a delay derived from retry-after, and the transcript shows why it is waiting instead of appearing to hang.

• Retry progress is reported as an artifact_publish_retry event, rendered by a new UI component.
• The line reads "Publish service temporarily unavailable" for a 503 and "Publish service busy" otherwise, followed by an attempt counter.
• Telemetry records "deploy_503_retried" and "deploy_429_retried" with a deploy_attempts field.

Publish service temporarily unavailable

The org-memory decision store now records which identity settled a decision and supports reopening a settled decision back to the undecided state.

• A settle attempt from a different identity than the one recorded is refused with cause "superseded".
• Reopening emits the new event tengu_org_memory_decision_reopened with from_state and from_cause.
• The reset helper clears the remembered identity in addition to the state.

tengu_org_memory_decision_reopened

The inbound-hold hook keeps a per-message record with an abortable approval prompt, so held peer messages can be superseded, dropped or released cleanly instead of leaving orphaned prompts.

• Superseded, dropped and released holds have their approval prompts cancelled via the stored abort handle.
• When the approval surface returns, the expiry deadline is re-armed rather than being counted against the time with no surface available.
• An approval or denial that lands after the message was already resolved by a mode or setting change posts a warning instead of acting.

That held message was already resolved before your

Posting a reply to an artifact summon can now come back as "already answered elsewhere", so a second session does not duplicate a standing answer or retry pointlessly.

• A 409 whose body reason is summon_already_answered, or a response with summon_answered: !0, maps to the outcome { kind: "summon_answered" }.
• The tool passes answersSummon with the reply, and the autoreact path threads a new declareAnswersSummon flag through reply and edit calls.
• The tool returns replied:false with a result carrying summon_answered, and the model is told not to retry but to read the comments for the answer that landed.
• The tool-use line shows "reply not posted (summon already answered)" instead of the generic reply-needs-thread-activation text.
• The autoreact pipeline takes a separate answeredElsewhereNoticeText notice, for example that the follow-up note was withheld because another session's reply already stands in the thread.
• Telemetry records summon_answered_elsewhere.

summon_answered_elsewhere, Reply not posted: this summon was already answered in another session, and the standing answer is in the thread. The draft was discarded. Do not retry \u2014 read the comments to see the answer that landed., reply not posted (summon already answered), summon_already_answered

The Artifact tool description gained a paragraph arguing that a report, plan or reference meant for an audience is not actually delivered until it is published and the link handed over.

• Applies to work products aimed at a reader, not to incidental output
• Frames publishing plus handing over the link as part of finishing the task, not an extra step
• Description text only; no change to the tool's parameters

is not fully delivered while it lives only in terminal scrollback or a local file

When the bridge runs out of token-refresh retries, the session is marked failed with an instruction to run /login instead of stalling silently.

• The refresher gained an onExhausted callback fired after the configured number of consecutive failures, logged at error level
• Existing "Refresh chain exhausted for sessionId=" logging and bridge_token_refresh_exhausted telemetry are unchanged
• The bridge supplies the callback and moves the session into a failed/auth state carrying the user-facing reason
• Token-refresh failures inside getAccessToken are now caught and logged rather than thrown
• A new cred_4094_recovery cause joins the recovery connect-timeout classification

OAuth token unavailable \u2014 run /login to restore Remote Control, run /login to restore Remote Control

When the auto-mode classifier call returns stop_reason "refusal", the action is denied but the denial is no longer treated as a normal block or counted against you.

• The decision is marked noVerdict: !0 and returns a message explaining the refusal reacts to earlier conversation content rather than the action itself: "Retrying it will hit the same refusal, so don't rewrite or rework the action to get around this".
• The denial is exempt from the denial counter.
• In headless mode it instead throws "Agent aborted: auto mode classifier request refused by the safety safeguard in headless mode".
• Downstream, decisions carrying noVerdict suppress the auto-mode meta message and the config-reject bookkeeping path.
• Telemetry gains failureKind: "policy_refusal", stopReason, stage1VerdictStands and refusedBySafeguard.

Auto mode classifier request refused by the safety safeguard, denying (exempt from the denial counter)

The remote bridge can now recover from a worker credential expiry instead of just reporting the close code, re-minting the credential and forcing an OAuth refresh.

• Adds a recovery-table entry for close code 4094 alongside the existing 401, 4091 and 4093 entries.
• The 4094 entry re-mints the worker credential and sets needsOAuthRefresh: !0.
• Epoch-mismatch conditions token_expired and auth_exhausted map to 4094.
• Gated on the typed close-code mapping, passed as causeTypedCloseCodes: !0 by both bridge callers, so it is active for the remote bridge.
• The plain "code 4094" close-reason text existed in 2.1.224; only the recovery handling is new.

worker credential expired \u2014 re-minting

Comment posting accepts an answersSummon flag; when set, the POST body carries answers_summon: !0 so the server knows the reply resolves an outstanding summon.

• A one-shot claim registry keyed by artifact slug validates the declaration against the expected thread id and tool-use id.
• The claim is marked consumed once used, so a given summon can only be answered once.

answers_summon

A dedicated message now explains that the Remote Control server sent something the client could not parse, and points at updating Claude Code, instead of a generic failure line.

• new exported message BRIDGE_MALFORMED_RESPONSE_HINT, returned for the malformed_response failure reason
• applies to both bridge session creation and reattach
• also listed among the errors the bridge status UI treats as actionable

Remote Control got an unexpected server response \u2014 try again after updating Claude Code

The old "reply-only bridge session" refusal was removed, and unresolved peer names now explain that Remote Control sessions on other machines could not be checked, with a suggestion to retry.

