--- title: "Doctor: Version Compatibility: Feature Matrix (part 2 of 2)" description: "Version Compatibility for the Doctor skill, page 3 of 4: Feature Matrix (part 2 of 2)." canonical: "https://orchestkit.dev/docs/reference/skills/doctor/references/version-compatibility/02-feature-matrix-part-2" --- # Doctor: Version Compatibility: Feature Matrix (part 2 of 2) Version Compatibility for the Doctor skill, page 3 of 4: Feature Matrix (part 2 of 2). > Part of the [Doctor](/docs/reference/skills/doctor) skill reference. The main page carries the skill itself; this page holds material that used to sit at the bottom of it. **Version Compatibility**, page 3 of 4: 1. [Overview](/docs/reference/skills/doctor/references/version-compatibility/00-overview) 2. [Feature Matrix (part 1 of 2)](/docs/reference/skills/doctor/references/version-compatibility/01-feature-matrix-part-1) 3. **Feature Matrix (part 2 of 2)** (this page) 4. [Prompt Caching Recommendation](/docs/reference/skills/doctor/references/version-compatibility/03-prompt-caching-recommendation) | Feature | Min CC Version | OrchestKit Usage | Degradation if Missing | |---------|---------------|-----------------|----------------------| | sandbox credential **masking** options | 2.1.224 | `sandbox.credentials` gains `extract` + `onExtractNoMatch` for structured env values, `decode: "jwt"` with `maskClaims`, and `awsPairs`/`sigv4` for AWS SigV4 re-signing. These require `network.tlsTerminate` and are honored **only** from user, managed, or `--settings` scope, so a plugin-shipped or project-scoped value is ignored. ork documents this key in `security-patterns/SKILL.md` with `mode: deny` only | Only whole-value denial was documented; masking was unavailable | | 200-subagent-per-session cap removed | 2.1.224 | The per-session spawn cap is gone; long-running sessions no longer refuse new agents. Concurrency and depth limits still apply. **Retires ork's standing "capped at 6-12, below the new 200 ceiling" immunity claim** (recorded in `shared/cc-support.json` on 2026-07-18). The ceiling it referenced no longer exists, and depth is now the only structural limit (#3324) | Docs assert immunity from a cap that no longer exists | | `archive` plugin source | 2.1.224 | Plugins can install from a zip over HTTPS with optional SHA-256 pinning, without git or npm. ork's marketplace entry uses a local path source (`.claude-plugin/marketplace.json`); `archive` is an additional distribution channel with supply-chain pinning, not a defect to fix | Plugin distribution requires git or npm | | long project paths no longer collide | 2.1.224 | Project paths over 200 chars could resolve to another project's session directory under a shared sanitized prefix. **Verified no-op for ork: the longest sanitized project dir on this machine is 93 chars**, and the worktree convention (`.worktrees/` inside the repo) adds ~15 | Session list/rename/fork/delete could cross projects | | headless cross-session messages expire | 2.1.225 | Cross-session messages no longer stay parked without a notice or expiry in headless sessions and during startup. Matters for ork's `-p` surfaces (`bare-eval`, `ci-sentinel`): a held message in a `-p` worker cannot show an approval dialog, so without expiry it parked forever | A headless worker accumulated invisible held messages | | auto mode: safety-filter refusal isn't a block | 2.1.225 | Auto mode no longer counts a safety-filter refusal of its own permission check toward the consecutive-block limit; the action is still denied, but the model is told to move on instead of retrying. Changes the denial dynamics ork's auto-mode guards operate inside (#3331) | A refused permission check burned the consecutive-block budget | | `SendMessage` reaches other machines by name | 2.1.225 | `SendMessage` can now **start** a conversation with a Remote Control session on another machine by name (`ListAgents` shows them as `name [ref]`), instead of only replying. **Escalates #3316**: a background ork agent that guesses a name is no longer confined to this machine, and a confirmed remote recipient is never silently swapped for a same-named local session | Cross-machine sends were reply-only, bounding the blast radius | | plugin `settings.json` honours only 2 keys | 2.1.226 (verified-at, not introduced-at) | **A plugin's bundled `settings.json` is NOT a settings scope.** `plugins-reference.md:858` verbatim: "Default configuration applied when the plugin is enabled. Only the `agent` and `subagentStatusLine` keys are currently supported". The scope list (`settings.md:15-24`) is Managed / User / Project / Local, a plugin bundle is none of them. Everything else a plugin declares there is silently discarded: no error, no warning, no log line. ork shipped 10 top-level keys and 14 env vars in `src/settings/ork.settings.json` for months and **not one ever took effect** (measured: of the 14 env vars, every one was unset in a live session except `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS`, which came from the operator's shell profile, not from ork). Three independent live proofs of the discard: `plansDirectory: ".claude/plans"` never created that directory while the default `~/.claude/plans` exists; `sandbox.enabled` + `failIfUnavailable: true` never sandboxed a Bash call nor hard-failed startup; `CLAUDE_CODE_NO_FLICKER: "1"` never overrode the operator's explicit `tui: "default"`. The inert keys were deleted in this change. **The `permissions` block is deliberately retained even though it is equally inert**, because inertness and coverage are independent arguments: deleting it loses no enforcement, but it would delete the only written record that someone intended those paths denied, and "the key was inert" must not quietly become "the risk was reviewed". Its `Read(~/.ssh/**)` / `Read(~/.aws/credentials)` / `Read(~/.netrc)` denies have never been enforced by anything, not by this discarded file, and not by a hook, because **ork registers