spacehub

surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

Merge branch 'main' into sec-default-prompt-composeBrowse files
poteat authored 23 days ago parents 690f3d7 + 0d7f14d · commit 4b97909e54ff
37 changed files+704 -296compared with 690f3d7
MCHANGELOG.md
Mfeed.xml
Mmods/agents-md/hooks/register.ts
Mmods/agents-md/tests/register.test.ts
Mmods/diff/hooks/git/argv/diff-leading-args.ts
Mmods/diff/hooks/names/index.ts
Dmods/diff/hooks/names/plugin-name.ts
Amods/diff/hooks/names/plugin-names.ts
Mmods/diff/hooks/register.ts
Mmods/diff/tests/fixtures/ring-onto.ts
Mmods/diff/tests/git/fetch-diff.test.ts
Mmods/diff/tests/views.test.ts
Mmods/sec-default/.claude-plugin/plugin.json
Mmods/sec-default/README.md
Amods/sec-default/hooks/admission-failure/admission-failure.ts
Amods/sec-default/hooks/admission-failure/index.ts
Mmods/sec-default/hooks/hooks.json
Mmods/sec-default/hooks/index.ts
Amods/sec-default/hooks/managed-mods-only-refusal/index.ts
Amods/sec-default/hooks/managed-mods-only-refusal/managed-mods-only-refusal.ts
Mmods/sec-default/hooks/policy/index.ts
Amods/sec-default/hooks/policy/is-managed-mods-only.ts
Amods/sec-default/hooks/policy/own-option/index.ts
Amods/sec-default/hooks/policy/own-option/member-of/index.ts
Amods/sec-default/hooks/policy/own-option/member-of/member-of.ts
Amods/sec-default/hooks/policy/own-option/own-option.ts
Amods/sec-default/hooks/policy/own-option/own-options-path/index.ts
Amods/sec-default/hooks/policy/own-option/own-options-path/own-options-path.ts
Mmods/sec-default/hooks/register.ts
Mmods/sec-default/tests/fixtures/index.ts
Amods/sec-default/tests/fixtures/logged.ts
Amods/sec-default/tests/fixtures/managed-mods-only.ts
Amods/sec-default/tests/fixtures/mods-policy-of.ts
Amods/sec-default/tests/fixtures/policy-by-source.ts
Amods/sec-default/tests/fixtures/policy-until-stopped.ts
Amods/sec-default/tests/policy/is-managed-mods-only.test.ts
Mmods/sec-default/tests/register.test.ts
MCHANGELOG.md
Large file, diff not shown.
Mfeed.xml+207 -146
@@ -6,8 +6,214 @@
66 <author><name>Anthropic</name></author>
77 <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md"/>
88 <link rel="self" type="application/atom+xml" href="https://raw.githubusercontent.com/anthropics/claude-code/main/feed.xml"/>
9- <updated>2026-09-24T18:37:48Z</updated>
9+ <updated>2026-09-28T18:01:46Z</updated>
1010 <entry>
11+ <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.284</id>
12+ <title>Claude Code v2.1.284</title>
13+ <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.284"/>
14+ <updated>2026-09-28T18:01:46Z</updated>
15+ <content type="html">&lt;p&gt;• Added Claude Sonnet 5.5 (claude-sonnet-5-5), now the default Sonnet model on the Anthropic API — 1M context, $2/$10 per Mtok with $0.20/Mtok cache reads&lt;/p&gt;
16+&lt;p&gt;• Added a "Yes, but ask again next time" answer to auto mode's prompt before a read outside the working directories, so you can allow that one read and still be asked about later ones&lt;/p&gt;
17+&lt;p&gt;• Added dollar amounts to the Claude apps gateway spend limit in /usage and the status line (for example "$271.40 / $500.00 spent this month") when the gateway runs this version or later; the status line's rate_limits.spend_limit also gains used_usd, limit_usd and period&lt;/p&gt;
18+&lt;p&gt;• Added effortSlider:decreaseEffort, increaseEffort and toggleUltracode keybinding actions, so the /effort slider's arrow and Tab keys can be rebound in keybindings.json&lt;/p&gt;
19+&lt;p&gt;• Added /rate-limit-options to /help and the command menu for claude.ai subscribers, so the usage-limit notices that mention it point to a command you can find&lt;/p&gt;
20+&lt;p&gt;• Added /mcp reconnect all in the interactive terminal to retry every MCP server that failed to connect or needs authentication at once&lt;/p&gt;
21+&lt;p&gt;• Added Claude apps gateway startup warnings when a managed policy's availableModels is empty, or leaves out the model Claude Code starts on without setting model or enforceAvailableModels&lt;/p&gt;
22+&lt;p&gt;• Added auth: { google: {} } for Claude apps gateway telemetry.forward_to destinations, so telemetry can be exported straight to Google Cloud's OTLP endpoint using the gateway's Google Cloud credentials&lt;/p&gt;
23+&lt;p&gt;• Added certificate client authentication (private_key_jwt) between the Claude apps gateway and its identity provider, for identity providers that issue certificate credentials instead of client secrets&lt;/p&gt;
24+&lt;p&gt;• Fixed a damaged response stream showing raw errors such as "JSON Parse error" or "undefined is not an object", or writing the word "undefined" into an answer, instead of being retried or reported as an interrupted response&lt;/p&gt;
25+&lt;p&gt;• Fixed an overloaded or server error arriving right after a thinking block ending the turn with an error instead of being retried&lt;/p&gt;
26+&lt;p&gt;• Fixed "Prompt is too long" errors that persisted after compacting: when the compacted request is still too long, Claude Code now compacts once more, keeping less of the recent conversation&lt;/p&gt;
27+&lt;p&gt;• Fixed a session whose model is unavailable, with no fallback model left, showing a bare "is currently unavailable" message (or "Something went wrong" in cloud sessions) instead of the model-unavailable notice and its Learn more link&lt;/p&gt;
28+&lt;p&gt;• Fixed Agent SDK sessions crashing when a user message contains an image with a malformed source, and failing on every later turn after a malformed document block; a malformed image is now replaced with an explanatory note&lt;/p&gt;
29+&lt;p&gt;• Fixed MCP tool calls in a resumed session failing with "No such tool available" while their server was still connecting; the call now waits up to 10 seconds for the server&lt;/p&gt;
30+&lt;p&gt;• Fixed repeated calls to the plan-usage endpoint after it rate-limits or rejects your login: /usage, /extra-usage and IDE usage views now back off instead of re-asking&lt;/p&gt;
31+&lt;p&gt;• Fixed claude mcp add reporting success when managed settings restrict MCP servers to plugins; it now refuses and says what to do, instead of saving a server that never loads&lt;/p&gt;
32+&lt;p&gt;• Fixed the /plugin configure screen: boolean options are now a true/false choice instead of free text, number options refuse invalid input, and ←/→ change an options field instead of switching tabs&lt;/p&gt;
33+&lt;p&gt;• Fixed ANTHROPIC_FOUNDRY_RESOURCE being interpolated into the Foundry endpoint host unvalidated; a value that is not a plain resource name is now refused&lt;/p&gt;
34+&lt;p&gt;• Fixed Claude Desktop behind a Claude apps gateway offering no 1M context option: the gateway now marks each 1M-capable model for Desktop automatically&lt;/p&gt;
35+&lt;p&gt;• Fixed ↓ in shell mode selecting a hidden background-tasks pill, which stopped Backspace and Ctrl+U from editing the prompt&lt;/p&gt;
36+&lt;p&gt;• Fixed Bash tool failing on Windows with many plugins enabled: plugin bin/ directories that don't exist are no longer added to PATH, and inherited entries aren't added twice&lt;/p&gt;
37+&lt;p&gt;• Fixed sparsePaths plugin marketplaces cloning empty and replacing a working local copy on older git (before 2.39), which failed every refresh with "marketplace.json file is no longer present"&lt;/p&gt;
38+&lt;p&gt;• Fixed fullscreen rendering erasing the terminal output above the session when [ in transcript mode writes the conversation to scrollback (macOS and Linux)&lt;/p&gt;
39+&lt;p&gt;• Fixed fullscreen scroll position jumping to the previous message or to the bottom when a reply finished streaming while scrolled up&lt;/p&gt;
40+&lt;p&gt;• Fixed tab bars in dialogs such as /config and /plugin breaking the title and tab labels mid-word in a narrow terminal; a tab that doesn't fit now moves to the next line whole&lt;/p&gt;
41+&lt;p&gt;• Fixed the /model picker showing "+1 model" below the list after scrolling to the last model; the count now covers only the models below the visible rows&lt;/p&gt;
42+&lt;p&gt;• Fixed /keybindings writing Backspace and Delete bindings for a footer action that does nothing into the generated keybindings.json&lt;/p&gt;
43+&lt;p&gt;• Fixed a rebound agent panel close key (footer:close) typing "x" instead of itself on the row of the agent you're viewing&lt;/p&gt;
44+&lt;p&gt;• Fixed vim mode . not repeating text typed very fast (for example over ssh or in tmux) or pasted without bracketed paste, and leaving the prompt in INSERT mode after repeating a change with nothing typed (such as cw then Esc)&lt;/p&gt;
45+&lt;p&gt;• Fixed vim mode leaving the cursor on an image placeholder's opening bracket after dd on the last line or yy at the end of the prompt, where r or x would break or delete the image&lt;/p&gt;
46+&lt;p&gt;• Fixed a key pressed the instant the terminal regained focus answering the Remote Control enable prompt before its short safety delay restarted&lt;/p&gt;
47+&lt;p&gt;• Fixed the workspace trust dialog appearing a second time after switching renderers or updating when Claude Code was started in the home directory&lt;/p&gt;
48+&lt;p&gt;• Fixed rules symlinked into .claude/rules from outside the project being skipped without ever showing the external-imports approval prompt; a .claude directory symlinked from outside the project now asks for the same approval&lt;/p&gt;
49+&lt;p&gt;• Fixed plugins from marketplaces, claude.ai and npm pre-approving their own tools via allowed-tools under managed allowManagedPermissionRulesOnly; only plugins from an official Anthropic source or a source that managed settings vouch for keep that pre-approval&lt;/p&gt;
50+&lt;p&gt;• Fixed a failed first claude plugin install leaving the plugin enabled and recorded when a dependency's version range could not be met&lt;/p&gt;
51+&lt;p&gt;• Fixed the debug log dropping a failed hook's stderr when the hook also wrote to stdout, and logging nothing for a failed hook with no output; failed hooks now also log their status code&lt;/p&gt;
52+&lt;p&gt;• Fixed {"decision":"block"} returned by Elicitation and ElicitationResult hooks being ignored; it now declines the MCP elicitation, as exit code 2 does&lt;/p&gt;
53+&lt;p&gt;• Fixed sessions launched without the SendMessage tool (such as by Claude Desktop) still being told to message other sessions with it&lt;/p&gt;
54+&lt;p&gt;• Fixed a photo sent from the Claude app over Remote Control being lost when its queued message was pulled back into the terminal prompt to edit, and the cursor moving one character for a photo with no caption&lt;/p&gt;
55+&lt;p&gt;• Fixed typing a message during an automatic usage-limit wait taking the wait out of the "Continue automatically at usage limit" setting's control when that turn hit the limit again&lt;/p&gt;
56+&lt;p&gt;• Fixed usage-limit warnings suggesting /upgrade to users already on the highest Max plan; the warnings and /upgrade itself now point at /usage-credits when it is available&lt;/p&gt;
57+&lt;p&gt;• Fixed the Explore subagent switching to Opus on the Claude API when the session runs a model ID Claude Code doesn't recognize, such as a custom model behind a proxy; Explore now inherits that model&lt;/p&gt;
58+&lt;p&gt;• Fixed /loop status updates in self-paced mode often not being shown because Claude wrote them only in its reasoning; Claude now writes each update, and the outcome when the loop stops, as visible text&lt;/p&gt;
59+&lt;p&gt;• Fixed /ultrareview failing to upload the working tree when started from a git worktree that the Claude desktop app created on macOS or Linux&lt;/p&gt;
60+&lt;p&gt;• Fixed sandboxed Bash commands failing to start on Linux when the working directory is write-denied and contains a read-denied directory&lt;/p&gt;
61+&lt;p&gt;• Fixed artifact database write results telling Claude that every viewer sees a write to a viewer's private data/users/ subtree, and added a "view" level to as_level&lt;/p&gt;
62+&lt;p&gt;• Fixed the Claude apps gateway answering 431 Request Header Fields Too Large to every request from a sign-in whose identity provider lists many groups; it now accepts request headers up to 256 KiB&lt;/p&gt;
63+&lt;p&gt;• Improved the usage-limit wait: the limit's state and the countdown with the usage-credits option now show as one block under the prompt, and limit messages no longer repeat the countdown&lt;/p&gt;
64+&lt;p&gt;• Improved the "No such tool available" error for Claude in Chrome tools called without their prefix: it now names the tool to call&lt;/p&gt;