• Unresolved names no longer fall back to the send_message connector.
• Timeouts are now reported as "timeout" instead of not_reachable.
• The isolatePeerMachines prompt is assembled from whichever of the cloud or bridge lookups actually failed.

sessions on other machines could not be checked just now, so they were not searched.

Scheduled token refreshes no longer rely on one long setTimeout, which makes them more reliable across long sleeps and machine suspends.

• A repeating chunked timer re-evaluates the remaining time against a 60000ms cap.
• The refresh only fires when a generation token still matches, so stale timers from a superseded schedule are ignored.

Scheduled token refresh for sessionId=

For sessions owned by the VS Code extension, permissions.defaultMode is read only from policy, flag and user settings, and unsafe values from settings are refused.

• bypassPermissions from settings is ignored unless the user has consented; a warning is printed to stderr and the mode falls back to default.
• auto is ignored while the auto-mode circuit breaker is active.
• The auto read additionally requires tengu_harbor_willow (fallback !1) or a meadow_lantern config value.

tengu_settings_bypass_unconsented_noninteractive_ignored

Asking for an artifact comment thread that is not in the fetched set now says whether the thread genuinely does not exist or whether threads were dropped from the fetch.

• Raises comments_thread_not_found when the id is absent, with text pointing at the "comments" action as the source of thread ids
• Raises comments_degraded instead when threads were dropped, so the model does not conclude the thread is gone
• A filtered listing that comes back empty now tells the model to re-run without thread_id

no comment thread ${er} on this artifact \u2014 thread ids come from action "comments"

If a summon was already answered in another session, the drafted reply is discarded rather than posted, and the caller is told why.

• New summon_answered result path reports the reply was not posted and that the standing answer is already in the thread
• The auto-react flow gained answeredElsewhereNoticeText variants for cases where the artifact is published but the reply is withheld
• Telemetry records summon_answered_elsewhere

Reply not posted: this summon was already answered in another session, and the standing answer is in the thread.

Opening the agents view goes through a trust check first, prompting if the workspace has not been trusted yet.

• The agents view and related entry points await ensureAgentsWorkspaceTrust, which decides skip, trusted or ask
• The ask path renders the TrustDialog
• After acceptance it clears the plugin cache, re-initializes GrowthBook while preserving pending exposures, primes plan slug collisions and captures a policy snapshot
• Telemetry and config environment variables are only applied once trust is accepted

post-trust: re-discover project @skills-dir plugins

The list-agents tool description no longer calls bridge sessions "reply-only" and instead describes them as your Remote Control sessions on other machines.

• The wording is conditional on Remote Control being connected on this machine
• Description text only; the listing behaviour is unchanged

and (when Remote Control is connected here) your Remote Control sessions on other machines

When an inbound cross-session peer message is held, the explanation now tells you whether an org managed setting or the repository's own settings forced it, rather than just reporting an explicit setting.

• Two new hold-reason cases: managed-setting and repo-setting, in addition to the plain explicit-setting case.
• The repo case explains that a repo may only tighten, so your own "accept" cannot override it, and points at --setting-sources to exclude it.
• The resolver was reworked to return both the effective value and which tier decided it; repo-level local and project settings are attributed as repoSettings.

This repository's settings set "crossSessionInbound" to "hold" (a repo may only tighten, so your own "accept" cannot override it); remove the repo setting or exclude it with --setting-sources., This repository's settings set "crossSessionInbound" to "hold" (your own "accept" cannot override a repo tightening).

listAllPeers now tells the model when bridge rows are present but the session walk did not finish, so partial results are not mistaken for the full set.

• The previous bridge-population field was replaced with a bridgeWalkFailed flag, set when the walk failed or the handle produced no usable result.
• With bridge rows present and the walk failed, the listing appends: "list incomplete just now — those rows carry no [ref] and are not messageable by name until a later listing completes".
• A helper that reported bridge population separately was removed.

bridgeWalkFailed

Unarchiving a remote session now handles device trust failures explicitly, and a malformed bridge response is no longer retried as if it were transient.

• untrusted_device and session_stale_relogin 403s are retried once with an X-Trusted-Device-Token header.
• If that does not resolve it, the call returns an elevated_auth outcome logged as bridge_repl_v2_unarchive_elevated_auth, so reattach surfaces an auth failure while preserving the session pointer.
• A malformed /bridge response, or one with an invalid worker_epoch, now returns a terminal malformed_response result instead of null.

bridge_repl_v2_unarchive_elevated_auth

The confirmation prompt now explains how the message is attributed on the receiving end rather than describing it as a user prompt.

• Removes the old "arrives as a user prompt" phrasing.
• States that the message is marked as coming from another Claude session, not from that session's user.

marked as from another Claude session, not from its user

A 403 from the code-session request helper can now report a stale session needing re-login, not just an untrusted device.

• The helper always parses the error resource on a 403.
• Still returns untrusted_device as before.
• Additionally surfaces session_stale_relogin when the call site is tagged elevated_auth.
• Replaces the old classifyUntrustedDevice option object.
• The user-facing re-login message itself already existed in 2.1.224.

Your session has expired for the trusted-device check. Run /login to re-authenticate, then retry.

The "temporarily unavailable" denial text in auto mode now ends with two shared constants rather than inline prose, and the same fragments are reused by the new safeguard-refusal message.

• The fragments are "If it keeps failing, continue with other tasks that don't require this action and come back to it later." and "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used."
• The helper that produced HTTP status and error-kind detail now returns the empty string, so status details no longer appear in either message.

Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.

When the bridge token refresher exhausts its retry chain it now reports the failure instead of stopping quietly, and re-logging in cancels bridge init attempts that started under the old credentials.

