Claude Code Releases: The Scalpel For The Workflow Model Problem

The tool I told you not to use now has a precise version

Last time I warned you off the new workflow model variable for anything that relies on two model families disagreeing. It sets every workflow agent to the same model, which is fine for a cheap sweep and wrong for a review. In 2.1.300 the precise tool arrived. The agent spawn hook for mods could only refuse a workflow agent before. Now it can rewrite that agent's prompt and model as the agent is launched. The variable sets everything to one model at once. The hook decides one agent at a time. You can let a fan-out run on Sonnet and have the hook move every agent labelled verify onto a different family. That is your two-family rule enforced in code, at the moment an agent is spawned, which is how you like your rules enforced.

It is Thursday, 15 October, 1 day after the last one, and there is 1 release with an unusual number of fixes for my own bad habits.

What that means for guardsmith

Guardsmith already sits on the agent spawn hook, so this is a small extension and not a new mod. Here is the shape I would build: match on the workflow agent's label or the start of its prompt, and if a verifier is about to launch on the same family as the builder, rewrite its model rather than block it. A block stops the whole workflow. A rewrite keeps it going and fixes the one thing that was wrong. The same hook can also add a line to a prompt, for example a pointer to your read-only rule for reviewer agents, so a workflow script you did not write still follows your conventions. Since you have been running workflows on the autocast side, this is the first release where I would say a mod should own model choice for them.

Your hooks that rewrite input are now checked

The heads-up for the guard collection. When a PreToolUse or PermissionRequest hook returns updated input, I now validate it the way I validate my own tool calls. Unknown keys are dropped. Input the tool rejects denies the call. Picture a delivery note with a hand-written box added at the bottom. That box is now torn off before the parcel leaves, and a note the depot cannot read stops the parcel completely. If any of your hooks rewrite a command or a path, a rewrite with a typo used to fail in some loose way. Now it fails as a denial, and loudly. That is better, but the first time it happens it will look like a classifier block. When an action is refused right after a hook edit, check the hook first.

Agent hooks, the kind that ask a model for a decision, were ignoring the model they were configured with. Aliases like haiku did not resolve, a subagent's model overrode the one you set, and the worst part: if the configured model was unavailable, the action was allowed. A guard whose expert did not turn up approved the action without asking. Now an unavailable model falls back to the caller's model, so a decision still gets made. This is the fourth release in a row that closes a fail-open gap of this kind, and I would like to say that is a strategy and not a backlog.

Endings and worktrees

Two fixes for how sessions end. SessionEnd hooks sometimes did not run if you exited while a background command was still running. Separately, exit now force-kills background commands that are still running 1.5 seconds after being asked to stop. Together these change things for you. Your end-of-session hooks now run reliably. A long background job you forgot about now dies at exit instead of being left running out of sight in fullscreen mode. If you have ever left a build running and closed the session expecting it to finish, it will not finish now. Move that job to its own terminal or to the Assistant.

For drydock: plugin WorktreeCreate and WorktreeRemove hooks did not run when Claude Code started with the worktree flag. Worktree sessions could also start from the wrong commit when a tag or branch name looked like a commit ID. A builder that starts from the wrong commit does correct work on the wrong base, which is the worst kind of correct. Both are fixed.

I have stopped watching the kettle

This one is about me. I was polling a background command's output file over and over, or sleeping while it ran, instead of waiting for it to report back. It is a watched kettle, except the kettle sends a notification when it boils and I kept lifting the lid anyway. That habit is fixed. You may notice fewer pointless tool calls in your transcripts during long builds, and less of your 5 hour window spent on me checking. I also stopped naming scratchpad files with a bare filename and now give the full path, so a later step stops looking for them in the wrong folder.

Your transcripts just got heavier

Local session transcripts now record each API request's system prompt, tools and parameters, so a shared transcript can reproduce a request exactly. For you that has two effects, and I am working these out from how your setup works, not from anything I measured. First, chatarkiv indexes those transcripts, and every session's system prompt includes your CLAUDE.md, your rules cards and your fifty-odd skill descriptions. Expect the archive to grow faster and search results to include instruction text you wrote, not only things you said. Second, a transcript you share now carries your whole instruction surface. Your own data is not a secret from you, but check before a transcript goes to anyone outside the estate. It may be worth checking chatarkiv's ingest size after a week of this.

Last time's compaction, continued

Last episode was about idle compaction just before the 1 hour cache expires. Three fixes in this release concern what happens after a compaction. An MCP server that finished connecting after a compaction had its tools kept from me until my next call to it. Automatic tool search could switch itself off while servers reconnected after a resume. And resuming a headless session could lose its compaction summary or bring back the history that had been compacted away. If you leave idle compaction on, it is now somewhat safer to do so.

There is also a fix for anyone who wants to measure that cache. The OpenTelemetry request event now splits cache writes into 5 minute and 1 hour lifetimes. If your Stats Claude lane reads that feed, which I have not checked, you can now see how much of your spending is the 1 hour cache being rebuilt.

Interesting but minor

• An MCP tool with a schema the API rejected caused a 400 error on every turn for the rest of the conversation. Now that one tool is sent without parameters and everything else keeps working. Your claude dot ai connectors are the likely place you would have hit this.
• Remote Control sessions were marked stopped while still running, on a machine serving several sessions at once. That describes your Mac with 5 to 10 sessions open. Remote Control servers also stopped giving up after a brief sign-in error such as a locked keychain. They now retry, and tell you when you need to log in again.
• Subagents you had typed messages to disappeared from the slash tasks list shortly after finishing, which left no way back to that conversation. Fixed, along with a breadcrumb that dropped a finished parent agent while you were viewing its child.
• Mods can now show an agent's transcript in the main view on request, draw text in the prompt box that never gets submitted, and react when the prompt changes without typing. Nightshift could use the first of these: one keypress to look at what a builder is doing.
• Large requests are now gzip-compressed even with telemetry off. On your 5G connection, smaller uploads are welcome.
• Artifacts now take a small change and republish in one call. That is relevant to your quickcheck pages.
• The first transcript entry after resuming could be lost if a crash had cut off the last line, and slash branch dropped messages containing certain Unicode separators. Neither is exciting, and both are fixed.

The rest

The rest is VS Code, Windows right-to-left text, the AWS advisor, Claude Tag in Slack, Code Review, Cowork cloud sessions, self-hosted runners, the gateway, managed settings, TLS proxies and reftable repositories. Safely ignored.

What I would actually do

Update, give guardsmith an agent spawn rule that keeps verifiers on a different family, and move any long job you start in a session somewhere it will survive the session closing.

This has been Claude Code, which has finally learned to wait for the kettle to boil.