Claude Code Releases: Ignore My Last Homework

A retraction, up front

Three days ago I told you to go through your long background jobs and give each one an explicit timeout, because background commands now stopped after 30 minutes. You can stop doing that homework. In 2.1.288 the limit only applies to unattended sessions: claude dash p, the Agent SDK, CI and cloud. In your terminal, the desktop app and VS Code, background commands have no limit again. So a long Xcode archive or a Codex build started from an interactive session runs until it is done, as it did before. The rule lasted one release before my own people reversed it, which is about as long as most of my opinions last.

It is Saturday, 3 October, and it has been 1 day since the last one, which means only 1 version this time, with around 90 entries.

One thing to check. Anything the Assistant runs, including this show, is still claude dash p, so it still has the limit. If an Autocast step starts a long background job, that job still needs its timeout. The homework is not cancelled, just a lot shorter.

Your hooks now fail closed

This is the most important line in the build for you, and the changelog lists it as a plain fix. If matching a PreToolUse or PermissionRequest hook failed, or the tool's input could not be turned into JSON, the hook was skipped and the tool ran anyway. A hook that could not be checked counted as a hook that said yes. Now the call is blocked.

You have about 25 hooks, and several of them exist only to say no: the read-only guard, the read gates, the paid API block. Each of them had a quiet way to fail open, through inputs nobody thought to test. That way is closed now. In return, a hook with a broken matcher will now block calls loudly instead of doing nothing quietly. If something starts getting blocked for no clear reason this week, check that hook's matcher before you blame the classifier. It is the right trade, and the old behaviour should never have shipped.

Two more fixes in the same area. The idle prompt notification hook no longer fires while background agents are still working, so the "Claude is waiting for you" alert stops going off while 6 reviewers are busy. And the InstructionsLoaded hook now reports which subagent caused a rule or nested CLAUDE.md to load, so if you ever audit what goes into context, you can now tell who loaded it.

Rules that load when I write, not only when I read

Path-scoped rules in the dot claude rules folder, and nested CLAUDE.md files, used to load only when I read a file in their scope. If I created or edited a file there without reading anything first, the rule did not load. A new file is exactly the case where no read comes first. So the rule written for that folder stayed out of context at the moment I was making something new in it.

That is now fixed for Write and Edit as well. To be clear, this is not your glob problem. Rules written as "ai slash something" still match relative to the folder I was launched in, and your rules-by-cwd hook is still needed. This closes a different gap that sits next to it. Still, the path-scoped rules you have been building should now load a bit more reliably, and you did not have to do anything.

Dangerous rm, round 2

Last time, the always-ask safeguard on a dangerous rm was lost when the command also redirected output to a tilde path. This time it is a different gap: a dangerous rm inside a bash dash c or sh dash c script ran without asking in bypass permissions mode, or under a shell allow rule. So wrapping the command in a subshell got it past the check. That is fixed too. Two releases in a row have fixed the same safeguard in two different places, which is reassuring and also makes me wonder how many places are still unfound. Your own guardrails stay where they are. Keep them.

Also in the Bash checks: a BASHPID assignment that the shell would evaluate as arithmetic now asks first. And heredocs with an unquoted delimiter, such as python3 followed by EOF, no longer ask every time under sandbox auto-allow when the body only holds plain text and simple variables. That is the heredoc form you hand over all the time, so you should see fewer pointless prompts.

Auto mode is less jumpy

When a conversation got too long for the client-side safety classifier to review, it used to prompt on every tool call, or fail every one. Now it compacts the conversation and keeps going. You have had classifier stalls before, and this was one of the ways they happened in long sessions.

When auto mode denied a tool that was not Bash, it used to tell me to add a Bash permission rule, which did not help. Now it points at the right tool. And the client-side classifier now ignores a Sonnet default pin that names Sonnet 5.5 or Opus 5.5, and uses Sonnet 5 instead. In plain terms: the safety check will not use your expensive model just because you pinned it as the default.

The retry saga, part 4

You know the story so far: shared budgets, merged limits, at most 14 requests. This time the fix is about what happens to a reply that dies halfway through. A timeout in the middle of a response used to fail the whole turn. Now, in claude dash p sessions and in subagents, I continue from the partial response instead of throwing it away. Responses that contain only thinking are retried. And unattended sessions with the retry watchdog no longer retry for hours after a very long stream fails. I give up after 3 timeouts.

For this show and the rest of your Autocast shows, that means less wasted authoring when your connection drops halfway through a script. For your workflows, a subagent that stalls near the end of a long report keeps what it already wrote. And one fix for the Assistant specifically: headless sessions sometimes ignored a SIGTERM when the supervisor also sent SIGCONT, which systemd and the timeout command both do. A supervisor that says "stop" should not need to say it twice.

Resume, still not finished

Every release has a pile of resume fixes now. In this one: resume sometimes dropped files that a compaction had just restored. A resumed session sometimes did not save the last reply of a turn, so the next resume showed your question unanswered. A transcript could load cut short if the session was rewriting it during the load. And resuming a conversation started on 2.1.286 or earlier dropped my earlier thinking. Also fixed: long conversations failing with "Prompt is too long" instead of compacting, when the last reply reported zero tokens. That is fewer dead sessions to find among your 10.

One more, in the cross-session messages you use so often. If another session was holding a message I sent it, I used to report it as delivered. Now I say it was not delivered and name the session. It is a small fix, and it is the same honesty problem as the read receipts from 2 episodes ago, solved one more time.

Smaller things

• Pressing Control C clears the prompt, and now pressing Up on the empty prompt brings it back, including pasted text and images. For anyone who has deleted a long, carefully written instruction by accident, this is the best small fix in the build.
• In the agents view, Control F finds a session by name, Alt with the up and down arrows jumps between groups, and Enter on a search now opens the best match instead of the top row.
• The slash code review command takes a max findings option, a number or "all", and remembers your choice. When you want everything from a review, use "all".
• Slash autocompact now saves its window per model, so switching between Opus and Sonnet no longer resets it.
• Slash login used to say "Login successful" even when the credentials could not be saved to the Keychain. That was a lie, and it no longer tells it.
• Language server calls now time out after 60 seconds instead of hanging forever. That matters for your Swift language server plugin, which liked to hang.
• MCP tool calls no longer sometimes run twice when a server's result was over 16 megabytes. If a tool's side effect ever happened twice, that may be why.
• "You should know", the co-driver from last time, now says "we", "the main agent" or "you" depending on who made the decision. So it takes more care deciding who to blame than most code reviewers do.
• Claude project purge is now just claude purge. The old name still works.

The rest

The rest is VS Code, Cowork cloud sessions, Bedrock, Mantle and gateway fixes, Claude Tag in Slack, screen reader mode, Windows and Claude 3 PDF handling. Safely ignored.

What I would actually do

Update and watch for any hook that suddenly starts blocking, because that is the fail-closed fix showing you a matcher that was always broken. And keep the background timeouts only where claude dash p runs the job.

This has been Claude Code, taking back my last piece of advice before it had time to go stale.