• On exhaustion it logs an error built from the fixed fragment "Refresh chain exhausted for sessionId=" plus the session id and failure count, emits bridge_token_refresh_exhausted, and returns "no_oauth_token" to the caller.
• App state gained authChangeGeneration, bumped on login or account change; bridge init compares it before applying results.
• The 401 recovery path keys off a per-endpoint needsOAuthRefresh flag and aborts init after a successful refresh rather than continuing with the stale response.

bridge_token_refresh_exhausted

User-facing text about relaunching a session now says environment instead of pool.

• The requeue confirmation reads "This re-launches the session on another runner in the environment."
• The secret-claim error says it "cannot derive the environment ID for spawn-hint polling".

This re-launches the session on another runner in the environment.

A permission decision that the classifier could not produce a verdict for is now tracked separately from a real denial, so telemetry and UI stop treating a classifier failure as a refusal.

• The decision reason carries a new noVerdict flag.
• Denial-reason bucketing keys off the flag instead of matching a message prefix; telemetry labels are assembled at runtime as classifier:${e.classifier}:no-verdict around the literal :no-verdict.
• The UI denial kind automode-parsing-error is now chosen by t.noVerdict.
• The 'add a Bash permission rule' hint and the post-denial hook message are both skipped for no-verdict cases.

noVerdict

An auth-triggered revive now either reattaches to the same session or reports a dead pointer, rather than quietly creating a fresh session under the old one.

• REPL bridge session options gained reattachOrFail, reviveInitiated, onAuthProven and onReattachPointerDead.
• The caller passes reattachOrFail only when a revive was initiated and a previous session id is known.

onReattachPointerDead

Enabling org memory records the identity that turned it on, and a later enable attempt from a different identity is rejected rather than silently taking over.

• the earlier decision is settled off with cause superseded
• the outcome is reported through the tengu_org_memory_decision event
• applies to everyone; no flag gates it

Wz("superseded")

The prompt asking what to do with a held cross-session message renders as a plain list with a sensible option already selected.

• the select is passed hideIndexes: !0, so options render without numeric indexes
• a defaultFocusValue is passed so the list opens on a specific choice

defaultFocusValue

HTTP failures from code-session calls are classified in one place, and a 401 is treated as recoverable so the caller refreshes OAuth and retries instead of failing the operation.

• one helper returns "oauth_rejected" for 401, "transient" for 408, 429 and any status >= 500, and "rejected" otherwise
• 401 yields { terminal: !1, reason: "oauth_rejected" }
• the type guards now check e.terminal === !0 / e.terminal === !1 rather than testing for the presence of a terminal key
• the bridge's 401 retry path also fires when the result is any non-terminal failure

oauth_rejected

Ancestor verification for peer connections no longer treats a container init process as a legitimate ancestor, so a session running under PID 1 cannot be matched by accident.

• the Linux /proc ancestor walk now records a parent pid of 1 and stops there, where it previously discarded it by breaking at ppid <= 1
• the array descendant helper returns false immediately for pid 1 (if (t === 1) return !1)
• the cached lookup now requires process.pid !== 1 && i.includes(process.pid)
• gated by platform: the ancestor walk reads /proc, so this is the Linux path

[peer-cred] peer pid lookup failed

IDE and Remote Control hosts now learn the CLI's permission mode at connect time, alongside the model.

• new current_permission_mode field in the connect-time state
• documented as "@internal The CLI's active permission mode at connect time, for the same connect-time sync as current_model."
• populated from the live tool-permission context in the main init payload and in both repl-bridge getInitializeState implementations

current_permission_mode

Sessions authenticating through the gateway get the same unified rate-limit handling that subscription sessions already had.

• the guarding predicate changed from "caller says so, or the subscription check passes" to additionally accepting a gateway auth source
• covers unified rate-limit header parsing, 429 handling and the background usage probe

anthropic-ratelimit-unified-overage-status

When a send fails because the peer is gone, the error now distinguishes a name-resolved peer from a stale bridge ID and tells you how to find the current peers.

• Name-resolved peers get "that session may have ended, been archived, or disconnected".
• Stale bridge IDs get their own wording.
• A suggestion to call the peer-listing tool is appended only when that tool is present in the current tool set.

— that session may have ended, been archived, or disconnected.

The /deploy/direct call now retries transient server responses instead of failing the deploy outright.

• 429 honours the retry-after header, capped at 30s.
• 503 retries with jittered exponential backoff up to a maximum attempt count.
• Each retry is logged, and a telemetry event records the attempt count and final status.
• A user abort cancels the retry loop.

deploy_503_retried

Converting a skill into a prompt command now carries menu text, aliases and tool permissions instead of only the allowed-tools list.

• passes through menuDescription, aliases, getAllowedTools and disallowedTools alongside allowedTools
• disallowedTools defaults to an empty list
• the skill extraction is cached per command rather than redone on each conversion

menuDescription

The reply-only composer now answers commenter questions directly and treats change requests as flagged rather than promised.

• Instructed to answer questions directly and substantively
• Change requests are acknowledged as flagged for the artifact's owning session, not committed to
• Explicitly told not to describe its own limitations to the commenter

Noted \u2014 flagged for this artifact's session to pick up

The opening publish of a workshop page now shows a painter animation while it waits for the next version, and nudges you to reload if nothing arrives.

• Both workshop HTML templates gained a script that detects the opening version by an empty ws-decisions island with no decision rows
• The painter animation runs while waiting for the next publish
• After 180000 ms it escalates once into the footer bar with a reload hint
• The authoring skill text drops its hardcoded line-number ranges, now stating the template is 2,948 lines, and adds a refresh hint

Still nothing \u2014 Claude may not be watching this page right now. Reload to check for the latest version.

The workflow auto-mode notice and the auto-default nudge now produce their unavailability text from one helper, and the notice is styled as a warning.