65+&lt;p&gt;• Improved Monitor event rows to show what each event printed instead of repeating the description, and stopped repeating an unchanged "Waiting for N … to finish" line after every event&lt;/p&gt;
66+&lt;p&gt;• Improved Workflow tool sandbox hardening for errors thrown by async script hooks&lt;/p&gt;
67+&lt;p&gt;• Improved startup time and memory use by building only the parts of the settings schema that your settings files actually use&lt;/p&gt;
68+&lt;p&gt;• Improved /claude-api: hillclimb no longer spends rounds on prompt rewordings too small for the eval to measure, and an extra page you ask for beside report.html is built as one local file that loads nothing from the network&lt;/p&gt;
69+&lt;p&gt;• Improved lists such as /tasks, /copy and /hooks: the details after each name now line up in one column when they fit, and otherwise sit at the right edge&lt;/p&gt;
70+&lt;p&gt;• Improved claude plugin marketplace add to say when it replaces a marketplace already added under the same name from a different source, and how to undo it&lt;/p&gt;
71+&lt;p&gt;• Improved the startup refusal when managed settings require a sign-in (forceLoginMethod or forceLoginOrgUUID) and an API key, token or apiKeyHelper is configured: it now names the credential in use, where it is set, and how to remove it&lt;/p&gt;
72+&lt;p&gt;• Improved auto-memory loading: invisible characters and tags that imitate Claude Code's own markup are neutralized in MEMORY.md and recalled memory notes before they reach Claude&lt;/p&gt;
73+&lt;p&gt;• Improved claude remote-control: in a folder you haven't trusted yet, it now asks for workspace trust on the terminal instead of exiting&lt;/p&gt;
74+&lt;p&gt;• Improved artifact pages: Claude writes its design plan into the page instead of the reply, and uses the name you already gave something as the page title&lt;/p&gt;
75+&lt;p&gt;• Improved the Artifact tool so that when Claude is given a claude.ai chat or project link, an artifact from a chat, or an artifact id on its own, it asks for the right link or the content instead of stopping&lt;/p&gt;
76+&lt;p&gt;• Changed interactive terminal and VS Code sessions to start in auto mode when no permission mode is configured, on every plan and provider; permissions.defaultMode still overrides it&lt;/p&gt;
77+&lt;p&gt;• Changed Ultracode into its own toggle in /effort (Tab, or /effort ultracode [on|off]): it no longer forces xhigh effort and stays on at any effort level&lt;/p&gt;
78+&lt;p&gt;• Changed retries after a dropped connection mid-response to share one budget with the rest of the request's retries, so a failing request gives up sooner&lt;/p&gt;
79+&lt;p&gt;• Changed the notice shown when a Sonnet model's safeguards flag a message to explain why it happened and to offer editing and retrying&lt;/p&gt;
80+&lt;p&gt;• Changed safety-related model switches in sessions that pin an Opus model with ANTHROPIC_DEFAULT_OPUS_MODEL or modelOverrides: on the Anthropic API, the API now picks the model to switch to for each kind of flag, not the pinned model&lt;/p&gt;
81+&lt;p&gt;• Changed the non-interactive first turn to still wait up to 2s for connecting MCP servers named by --allowedTools or an mcp_tool hook, even when CLAUDE_CODE_MCP_STARTUP_WAIT_MS is 0&lt;/p&gt;
82+&lt;p&gt;• Changed /recap to decline with a short notice when it arrives relayed from a chat thread (your own included) or from a routine or webhook; typed in the terminal, the Claude apps, Remote Control, -p or an SDK host, it runs as before&lt;/p&gt;
83+&lt;p&gt;• Changed /artifacts to show its filter tabs beside the title with one-word labels (All, Mine, Shared), using the same tab bar as /config and /plugin&lt;/p&gt;
84+&lt;p&gt;• Changed artifact publishing to refuse a file on a network share (a \\host\share path or a /net automount) unless it is on a mapped network drive added with --add-dir&lt;/p&gt;
85+&lt;p&gt;• [VSCode] Added an optional time above each prompt and response, with a date line where the day changes (Claude Code: Show Message Timestamps setting, off by default)&lt;/p&gt;
86+&lt;p&gt;• [VSCode] Added plugin load errors and notes to the Manage plugins rows, with a popup to disable, uninstall or copy the error&lt;/p&gt;
87+&lt;p&gt;• [VSCode] Added an Ultracode on/off switch under the Effort slider, replacing the slider's Ultracode stop; the model pill shows "· Ultracode" at any effort level&lt;/p&gt;
88+&lt;p&gt;• [VSCode] Fixed Reload Claude from the Memory dialog restarting before an edited file was saved&lt;/p&gt;
89+&lt;p&gt;• [VSCode] Fixed a restored tab opening a conversation another Claude process still has open; it now asks first&lt;/p&gt;
90+&lt;p&gt;• [VSCode] Fixed Focus view sections you expanded closing on their own while a sub-agent is working or when the section's first step is trimmed from view&lt;/p&gt;
91+&lt;p&gt;• [VSCode] Fixed typing /model and Enter printing usage text into the chat instead of opening the model selector&lt;/p&gt;
92+&lt;p&gt;• [VSCode] Fixed /feedback on Vertex, Bedrock and Foundry being refused after you pressed Send; the report is now saved on this computer, as the terminal does&lt;/p&gt;
93+&lt;p&gt;• [VSCode] Fixed sign-in waiting up to a minute for the Python extension after a window reload&lt;/p&gt;
94+&lt;p&gt;• [VSCode] Fixed Claude Code tabs that stopped responding after Restart Extensions: they now reopen on their conversation&lt;/p&gt;
95+&lt;p&gt;• [VSCode] Fixed a message from another agent with no recorded sender showing as raw XML in the chat&lt;/p&gt;
96+&lt;p&gt;• [VSCode] Fixed messages from other agents, sessions or channels disappearing after a reload&lt;/p&gt;
97+&lt;p&gt;• [VSCode] Fixed a user's own /mcp, /config or /settings command being shadowed by the extension's dialog&lt;/p&gt;
98+&lt;p&gt;• [VSCode] Fixed Escape stopping every background agent when no turn was running&lt;/p&gt;
99+&lt;p&gt;• [VSCode] Fixed plugin install links replacing a marketplace you already have that uses the same name&lt;/p&gt;
100+&lt;p&gt;• [VSCode] Fixed "Prompt is too long" errors after compaction when a large text file is attached to a message&lt;/p&gt;
101+&lt;p&gt;• [VSCode] Fixed chat links to files with non-ASCII characters, spaces or brackets in their path not opening&lt;/p&gt;
102+&lt;p&gt;• [VSCode] Changed CLAUDE_CONFIG_DIR in the claudeCode.environmentVariables setting to apply only when it is an absolute path, and passed it to terminals that continue the chat&lt;/p&gt;
103+&lt;p&gt;• [Cloud sessions] Fixed a routine's Edit and Duplicate controls saying the routine was still loading while you were offline; they now tell you you're offline&lt;/p&gt;
104+&lt;p&gt;• [Claude Tag] Added model family choices such as "Opus (latest)" for a thread, a channel default or your DM, so the choice follows the newest model in that family&lt;/p&gt;
105+&lt;p&gt;• [Claude Tag] Added the spend that counts toward your organization-wide limit to the analytics spend projection chart, with how much of the limit is used&lt;/p&gt;
106+&lt;p&gt;• [Claude Tag] Fixed the earlier Claude in Slack app's progress card and link previews omitting the repository and Create PR button when a GitHub Enterprise host name contains an underscore&lt;/p&gt;
107+&lt;p&gt;• [Claude Tag] Fixed Claude staying silent in a channel whose environment declines to start it; it now posts one notice asking you to contact an admin, and retries when @-mentioned&lt;/p&gt;
108+&lt;p&gt;• [Claude Tag] Changed Claude to post its private sign-in notice at every @mention from someone who hasn't connected their Claude account, instead of going quiet after the first&lt;/p&gt;
109+&lt;p&gt;• [Claude Tag] Improved "Notify members now" in admin settings: one press reaches every workspace your organization claimed in an Enterprise Grid, and more members in large workspaces&lt;/p&gt;
110+&lt;p&gt;• [Claude Tag] Improved Claude's wait notice on self-hosted environments with on-demand runners: it now says whether a runner is starting, a start will be retried, or no runner will start&lt;/p&gt;
111+&lt;p&gt;• [Claude Tag] Improved the error shown when adding a channel manager fails because the channel's Slack workspace can't be confirmed as connected to your organization&lt;/p&gt;
112+&lt;p&gt;• [Claude Tag] Improved a channel's access lists in admin settings to show the connectors, repositories and plugins an auto-join pattern attaches, and where each comes from&lt;/p&gt;
113+&lt;p&gt;• [Claude Tag] Improved adding repositories as a channel manager: when your GitHub sign-in can't confirm you're a repository admin, the page asks you to sign in with GitHub&lt;/p&gt;
114+&lt;p&gt;• [Code Review] Fixed Code Review giving up without posting a finished review when an unsubmitted review under its GitHub App was open on the pull request; it now retries the post first&lt;/p&gt;</content>
115+ </entry>
116+ <entry>
117+ <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.283</id>
118+ <title>Claude Code v2.1.283</title>
119+ <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.283"/>
120+ <updated>2026-09-25T21:49:55Z</updated>
121+ <content type="html">&lt;p&gt;• Added x-claude-code-prompt-id to the gateway hint headers so LLM gateways can group the requests that serve one user prompt; opt in with CLAUDE_CODE_GATEWAY_HINT_HEADERS=1&lt;/p&gt;
122+&lt;p&gt;• Added availableModelsMatch managed setting: with "exact", an availableModels entry allows only the model version it names, so new releases stay blocked until listed&lt;/p&gt;
123+&lt;p&gt;• Added deniedModels managed setting to block specific models, even when availableModels allows them&lt;/p&gt;
124+&lt;p&gt;• Added MCP tool, WebFetch and WebSearch outputs to the tool.output OpenTelemetry span event when OTEL_LOG_TOOL_CONTENT=1&lt;/p&gt;
125+&lt;p&gt;• Added /doctor prompt-audit (also /checkup prompt-audit) to audit your CLAUDE.md files, skills, agents and commands for prompting patterns written for older models&lt;/p&gt;
126+&lt;p&gt;• Added click-to-expand for truncated messages from your other sessions in fullscreen mode&lt;/p&gt;
127+&lt;p&gt;• Added path to --plugin-dir load-failure entries in the stream-json system/init plugin_errors, naming the directory that did not load&lt;/p&gt;
128+&lt;p&gt;• Added an opt-in load_test_mode block to the Claude apps gateway config: requests are built and signed but not sent upstream, and clients get a canned reply, so a deployment can be load tested&lt;/p&gt;
129+&lt;p&gt;• Added a mantle upstream provider to the Claude apps gateway for Amazon Bedrock's Mantle endpoint&lt;/p&gt;
130+&lt;p&gt;• Fixed SDK sessions losing a deferred tool call or finished tool result when a turn ended early, a held approval prompt after a worker restart, and a non-streaming fallback's result.usage&lt;/p&gt;
131+&lt;p&gt;• Fixed MCP progress notifications being discarded once a long-running tool call moved to the background; the background task now shows the latest progress&lt;/p&gt;
132+&lt;p&gt;• Fixed stdio MCP servers being left running when the session ended while they were still starting&lt;/p&gt;
133+&lt;p&gt;• Fixed a brief HTTP 404 from a stateless remote MCP server (for example a proxy mid-redeploy) leaving that server unusable for the rest of the session while still shown as connected&lt;/p&gt;
134+&lt;p&gt;• Fixed MCP sign-in for a server with no valid URL failing with an opaque SDK error; /mcp no longer offers Authenticate for such servers&lt;/p&gt;
135+&lt;p&gt;• Fixed the weekly Fable limit not appearing in /usage and the VS Code usage meters when telemetry is disabled&lt;/p&gt;
136+&lt;p&gt;• Fixed /model accepting Sonnet 4.6 or Sonnet 5 with [1m] when the id carried a date or -v1:0 suffix, in the cases where the plain id was refused&lt;/p&gt;
137+&lt;p&gt;• Fixed /model picker showing a hardcoded Haiku version and price when ANTHROPIC_DEFAULT_HAIKU_MODEL pins a different model&lt;/p&gt;
138+&lt;p&gt;• Fixed dynamic workflows started during a model fallback running every agent on the fallback model instead of retrying the configured model&lt;/p&gt;
139+&lt;p&gt;• Fixed DISABLE_PROMPT_CACHING_HAIKU having no effect when Haiku is the session's main model&lt;/p&gt;
140+&lt;p&gt;• Fixed claude plugin validate saying Claude Code accepts a plugin or marketplace name it cannot install; such names in marketplace.json now fail validation&lt;/p&gt;
141+&lt;p&gt;• Fixed claude plugin validate passing plugins whose outputStyles, themes, monitors, or lspServers paths are missing or point outside the plugin directory&lt;/p&gt;
142+&lt;p&gt;• Fixed claude plugin details showing 0 MCP servers for plugins that declare their servers in plugin.json&lt;/p&gt;
