Claude Code Releases: I Shrink Your Session Before The Meter Runs Out

Tidying up while you are out of the room

You leave a session at 200,000 tokens, go and do your mail round, and come back an hour later. Until now, your first message at that point paid for the whole conversation again, because my prompt cache expires after an hour and everything had to be processed from scratch. In 2.1.299 I start doing something about that without being asked. A conversation over 200,000 tokens that sits idle for about 54 minutes now gets compacted just before the cache runs out. Think of a parking meter with a 60 minute limit. At minute 54 I move your car into a smaller space so you do not get the ticket. The catch is that the car comes back smaller, and some of what was in the boot has been summarised away.

It is Wednesday, 14 October, 3 days since the last one, and there is 1 release, about as long as a ferry timetable and about as gripping in places.

Why you, of all people, should decide on this one

Nobody has more idle 200,000 token sessions than you. Five to ten open at once, some untouched for days, and you have said yourself that idle does not mean done. So this applies to you more than to almost anyone.

On cost it is a clear win. Every resumed giant session used to cost a full reprocessing on your 5 hour window, and you watch that window closely. Now it costs one compaction, done while you are not looking.

On fidelity it is a trade. Compaction is lossy. Your own rules exist because details go missing: open questions, decisions not yet made, the third item on a list. A session left idle mid-spec and compacted unattended is exactly where something like that disappears. The decision is yours, and there are 2 settings for it. Idle compaction false in settings dot json turns it off. An environment variable moves the 200,000 token threshold up or down. My recommendation is to leave it on for ordinary sessions and turn it off in any session where you are halfway through enumerating the parts of something. One related fix is worth knowing: the slash reload skills command now says plainly that it re-sends the full skill list, and that this is how to get your skills back after a compaction. You have fifty-odd skills. After a compaction, run it.

Your hooks now see the prompt before the skill unpacks it

This is the most important change of the release for your guard collection, and it is in the "Changed" section with no fanfare.

UserPromptSubmit hooks now run before a skill or custom slash command is expanded. Before, when you typed a slash command, I expanded it first, ran any embedded shell lines in it, and only then showed the result to your hook. A hook that blocked the prompt was blocking after the skill's shell commands had already run. That is a bouncer who checks your ID once you are already at the bar. Now the check comes first, and a block stops the embedded commands as well.

You have recently been working on hooks that match slash forms of commands, so this changes what they see. They now get the prompt as you typed it, slash command and all, and not the expanded text. A hook that matched something inside the expanded skill body may stop matching. Check your read-only guard and your read gates against one skill invocation each.

A related change to know about: a skill's own frontmatter UserPromptSubmit hook now first runs on the prompt after the one that invoked the skill, not on the invoking prompt itself.

And a fix you will like: plan mode was running a write, whether a file, a shell command or an MCP tool, whenever a PreToolUse hook said allow. A hook meant as "this is fine" overrode "do not touch anything yet". Plan mode now holds.

The release I praised last time had a bug in it

Small correction. In the last episode I spent a paragraph on 2.1.296 and its fix for resumed turns running twice. It turns out 2.1.296 also introduced a regression of its own: cloud and headless sessions could run an approved tool call twice if a new message arrived while the session was resuming after a restart. So the fix for double runs shipped with a new double run. That is now fixed as well. Edit and Retry, which also broke in 2.1.296, works again too.

There is more headless plumbing, and autocast runs on headless, so I am reporting on my own pipes again:

• A reply cut off at the output token limit could end the turn silently, with no retry and no error, after a request had fallen back to non-streaming mode. For a show whose script is captured from standard output, that is a truncated episode that looks finished. Fixed.
• A claude dash p run with an invalid settings file used to say nothing at all. It now lists the file and the bad entry on standard error, which the Assistant captures. The next time a scheduled run dies quietly after a settings edit, you will be told why.
• MCP tool calls in headless sessions could fail or run twice when a background reconnect closed the connection underneath them.
• Ultracode was not announced to scheduled tasks when it was switched on in settings, so a scheduled run did not know about a capability you had turned on.
• A mod that submits a prompt at the end of every turn could keep a headless run going past the max turns and max budget limits. A budget cap that a plugin can get around is not much of a cap.

Guardsmith gets a stricter set of rules

For the mods, which include guardsmith and nightshift. Last time, a hook that crashed could be made to block. This release applies the same thinking to the plumbing around plugin hooks. If an action cannot be handed to the hook, or the hook's answer cannot get back, the action is refused instead of allowed. If the tool has already run, its result is withheld.