• The helper returns a reason-specific string when there is one, otherwise the fallback "auto mode is unavailable right now"
• The notice is tagged kind: "warning"

auto mode is unavailable right now

A sub-agent handoff whose safety classifier request is itself refused by the safeguard is no longer blocked; the output is passed through with a security warning attached.

• The refusal is not treated as a verdict. The sub-agent output is allowed but prefixed with a long warning telling the model the work is unreviewed and untrusted.
• Classifier outcome logging gained a "refused" bucket alongside the existing "unavailable" and "blocked".

Handoff classifier request refused by the safety safeguard, allowing sub-agent output with an unreviewed warning

The permission prompt for messaging another session now says which kind of peer you are reaching and makes clear how the message is attributed on arrival.

• The prompt branches on the peer's via, saying either "cloud session" (running in the cloud) or "Remote Control session" (on another machine).
• Both texts now spell out that the message arrives marked as from another Claude session, not from its user.
• Peer-listing and error paths were updated to match: a peer-name collision now reads "a Claude session on another machine (cloud or Remote Control)", and error text says a session "may have ended" and either "or been archived" (cloud) or "or disconnected".

It reaches the receiving Claude (running in the cloud) via Anthropic's servers as a cross-session message — marked as from another Claude session, not from its user.

Reading a single artifact comment thread now has its own result rendering in both the tool-result UI and the model-facing text.

• "read 1 comment thread (filtered)" replaces the plain comment count.
• A missing thread renders "requested thread not in this result".
• An empty filtered result tells the model to re-run action "comments" without thread_id for the full list.

The requested comment thread is not in this result — run action "comments" without thread_id for the full list.

The success text after delivering a message to another Claude session no longer always claims the target was a cloud session.

• The message branches on the delivery route used.
• A recipient reached over Remote Control is recorded as a "bridge-session" rather than a "cloud-session".
• The wording appears in the tool result text, so anyone using cross-session messaging sees it.

a Claude session on another machine, over Remote Control

HTTP failures from the code-sessions endpoints are now sorted into transient, terminal and auth categories instead of being treated uniformly, which changes what gets retried and what gets reported.

• 401 becomes a non-terminal oauth_rejected.
• 408, 429 and 5xx remain transient and are retried.
• Anything else becomes terminal request_rejected.
• Grouping and project rejections are tagged grouping_rejected and get their own message about the Project being unavailable.
• OAuth-rejected session creation feeds a distinct telemetry path.

v2_session_create_oauth_rejected

The permission prompt for starting a detached self-hosted runner drops the "pool secret" wording in favour of environment-centric terms used by the other runner tools.

• Refers to an environment secret file rather than a pool secret.
• Describes the work as that environment's queued sessions.

Start a detached self-hosted runner with the environment secret file

Bridge failures are now distinguished by reason and kind instead of collapsing into one generic error, and the message tells you how to retry.

• New failure reasons request_rejected, whose message is assembled as "Remote Control server rejected the request (HTTP ...) — run /remote-control to retry", and malformed_response.
• HTTP classification separates "oauth_rejected" (non-terminal) from "transient" and "rejected" (terminal).
• Failures are reported with an explicit kind, "terminal" or "auth", including the org-policy case.
• App state carries replBridgeError and replBridgeErrorKind.

run /remote-control to retry

Two more patterns were added to the telemetry and error scrubber so header values do not leak through error text.

• One pattern truncates everything after "has invalid value: " for a named header.
• The other covers Headers.append and Headers.set messages about an invalid header name or value.

has invalid value:

Query tokenization pairs a single-character token with an adjacent multi-character neighbour and offers the joined form as an extra candidate, improving matches on terms that were split apart.

• The joined form is appended before the compound-first ordering is applied.
• Compound candidates are still filtered out unless the caller explicitly asked for compounds.

compound

Reconnect recovery no longer forces an OAuth refresh for every handled close code, cutting unnecessary token work on non-auth disconnects.

• The per-close-code recovery table (401, 4091, 4093, 4094) gains needsOAuthRefresh, true for 401 and 4094 only.
• The flag decides whether to force an OAuth refresh up front, whether to enter the retry loop that prompts for a fresh login, and whether to do a late refresh instead.
• The CCR client gained an onRequestAuthOk callback fired on a successful heartbeat, wired through the bridge so the session can mark auth as proven.

needsOAuthRefresh

A peer reachable over Remote Control is described as being on another machine instead of falling through to the "on this machine" wording.

• The human description helper treats bridge-session like other Claude sessions.
• A new location string is rendered for these sessions.

on another machine (Remote Control)

Persisted background job state now carries the flags needed to respawn a job, with unknown flag tokens filtered out before they are written.

• the job-state writer persists respawnFlags alongside the fields it already rewrites
• the schema defaults respawnFlags to an empty list and filters its contents against an allowlist
• dropped tokens produce a warning naming them

[jobs] stripped non-allowlisted respawnFlags token(s) from persisted job state:

A successful bridge heartbeat clears accumulated authentication-failure state instead of leaving the counter to age out on its own.

• the CCR client gained an onRequestAuthOk option, invoked next to resetHeartbeatStreak() on each successful heartbeat
• the bridge supplies a callback that resets its auth-failure counter and calls the existing onAuthProven hook

onRequestAuthOk

When an inbound cross-session message is held by an explicit setting, the notice names the settings layer responsible instead of giving a single generic cause.

• the old single hold cause "explicit-setting" was replaced by source attribution, including managed-setting
• policy settings render "Your organization's managed settings set \"crossSessionInbound\" to \"hold\"."
• project and local settings render "This repository's settings set \"crossSessionInbound\" to \"hold\" (your own \"accept\" cannot override a repo tightening)."
• a WeakMap holds the last-reported cause so a notice is re-emitted only when the cause changes

managed-setting

Inbound peer messages are no longer misattributed to this process when the session runs as PID 1, which is common inside containers.