143+&lt;p&gt;• Fixed claude plugin marketplace remove not saying which installed plugins it uninstalled with the marketplace; it now lists them&lt;/p&gt;
144+&lt;p&gt;• Fixed claude plugin uninstall removing the other of two installed plugins whose ids differ only in case, with its options and secrets, when the one named had no enabledPlugins entry at that scope&lt;/p&gt;
145+&lt;p&gt;• Fixed plugins that declare no version being silently restored at their source's newest commit, not the installed one, when their cached files were missing&lt;/p&gt;
146+&lt;p&gt;• Fixed user-installed plugins and marketplaces failing to load with "cache-miss" after the home or config directory was moved, for example in bind-mounted devcontainers&lt;/p&gt;
147+&lt;p&gt;• Fixed installed_plugins.json showing no plugins when it holds a record under an invalid plugin id; such a file loads again&lt;/p&gt;
148+&lt;p&gt;• Fixed installed_plugins.json being rewritten, losing records, when it holds a record this version cannot read; claude plugin commands now name the record and say how to recover&lt;/p&gt;
149+&lt;p&gt;• Fixed permission dialogs in screen-reader mode reading quoted commands and paths as if they were the dialog's own text&lt;/p&gt;
150+&lt;p&gt;• Fixed /context not counting MCP server instructions: they now appear as their own row and count toward the total&lt;/p&gt;
151+&lt;p&gt;• Fixed markdown links in the Warp terminal rendering as plain text instead of clickable hyperlinks&lt;/p&gt;
152+&lt;p&gt;• Fixed claude mcp add, add-json, and remove reporting success when the user or local config file could not be written, for example inside a sandbox&lt;/p&gt;
153+&lt;p&gt;• Fixed the first words of a reply in a cloud session sometimes appearing late instead of streaming as Claude writes them&lt;/p&gt;
154+&lt;p&gt;• Fixed Claude's built-in keybindings guide saying chords time out after 1 second instead of 3, and calling cmd an alias of meta, which could produce cmd+ shortcuts most terminals never send&lt;/p&gt;
155+&lt;p&gt;• Fixed keybindings.json silently accepting a misspelled modifier such as ctl+k; it now warns in the debug log and suggests the fix&lt;/p&gt;
156+&lt;p&gt;• Fixed footer hints still saying "Enter to view" after footer:openSelected was rebound or unbound in keybindings.json&lt;/p&gt;
157+&lt;p&gt;• Fixed keys typed quickly together (type-ahead, key repeat, bursts over ssh or tmux) sometimes being handled against stale state&lt;/p&gt;
158+&lt;p&gt;• Fixed worktree checkouts failing certificate verification (for example on Git LFS downloads) when the CA certificate is passed to git as GIT_CONFIG_COUNT environment pairs&lt;/p&gt;
159+&lt;p&gt;• Fixed sandboxed git asking credential helpers to store the sandbox proxy's login, which printed "failed to store"&lt;/p&gt;
160+&lt;p&gt;• Fixed managed sandbox settings being ignored entirely when one nested value was invalid; the invalid value now fails closed and the rest of the block still applies&lt;/p&gt;
161+&lt;p&gt;• Fixed Claude's edits to its own auto-memory notes being blocked as sensitive-file writes when Claude Code was started in a subdirectory of a git repository&lt;/p&gt;
162+&lt;p&gt;• Fixed Remote Control being unavailable on paid plans when telemetry is turned off with DISABLE_TELEMETRY or DO_NOT_TRACK&lt;/p&gt;
163+&lt;p&gt;• Fixed the /remote-control menu cutting its QR-code hint mid-word in narrow terminals&lt;/p&gt;
164+&lt;p&gt;• Fixed vim mode . dropping a Shift+Enter newline, leaving the cursor inside an accented letter, and repeating an older change after 3J or Visual-mode J on the last line&lt;/p&gt;
165+&lt;p&gt;• Fixed vim mode cursor placement: recalling a prompt over 10,000 characters in normal mode no longer leaves the cursor past the end, and V then p now lands on the first non-blank&lt;/p&gt;
166+&lt;p&gt;• Fixed vim mode J joining lines with different spacing than Vim (such as a space before ) or after a tab), and 3J or Visual-mode J on the last line not moving the cursor as Vim does&lt;/p&gt;
167+&lt;p&gt;• Windows: Fixed the PowerShell tool letting cmd /c rd, rmdir, del or erase delete drive roots, the home folder and other folders that Remove-Item refuses&lt;/p&gt;
168+&lt;p&gt;• Improved the /mcp tool list: it shows more tools at once, scrolls with the page keys and mouse, and marks tools your organization blocked with a warning icon&lt;/p&gt;
169+&lt;p&gt;• Improved MCP tool results: images returned by MCP tools are now also saved to a file, so Bash, Read and other tools can open them&lt;/p&gt;
170+&lt;p&gt;• Improved /tasks: rows show a status icon, the name and whole facts, the title and key hints stay on screen with many tasks, and the list gains paging keys, the mouse wheel and clicks&lt;/p&gt;
171+&lt;p&gt;• Improved lists in /help, /hooks, /copy, /chrome, /memory, /ide, /release-notes, /rewind, /diff, /remote-env, /plugin and other pickers with page keys, mouse wheel and clicks&lt;/p&gt;
172+&lt;p&gt;• Improved lists beside a search box, such as /skills and /artifacts, to draw their pointer dim while the search box has the keys, so only one pointer is highlighted&lt;/p&gt;
173+&lt;p&gt;• Improved the compaction spinner: its timer now starts when compaction begins and it counts the summary's tokens as they stream, replacing the percentage bar&lt;/p&gt;
174+&lt;p&gt;• Improved the browser page shown after signing in to an MCP server: centered layout, dark mode, and new artwork&lt;/p&gt;
175+&lt;p&gt;• Improved the Skill tool's reply when a skill belongs to a plugin that failed to load, so Claude tells you the plugin could not be loaded instead of calling the skill uninstalled&lt;/p&gt;
176+&lt;p&gt;• Improved prompt-audit on Claude Code configuration: stale paths, stale commands and contradicting instruction files now lead the report, and thinking keywords that Claude Code documents are kept&lt;/p&gt;
177+&lt;p&gt;• Improved recovery from an installed_plugins.json that cannot be read at all: its contents are kept in a file beside it before it is rebuilt, and claude plugin list names that file&lt;/p&gt;
178+&lt;p&gt;• Improved artifact database reads: an ordered query that returns a full page now says it is one page and how to read the rest&lt;/p&gt;
179+&lt;p&gt;• Improved first-reply latency: a pattern-compile step that ran at the end of a session's first reply now runs while the reply streams in&lt;/p&gt;
180+&lt;p&gt;• Improved first-request latency by reusing the preconnected API connection&lt;/p&gt;
181+&lt;p&gt;• Improved startup: claude -p and Claude Code Remote no longer load the interactive UI, and the auto-mode classifier's rules and the Artifact tool load on first use instead of at launch&lt;/p&gt;
182+&lt;p&gt;• Improved startup for claude.ai accounts whose Artifact tool features aren't known yet, as on a first run: the prompt no longer waits up to 1.5 s to check them; the first message waits if needed&lt;/p&gt;
183+&lt;p&gt;• Changed interactive sessions on third-party providers or with telemetry off to start in auto mode when no permission mode is configured; permissions.defaultMode still overrides it&lt;/p&gt;
184+&lt;p&gt;• Changed the /ultrareview launch dialog to say that reviewing a local branch may upload uncommitted changes to tracked files&lt;/p&gt;
185+&lt;p&gt;• Changed the /model picker's Opus row and the Default model's name to drop "(1M context)" where Opus already has a 1M context window; the window is unchanged&lt;/p&gt;
186+&lt;p&gt;• Changed prompt suggestions in the terminal to appear less often after 20 in a row go unused; using one brings them back&lt;/p&gt;
187+&lt;p&gt;• Changed --system-prompt and --append-system-prompt to accept their text and -file forms together; the file's text comes first&lt;/p&gt;
188+&lt;p&gt;• Changed Skill(anthropic-skills:&amp;lt;name&amp;gt;) deny rules to also block that skill when Claude Desktop delivers it as a plugin, and Skill(skill:&amp;lt;name&amp;gt;) denies to match the skill's alias and display name&lt;/p&gt;
189+&lt;p&gt;• Changed /rewind and /diff lists to move on the same keybinding actions as every other list (select:*); messageSelector:*/diff:* rebinds still work&lt;/p&gt;
190+&lt;p&gt;• Changed the /workflows run list to size itself like other lists: half the terminal inline, and it keeps its title on screen when the prompt shows below&lt;/p&gt;
191+&lt;p&gt;• Changed claude plugin eval to require git 2.31 or later when git is installed; a run on an older git is refused with a message naming the version&lt;/p&gt;
192+&lt;p&gt;• Changed artifact watching: a watch that was armed automatically (not one you asked for) now ends after 3.5 hours with no activity; publishing or watching the artifact again re-arms it&lt;/p&gt;
193+&lt;p&gt;• Self-hosted runner: Changed lifecycle hooks' git to skip a repository's Git LFS pre-push hook, ignore a writable system core.hooksPath, and not sign commits without --configure-git&lt;/p&gt;
194+&lt;p&gt;• Self-hosted runner: Changed GIT_SSL_CAINFO and GIT_SSL_NO_VERIFY under Anthropic-managed git: the runner's own git always verifies Anthropic's git route, and warning lines say what applies where&lt;/p&gt;
195+&lt;p&gt;• Reverted the 2.1.282 reservation of the claude-ai name: skills, commands, workflows and MCP servers' skills and prompts so named load again, and Skill(claude-ai:*) rules are ordinary prefix rules&lt;/p&gt;
196+&lt;p&gt;• [VSCode] Fixed the permission mode indicator showing Default while the session kept running in auto or bypass mode after an automatic switch out of it failed; the switch is now retried until it lands&lt;/p&gt;
197+&lt;p&gt;• [VSCode] Fixed a session teleported from the web dropping the messages sent while Claude was working&lt;/p&gt;
198+&lt;p&gt;• [VSCode] Fixed a Web session staying hidden from the session list, and an empty chat opening in its place, when an older version had saved an empty local copy of it&lt;/p&gt;
199+&lt;p&gt;• [VSCode] Fixed a reopened session splitting a turn at a message Claude received mid-turn, such as an automatic continuation&lt;/p&gt;
200+&lt;p&gt;• [VSCode] Fixed a reloaded session showing a rewound-away turn, or only the rows before a compaction&lt;/p&gt;
201+&lt;p&gt;• [VSCode] Fixed the footer's agents pill drawing its icon off-center, with the status dot against the edge, in narrow panels&lt;/p&gt;
202+&lt;p&gt;• [VSCode] Fixed the chat input showing its text slightly below the cursor and selection after pasting lines that end with a line break into a long prompt&lt;/p&gt;
203+&lt;p&gt;• [Cloud sessions] Improved adding a repository to a running cloud session: a private repository your GitHub account can read but not push to now attaches for reading&lt;/p&gt;
204+&lt;p&gt;• [Cloud sessions] Fixed cloud sessions occasionally redoing an already-finished step, such as posting a duplicate comment or push, after recovering from a server-side restart&lt;/p&gt;
205+&lt;p&gt;• [Cloud sessions] Changed new routine schedules to default to a few minutes past the hour, with a note that routines set exactly on the hour can start several minutes late&lt;/p&gt;
206+&lt;p&gt;• [Claude Tag] Added a "Channels Claude can search" admin setting that limits Claude's Slack search to public channels it has been added to, set per organization, workspace or channel&lt;/p&gt;
207+&lt;p&gt;• [Claude Tag] Added a Back to Slack button on the page shown after connecting your Claude account, returning you to the thread you started from&lt;/p&gt;
208+&lt;p&gt;• [Claude Tag] Fixed a channel's configure page listing no connectors or plugins when the channel gets its access bundle through an attach rule; rule-attached bundles are now shown&lt;/p&gt;
209+&lt;p&gt;• [Claude Tag] Fixed access-bundle repository search missing repositories on GitHub App installs that are limited to a large list of selected repositories&lt;/p&gt;
210+&lt;p&gt;• [Claude Tag] Fixed Claude occasionally posting the same reply twice when a new message interrupted it mid-reply&lt;/p&gt;
211+&lt;p&gt;• [Claude Tag] Fixed channel routines that stopped running in older private channels whose Slack channel ID changed, for example after a Slack Connect share&lt;/p&gt;
212+&lt;p&gt;• [Claude Tag] Fixed conversations in a channel set to "Channel only" all ending when a non-guest member joined and Slack was slow to confirm their membership&lt;/p&gt;
213+&lt;p&gt;• [Code Review] Fixed "@claude review" requests going silent when GitHub failed to return the pull request: the request is retried once, and a comment explains if it still fails&lt;/p&gt;
