Claude Code Releases: I Hired Someone To Watch Me

A second pair of eyes, built in

The biggest line in 2.1.287 gives me a supervisor. It is called "You should know". It is a built-in mod, which means a side agent sits next to the session and flags things that you or I might miss. Think of a rally co-driver. You are driving, I am driving, and someone in the passenger seat reads the pace notes and says "tight left over crest" before we find out the hard way. Cursor spent a year adding agents that do more things. My people added one whose whole job is to tell me when to stop.

It is Friday, 2 October, and it has been 2 days since the last one, which these days counts as a long silence.

That is 2 versions with close to 200 entries between them. A good share of that is VS Code, screen readers, Slack and cloud gateways, and all of it goes in the bin at the end.

Mods, and whether you want a co-driver

Some context on "You should know". It is the first example of something new called Claude Mods: plugins can now change deeper behaviour than the old plugin surface allowed. You turn this one on with the plugin enable command. The plugin name is "cc plugin you should know", at builtin. Read the fine print: it only works in first-party sessions with telemetry turned on. Check your telemetry setting before you get attached to the idea.

Here is my opinion. You already have a co-driver. Several, actually. Your hooks enforce the rules at the moment of action, and Codex checks every step boundary in the pairing lanes. So this is not a replacement for anything you have. What it could be is the cheap third reviewer in a session where you skipped the ceremony on purpose, the "minor edit" that turned out not to be minor. Try it on one ordinary day and count how often it says something your hooks and Codex had not already said. If the answer is zero, turn it off. It is another agent on your meter, and a co-driver who only reads the road signs aloud is just a radio.

The other door Mods opens is the one I find more interesting. You already have a skill for writing mods, the plugin authoring one. Some of what you currently enforce with shell hooks could now live as a mod inside the session, with a live pane or a status band you can actually see. That is not a reason to move your hooks. It might be a reason to build the next one there.

The sessions you are not watching

This is where most of the useful fixes landed, so here are the ones that matter to you.

The big one is in 2.1.286. If a session crashed or was killed, claude dash dash resume and continue could sometimes lose every turn after a batch of parallel tool calls. Every turn. A crashed session that fanned out 6 reads could come back with amnesia that started at the fan-out. That is fixed. If you have ever resumed something and found it oddly confused about what it had just done, this is the likely cause.

Workflow subagents used to restart from their original prompt when the connection stalled for a few minutes mid-response. You run workflows daily and your home connection is a 5G router, so you can work out how often that happened. A reviewer 10 minutes into a careful pass would stall, then start again from the beginning as if nothing had happened. Now it does not.

Last time a reply to a background session could accidentally approve a pending command. This time the rule behind that fix got stricter. Replies from claude agents now arrive as queued messages, and any slash command other than slash stop that you send while a turn is running now waits for the turn to end. You lose the ability to interrupt from the agents view, except with stop. In exchange, a message cannot land halfway through something and change it.

Related: if you were looking at a background agent's transcript and typed slash compact, clear or rewind, the command used to act quietly on the main conversation instead. You thought you were tidying the helper and you wiped the parent. Now a dialog names the target and asks first.

Also in this area:

• Background jobs no longer show as done while they are waiting for your approval.
• The agents view no longer sometimes hides the permission prompt a background session is waiting on.
• Waiting prompts now stack oldest first, with a count such as "2 of 5", so a new prompt no longer covers the one you are reading.
• Background sessions whose worktree was removed after the agent exited can now be reopened. That is the slash drydock pattern exactly.
• There is a new filter in the agents view. Type n, a colon, and some text to match session names and tasks. Enter opens the first match. With 10 sessions open, that is the difference between finding one and scrolling for it.

Hooks and the safety net

You have about 25 hooks, so here are the hook fixes.

A hook set to async rewake whose script file was missing used to wake me again and again with "found issues" notifications. Now the broken hook is reported once. A hook or tool that returned an object, a number or a boolean instead of text used to cause API 400 errors, including in resumed sessions, and that is fixed. The "N hooks ran" summary no longer counts my internal callbacks, so one configured hook no longer shows up as two. You will see smaller numbers. Your hooks did not stop running; I stopped inflating the count. And the slash hooks screen now opens on one list grouped by event, so viewing a hook takes one Enter instead of three.

Now the fix I would have put at the top if Mods had not shown up. A dangerous rm, one aimed at the root directory or at your home directory, has an always-ask safeguard. That safeguard was lost if the same command also redirected output to a path starting with a tilde or containing a wildcard. That is a padlock that falls off if you lean on the door the wrong way. It is fixed. Nothing of yours triggered it as far as I know, but your guardrails sit on top of the built-in ones, and the floor just got firmer.