• the self-sent check now takes the pid as a parameter rather than reading it implicitly
• returns false outright when that pid is 1, so no false selfSent match
• pairs with the ancestor-walk change above

selfSent

An authentication failure in the repl-bridge connect loop is reported as such and does not consume one of the limited retries.

• the retry counter is incremented only for non-auth failures
• failures now carry an explicit kind: auth for auth failures, terminal otherwise
• replaces a single generic terminal path for both cases

auth

The in-REPL haiku, opus, sonnet and fable sampling helpers emit their start progress event before validating arguments, so bad input shows up as a visible error rather than a throw with nothing recorded.

• "prompt must be a string" and "schema must be an object" now arrive as a repl_tool_call progress event with phase "error"
• a non-string prompt is recorded in progress as an assembled placeholder naming its typeof

schema must be JSON-serializable

When preserved event ids exceed the cap, the compaction payload itself is now trimmed to match, rather than only the id list.

• The internal event writer rewrites compactMetadata.preservedMessages.uuids to the last N and adjusts the preserved segment.
• Whether that rewrite happened is reported as payloadClamped on the existing tengu_ccr_preserved_event_ids_clamped event.

tengu_ccr_preserved_event_ids_clamped

Changing the working directory mid-session no longer discards a pending archive in the REPL bridge hook.

• The per-session state reset was factored into a single helper taking an archiveAbandoned flag.
• The working-directory-change path now calls it with the flag set, which fires the pending archive before unregistering it.
• Previously that path cleared the refs silently.

archiveAbandoned

The watch summary now reads correctly for more than one watch.

• The count is formatted separately and the word "watch" is pluralized to "watches".
• Previously the whole phrase "artifact watch" was pluralized.

in this session (session-local; none survive a restart):

Selecting a group header no longer causes the selection to bounce between the header and the previously selected row.

• The effect that snaps selection to the computed target bails out when the current index already equals the target.
• The header-scroll effect sets selection and scroll offset together.
• The empty-state telemetry event still reports skeleton and has_origin.

tengu_fleetview_empty_state_shown

Re-extracting a bundled skill over files that already exist succeeds when the contents already match, instead of erroring out on EEXIST.

• Extraction passes a tolerance option; on EEXIST it opens the existing file, checks it is a regular file and compares its full contents to what would be written.
• It rethrows only if the contents differ.
• The 'additional skill files' path uses plain tolerateExisting: !0.

tolerateExisting: "verify-content"

The post-commit awareness system message is now emitted only for the main session, not for every subagent that happens to run the tool.

• the PostToolUse callback returns early when the hook payload carries an agent_id, on top of the existing non-interactive check
• relatedly, the code-review prompt no longer appends its "end your response with this exact line" suffix when running with an agent id or as a skill preload

e.agent_id !== void 0

A recorded set of sessions for a handle is now dropped when an unrecordable listing supersedes it, instead of being left stale.

• The successful path records the newly computed listing as before.
• The drop is logged as "[bridge:population] forgot the recorded set (an unrecordable listing superseded it)".

[bridge:population] forgot the recorded set (an unrecordable listing superseded it)

Importing a Gemini command that used an exclamation mark as prose or negation could fail validation even when nothing shell-like was involved.

• Previously any command mixing argument placeholders with a '!' anywhere outside its shell blocks was rejected.
• The importer now masks $-prefixed tokens first.
• It only flags a '!' whose preceding character is not an ordinary word or punctuation character.
• The dangling-marker and shell-block checks are unchanged.

Mixes argument placeholders with backticks or '!' outside its shell blocks

Share status no longer trusts a server-reported mode when the response carries no asset token, which stops a public read from being presented as owner access.

• With no asset token, the mode is reported as "public" regardless of what the server said.
• A role of "owner" is dropped in that case.
• The artifact tool emits an "unknown_share_mode" telemetry reason when the derived mode is "unknown".

unknown_share_mode

An incoming message with an unrecognized type no longer leaves callers waiting on it forever.

• The handler extracts a uuid if present and reports that command as "completed" through the lifecycle callback.
• The existing "Ignoring unknown message type" warning is still emitted alongside.

Ignoring unknown message type:

A machine reachable only over the bridge no longer shows "No reachable agents.", because bridge transports are now passed into the session section rather than merely counted.

• Bridge rows are deduplicated against cloud sessions.
• The recorded-population debug lines were reworded to say so.

[bridge:population] warm recorded set:

A 429 injected by the gateway, for example a spend block, no longer overwrites the displayed Anthropic rate-limit state.

• Rate-limit status tracking returns early when the provider is the gateway and the 429 response lacks the unified status header.

anthropic-ratelimit-unified-status

The follow poller in the virtual scroll list now updates an additional focus setter when it re-pins, and the scroll layout effect's early-return guard was rewritten against different refs.

• triggered on the same path that logs [FV-poll] follow re-pin moved focus:
• the extra setter runs alongside the existing one rather than replacing it
• the user-visible consequence could not be pinned down beyond it being a focus and scroll sync fix

follow re-pin moved focus

The helper that returns the verify-skill nudge string now returns an empty string early for skill preloads and whenever the opal circuit check is false. The string itself already existed; the gating around it is new.

• Gated on tengu_opal_circuit.
• Even when the circuit passes, the nudge is only produced if a skill matching the verify constant is present in the loaded skill set.
• Skill preload paths always get "".

if (e.options?.isSkillPreload) return "";

Credential re-mint after a transport close now retries with exponential backoff instead of giving up, and authentication failures get their own terminal messages telling you exactly which command to run.