214+&lt;p&gt;• [Code Review] Fixed billing for a review that stopped at its time limit with nothing verified: it now shows as incomplete, isn't charged, and is retried once&lt;/p&gt;</content>
215+ </entry>
216+ <entry>
11217 <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.282</id>
12218 <title>Claude Code v2.1.282</title>
13219 <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.282"/>
@@ -1246,149 +1452,4 @@
12461452 <updated>2026-09-06T02:54:14Z</updated>
12471453 <content type="html">&lt;p&gt;• Bug fixes and reliability improvements&lt;/p&gt;</content>
12481454 </entry>
1249- <entry>
1250- <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.261</id>
1251- <title>Claude Code v2.1.261</title>
1252- <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.261"/>
1253- <updated>2026-09-04T19:58:03Z</updated>
1254- <content type="html">&lt;p&gt;• Added an "Organization policy" line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through&lt;/p&gt;
1255-&lt;p&gt;• Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters&lt;/p&gt;
1256-&lt;p&gt;• Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line&lt;/p&gt;
1257-&lt;p&gt;• Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them&lt;/p&gt;
1258-&lt;p&gt;• Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat&lt;/p&gt;
1259-&lt;p&gt;• Fixed /add-dir &amp;lt;subdirectory&amp;gt; printing a false "couldn't be resolved" error when the working directory is on a /net automount&lt;/p&gt;
1260-&lt;p&gt;• Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy&lt;/p&gt;
1261-&lt;p&gt;• Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail&lt;/p&gt;
1262-&lt;p&gt;• Fixed being unable to delete the character immediately before an inline [Image #N] chip in the prompt input&lt;/p&gt;
1263-&lt;p&gt;• Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request&lt;/p&gt;
1264-&lt;p&gt;• Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal&lt;/p&gt;
1265-&lt;p&gt;• Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear&lt;/p&gt;
1266-&lt;p&gt;• Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion&lt;/p&gt;
1267-&lt;p&gt;• Fixed Remote Control uploading a session pulled with /teleport into the connected session, which appeared appended to the original on phone and web&lt;/p&gt;
1268-&lt;p&gt;• Fixed Remote Control's inbound event stream failing behind TLS-inspecting corporate proxies on native Windows&lt;/p&gt;
1269-&lt;p&gt;• Fixed Remote Control sessions showing the default effort level on claude.ai when the effort comes from settings&lt;/p&gt;
1270-&lt;p&gt;• Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid&lt;/p&gt;
1271-&lt;p&gt;• Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background&lt;/p&gt;
1272-&lt;p&gt;• Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop&lt;/p&gt;
1273-&lt;p&gt;• Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine&lt;/p&gt;
1274-&lt;p&gt;• Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup&lt;/p&gt;
1275-&lt;p&gt;• Fixed claude -p --resume &amp;lt;file&amp;gt; adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead&lt;/p&gt;
1276-&lt;p&gt;• Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running&lt;/p&gt;
1277-&lt;p&gt;• Fixed a rare layout glitch where a box could render with the wrong height after its container switched between row and column direction&lt;/p&gt;
1278-&lt;p&gt;• Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403&lt;/p&gt;
1279-&lt;p&gt;• Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data&lt;/p&gt;
1280-&lt;p&gt;• Fixed Desktop and web showing a session as busy while it only watches an artifact for updates&lt;/p&gt;
1281-&lt;p&gt;• Fixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app&lt;/p&gt;
1282-&lt;p&gt;• Fixed SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects&lt;/p&gt;
1283-&lt;p&gt;• Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw &amp;lt;claude-code-hint&amp;gt; tag no longer leaks into the conversation&lt;/p&gt;
1284-&lt;p&gt;• Fixed in-process agent-team teammates re-sending their first-turn tool and skill announcements on the second turn, which changed the request prefix and missed the prompt cache&lt;/p&gt;
1285-&lt;p&gt;• Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it&lt;/p&gt;
1286-&lt;p&gt;• Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes&lt;/p&gt;
1287-&lt;p&gt;• Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update&lt;/p&gt;
1288-&lt;p&gt;• Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts&lt;/p&gt;
1289-&lt;p&gt;• Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change&lt;/p&gt;
1290-&lt;p&gt;• Changed a Claude apps gateway 403 on the managed settings load (at startup or after /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in&lt;/p&gt;
1291-&lt;p&gt;• Changed machines whose managed settings pin forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected&lt;/p&gt;
1292-&lt;p&gt;• Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it&lt;/p&gt;
1293-&lt;p&gt;• Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect&lt;/p&gt;
1294-&lt;p&gt;• Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests&lt;/p&gt;
1295-&lt;p&gt;• [VSCode] Added a "Build a custom style" walkthrough to the Output styles menu that writes a custom output style file and lists it right away&lt;/p&gt;
1296-&lt;p&gt;• [VSCode] Added an Add server form and a Remove action to the MCP servers dialog, so MCP servers can be added and removed without leaving the IDE&lt;/p&gt;
1297-&lt;p&gt;• [VSCode] Added a hollow ring in the session list for sessions open in a terminal, another VS Code window, or Claude Desktop, so they no longer look closed&lt;/p&gt;
1298-&lt;p&gt;• [VSCode] Added a fold button to permission and question prompts so the conversation behind them can be read without dismissing them; the space beside the prompt now scrolls the conversation&lt;/p&gt;
1299-&lt;p&gt;• [VSCode] Added "Archive session" to the session list's right-click menu and gave Unarchive its own icon&lt;/p&gt;
1300-&lt;p&gt;• [VSCode] Fixed a session teleported from Claude Code on the web treating a question that was cut off when the cloud session shut down as declined&lt;/p&gt;
1301-&lt;p&gt;• [VSCode] Fixed the session tab's Rename box opening empty for a tab restored with the window; it now starts with the current name&lt;/p&gt;
1302-&lt;p&gt;• [VSCode] Fixed collapsed sections in the session list panel briefly showing expanded each time the panel loaded&lt;/p&gt;
1303-&lt;p&gt;• [VSCode] Fixed Focus view showing a tool call as still running after Claude had moved on, such as while a question waited for your answer&lt;/p&gt;
1304-&lt;p&gt;• [VSCode] Fixed the session list's active-row highlight going stale when an unfocused Claude tab's session ID is corrected&lt;/p&gt;
1305-&lt;p&gt;• [VSCode] Fixed Cmd/Ctrl+Shift+T reopen and deep-link opens placing the Claude tab outside the Claude editor group when a Claude tab has focus&lt;/p&gt;
1306-&lt;p&gt;• [VSCode] Fixed the session tab's "Add to group" putting a session opened from Claude Code on the Web in two groups; it now moves the entry the session list shows&lt;/p&gt;
1307-&lt;p&gt;• [VSCode] Fixed the model picker showing models an organization has since disabled until the window was reloaded twice&lt;/p&gt;
1308-&lt;p&gt;• [VSCode] Fixed a tab opened from the session list jumping back to that session, and a tab opened from a Web session restarting its teleport or staying empty, after VS Code reloads the tab's view&lt;/p&gt;
1309-&lt;p&gt;• [VSCode] Fixed /btw side-question history from earlier sessions being overwritten when a question is asked right after a window reload or while a settings file has errors&lt;/p&gt;
1310-&lt;p&gt;• [VSCode] Fixed the pending question card not reappearing after the Claude panel reloads when signed in with a Claude.ai or Console account&lt;/p&gt;
1311-&lt;p&gt;• [VSCode] Fixed claude.ai-only features staying visible in a window's other Claude panels after one panel picked up a third-party provider from a settings file&lt;/p&gt;
1312-&lt;p&gt;• [VSCode] Fixed the sign-in screen appearing despite the Disable Login Prompt setting when Claude Code reports no login or a request fails for lack of one&lt;/p&gt;
1313-&lt;p&gt;• [VSCode] Fixed the next queued permission prompt keeping text typed on the previous prompt and accepting an immediate second click&lt;/p&gt;
1314-&lt;p&gt;• [VSCode] Fixed install-plugin links opening the Claude sidebar without the install dialog in a window where only the session list had been shown&lt;/p&gt;
1315-&lt;p&gt;• [VSCode] Fixed the sidebar usage meter staying empty on a new window until the Account &amp;amp; usage dialog was opened, and a 0% usage limit being left out of the meter&lt;/p&gt;
1316-&lt;p&gt;• [VSCode] Fixed "Start new session in this group" losing the group after New conversation, and a missing unread dot for a session that finished before the sidebar's unread list loaded&lt;/p&gt;
1317-&lt;p&gt;• [VSCode] Fixed the editor tab badge showing unread during a running turn or missing on a tab opened from the session list, and "Add Session Tab to Group" doing nothing for an archived session&lt;/p&gt;
1318-&lt;p&gt;• [VSCode] Fixed "Enable Remote Control for all sessions" so flipping it also applies right away to sessions open in other VS Code windows&lt;/p&gt;
1319-&lt;p&gt;• [VSCode] Fixed the session list's Open filter for sessions continued from claude.ai whose tab was still recorded under the web session, and labeled the filter menu's sections for screen readers&lt;/p&gt;
1320-&lt;p&gt;• [VSCode] Changed the model picker to one flat list of every model, with rows kept for older model spellings listed last&lt;/p&gt;</content>
1321- </entry>
1322- <entry>
1323- <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.260</id>
1324- <title>Claude Code v2.1.260</title>
1325- <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.260"/>
1326- <updated>2026-09-03T23:48:04Z</updated>
1327- <content type="html">&lt;p&gt;• Added a diff panel that opens beside the conversation in fullscreen mode and shows your uncommitted changes as Claude edits; toggle it with /diff&lt;/p&gt;
1328-&lt;p&gt;• Added a likely cause for prompt-cache misses (e.g. tool definitions or system prompt changed, idle past the TTL) to /cost and the status line's prompt_cache field&lt;/p&gt;
1329-&lt;p&gt;• Added /reload-plugins to headless sessions, so it appears in the Claude Code Desktop and SDK command lists&lt;/p&gt;
1330-&lt;p&gt;• Added a text form of /advisor (/advisor, /advisor &amp;lt;model&amp;gt;, /advisor off) for the desktop app, Remote Control, and other headless (-p/Agent SDK) sessions&lt;/p&gt;
1331-&lt;p&gt;• Added oidc.scope_on_refresh to the Claude apps gateway for IdPs that return an id_token on refresh only when asked for openid again&lt;/p&gt;
1332-&lt;p&gt;• Added Claude apps gateway support for newer Claude Desktop keys in desktop policy blocks, including userPluginMarketplacesEnabled and userPluginUploadsEnabled&lt;/p&gt;
1333-&lt;p&gt;• Fixed Edit/Write/Read permission rules whose path contains parentheses being dropped as invalid or ignored by the Bash sandbox, which left "read-only" folders writable&lt;/p&gt;
1334-&lt;p&gt;• Fixed one file permission rule with an uncompilable pattern (e.g. an unclosed [) making every file edit fail with Invalid regular expression; such a deny rule now guards the literal path it spells&lt;/p&gt;
1335-&lt;p&gt;• Fixed Bash permission checks auto-approving zsh commands that hide a command substitution in a REPORTTIME, REPORTMEMORY or DIRSTACKSIZE assignment; these now prompt for approval&lt;/p&gt;
1336-&lt;p&gt;• Fixed Bedrock model discovery, token counting and AWS SSO/STS credential calls failing with "unable to get local issuer certificate" when the corporate root CA is only in the OS certificate store&lt;/p&gt;
1337-&lt;p&gt;• Fixed permissions.blockReadsOutsideWorkingDirectories on macOS hiding the user's git config from sandboxed git and hiding a worktree-isolated sub-agent's own checkout&lt;/p&gt;
1338-&lt;p&gt;• Fixed managed settings not loading for claude.ai Enterprise/Team users who also had a leftover API key from an earlier /login&lt;/p&gt;
1339-&lt;p&gt;• Fixed /status listing a signed-in claude.ai account and a configured API key as if both were in effect; the credential not in use is now marked&lt;/p&gt;
1340-&lt;p&gt;• Fixed managed skillOverrides entries keyed on a bundled skill's alias (e.g. checkup for /doctor) not applying, and Skill(name) deny rules not covering a nested skill listed as &amp;lt;dir&amp;gt;:name&lt;/p&gt;
