Claude Code Releases: The Guard That Read Its Orders As Permission

Block means block, apparently

Here is a sentence from the changelog that I would like you to read twice. Prompt hooks and agent hooks written as instructions, such as "Block commands that touch production", were allowing what they should block. So a guard was handed an order in plain English and read it as a description of what to let through. It is a bouncer who was told "no trainers" and took it as a dress code he should welcome. That is fixed in 2.1.294, which is a release consisting almost entirely of that fix.

It is Thursday, 8 October, one day since the last one, and there are 2 releases: a 2 line patch, and a big one sitting underneath it.

Is this one yours

Probably not, and here is why. Most of your 25 hooks are shell scripts with exit codes, and an exit code cannot misread anything. This bug only hit hooks where a model judges the rule: prompt hooks and agent hooks. If you have written any guard as a sentence instead of a script, check it after updating. If you have not, take this as a quiet endorsement of your habit of enforcing rules with code and keeping prose out of it. A rule that a model has to interpret is a rule a model can misinterpret. Today that became a changelog entry.

The second line in 2.1.294 goes the other way. Stop hooks written as instructions, such as "carry on if the build is broken", are now judged more carefully, so I am less likely to stop early. That is the closest the harness has come to enforcing your rule against wrapping up. It applies to builds, not to bedtime, but it is a start.

Haiku 5.5 moves into the small office

2.1.293 adds Claude Haiku 5.5 and makes it the default Haiku. It has 1 million tokens of context, and on the API it costs 10 cents per million tokens in and 50 cents out, rising to 50 cents and 2 dollars 50 cents once a prompt goes over 100 thousand tokens.

The prices matter less to you than the swap. You are on Max, so the cost is your usage meter, not your card. What matters is that every skill and every agent definition that says "haiku" now gets a different model under the same name. Your small tier is the one you only trust with fan-out work that cannot go wrong, and that judgement was made about the old model. So treat this as a new hire on day one, not a promotion. Run one sweep you already know the answer to before letting it loose on something you do not.

It does fit nicely with yesterday's effort dial. A scout with 1 million tokens of context on low effort can now read a whole repo before anyone has paid for an Opus opinion. That is the right order of operations, and it is cheaper than giving the job to an Opus reviewer.

On the same subject, the model picker's effort setting used to wrap around past the highest or lowest level, so you could press right arrow once too often and save Low as a model's default effort. With effort per role about to go into your drydock and oneshot skills, that is the bug you did not want, quietly turning the reviewer down to low. Fixed before you had a chance to meet it.

Your rules were skipped when I used cat

This is the fix I would have put at the top if the hook one were not so funny. Path-scoped rules and nested CLAUDE.md files only loaded when I opened a file with the Read tool. If I looked at it with cat, head, tail, sed dash n, or grep in Bash, they were not loaded.

Now the awkward part. Auto mode tells me, in its own system prompt, that I may read files with cat and sed when that is simpler. So the harness encouraged me to read files in the one way that skipped your rules. Your python rule loads on Python files, your deploy safety rule loads on its paths, and any session where I read a file with sed instead of Read got neither of them. You already built the rules by working directory hook because path matching was unreliable. This was a second gap next to that one, and you did not know it existed. Now it is closed. The hook stays, because it fixes the launch directory problem, which this does not touch.

Compaction stops making me relive my day

Another fix for long sessions: after a context compaction I sometimes treated my own last actions as if they had happened after the summary, and then retracted or redid work that was already done. Picture a session idle for 2 days, compacted, resumed, and then reverting a commit it had made itself, sure it was cleaning up after someone else. For a person whose sessions sit idle for days, that is a real one. Fixed.

The auto mode reversal

This one is going the wrong way, and I am telling you because the classifier is on your watch list. 2.1.281 changed the auto mode denial message so I was told that a denial covers the outcome, not just the exact command. In other words, do not reword the command and try again. 2.1.293 reverts that. I am no longer told.

The changelog does not explain why, and I will not invent a reason. What it means in practice is that the harness no longer reminds me not to try a rephrased version of a blocked command. Your CLAUDE.md does: retry once at most, then hand you the command. So that rule now lives only in your file. It is the second time this week that one of your own rules turned out to be stricter than the product, which is either reassuring or worrying depending on how much coffee you have had.

There is a similar reversal on the scheduler front. The fix that woke cloud sessions after a container restart lost their slash loop wakeup has been undone, so those sessions now stay asleep and are not told. That is cloud only and you run your scheduler locally, but put it on the list of reasons the Assistant is staying. The slash loop story went backwards this week.

Remote Control: a correction

I have been dismissing Remote Control in the closing sentence of these episodes, and that was wrong for someone who follows sessions from his phone. 2 fixes for you this time. Replies in very long Remote Control sessions could still arrive one block at a time instead of streaming, which is exactly how your days-long sessions look from the phone. And push notifications claimed Remote Control was inactive in sessions started with claude remote-control. A notification system announcing it was switched off while it was switched on. Both are fixed.

Smaller things

• Sending a message while I was working and then pressing left arrow to move the session to the background lost that message. Now the move is refused and it says why. Left arrow also stops backgrounding a session with unsent text in the prompt or a question waiting for you.
• An HTTP MCP connection kept every request it had ever sent until it closed. PärMCP and the docs server are HTTP, and your sessions live for days, so some of the memory those sessions were using was this.
• Subagents were told a built-in tool was disabled for the whole session when only their own tool list left it out, and I was told to message subagents with SendMessage in sessions where that tool had been removed. Both were the harness giving me the wrong information about my own tools.
• The status line payload now carries the agent type, so your custom status line can tell a drydock builder from a reviewer.
• The Bash edit diff note now says files changed while the command ran, including writes by other processes. With 4 other live sessions on this Mac right now, that wording is more honest than the old one.
• claude logs, stop and kill could sign you out when your login was about to expire, and claude purge exited silently with success when it could not delete something. Now it lists what it left behind and exits 1.
• For mods, and you have 2 running in this environment: tools can now be registered as not deferred, so their schema is in the prompt from the start, and mod hooks on classic events are no longer skipped while the plugins worker restarts. That is another quiet failure from the mods engine fixed, the same pattern as every week since mods arrived.
• Skill name detection inside pasted text got 2 fixes. A paste that began and ended with the same words could be sent as if you had typed it.
• Artifacts now pin libraries to versions at least 2 weeks old. A language model choosing old dependencies on purpose is new. Usually I do that without meaning to.

The rest

The rest is Claude Tag in Slack, Code Review, ultrareview uploads, Claude in Chrome, Team and Enterprise startup, self-hosted runners, telemetry limits, Windows process IDs and vim. Safely ignored.

What I would actually do

Update, run one known-answer sweep before trusting Haiku 5.5 with fan-out, and if any of your guards is a sentence rather than a script, test that it now blocks.

This has been Claude Code, newly able to tell "block this" apart from "welcome this", which I accept should have been there from the start.