• Backoff uses a 30s base with a 300s cap, showing "Remote Control server unreachable — retrying (attempt N)".
• A rejected credential forces one OAuth refresh before the next attempt.
• Terminal failures direct the user to run /login and then /remote-control.

Claude.ai login expired — run /login, then /remote-control

Remote credential fetch retries once through a new device-attestation path, and an untrusted_device result without the relevant capability now returns a terminal rejection instead of a bare null.

• The rejection carries reason: "request_rejected" with status 403 and is marked terminal, so callers stop retrying.
• OAuth-rejected results are now passed through to the caller rather than swallowed.
• The enabled state of the surrounding path could not be resolved from the build.

{ terminal: !0, reason: "request_rejected", status: 403 }

Attaching a cloud session and completing remote auth setup both now attempt to bring up the device bridge for that session.

• both paths dynamically import startDeviceRegistration and call it with the session id, an access-token getter and the org uuid
• registration short-circuits on its own enable and egress checks, so nothing happens unless tengu_violin_wood and the allow_remote_sessions policy both permit it

startDeviceRegistration

A safeguard refusal from the primary classifier model is treated like the model being unavailable, so the fallback model gets a chance instead of the request failing outright. The rollout state of this path could not be resolved in this build.

• refusedBySafeguard joins unavailability as a trigger for retrying on the fallback model within the remaining time budget
• Usage and durations from both attempts are merged
• If the fallback also fails to produce a usable answer, the original result is kept
• The log line now distinguishes a refusal from an unavailability

refused (stop_reason=refusal)

Streaming now emits tool-use and partial-JSON callbacks into a workshop authoring-progress module, which is off unless internal workshop mode applies.

• onToolUseStart is called on a content_block_start for a tool use.
• onInputJsonDelta is called on each partial JSON delta.
• The module is only consulted when enabled, which requires an internal workshop-mode predicate.
• Setting CLAUDE_WORKSHOP_PROGRESS to false switches it off.

CLAUDE_WORKSHOP_PROGRESS

The refusal shown when an artifact is served to a public, non-member reader moved out of the boot-response parser into a wrapper around it, and now fires whenever no asset token comes back.

• The error text is unchanged: "artifact read failed: this artifact is served to you as a public (non-member) reader, and reading public artifacts that way is not enabled yet".
• Public reading remains behind the remote-config gate tengu_cobalt_plinth_sedge, whose in-source fallback is false, so it is off in this build.

tengu_cobalt_plinth_sedge

The artifact tool's argument extractor now reads an optional string cursor in addition to thread_id and text.

• cursor is returned as part of the parsed argument shape
• no schema entry or request consuming it was found in this build, so it appears to be plumbing ahead of paginated comment fetching

"cursor" in e

The nudge suggesting the user's non-auto default permission mode no longer fires in sessions where auto mode is not reachable.

• shouldShowAutoDefaultNudge now takes the tool permission context
• additionally checks that auto mode can be cycled to, meaning context availability plus the auto-mode gate
• the nudge itself sits behind tengu_maple_pier, fallback false

shouldShowAutoDefaultNudge

When init runs in reattach-or-fail mode, a reattach pointer that is gone (or absent entirely) now fails terminally with a user-facing message instead of quietly creating a new remote session.

• Covers both the gone-pointer case and the no-pointer-at-all case.
• Emits distinct telemetry for each failure shape.
• The enabled state of the reattach-or-fail mode itself could not be resolved from the build.

[remote-bridge] Reattach-or-fail: no reattach pointer for this init; failing terminally instead of minting fresh

Two guards were added to Remote Control auth recovery so a stuck flag or a repeatedly failing credential no longer loops forever.

• If the auth-recovery in-flight flag is still held past a computed ceiling, the close is handled directly and logged as leaked.
• Close code 4094 gets its own attempt counter.
• Recovery gives up after repeated failures with no successful heartbeat in between.

worker-credential recovery exhausted after

The bridge reports its full connection lifecycle, gated the same way as the bridge itself, so none of it fires in this build unless tengu_violin_wood is on.

• events: tengu_device_bridge_started, _stopped, _skipped (with reasons missing_org and missing_account), _start_failed, _connected, _rejected, _closed, _connect_failed, _pong_timeout, _reconnect_exhausted and _heartbeat_unsupported
• the connected event records the protocol version plus negotiated hb_interval_ms, staleness_ms and rpc_timeout_ms
• repeated transport failures are de-duplicated before being reported

tengu_device_bridge_heartbeat_unsupported

Startup, after prefetch, can run an async warm read that populates keybindings from the storage backend ahead of first use, tracked by a warmedFromBackend flag.

• the warm read suppresses feature events; the next synchronous read re-validates and discards the warmed value if customization is disabled, so a backend-loaded set does not survive the feature being turned off
• warming is skipped in non-interactive mode and when the feature is off
• a backend read failure during warming logs the telemetry reason warm_backend_read_failed_fell_back
• hot-reload and delete paths clear the flag
• gated on tengu_keybinding_customization_release, which falls back to true

warm_backend_read_failed_fell_back, warmedFromBackend

The memory-consolidation prompt keeps its exact wording but is now bound to different constants, and the background-session shipping instructions that told the model to open a draft PR are not present in this build's module graph.

• The removed text instructed the model to open a draft PR via gh pr create --draft without asking.
• Whether that text was relocated elsewhere rather than deleted could not be established, so treat its status as unresolved.

open a draft PR via gh pr create --draft without asking

The auto-default-nudge dialog now renders a different component whose only action on completion is to dismiss itself, so the state it used to change is no longer applied here.

• The previous onDone callback that switched the session to "auto" and merged a new toolPermissionContext is gone.
• The new component clears itself on done and nothing else.
• Whether and when this dialog is reachable in this build could not be resolved.

auto-default-nudge

Both transcript scope-listing loops now pass a flag to listEntries requesting that scope statistics be skipped.