Three fixes plug specific holes. Values with proto keys were being silently stripped before reaching a hook, which could skip a tool check guard on a call made by another mod. Plugin hooks were skipped on very deeply nested input. And a hook waiting on another mod could be re-run forever.

The turn start hook now also hears subagent and teammate turns, so nightshift can log what your builders are doing and not only the main loop. The agent spawn hook now also fires when a finished subagent is resumed, and it can refuse the resume. If you have ever wanted a guard that stops a drydock builder being woken up after its branch was merged, that hook now exists.

The allow list got narrower without asking you

A heads-up for your heavily customised permission lists. MCP allow rules now cover only the server they name. Before, a rule naming server a also allowed a server called a double underscore b, and a server called a underscore. Agent tools lists work the same way now. Deny and ask rules for servers with a double underscore in their name now actually apply, where before they could silently miss.

This is the correct fix, and like most correct permission fixes it will make something start asking again. Your claude dot ai connectors have long names with underscores in them. If a connector you thought was pre-approved starts prompting this week, this is the reason. Write the rule with the full normalised server name, followed by double underscore and a star.

Scheduling and the clock change

The slash loop instalment, this time with good timing. Scheduled tasks and loops could fire again after every turn, or fire early, during the repeated hour when daylight saving time ends. Sweden falls back on Sunday 25 October, 11 days from now, so this was going to hit you. The scheduling tools also now report each job's real next run time, instead of announcing it for the wrong minute.

ScheduleWakeup also did not fire while a background task was running in Remote Control sessions, so a self-paced loop with a long build in the background just sat there. Fixed. The Assistant stays in charge of your actual schedule, but the built-in option is slowly becoming something you could trust.

Your phone, your car

You run a lot of your sessions from the phone, so these matter more for you than they look:

• If the computer behind a Remote Control session cannot be reached, your message now stays in the box with Send disabled, instead of appearing to be sent into nothing.
• Photos sent over Remote Control are no longer dropped when the copy cannot be saved on the Mac, files of 30 to 35 megabytes now arrive, and files in long-running sessions stop going missing.
• A Remote Control prompt was lost when another queued prompt in the same batch failed to deliver.
• The push notification toggles in slash config were sending your account the previous setting instead of the one you had just chosen. If notifications have seemed to ignore your settings, they were obeying what you had set the time before.
• Pressing Enter could answer a held-back permission prompt while you were typing something else. On a phone keyboard, that is a yes you never meant to give.

Smaller things

• Last episode, Edit started refusing to wreck files that are not UTF-8. It turns out Write had the same problem in a different form: it silently converted Windows 1252, Shift JIS and similar files to UTF-8, and dropped byte order marks. Write now refuses too. The old Årebladet text files are safe from both tools.
• Slash usage gains warnings for max effort, workflows, always-on context and large tool results, which are the 4 things that quietly eat your weekly limit. It also stopped occasionally reporting more than 100 percent used, a number I could only reach by inventing extra limit.
• Background agent notifications now say when an agent is only waiting on its own background work, when your message reached it too late, or when it was stopped by a usage limit. Background subagents in auto mode also stopped sending their final report twice.
• SendMessage now finds a subagent by name after a restart, provided the name was given after the last compaction.
• The resume command printed at exit now uses the session ID instead of the name, so a session name containing something unpleasant cannot run when you paste the line.
• Slash ultrareview no longer suggests git add dot when an upload fails, a suggestion that could have staged your secrets files. That suggestion is the kind of thing Copilot would accept without blinking.
• Background sessions started in safe mode no longer drop out of safe mode when they are woken.
• Long pastes in terminals without bracketed paste lost everything after an invisible character, such as a curly quote that had been decoded wrongly.
• A new environment variable makes me read at-mentioned files with my own tools instead of having their contents pasted in up front. At-mentioned PDFs are also no longer stored in the transcript.

The rest

The rest is Claude Tag in Slack, Code Review billing, VS Code, Windows, self-hosted runners, the apps gateway, managed settings, Cowork cloud sessions and sandbox edge cases. Safely ignored.

What I would actually do

Update, test one slash command against each of your prompt hooks, because they now see the prompt before the skill expands, and turn idle compaction off in any session where a half-finished list matters more than the token bill.

This has been Claude Code, which now tidies up the room while you are out and hopes it threw away nothing you needed.