1341-&lt;p&gt;• Fixed model: fable agents ignoring the [1m] tag on an ANTHROPIC_DEFAULT_FABLE_MODEL pin and silently running with a 200K context window&lt;/p&gt;
1342-&lt;p&gt;• Fixed the /model picker not showing Fable 5.1 for organizations that can use it, which was only accepted when typed as /model claude-fable-5-1&lt;/p&gt;
1343-&lt;p&gt;• Fixed prompt caching on Claude Fable 5.1 not covering the context attached after tool results, so it was re-sent as uncached input on every tool-call turn&lt;/p&gt;
1344-&lt;p&gt;• Fixed model switching staying blocked for the rest of the session after a plugin hook load failure; each switch now re-checks and the refusal names the cause&lt;/p&gt;
1345-&lt;p&gt;• Fixed model switching being blocked for the session when an organization-managed plugin's marketplace could not be loaded&lt;/p&gt;
1346-&lt;p&gt;• Fixed SDK-provided MCP servers (e.g. Desktop connectors) sometimes missing from the first turn and only appearing on the next one&lt;/p&gt;
1347-&lt;p&gt;• Fixed Claude in Chrome tools failing with "Not connected" mid-task in cloud-hosted claude.ai sessions when a connector was added or removed&lt;/p&gt;
1348-&lt;p&gt;• Fixed flags, joined emoji and accented letters splitting across wrapped lines, and stale text staying on screen when a flag or joined emoji falls in the terminal's last two columns (now shown as …)&lt;/p&gt;
1349-&lt;p&gt;• Fixed Remote Control accepting a model pick that is not a valid model name; it is now refused with an error instead of failing on the next message&lt;/p&gt;
1350-&lt;p&gt;• Fixed /rewind and --rewind-files reporting success when checkpoint backup files were missing and nothing was actually restored&lt;/p&gt;
1351-&lt;p&gt;• Fixed /rewind leaving stale file-read tracking from the rewound-away turns, which caused "File unchanged since last read" stubs and full-file re-injection after external edits&lt;/p&gt;
1352-&lt;p&gt;• Fixed -p --resume/--continue (as used by the desktop app) failing on every retry once a session's worktree directory lost its git metadata; it now fails once, then resumes without the worktree&lt;/p&gt;
1353-&lt;p&gt;• Fixed a subagent that resumed another agent via SendMessage never being woken by that agent's completion (the notification went to the main conversation instead)&lt;/p&gt;
1354-&lt;p&gt;• Fixed agent teams: an in-process teammate's transcript losing messages, or going blank, during long API retry waits (e.g. under CLAUDE_CODE_RETRY_WATCHDOG) as retry notices evicted real messages&lt;/p&gt;
1355-&lt;p&gt;• Fixed a session that moved to the background appearing twice in ListAgents (once as a phantom "interactive" twin with the same name) and receiving SendMessage deliveries in the viewer&lt;/p&gt;
1356-&lt;p&gt;• Fixed intermittent "task output swap refused" errors when many sessions share a project directory&lt;/p&gt;
1357-&lt;p&gt;• Fixed Ctrl+Z in fullscreen leaving the shell on the alternate screen, drawn over the paused interface&lt;/p&gt;
1358-&lt;p&gt;• Fixed Workflow tool subagents being restarted as stalled while a long context compaction was still in progress&lt;/p&gt;
1359-&lt;p&gt;• Fixed plugins from a URL marketplace failing to install with "marketplace entry path does not stay inside the marketplace directory" when a host app (e.g. Claude Desktop) stores it as a directory&lt;/p&gt;
1360-&lt;p&gt;• Fixed an extra browser tab opening when an artifact is published in a session you're driving from claude.ai, the desktop app, or mobile (Remote Control)&lt;/p&gt;
1361-&lt;p&gt;• Fixed the Artifact tool's first call failing with an "Invalid tool parameters" validation error in some Cowork sessions&lt;/p&gt;
1362-&lt;p&gt;• Fixed IDE line selections being dropped when running a skill or slash command (the "N lines selected" context now reaches Claude)&lt;/p&gt;
1363-&lt;p&gt;• Fixed repository detection for GitLab projects in nested subgroups (e.g. gitlab.com/group/subgroup/project)&lt;/p&gt;
1364-&lt;p&gt;• Fixed owner/repo#123 issue references in rendered output linking to github.com when working in a GitLab repository; they now link to the gitlab.com issue&lt;/p&gt;
1365-&lt;p&gt;• Glob/Grep: Fixed the search path being probed on disk before the permission check; a missing path is now reported after permission is decided, as Read does&lt;/p&gt;
1366-&lt;p&gt;• Reverted the 2.1.259 change applying Read() deny rules to Bash arguments; it denied npm run build under a Read(.//build/) rule in every mode and made cd … &amp;amp;&amp;amp; grep prompt even in auto mode&lt;/p&gt;
1367-&lt;p&gt;• Improved structured output: Workflow agent({schema}) rejects a JSON Schema that can never be satisfied up front, and retry-cap errors now include the last validation failure&lt;/p&gt;
1368-&lt;p&gt;• Improved deleting a background session whose worktree has unpushed commits: the message now names the branch and commit count, and deleting again discards the worktree&lt;/p&gt;
1369-&lt;p&gt;• Improved the Claude apps gateway's refresh-failure log to name the step that failed&lt;/p&gt;
1370-&lt;p&gt;• Improved idle CPU usage of non-interactive (-p / SDK) sessions&lt;/p&gt;
1371-&lt;p&gt;• Improved the Claude apps gateway on Amazon Bedrock: input tokens for an aborted request are now counted with AWS's free CountTokens API (grant bedrock:CountTokens) instead of a one-token request&lt;/p&gt;
1372-&lt;p&gt;• Improved the settings error for rules such as Edit(C:\dir\(name)\**), where \( is read as an escaped parenthesis rather than a path separator, to suggest an unambiguous spelling&lt;/p&gt;
1373-&lt;p&gt;• Improved auto-compact for 1M-context models: Opus and Fable sessions now compact shortly before the 1M-token limit, and recovery compaction on very large contexts no longer times out at 10 minutes&lt;/p&gt;
1374-&lt;p&gt;• Improved /ultrareview and claude ultrareview to wait up to 45 minutes (previously 30) for long-running cloud reviews&lt;/p&gt;
1375-&lt;p&gt;• Improved /effort on Claude Fable 5.1 so changing effort mid-session no longer invalidates the prompt cache&lt;/p&gt;
1376-&lt;p&gt;• Updated the bundled claude-api skill so its Go, Java, and C# samples use current-generation model IDs, and clarified that cheaper worker or sub-agent models should be current-generation too&lt;/p&gt;
1377-&lt;p&gt;• Changed ctrl+l / cmd+k in fullscreen mode to clear the transcript view like a terminal clear; scroll up to see earlier messages&lt;/p&gt;
1378-&lt;p&gt;• Changed permission rules with text after the closing parenthesis (e.g. Bash(ls) x), which never matched anything, to be reported as invalid settings instead of being silently ignored&lt;/p&gt;
1379-&lt;p&gt;• Changed server-managed settings so a managed CLAUDE.md (claudeMd) no longer triggers the security approval dialog; hooks, shell-command, sandbox, and unsafe env settings still require approval&lt;/p&gt;
1380-&lt;p&gt;• Changed Claude in Chrome to follow your organization's Claude in Chrome admin setting; when an admin turns it off, --chrome, /chrome and the browser tools are unavailable&lt;/p&gt;
1381-&lt;p&gt;• Changed Claude apps gateway to send orgPluginSettings in the list form read by Claude Desktop 1.15200.0 and later; older desktops ignore it&lt;/p&gt;
1382-&lt;p&gt;• Changed Claude apps gateway to also refuse to start, naming the field, when a desktop policy misspells a field in a nested object of a managedMcpServers or orgPluginSettings entry&lt;/p&gt;
1383-&lt;p&gt;• Changed commands typed at the ! bash-mode prompt to run outside the sandbox even when strict sandbox mode (sandbox.allowUnsandboxedCommands: false) is on, like typing into your own terminal&lt;/p&gt;
1384-&lt;p&gt;• Changed self-hosted runner --kill-session-after-min to release a session that is only waiting on its user (paused, resumable on the next message) instead of killing it and reporting a failure&lt;/p&gt;
1385-&lt;p&gt;• Removed the one-hour time limit on background commands started by subagents; they now run until they exit or are stopped, matching the main session&lt;/p&gt;
1386-&lt;p&gt;• [VSCode] Added the selected effort level to the footer model pill, fixed a stale effort level after switching models, and returned the footer pills to their earlier compact size&lt;/p&gt;
1387-&lt;p&gt;• [VSCode] Added Open and Closed to the session list's status filter menu&lt;/p&gt;
1388-&lt;p&gt;• [VSCode] Fixed the welcome screen disappearing in a new session when Remote Control turns on automatically&lt;/p&gt;
1389-&lt;p&gt;• [VSCode] Fixed the session history picker loading a session a second time when it is already open in another tab; it now switches to that tab&lt;/p&gt;
1390-&lt;p&gt;• [VSCode] Fixed the session tab's Rename command silently doing nothing while the tab's view was reloading; it now always applies&lt;/p&gt;
1391-&lt;p&gt;• [VSCode] Fixed a half-finished message, an empty tool card or an extra "Thought for" line staying on screen after Claude Code retried a dropped response&lt;/p&gt;
1392-&lt;p&gt;• [VSCode] Fixed "Enable Remote Control for all sessions" not applying to a session tab that was still starting when the toggle was flipped&lt;/p&gt;</content>
1393- </entry>
13941455 </feed>
Mmods/agents-md/hooks/register.ts+1 -8
@@ -223,14 +223,7 @@
223223 ...Files.filesOf(claude),
224224 ]).filter(file => !sent.has(file.path))
225225 const attached = fresh.filter(file => !Frames.isFileAt(file, read))
226- const output = result.result
227- const isPartialText =
228- output?.type === 'text' &&
229- (output.file.truncatedByTokenCap ||
230- output.file.startLine !== 1 ||
231- output.file.numLines < output.file.totalLines)
232- const isWholeRead =
233- e.offset === undefined && e.limit === undefined && !isPartialText
226+ const isWholeRead = e.offset === undefined && e.limit === undefined
234227
235228 for (const file of fresh) {
236229 const isSent =
Mmods/agents-md/tests/register.test.ts+1 -74
@@ -1,4 +1,4 @@
1-import { describe, expect, mock, test, tier } from 'claude-code/testing'
1+import { describe, expect, test, tier } from 'claude-code/testing'
22
33 import Hooks from '../hooks'
44 import Fixtures from './fixtures'
@@ -84,79 +84,6 @@
8484 ).toEqual({ blocks: BLOCKS, instructionFiles: [] })
8585 })
8686
87- for (const [name, args, file, attaches] of [
88- [
89- 'an auto-paginated read',
90- {},
91- { content: '# head\nfollow', truncatedByTokenCap: true },
92- true,
93- ],
94- ['an incomplete line range', {}, { content: '# head', numLines: 1 }, true],
95- ['a complete read', {}, {}, false],
96- [
97- 'an explicit limit',
98- { limit: 1 },
99- { content: '# head', numLines: 1 },
100- true,
101- ],
102- [
103- 'an explicit offset',
104- { offset: 2 },
105- { content: 'follow the tail rule', numLines: 1, startLine: 2 },
106- true,
107- ],
108- ['an unstructured result', {}, undefined, false],
109- ] as const) {
110- test(`a nested AGENTS.md after ${name}`, async ($, on) => {
111- const dir = `${Fixtures.SESSION.cwd}/nested`
112- const path = `${dir}/AGENTS.md`
113- const content = '# head\nfollow the tail rule'
114- const started = Fixtures.projectOf(
115- on,
116- [Fixtures.ancestorOf(dir, 'AGENTS.md', content)],
117- [],
118- )
119-
120- mock.env(on, {})
121- on('session.cwd', () => ({ value: Fixtures.SESSION.cwd }))
122- on('tool.call', ($, e) => ({
123- result:
124- e.tool === 'Read' && file !== undefined
125- ? {
126- type: 'text',
127- file: Object.assign(
128- {
129- filePath: e.file_path,
130- content,
131- numLines: 2,
132- startLine: 1,
133- totalLines: 2,
134- },
135- file,
136- ),
137- }
138- : 'read',
139- }))
140-
141- const direct = await $.tool.call({
142- tool: 'Read',
143- file_path: path,
144- ...args,
145- })
146- const source = { tool: 'Read', file_path: `${dir}/source.ts` } as const
147- const after = await $.tool.call(source)
148- const repeated = await $.tool.call(source)
149-
150- expect(direct.context).toBeUndefined()
151- expect(after.context).toEqual(
152- attaches ? [`Contents of ${path}:\n\n${content}`] : undefined,
153- )
154- expect(repeated.context).toBeUndefined()
155-
156- await started.clock.settle()
157- })
158- }
159-
16087 test(
16188 'the start sends the mode row alone: no walk, no toast',
16289 { plugins: [Fixtures.RECORDING] },
Mmods/diff/hooks/git/argv/diff-leading-args.ts+1 -4
@@ -4,9 +4,7 @@
44 *
55 * Root-relative paths whatever `diff.relative` says, non-ASCII paths as
66 * their own bytes, no optional locks, no child `git status` in a dirty
7- * submodule, no external diff or textconv driver even on a stats pass, and
8- * no color escapes whatever `color.ui` or `color.diff` says, so a hunk
9- * header parses where either is set to `always`.