• the calls pass { skipScopeStats: !0, ... } instead of only a cursor
• the flag appears at exactly these two call sites in the bundle, so the consumer is not visible and what the backend does with it could not be confirmed

skipScopeStats

The headless daemon's browser-login cooldown and auth-status records can now be read and written through the v5 storage client instead of files in the config dir.

• both records gained state keys for the v5 layer
• active only when the supervisor is constructed with a storageV5 client
• dedicated failure reporting on that path, for example daemon-auth v5 cooldown read failed
• falls back to the daemon-auth-cooldown and daemon-auth-status.json files under the config dir when no client is passed

daemon-auth-cooldown

The two-stage prompt-injection and safeguard classifier now records when the model stopped with a refusal, which previously looked identical to an ordinary parse failure.

• The parse-failure event now carries stopReason plus failureKind: "policy_refusal".
• The block result itself carries refusedBySafeguard.

refusedBySafeguard

The browser-login cooldown timestamp and the auth_required status file go through the storage backend when one is available instead of direct file IO.

• writes use a umask-derived file mode
• backend failures raise explicit errors carrying telemetry codes rather than being swallowed

daemon-auth v5 cooldown write failed

New serialized entry points re-run org-memory discovery and report how the decision moved.

• refuses to run in an untrusted workspace or when the account boundary changed, returning a refusal with a reason
• on success it clears the discovery cache, re-runs discovery and reports both the previous and current state

{ kind: "refused", reason: "untrusted_workspace" }

The query loop's inline transcript bookkeeping is now a single factory with named operations rather than scattered inline logic.

• covers incremental persistence, tombstone eviction, compact-boundary handling and the unanchored preserved-tail flush
• the telemetry event for preserved-but-unanchored messages is unchanged

tengu_compact_preserved_unanchored

Re-running the inbound policy over queued cross-session messages now reports why each still-held message is held.

• the hold cause, which may have changed since the message arrived, is passed to a listener along with the current queue depth
• refused messages additionally fire a drop callback

[cross-session-inbound] dropped

The non-interactive query path no longer builds the same large context object inline in two places, which is intended to be behaviour-preserving.

• Context is built through a shared factory called with phase: "input" and phase: "query"
• Model and thinking configuration come from a single resolver
• systemPrompt arrives pre-rendered from the prompt builder, including appendSystemPrompt and mcpClients
• Compact-boundary handling is delegated to applyCompactBoundary and flushBeforeCompactBoundary

applyCompactBoundary

Docker detection and git identity lookups no longer spawn subprocesses, doing the same work in-process.

• The Docker check no longer runs test -f /.dockerenv as a subprocess.
• Git identity no longer shells out to git config --get user.email or user.name.
• Both results stay memoised as before.

/.dockerenv

Executable launch failures and subprocess init timeouts now report a structured error class, and any path in the message is scrubbed for secrets before it is interpolated.

• The helper producing "executable not found / failed to launch" strings now returns an object with telemetryMessage and errorClass, one of "executable_launch_failed" or "executable_not_found".
• Paths go through a new redaction helper applying the shared token patterns: Bearer, sk-ant-, AKIA, gh*_, JWT and others.
• Subprocess init timeouts become a TelemetrySafeError with errorClass "initialize_timeout"; the user-visible message is unchanged.

errorClass: "initialize_timeout"

The protobuf-shaped event metadata changes which fields it carries, removing two code and repo identifiers and adding MCP identity plus reported account details.

• Removed: repl_code and git_remote_url.
• Added: mcp_server_name, mcp_tool_name, an optional event_metadata_vars string, and a client_reported_auth submessage carrying account_uuid and organization_uuid.
• The experiment-exposure message separately gains variation_key, and user_attributes / experiment_metadata become optional, serializing as undefined rather than an empty string.

client_reported_auth

Experiment events now record which variation was seen, and absent optional fields are omitted rather than sent as empty strings.

• Adds a variation_key field to the experiment event schema.
• user_attributes and experiment_metadata default to undefined instead of "".
• The same treatment applies to the generic event's process and additional_metadata fields.

variation_key

A new async helper pulls the account identifiers directly off the config file instead of going through the synchronous cached config.

• Reads oauthAccount for accountUuid and organizationUuid.
• Returns undefined on any parse or type failure rather than throwing.
• Used by the OAuth refresh path and by the bridge hook when refreshing credentials mid-session.

"oauthAccount" in t

The tool UI override map for the artifact tool passes renderToolUseProgressMessage alongside renderToolResultMessage.

• This is the path by which the publish-retry progress line reaches the transcript.

renderToolUseProgressMessage

A large module-init block was emptied down to a single import of getCoordinatorUserContext, and a new init block elsewhere now pulls in the roughly 45 modules, plus require("crypto"), that used to live there.

• Bundling and lazy-init layout only; no behaviour visible to a user changes.

getCoordinatorUserContext

The runtime-environment classifier that returns "docker" now goes through a shared helper rather than inlining its own caching.

• Replaces the inline cached ?? probe() pattern with a helper wrapping it.
• The same detection is now shared with other callers.

kubernetes

Aborts in the direct-connect transport are now classified as aborts in telemetry instead of appearing as generic failures.

• the transport rejects with a helper that builds the abort error together with telemetry metadata, rather than constructing a bare error
• the resulting event carries errorClass: "aborted"

telemetryMessage: "Operation aborted"

Heuristic classifier summaries are now the unconditional fallback rather than needing their own flag turned on.