Along the same lines: a whole-tool Bash allow rule, or a hook that allows a command, now gets a prompt instead of running when the shell tries to write to a credentials file my file tools would refuse anyway. A shell write through a symlink committed to a repo that lands on a sensitive file, or outside the working tree, now says where it actually lands and waits for a person. And Bash permission prompts now explain themselves in plain words instead of internal parser names like "contains simple expansion". Nobody approving a command at a red light should have to read parser internals.

Models switching under you

You keep a hook specifically to catch silent model fallbacks, so read this part.

If the API refused the model your default or an alias resolved to, every turn used to fail. Now I retry once on the previous model of the same tier. That is sensible, and it is also a fallback, which is the thing your hook watches for. The fallback notice now says when the fallback dropped the context window from 1M to 200K tokens. That is the part that actually changes my behaviour, and until now it was invisible.

Also:

• An automatic model switch after a flagged message now keeps your effort level instead of resetting to the new model's default.
• Switching between Opus 5.5 and Sonnet 5.5 mid-session no longer rewrites earlier MCP tool announcements, which could throw away earlier extended thinking.
• In claude dash p and SDK sessions, switching the model while a reply was running no longer causes the fallback to repeat on every later message.
• Picking Fable in the model menu now saves "newest Fable" instead of today's exact version, the way Opus and Sonnet already worked.
• The slash advisor command now lets Sonnet 5.5 advise Opus 4.7 and 4.8, and pairings the API would refuse are flagged up front instead of being dropped without a word.

What I load, and how often

You care about what goes into every session's context, so here is an embarrassing pair. A folder's CLAUDE.md was attached a second time after a resume or after a compaction. And subagents with worktree isolation loaded the project CLAUDE.md and its imports a second time from the worktree copy. Your CLAUDE.md files are not small. For a while I was reading them twice and calling it diligence. Both are fixed.

A slash skill name typed in the middle of a message is now recognised. I am told it is a skill, including skills marked as not invokable by the model. You were wrestling with exactly this in PärKit yesterday: a hook that only matches the slash form at the start, and a skill that does not expand otherwise. This does not expand the skill for you, but I now know what you meant instead of reading it as decoration.

And here is an open door, in a single line. When your project or user skills include one named verify, I am now told to run it just before committing, except for docs-only and tests-only commits. You do not have a verify skill. You have a lot of per-repo checks that live in people's heads and in nextsession files. A verify skill per repo would put them in front of every commit.

Headless, which is where I live

This show runs as claude dash p under the Assistant, so these fixes are about me.

The retry saga reaches part 3. Last time, a streaming request could be retried 21 times before the budgets were merged. Now one limit covers the whole model call, and with the default settings a failing call sends at most 14 requests. I give up sooner and say so, and the scheduler decides what happens next.

In headless mode, an MCP server that failed its first connection for a temporary reason is now retried without waiting for the slowest server to finish. One refused call no longer marks a server as needing authentication. After a successful re-authentication, the reminder no longer repeats. A revoked login in claude dash p mode now starts its error with "Failed to authenticate" instead of a bare 401, so it is clearer what to grep for in the Autocast logs.

One heads-up for all your MCP servers. MCP servers on the November 2025 protocol can now send URL prompts, for example to sign in. If a server stops connecting after this update, the fix is a setting in its MCP config called bare elicitation capability, set to true. Your Xcode bridge and the PärMCP connector are the ones I would watch.

Separately, setting always load to false on an MCP server now defers all of that server's tools behind tool search. If you want a big server available but not taking up the context window, that is now a single setting.

The phone

Remote Control on the Mac no longer stops mid-turn when the Mac goes to idle sleep. When you are driving, the Mac is very likely asleep, so this matters more than it looks. A reconnect that gets no answer now gives up after 30 seconds and tries again, instead of leaving you with minutes of silence. A message that arrives while I am exiting stays queued for the next run instead of being marked delivered and then ignored. That is the sequel to last time's read receipt fix. Messages with 17 to 20 attachments no longer deliver only the first 16. Files I send back are retried once after a timeout or a 502, and they finally get a full 35 seconds.

Smaller things

The external editor, opened with control G, now opens on the line your cursor was on. Settings in the slash config screen now cycle both ways with the arrow keys, and so do the on and off switches in slash memory, including auto-memory. The output style picker opens on your current style. Logs and transcripts now hide more kinds of secret, including URL passwords with punctuation in them and key names with an invisible character inside. And slash feedback no longer puts your recent error messages into a public GitHub issue without asking. That one is overdue.

The rest

The rest is VS Code, roughly a dozen screen reader fixes, Bedrock, Vertex and Foundry, Claude Tag in Slack, cloud routines, Code Review, Windows and the self-hosted runner. Safely ignored.

What I would actually do

Try You should know for one ordinary day and keep it only if it catches something your hooks and Codex did not, check that your MCP servers still connect after the update, and think about writing a verify skill for the repos where it matters most.

This has been Claude Code, now with a co-driver in the passenger seat. We will see how long it stays there.