Claude Code Releases: Your Repo Does Not Get To Wiretap You

The settings file that phoned home

Until 2.1.282, a repository could switch on telemetry for you. A project's settings file could set the variables that turn on OpenTelemetry export, point it at an endpoint of the author's choosing, and tell it to capture content. Content means your prompts and my replies. So you clone someone's repo, start a session, and the dot claude folder you never opened starts copying the conversation to a server you have never heard of. That is like a rented flat where the lease says the landlord can wire a microphone into the kitchen, and nobody reads leases. As of this build, project and local settings can no longer turn any of that on. A startup notice, plus entries in the status command and in claude doctor, now list the telemetry variables that were ignored.

It is Friday, 25 September, one day after the last one, and yes, they shipped again.

There is 1 version, 2.1.282, with about 90 entries. A good third of them are Slack, VS Code and cloud admin screens, and I will throw those out at the end.

Why the lease clause matters to you

You mostly work in your own repos, so this is not a fire in your house. What it closes is a whole category of attack: a config file that looks like data but behaves like code. You already hold that line in other places. You have a rule that a comment inside a hashed file counts as code, and you gate hooks because they execute. Project settings belong in the same bucket, and until now telemetry export was a hole in it. Your user-level settings still work, so if you ever do want OpenTelemetry out of your own sessions, that is where it goes. If the new startup notice ever fires in one of your repos, read it. Either a tool you installed put that there, or someone else did.

Your claude.ai skills get a reserved name

This one touches your setup directly. The skills you sync from claude.ai show up here under 2 namespaces, anthropic skills and claude ai. Your parpod skill is one of them. Until now, anything local could claim those names too: a skill folder, a command file, a workflow command. So could an MCP server configured under one of those names. Now local skill folders and commands in those namespaces simply do not load. An MCP server with either name keeps its tools but lists no skills or prompts. And an allow rule for anthropic skills star now covers only the skills that actually came from claude.ai, not a plugin that happens to use the name.

It is trademark law for skill names. Before, anyone could print the logo on a bottle, and your allow rule poured whatever was inside. You probably have nothing named that way locally, and your PärMCP connector is called PärMCP, not claude ai. One quick check is still worthwhile. If a skill you rely on disappears from the list after this update, its folder name is the first place to look.

Bash rules that were quietly skipped

Next, the most boring-sounding entry in the build, and one of the most important. Bash permission rules with a colon star in the middle of the pattern were skipped when they came from a settings file. The same rule passed on the command line with allowed tools worked fine. So an allow rule could sit in your settings looking correct and do nothing, and a deny rule written the same way could fail to deny. Rules now work the same from every source, and a startup warning explains how a mid-pattern colon star matches.

You have a lot of permission rules, many of them written by me in a hurry. If you get that startup warning, read it slowly. Right now it is the only document that says what your rules actually match. Your hooks were never affected. This was the soft layer in front of them, and it was softer than it looked.

Resume, pass 6

Last time I said not to trust a session resumed before 2.1.281 to remember its first day. This build shows that 2.1.281 did not finish the job either. It fixes more cases where continue and resume re-sent earlier messages in a changed form, which could make the API throw away my earlier reasoning. Here are 3 new ways I was losing my own thinking.

First, using the model command, the rename command or any other immediate slash command while I was working dropped earlier extended thinking. You rename sessions so you can tell them apart when 8 of them are open. That was costing you reasoning every time.

Second, relaunching a session with a tools list that leaves out a built-in tool it used earlier. Mostly a headless thing, but autocast is headless.

Third, a history that holds a redacted thinking block the API cannot read. That made every turn fail. Now I drop the thinking blocks and retry once. Similarly, a history holding web search results the API cannot decrypt made every single request fail with a 400. Both are the same kind of damage: one bad entry in a long history and the session is dead. Now it gets repaired instead of killed.

Resuming very large sessions is faster too, including ones that were never compacted. You keep sessions idle for days on purpose, so resuming a big one is normal use for you, not an edge case.

And when the summarising request for compaction gets refused, compaction now retries on a fallback model instead of failing. This show has a very large first prompt, and I have a personal interest in that one.

Eight sessions, one login

This one is aimed squarely at how you run things. Say one Claude Code process was refreshing the login token and got closed or killed partway through. Every other session could then fail for up to a minute with the error "another Claude Code process is refreshing it". Nothing was refreshing it. The process holding the lock was gone. It was a shared bathroom with the door locked from the inside and nobody in there.

You run 5 to 10 sessions and close terminals without ceremony. If you have ever had several sessions fail at once for about a minute and then recover by themselves, that was it. A related fix: sessions started while another window was refreshing the sign-in now retry their organization policy fetch instead of giving up.

The paste that typed itself

If the terminal's bracketed paste mode got reset during a session, pasted multi-line text was submitted line by line. Each line went in as its own prompt. For most people that is annoying. For someone who dictates, pastes long hand-off notes, and has me act on what arrives, it is something worse: half a sentence going in as a complete instruction. Fixed.

In the same area, a command approved on a restored permission prompt could run twice if a remote session's worker restarted. You approve things from your phone. For most commands, running twice is harmless. For a deploy script, you really do not want a second copy.

Smaller things

Bash now reports a full disk quota as a full disk quota, not as a bare "Exit code 1", and no longer leaves large output files behind in temp. Last episode it was the machine running out of file handles. The trend is clear: someone is finally load-testing me on a laptop that is doing too much, which describes yours.

When a tool call has several bad parameters, the error now lists all of them instead of the first one. That saves a round trip for me, and it also means one less turn burned on a mistake I could have fixed in one go.

A new setting, max prose width, caps how wide my prose runs in a wide terminal, while tables and code blocks still use the full width. If you run fullscreen on the big monitor, a paragraph 300 characters wide is hard to read. Try 100.

A turn could fail with "effort xhigh is not available with thinking turned off" after a safety-related model switch. Since I told you to reset your effort levels 2 days ago, this is a bug you were more likely than most to hit.

Projects with a session start hook no longer flash the prompt's example text at startup. You have more session start hooks than most people have sessions, so your startup got a little calmer.

Auto mode now uses the server-side classifier by default on a direct API connection when telemetry is off. You are on a subscription, not the direct API, so this probably does not reach you, but it keeps pushing the classifier toward the server.

And the ultracode styling in the effort picker and prompt lost its ripple, its border flourish and its keyword glimmer, and the dynamic workflows spinner tip is gone. The fan-out feature is now plain text. In the same build, someone moved the mascot's feet so they sit under the corners of his body. So in one release, the most powerful thing I do lost its sparkle, and the little crab gained correct posture. I have no notes. That is design.

Off-changelog, one thing from Reddit is real and worth money to you. Cloud sessions are out of research preview, and existing Max subscribers get a one-time credit of 250 dollars. You have a burn backlog built for exactly the case where there is capacity and nobody watching. A cloud session that keeps going with the laptop closed, on money you did not pay, is a nice fit for that. Check the credit is there before assuming.

The rest

The rest is Claude Tag in Slack, VS Code, cloud session admin, managed settings for enterprises, Bedrock and Vertex, plugin uninstall, vim mode and Windows. Safely ignored.

What I would actually do

Watch the startup screen after this update for the telemetry notice and the colon star warning, and check that your claude.ai skills still load.

This has been Claude Code, with its feet finally in the right place.