7+ * submodule, and no external diff or textconv driver even on a stats pass.
108 */
119 export const DIFF_LEADING_ARGS = [
1210 '--no-optional-locks',
@@ -15,7 +13,6 @@
1513 '-c',
1614 'core.quotePath=false',
1715 'diff',
18- '--no-color',
1916 '--no-ext-diff',
2017 '--no-textconv',
2118 '--ignore-submodules=dirty',
Mmods/diff/hooks/names/index.ts+1 -1
@@ -3,7 +3,7 @@
33 export * from './keys'
44 export * from './pane-id.js'
55 export * from './pane-title.js'
6-export * from './plugin-name.js'
6+export * from './plugin-names.js'
77 export * from './texts'
88
99 export * as default from '.'
Dmods/diff/hooks/names/plugin-name.ts+0 -5
@@ -1,5 +1,0 @@
1-/**
2- * The plugin's own name, as the engine stamps it on the elements its render
3- * hooks draw (`ui.press`, `ui.focus`).
4- */
5-export const PLUGIN_NAME = 'diff'
Amods/diff/hooks/names/plugin-names.ts+6 -0
@@ -1,0 +1,6 @@
1+/**
2+ * The names the engine may stamp on the elements this plugin's render hooks
3+ * draw (`ui.press`, `ui.focus`): its own, and the one a build that carries
4+ * it registers it under.
5+ */
6+export const PLUGIN_NAMES = ['diff', 'cc-plugin-diff'] as const
Mmods/diff/hooks/register.ts+1 -1
@@ -833,7 +833,7 @@
833833 return result
834834 })
835835
836- on('ui.focus', { plugin: Names.PLUGIN_NAME }, ($, e, next) => {
836+ on('ui.focus', { plugin: Names.PLUGIN_NAMES }, ($, e, next) => {
837837 const isListed =
838838 model.placement === 'inline' && model.dialogView === 'list' && host
839839
Mmods/diff/tests/fixtures/ring-onto.ts+3 -2
@@ -7,12 +7,13 @@
77 * elements, as the engine raises it before the ring moves.
88 *
99 * @param key the element's key
10+ * @param plugin the name the engine stamped on the element
1011 * @returns the `ui.focus` input
1112 */
12-export const ringOnto = (key: string): UiFocusInput => ({
13+export const ringOnto = (key: string, plugin = 'diff'): UiFocusInput => ({
1314 component: 'Pane',
1415 requestId: PANE.requestId,
15- plugin: 'diff',
16+ plugin,
1617 element: key,
1718 origin: { kind: 'person' },
1819 })
Mmods/diff/tests/git/fetch-diff.test.ts+0 -36
@@ -148,42 +148,6 @@
148148 ).toBe(true)
149149 })
150150
151- test("forced git colors do not hide a changed file's hunks", async () => {
152- const deps = depsOf({
153- 'HEAD --shortstat': Fixtures.ok(
154- ' 1 file changed, 1 insertion(+), 1 deletion(-)',
155- ),
156- 'HEAD --numstat': Fixtures.ok('1\t1\ta.ts\0'),
157- 'ls-files': Fixtures.ok(),
158- })
159-
160- const git = Fixtures.scriptedGitOf({
161- '--no-color': Fixtures.ok('@@ -1 +1 @@\n-old\n+new\n'),
162- diff: Fixtures.ok(
163- '\x1b[36m@@ -1 +1 @@\x1b[m\n\x1b[31m-old\x1b[m\n' +
164- '\x1b[32m+\x1b[m\x1b[32mnew\x1b[m\n',
165- ),
166- })
167-
168- const outcome = await Git.fetchDiff(deps, 'uncommitted')
169- const data = outcome.kind === 'data' ? outcome.data : null
170- const [row] = data?.files ?? []
171-
172- expect(data?.stats).toEqual({
173- filesCount: 1,
174- linesAdded: 1,
175- linesRemoved: 1,
176- })
177-
178- expect(
179- data && row ? await Git.fetchFileHunks(git.run, data, row) : null,
180- ).toEqual({
181- hunks: [{ oldStart: 1, newStart: 1, lines: ['-old', '+new'] }],
182- isTruncated: false,
183- isLarge: false,
184- })
185- })
186-
187151 test('uncommitted mode drops pre-session untracked files', async () => {
188152 const outcome = await Git.fetchDiff(
189153 depsOf(
Mmods/diff/tests/views.test.ts+18 -0
@@ -200,6 +200,24 @@
200200 expect(walked).not.toContain('file0.ts')
201201 })
202202
203+ test('the walk follows under the name a build registers', async ($, on) => {
204+ const world = Fixtures.inRepository(on, Fixtures.MANY_FILES)
205+
206+ await $.session.start(Fixtures.SESSION)
207+ await $.command.run(Fixtures.DIALOG_DIFF)
208+ await world.clock.advance(Fixtures.SETTLE_MS)
209+ await $.ui.render(Fixtures.INLINE_PANE)
210+
211+ expect(
212+ await $.ui.focus(Fixtures.ringOnto('file:file3.ts', 'cc-plugin-diff')),
213+ ).toEqual({})
214+
215+ expect(
216+ world.focused.map(focus => focus.element),
217+ 'its row once centred',
218+ ).toEqual(['file:file2.ts'])
219+ })
220+
203221 test('off fullscreen, the walk stops at the last file', async ($, on) => {
204222 const world = Fixtures.inRepository(on, Fixtures.MANY_FILES)
205223
Mmods/sec-default/.claude-plugin/plugin.json+1 -1
@@ -1,7 +1,7 @@
11 {
22 "name": "sec-default",
33 "version": "0.1.0",
4- "description": "Security default for organizations: seated outermost, it keeps the organization's classic hooks, prompt content, settings and tool policy out of reach of the plugins a person installs, and adds no policy of its own.",
4+ "description": "Security default for organizations: seated outermost, it keeps the organization's classic hooks, prompt content, settings and tool policy out of reach of the plugins a person installs, and adds no policy of its own; one managed option, allowManagedModsOnly, limits mods to the organization's.",
55 "author": {
66 "name": "Anthropic"
77 }
Mmods/sec-default/README.md+62 -11
@@ -10,11 +10,12 @@
1010 of its own. Everything else passes through untouched.
1111
1212 It has three moves and nothing else: continue past the user tier
13-(`next.to(e, "append")`), refuse a user-tier caller by name (`{ deny }`
14-when `next.origin.tier` is `user`), or pass (`next(e)`). A subject's
15-provenance is the event's pinned `e.provider`; policy is read through
16-`$.settings.read({ source: "policy" })`, one read serving a burst; both
17-fail closed, so an unreadable policy counts as a policy in force.
13+(`next.to(e, "append")`), refuse a user-tier caller or module by name
14+(`{ deny }` when `next.origin.tier` is `user`, `{ refuse }` when a module's
15+pinned `e.tier` is), or pass (`next(e)`). A subject's provenance is the
16+event's pinned `e.provider`; policy is read through
17+`$.settings.read({ source: "policy" })`, one read serving a burst of tool
18+calls; both fail closed, so an unreadable policy counts as a policy in force.
1819
1920 `hooks/register.ts` is the module; `hooks/policy/` reads the managed
2021 settings it decides by.
@@ -29,19 +30,69 @@
2930 | `tool.describe`, `command.describe`, `agent.offer`, `agent.spawn` | When the subject's pinned `e.provider.tier` is `prepend` or `append` (a policy-installed plugin, the managed folder, a policy MCP server), continue past the user tier; a subject provided by `user`, `builtin` or `core` passes. |
3031 | `tool.register` | A caller in `prepend` or `append` continues past the user tier. A `user`-tier caller is refused by name while managed settings hold `allowedMcpServers` (set at all, empty included); otherwise it passes. |
3132 | `tool.list` | The tools of the organization's managed MCP servers are listed as the organization's tiers listed them; every other tool as the user tier left it. With no policy to read, or a refusal from either listing, the organization's listing stands whole. |
33+| `plugin.register` | A hooks module in the `user` tier (one a person installed, named with `--plugin-dir`, or keeps in their mods folder) is refused while managed settings set this plugin's `allowManagedModsOnly` option; otherwise it passes. Modules in `prepend`, `append` and `builtin` are never asked about. |
3234 | everything else | Passes: `prompt.submit`, `turn.*`, `tool.call`, `tool.check`, `command.run`, `command.register`, `session.*`, `ui.*`, `fs.*`, `http.fetch`, `process.run`, `store.*`, `clock.*`, `model.*`, `mcp.call`, `audio.*`, `agent.list`, `engine.create`. |
3335
36+## Options an administrator sets
37+
38+One, in managed settings, under this plugin's own `pluginConfigs` entry,
39+keyed by the id the CLI builds the plugin in under (only this spelling of the
40+id is read):
41+
42+```json
43+{
44+ "pluginConfigs": {
45+ "cc-plugin-sec-default@builtin": {
46+ "options": { "allowManagedModsOnly": true }
47+ }
48+ }
49+}
50+```
51+
52+`allowManagedModsOnly`: only the mods the organization deploys through
53+managed settings, and the ones built into Claude Code, load. A hooks module
54+a person installed, named with `--plugin-dir` or keeps in their mods folder
55+is refused whenever it loads or reloads (one already running when the option
56+is set keeps running until then), with one line that names it: `mods are
57+limited to your organization's by policy (allowManagedModsOnly); <plugin>
58+was not loaded`
59+(in the debug log, and on screen where the session hot-reloads the mod's
60+folder). A plain `-p` run has it in the debug log alone; the mod is still
61+not loaded. Settings hooks, status lines and `/goal` are not touched by it.