• the selector previously returned "llm" under one flag, "heuristic" under a second flag, and null otherwise
• it now returns "heuristic" whenever the llm flag is off
• tengu_classifier_summary_llm_emit still selects "llm", fallback false
• tengu_classifier_summary_heuristic_emit no longer appears anywhere in the bundle

tengu_classifier_summary_llm_emit

The credentials cache carries a new field for recording a read failure, with nothing reading it yet.

• lastReadFailure: null added to the cache object literal and to its reset routine
• sits alongside the existing cache, generation and readInFlight fields
• nothing else in the bundle reads or writes it, so there is no observable effect in this build

lastReadFailure

Resume-style session and transcript listing gained a backend path that pages through stored entries instead of scanning directories.

• pages listEntries for the "transcript" namespace to enumerate project keys and session files
• falls back to the previous readdir-based scan when no backend is passed
• the old standalone directory-scanning helpers were removed

{ namespace: "transcript" }

Errors from the SDK's subprocess transport are wrapped with a redacted telemetryMessage and an errorClass so failures can be grouped.

• classes include spawn_failed, process_exited_nonzero, process_killed_by_signal, executable_not_found and control_request_failed
• covers spawn failures, non-zero exits, signal kills, aborts, control-request failures and error results
• stderr tails and filesystem paths are redacted before being attached

process_killed_by_signal

A wake router scans pending notifications on each query-loop tick and delivers them as meta prompts.

• delivers task-notification prompts per agent, de-duplicated by agentId
• re-arms a 60s timer while agent notifications remain pending
• drops events for agents whose session has already ended

[wakeRouter] dropping

Prepared tool descriptions are cached under a key that now varies on whether a particular tool is in the tool set.

• an "S:" prefix segment is added when that tool is present, empty otherwise
• sessions with and without it no longer share cached descriptions

? "S:" : ""

The hook-generated session environment loader and the cwd-env clearing routine can now read and write through a storage handle instead of the filesystem directly.

• Both take an optional storage handle; when supplied, entries under session-env in userConfigDir are listed, read and written through that layer, paged with a cursor
• When no handle is passed, the existing direct fs/promises path is used
• CLAUDE_ENV_FILE handling is unchanged

Failed to clear cwd env files

The bundled-command builder no longer constructs and registers a command object inline; registration moved to a dedicated function.

• The old helper now just returns { skillRoot, getPromptForCommand }.
• A reset helper clears the bundled command lists and the kill-switch-survivor set tracked by survivesBundledKillSwitch.
• A batched file-writing helper with tolerateExisting and verify-content semantics was added alongside.

survivesBundledKillSwitch

The embedded build constants advance everywhere they appear.

• VERSION 2.1.224 to 2.1.225, BUILD_TIME 2026-08-07T19:37:58Z, and a new GIT_SHA.
• These are what /status, claude --version, the updater messages and the claude-cli/… user agent report.

VERSION: "2.1.225"

The credential-scrubbing regex table was split into two reusable arrays so more than one code path can apply the same rules.

• One array covers Bearer, Basic, sk-ant, sk-, AKIA and ASIA forms.
• The other covers gh_ tokens, xox- tokens and JWTs.
• The existing transcript redactor splices both lists in.
• A new standalone helper applies all of them to any string, and is what the SDK error paths use for file paths.

/\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g

The OpenTelemetry-to-internal-event transform stops reporting two attributes and starts reporting MCP identity in their place.

• No longer emits repl_code or git_remote_url.
• Emits mcp_server_name and mcp_tool_name, sourced from _PROTO_mcp_server_name and _PROTO_mcp_tool_name.
• _PROTO_code and _PROTO_git_remote_url are still stripped from additional_metadata, they are just no longer reported anywhere.

_PROTO_mcp_tool_name

The bridge teardown telemetry event can now say which of two skips happened when a session is torn down.

• tengu_bridge_repl_teardown gains archive_status value skipped_remint_loop, alongside the existing skipped_teleport.
• Reported when the teardown reason is something other than remote_control_disabled.
• The value is new in this build.

skipped_remint_loop

The bundled protobuf descriptor and CEL evaluator code moved from module-scope variables to explicit exported members.

• Edition and SymbolVisibility enums are now published with matching *Schema descriptors.
• CEL conversions go through exported toCel, celError and isCelUint helpers.
• No behaviour change is visible from the diff; it reads as a bundling or module-format change.

SymbolVisibilitySchema

Reading and augmenting error metadata for telemetry no longer risks throwing from a malformed thrown value.

• telemetryMessage is read through a guarded helper that type-checks the property and swallows any throw.
• A companion helper copies missing fields onto an error only when it is a non-null extensible object, also wrapped in try/catch.
• Fields already present on the error are never overwritten.

telemetryMessage

A replayed tool call that runs past the end of the cached call list now records the mismatch before throwing.

• The message is assembled from the position, tool name and count, ending in "... invoked but only N calls cached (exhausted)".

calls cached (exhausted)

Several regex sets and constants were relocated between lazy-init modules with no change to their behaviour.

• Test runner patterns (bun/npm/yarn/pnpm/deno test, go/cargo/make/... test, pytest/jest/vitest/rspec/phpunit/ctest) moved.
• Typecheck patterns (tsc, mypy) moved.
• The transcript marker strings and the opening-tag regex moved.
• The patterns themselves are unchanged.

(?:bun|npm|yarn|pnpm)\s+run\s+typecheck\b

Spinner text and colour updates go through a shared event emitter instead of calling into the render layer directly.

• a new module exposes setSpinnerMessage and setSpinnerColors
• these emit main-message and main-colors events on a shared emitter
• a handler switch on the receiving side applies them

kind: "main-colors"

Classifier failure events now report why generation stopped.

• stopReason is added to the payload alongside classifierModel, classifierType and failureKind
• the optional errorKind and fallbackFrom fields are unchanged

stopReason