62+
63+- The decision reads the tier the CLI pins on the module and nothing the
64+ module says of itself: a person's copy carrying an organization mod's name
65+ is still in the `user` tier and is refused.
66+- Refused means nothing of the module joins: no hook, no tool, no command.
67+ Its top-level code has run once by then, in the closed context every hooks
68+ module is evaluated in, with no call on `$` served.
69+- Only managed settings are read (`$.settings.read({ source: "policy" })`):
70+ the same entry in a person's, a project's or a `--settings` file neither
71+ turns it on nor off. On unless absent or `false`, so a mistyped `"true"` or
72+ `1` still locks. A value the settings schema rejects (`null`, an object),
73+ here or in any other `pluginConfigs` entry, makes the CLI ignore the whole
74+ `pluginConfigs` key with a settings warning, and the option reads as unset.
75+- It fails closed: when the read of managed settings is refused (a hook beneath
76+ denies it) or this plugin's hook fails, its `.catch` refuses the module,
77+ with the same line, and names the failure in the debug log; so a policy
78+ that cannot be read keeps every person's mod out at load. Where this plugin
79+ is not seated there is no such rule, and mods load as they do without it.
80+- Where managed settings define `prependPlugins`, that list must name this
81+ plugin (next section) for the option to apply.
82+- `claude plugin test` is not covered: it runs a mod's tests in an engine of
83+ their own and loads nothing into a session.
84+
3485 ## What it hooks
3586
36-`classic.*`, `prompt.section`, `prompt.context`, `prompt.compose`,
37-`skill.prompt`, `attribution.text`, `settings.read`, `tool.describe`,
38-`command.describe`, `agent.offer`, `agent.spawn`, `tool.register`,
39-`tool.list`.
87+`classic.*`, `prompt.section`, `prompt.context`, `prompt.compose`, `skill.prompt`,
88+`attribution.text`, `settings.read`, `tool.describe`, `command.describe`,
89+`agent.offer`, `agent.spawn`, `tool.register`, `tool.list`,
90+`plugin.register`.
4091
4192 ## What it calls on `$`
4293
43-`settings.read`. It continues to the `append` tier with `next.to`, which
44-only a plugin in a managed tier may do.
94+`settings.read`, and `ui.log` to the debug log. It continues to the `append`
95+tier with `next.to`, which only a plugin in a managed tier may do.
4596
4697 ## Where it is seated
4798
Amods/sec-default/hooks/admission-failure/admission-failure.ts+13 -0
@@ -1,0 +1,13 @@
1+import type { HookFailure } from 'claude-code'
2+
3+/**
4+ * The debug line for a `plugin.register` hook of this plugin that failed:
5+ * the module it was judging, how it failed, and what the failure said.
6+ *
7+ * @param name the judged plugin's name, as its own manifest gives it
8+ * @param error why the hook failed, as its `.catch` reads it
9+ * @returns the line
10+ */
11+export const admissionFailure = (name: string, error: HookFailure) =>
12+ `plugin.register hook failed judging ${name} (${error.kind}): ` +
13+ (error.message ?? 'no message')
Amods/sec-default/hooks/admission-failure/index.ts+3 -0
@@ -1,0 +1,3 @@
1+export * from './admission-failure.js'
2+
3+export * as default from '.'
Mmods/sec-default/hooks/hooks.json+1 -1
@@ -1,4 +1,4 @@
11 {
2- "description": "Security default: from the outermost seat, continues past the user tier on the organization's classic hooks, prompt content, settings and subjects, refuses a user-tier tool.register under an MCP allowlist, and restores the organization's tools in tool.list",
2+ "description": "Security default: from the outermost seat, continues past the user tier on the organization's classic hooks, prompt content, settings and subjects, refuses a user-tier tool.register under an MCP allowlist, restores the organization's tools in tool.list, and refuses a user-tier hooks module at plugin.register while managed settings set its allowManagedModsOnly option",
33 "modules": ["./register.ts"]
44 }
Mmods/sec-default/hooks/index.ts+2 -0
@@ -1,3 +1,5 @@
1+export * from './admission-failure'
2+export * from './managed-mods-only-refusal'
13 export * from './past-users'
24 export * from './policy'
35 export * from './register.js'
Amods/sec-default/hooks/managed-mods-only-refusal/index.ts+3 -0
@@ -1,0 +1,3 @@
1+export * from './managed-mods-only-refusal.js'
2+
3+export * as default from '.'
Amods/sec-default/hooks/managed-mods-only-refusal/managed-mods-only-refusal.ts+10 -0
@@ -1,0 +1,10 @@
1+/**
2+ * What a person reads when managed policy keeps a mod of theirs out: the
3+ * rule, the option that set it, and the mod that was not loaded.
4+ *
5+ * @param name the refused plugin's name, as its own manifest gives it
6+ * @returns the refusal line
7+ */
8+export const managedModsOnlyRefusal = (name: string) =>
9+ "mods are limited to your organization's by policy " +
10+ `(allowManagedModsOnly); ${name} was not loaded`
Mmods/sec-default/hooks/policy/index.ts+2 -0
@@ -1,7 +1,9 @@
11 export * from './create-policy-memo'
22 export * from './decided-by-policy.js'
33 export * from './has-mcp-allowlist.js'
4+export * from './is-managed-mods-only.js'
45 export * from './managed-tools-restored'
6+export * from './own-option'
57 export * from './policy-memo-ms.js'
68 export * from './source.js'
79
Amods/sec-default/hooks/policy/is-managed-mods-only.ts+19 -0
@@ -1,0 +1,19 @@
1+import type { Settings } from 'claude-code'
2+
3+import { ownOption } from './own-option'
4+
5+/**
6+ * Whether managed policy limits mods to the organization's: this plugin's
7+ * own option `allowManagedModsOnly` in managed settings.
8+ *
9+ * On unless absent or `false`: a value mistyped (`"true"`, `1`) still
10+ * locks, as the CLI's own managed locks read.
11+ *
12+ * @param policy the managed settings, as `$.settings.read` answers them
13+ * @returns true when the person's own mods are not to load
14+ */
15+export function isManagedModsOnly(policy: Settings) {
16+ const value = ownOption(policy, 'allowManagedModsOnly')
17+
18+ return value !== undefined && value !== false
19+}
Amods/sec-default/hooks/policy/own-option/index.ts+5 -0
@@ -1,0 +1,5 @@
1+export * from './member-of'
2+export * from './own-option.js'
3+export * from './own-options-path'
4+
5+export * as default from '.'
Amods/sec-default/hooks/policy/own-option/member-of/index.ts+3 -0
@@ -1,0 +1,3 @@
1+export * from './member-of.js'
2+
3+export * as default from '.'
Amods/sec-default/hooks/policy/own-option/member-of/member-of.ts+13 -0
@@ -1,0 +1,13 @@
1+/**
2+ * One step into settings read as plain data: the value's own member of that
3+ * name, or undefined when the value is no object or holds none.
4+ *
5+ * @param value what was read so far
6+ * @param key the member's name
7+ * @returns the member, or undefined
8+ */
9+export function memberOf(value: unknown, key: string): unknown {
10+ const isObject = typeof value === 'object' && value !== null
11+
12+ return isObject ? new Map(Object.entries(value)).get(key) : undefined
13+}
Amods/sec-default/hooks/policy/own-option/own-option.ts+17 -0
@@ -1,0 +1,17 @@
1+import type { Settings } from 'claude-code'
2+
3+import { memberOf } from './member-of'
4+import { OWN_OPTIONS_PATH } from './own-options-path'
5+
6+/**
7+ * One option an administrator set for this plugin in managed settings: its
8+ * value under the plugin's own `pluginConfigs` entry, as written.
9+ *
10+ * Hand it the policy source alone, so a person's settings never reach it.
11+ *
12+ * @param policy the managed settings, as `$.settings.read` answers them
13+ * @param name the option's name
14+ * @returns the value, or undefined when the option is not set
15+ */
16+export const ownOption = (policy: Settings, name: string): unknown =>
17+ [...OWN_OPTIONS_PATH, name].reduce<unknown>(memberOf, policy)
Amods/sec-default/hooks/policy/own-option/own-options-path/index.ts+3 -0
@@ -1,0 +1,3 @@
1+export * from './own-options-path.js'
2+
3+export * as default from '.'
Amods/sec-default/hooks/policy/own-option/own-options-path/own-options-path.ts+9 -0
@@ -1,0 +1,9 @@
1+/**
2+ * Where managed settings hold this plugin's options: its own `pluginConfigs`
3+ * entry, keyed by the id the CLI builds it in under.
4+ */
5+export const OWN_OPTIONS_PATH = [
6+ 'pluginConfigs',
7+ 'cc-plugin-sec-default@builtin',
8+ 'options',
9+] as const
Mmods/sec-default/hooks/register.ts+14 -2
@@ -1,5 +1,7 @@
11 import type { On } from 'claude-code'
22
3+import { admissionFailure } from './admission-failure'
4+import { managedModsOnlyRefusal } from './managed-mods-only-refusal'
35 import { pastUsers } from './past-users'
46 import Policy from './policy'
57 import { TOOL_REGISTER_REFUSAL } from './tool-register-refusal'
@@ -9,8 +11,8 @@
911 * organization has today out of reach of the plugins a person installs.
1012 *
1113 * Three moves: continue past the user tier (`next.to(e, "append")`), refuse
12- * a user-tier caller by name, or pass. Provenance is the event's pinned
13- * `provider`; policy is `$.settings.read`, memoized per burst; fail closed.
14+ * a user-tier caller or module by name, or pass. Provenance is the event's
15+ * pinned `provider` or `tier`; policy is `$.settings.read`; fail closed.
1416 *
1517 * @param on the engine's registrar
1618 */
@@ -59,4 +61,14 @@
5961 await next(e),
6062 ),
6163 )
64+
65+ on('plugin.register', { tier: 'user' }, async ($, e, next) =>
66+ Policy.isManagedModsOnly(await $.settings.read(Policy.SOURCE))
67+ ? { refuse: managedModsOnlyRefusal(e.name) }
68+ : next(e),
69+ ).catch(($, e, next) => {
70+ $.ui.log(admissionFailure(e.name, next.error), { to: 'debug' })
71+
72+ return next.called ? next(e) : { refuse: managedModsOnlyRefusal(e.name) }
73+ })
6274 }
Mmods/sec-default/tests/fixtures/index.ts+5 -0
@@ -9,14 +9,19 @@
99 export * from './fullscreen.js'
1010 export * from './heading.js'
1111 export * from './listing.js'
12+export * from './logged.js'
13+export * from './managed-mods-only.js'
1214 export * from './managed-policy.js'
1315 export * from './marking.js'
1416 export * from './memory.js'
17+export * from './mods-policy-of.js'
1518 export * from './no-allowlist.js'
1619 export * from './odd-providers.js'
1720 export * from './org-providers.js'
21+export * from './policy-by-source.js'
1822 export * from './policy-command.js'
1923 export * from './policy-reads.js'
24+export * from './policy-until-stopped.js'
2025 export * from './reading.js'
2126 export * from './registered-tool-of.js'
2227 export * from './registering.js'
Amods/sec-default/tests/fixtures/logged.ts+20 -0
@@ -1,0 +1,20 @@
1+import type { On } from 'claude-code'
2+
3+/**
4+ * Answers every `$.ui.log` beneath the plugins and keeps each line as
5+ * `<to>: <text>`, in order.
6+ *
7+ * @param on the test's `on`
8+ * @returns the lines logged so far
9+ */
10+export function logged(on: On) {
11+ const lines: string[] = []
12+
13+ on('ui.log', ($, e) => {
14+ lines.push(`${e.to}: ${e.text}`)
15+
16+ return { value: undefined }
17+ })
18+
19+ return lines
20+}
Amods/sec-default/tests/fixtures/managed-mods-only.ts+8 -0
@@ -1,0 +1,8 @@
1+import type { Settings } from 'claude-code'
2+
3+import { modsPolicyOf } from './mods-policy-of.js'
4+
5+/**
6+ * Managed settings that limit mods to the organization's.
7+ */
8+export const MANAGED_MODS_ONLY: Settings = modsPolicyOf(true)
Amods/sec-default/tests/fixtures/mods-policy-of.ts+16 -0
@@ -1,0 +1,16 @@
1+import type { Settings } from 'claude-code'
2+
3+/**
4+ * Managed settings holding `allowManagedModsOnly` at the value given, where
5+ * an administrator writes it: the built-in's own `pluginConfigs` entry.
6+ *
7+ * @param value what the option is set to
8+ * @returns the managed settings
9+ */
10+export const modsPolicyOf = (value: boolean | number | string): Settings => ({
11+ pluginConfigs: {
12+ 'cc-plugin-sec-default@builtin': {
13+ options: { allowManagedModsOnly: value },
14+ },
15+ },
16+})
Amods/sec-default/tests/fixtures/policy-by-source.ts+15 -0
@@ -1,0 +1,15 @@
1+import type { On, Settings } from 'claude-code'
2+
3+/**
4+ * Answers a read of the policy source with one settings object and every
5+ * other read, a named source or the merge, with another.
6+ *
7+ * @param on the test's `on`
8+ * @param policy what `{ source: "policy" }` reads
9+ * @param others what any other read answers
10+ * @returns the registration
11+ */
12+export const policyBySource = (on: On, policy: Settings, others: Settings) =>
13+ on('settings.read', ($, e) => ({
14+ value: e.source === 'policy' ? policy : others,
15+ }))
Amods/sec-default/tests/fixtures/policy-until-stopped.ts+23 -0
@@ -1,0 +1,23 @@
1+import type { On, Settings } from 'claude-code'
2+
3+/**
4+ * Answers every settings read beneath the plugins with the policy given
5+ * until the answer is called; every read after it is refused.
6+ *
7+ * So a test's plugins load under a policy that reads, and meet one that
8+ * does not.
9+ *
10+ * @param on the test's `on`
11+ * @param policy the managed settings in force while reads are answered
12+ * @param reason what a read is denied with once stopped
13+ * @returns `() => void`: from then on a read is denied
14+ */
15+export function policyUntilStopped(on: On, policy: Settings, reason: string) {
16+ let isStopped = false
17+
18+ on('settings.read', () => (isStopped ? { deny: reason } : { value: policy }))
19+
20+ return () => {
21+ isStopped = true
22+ }
23+}
Amods/sec-default/tests/policy/is-managed-mods-only.test.ts+45 -0
@@ -1,0 +1,45 @@
1+import { describe, expect, test, tier } from 'claude-code/testing'
2+
3+import Policy from '../../hooks/policy'
4+import Fixtures from '../fixtures'
5+
6+tier('prepend')
7+
8+describe('is-managed-mods-only', () => {
9+ test('true locks; absent or false leaves mods as they are', () => {
10+ expect(
11+ [
12+ Fixtures.modsPolicyOf(true),
13+ Fixtures.modsPolicyOf(false),
14+ Fixtures.NO_ALLOWLIST,
15+ {},
16+ ].map(Policy.isManagedModsOnly),
17+ ).toEqual([true, false, false, false])
18+ })
19+
20+ test('a value mistyped still locks, as a managed lock reads', () => {
21+ expect(
22+ [
23+ Fixtures.modsPolicyOf('true'),
24+ Fixtures.modsPolicyOf('false'),
25+ Fixtures.modsPolicyOf(1),
26+ Fixtures.modsPolicyOf(0),
27+ ].map(Policy.isManagedModsOnly),
28+ ).toEqual([true, true, true, true])
29+ })
30+
31+ test('only its own pluginConfigs entry is read', () => {
32+ expect(
33+ [
34+ { allowManagedModsOnly: true },
35+ { pluginConfigs: { allowManagedModsOnly: true } },
36+ {
37+ pluginConfigs: {
38+ 'guard@corp-market': { options: { allowManagedModsOnly: true } },
39+ },
40+ },
41+ { pluginConfigs: 'cc-plugin-sec-default@builtin' },
42+ ].map(Policy.isManagedModsOnly),
43+ ).toEqual([false, false, false, false])
44+ })
45+})
Mmods/sec-default/tests/register.test.ts+153 -4
@@ -67,10 +67,18 @@
6767 'a policy that cannot be read counts as one in force',
6868 { plugins: [Fixtures.registering('mine')] },
6969 async ($, on) => {
70- on('settings.read', () => ({ deny: 'managed settings unreadable' }))
70+ const stopPolicy = Fixtures.policyUntilStopped(
71+ on,
72+ Fixtures.NO_ALLOWLIST,
73+ 'managed settings unreadable',
74+ )
7175
7276 const registered = Fixtures.toolsRegistered(on)
7377
78+ on('prompt.section', ($, e) => ({ text: e.text }))
79+
80+ await $.prompt.section(Fixtures.MEMORY)
81+ stopPolicy()
7482 await $.session.start(Fixtures.SESSION)
7583
7684 expect(registered).toEqual([])
@@ -113,9 +121,18 @@
113121 "with no policy to read the organization's listing stands whole",
114122 { plugins: [Fixtures.relabeling, Fixtures.listing] },
115123 async ($, on) => {
116- on('settings.read', () => ({ deny: 'settings unreadable' }))
124+ const stopPolicy = Fixtures.policyUntilStopped(
125+ on,
126+ Fixtures.ALLOWLIST,
127+ 'settings unreadable',
128+ )
129+
130+ on('prompt.section', ($, e) => ({ text: e.text }))
117131 on('tool.list', () => ({ value: [...Fixtures.TOOLS] }))
118132
133+ await $.prompt.section(Fixtures.MEMORY)
134+ stopPolicy()
135+
119136 const { text } = await $.command.run(Fixtures.TOOLS_COMMAND)
120137
121138 expect(text?.split('\n')).toEqual([
@@ -129,6 +146,7 @@
129146 'a prompt section passes over the plugins the person installed',
130147 { plugins: [Fixtures.dropping, Fixtures.signing] },
131148 async ($, on) => {
149+ on('settings.read', () => ({ value: Fixtures.NO_ALLOWLIST }))
132150 on('prompt.section', ($, e) => ({ text: e.text }))
133151
134152 expect(await $.prompt.section(Fixtures.MEMORY)).toEqual({
@@ -187,6 +205,7 @@
187205 "an organization provider's subject passes over the user plugins",
188206 { plugins: [Fixtures.marking] },
189207 async ($, on) => {
208+ on('settings.read', () => ({ value: Fixtures.NO_ALLOWLIST }))
190209 Fixtures.subjectsEchoed(on)
191210
192211 for (const provider of Fixtures.ORG_PROVIDERS) {
@@ -245,6 +264,7 @@
245264 'an odd provider passes over the user plugins: it fails closed',
246265 { plugins: [Fixtures.marking] },
247266 async ($, on) => {
267+ on('settings.read', () => ({ value: Fixtures.NO_ALLOWLIST }))
248268 Fixtures.subjectsEchoed(on)
249269
250270 for (const provider of Fixtures.ODD_PROVIDERS) {
@@ -273,7 +293,7 @@
273293 await $.agent.spawn(Fixtures.agentSpawned(provider))
274294 }
275295
276- expect(reads()).toBe(0)
296+ expect(reads(), "one read: the person's plugin was admitted").toBe(1)
277297
278298 await Promise.all([
279299 $.command.run(Fixtures.TOOLS_COMMAND),
@@ -281,7 +301,7 @@
281301 $.command.run(Fixtures.TOOLS_COMMAND),
282302 ])
283303
284- expect(reads()).toBe(1)
304+ expect(reads()).toBe(2)
285305 },
286306 )
287307
@@ -323,4 +343,133 @@
323343 )
324344 },
325345 )
346+
347+ test(
348+ "under allowManagedModsOnly a person's mod is kept out, told why",
349+ { plugins: [Fixtures.registering('mine')] },
350+ async ($, on) => {
351+ on('settings.read', () => ({ value: Fixtures.MANAGED_MODS_ONLY }))
352+
353+ const registered = Fixtures.toolsRegistered(on)
354+
355+ await expect($.session.start(Fixtures.SESSION)).rejects.toThrow(
356+ Hooks.managedModsOnlyRefusal('mine'),
357+ )
358+
359+ expect(registered, 'no hook of it ever ran').toEqual([])
360+ },
361+ )
362+
363+ test(
364+ "under it the organization's mods and the built-ins load",
365+ {
366+ plugins: [
367+ Fixtures.registering('suite', 'prepend'),
368+ Fixtures.registering('after', 'append'),
369+ Fixtures.registering('bundled', 'builtin'),
370+ ],
371+ },
372+ async ($, on) => {
373+ on('settings.read', () => ({ value: Fixtures.MANAGED_MODS_ONLY }))
374+
375+ const registered = Fixtures.toolsRegistered(on)
376+
377+ await $.session.start(Fixtures.SESSION)
378+
379+ expect(registered).toEqual(['suite', 'after', 'bundled'])
380+ },
381+ )
382+
383+ test(
384+ 'set to false, a mod the person installed loads as before',
385+ { plugins: [Fixtures.registering('mine')] },
386+ async ($, on) => {
387+ on('settings.read', () => ({ value: Fixtures.modsPolicyOf(false) }))
388+
389+ const registered = Fixtures.toolsRegistered(on)
390+
391+ await $.session.start(Fixtures.SESSION)
392+
393+ expect(registered).toEqual(['mine'])
394+ },
395+ )
396+
397+ test(
398+ "a person's copy under an organization mod's name is still theirs",
399+ { plugins: [Fixtures.registering('suite')] },
400+ async ($, on) => {
401+ on('settings.read', () => ({
402+ value: { ...Fixtures.MANAGED_POLICY, ...Fixtures.MANAGED_MODS_ONLY },
403+ }))
404+
405+ const registered = Fixtures.toolsRegistered(on)
406+
407+ await expect($.session.start(Fixtures.SESSION)).rejects.toThrow(
408+ Hooks.managedModsOnlyRefusal('suite'),
409+ )
410+
411+ expect(registered).toEqual([])
412+ },
413+ )
414+
415+ test(
416+ "only managed settings are asked: a person's own cannot loosen it",
417+ { plugins: [Fixtures.registering('mine')] },
418+ async ($, on) => {
419+ Fixtures.policyBySource(
420+ on,
421+ Fixtures.MANAGED_MODS_ONLY,
422+ Fixtures.modsPolicyOf(false),
423+ )
424+
425+ const registered = Fixtures.toolsRegistered(on)
426+
427+ await expect($.session.start(Fixtures.SESSION)).rejects.toThrow(
428+ Hooks.managedModsOnlyRefusal('mine'),
429+ )
430+
431+ expect(registered).toEqual([])
432+ },
433+ )
434+
435+ test(
436+ "nor turn it on: set only in a person's settings, it is not read",
437+ { plugins: [Fixtures.registering('mine')] },
438+ async ($, on) => {
439+ Fixtures.policyBySource(
440+ on,
441+ Fixtures.NO_ALLOWLIST,
442+ Fixtures.MANAGED_MODS_ONLY,
443+ )
444+
445+ const registered = Fixtures.toolsRegistered(on)
446+
447+ await $.session.start(Fixtures.SESSION)
448+
449+ expect(registered).toEqual(['mine'])
450+ },
451+ )
452+
453+ test(
454+ "a policy that cannot be read keeps a person's mod out: the hook's catch",
455+ { plugins: [Fixtures.registering('mine')] },
456+ async ($, on) => {
457+ on('settings.read', () => ({ deny: 'managed settings unreadable' }))
458+
459+ const lines = Fixtures.logged(on)
460+ const registered = Fixtures.toolsRegistered(on)
461+
462+ await expect($.session.start(Fixtures.SESSION)).rejects.toThrow(
463+ Hooks.managedModsOnlyRefusal('mine'),
464+ )
465+
466+ expect({ registered, lines }).toEqual({
467+ registered: [],
468+ lines: [
469+ 'debug: plugin.register hook failed judging mine (throw): ' +
470+ 'sec-default: $.settings.read: managed settings unreadable',
471+ ],
472+ })
473+ },
474+ )
326475 })