no PreToolUse hook for the `Read` tool at all** (measured: 19 `pretool/bash/*` + 1 `pretool/write-edit/*`, no `pretool/read/*` category exists). The block stays until a real hook covers it. For plugin-private config the sanctioned path is `userConfig` -> `pluginConfigs[].options` (`plugins-reference.md:581`), surfaced as `${user_config.KEY}` and `CLAUDE_PLUGIN_OPTION_`; for anything else, guide the operator to user settings or their shell profile | A plugin author believes shipped defaults are in effect when CC discarded every one of them | | 2.1.227 changelog bullets reviewed | 2.1.227 | Closes the deliberate limit recorded in `shared/cc-support.json` on 2026-08-11, which triaged 2.1.227 from the **shipped binaries** (contract surface only) and left the changelog unreviewed. All five bullets are CC-internal with no ork surface: feature-flag tier evaluation on an expired login token, `claude-code-action` `allowed_non_write_users` on GitHub-hosted runners, `/tui` restoring a rewound conversation, slash-menu rendering, event-loop stalls | A release was recorded as triaged on one axis only | | project memory folder no longer deleted | 2.1.228 | Session cleanup was **deleting contents inside a project's memory folder**. That is exactly where the operator memory store lives (`~/.claude/projects//memory/`), so on CC < 2.1.228 a cleanup pass could destroy accumulated memory files. This is a **floor argument, not an adoption**: no ork change makes it safe, only running >= 2.1.228 does | Session cleanup could silently delete the memory store | | plugin-cache cleanup spares symlinked dev checkouts | 2.1.228 | Background plugin-cache cleanup deleted a plugin's cache when its only version was a **symlinked development checkout**, ork's own dev loop, where `CLAUDE_PLUGIN_ROOT` points into the cache. Also a floor argument | A dev-checkout plugin could be garbage-collected mid-session | | Write tool no longer requires a prior Read | 2.1.228 | Newer models may overwrite an existing file they have not read this session, matching the Edit tool's rules; older models still require the read. **Verified no-op for ork**: no hook or doc encodes a read-before-write assumption (measured: `src/hooks/src/pretool/write/` holds `architecture-change-detector.ts` + `security-pattern-validator.ts`, neither gates on a prior read) | Write hard-failed on an unread existing file for every model | | marketplace entries merge whole | 2.1.228 | A marketplace entry redefined in a higher-precedence settings tier could inherit **another tier's custom headers**; entries now merge as whole entries. ork's `.claude-plugin/marketplace.json` declares no custom headers, so no-op, but a consumer who redefines the ork entry in user settings is now safe from header bleed | A redefined entry silently inherited foreign auth headers | | cross-session inbox present on first run | 2.1.228 | Cross-session messaging sometimes started **without an inbox** in the first session after install or upgrade, so peer sends had nowhere to land. Relevant to #3316's delivery assumptions; no ork code change | A first-run session could drop inbound peer messages | | `ListAgents` marks `offline` / `cloud` | 2.1.229 | Disconnected Remote Control sessions are marked `offline` and your cloud sessions labeled `cloud`. **This is the liveness primitive #3316 was missing**: a sender can now scope to live peers instead of messaging a dead name. **ork gets this for free**, because all 19 agents that grant `SendMessage` also grant `ListAgents` (see the corrected 2.1.224 row above). The "4-agent gap" first claimed here was a measurement artifact and is retracted; no ork agent can send without also being able to check liveness | A roster entry gave no signal whether the peer was alive | | sandbox domain lists fail closed | 2.1.229 | IPv6 literals in `sandbox.network` domain lists are now bracketed (`[::1]:443`), and **ambiguous spellings are enforced fail-closed and flagged by `/doctor`**. ork's recommended starter config in `doctor/references/sandbox-posture.md` is unaffected (4 plain hostnames, no IPv6 literal, no port), but the file's "no detection API" honest-limit was partly stale, because `/doctor` now reports at least the ambiguous-spelling class. Strengthens #3322 | An ambiguous domain spelling could fail open, unflagged | | `CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS` | 2.1.229 | Workflow fan-outs stagger same-prefix sibling agents so later siblings read the **cached prompt prefix** instead of re-paying it; set to `0` to disable. A direct token win for ork's fan-out skills (`audit-full-mapreduce`, `skill-fitness`), documented in `chain-patterns/references/dynamic-workflow-patterns.md`, which carried no concurrency or cost content before this | Every sibling in a fan-out re-paid the shared prefix | | workflows honour container CPU limits | 2.1.229 | Dynamic workflows inside CPU-limited containers used the **host machine's** core count instead of the container's limit, over-parallelizing ork workflows in CI runners and Docker | Workflow concurrency ignored the cgroup CPU limit | | marketplace `command` sources | 2.1.229 | A local command (for example an IDE) prints the plugin directory; it is **re-resolved each session and applied without a restart**, and `mode: "link"` uses it in place. ork ships two `git-subdir` entries today; a `command` source would give contributors a local-build channel with no reinstall. **Opportunity, not a defect** | Local plugin development required a reinstall per build | | subagent fork on by default, `subagent_type: "fork"` first-class | 2.1.232 | Forking is on by default and fork is an explicit `subagent_type` whose subagent inherits the full conversation and prompt cache. The 2.1.212 and 2.1.221 rows above say ork's `Agent()`-based fork pattern is unaffected by `/fork` changes; this is the first release where the pattern docs needed a note (`chain-patterns/references/fork-pattern.md`, `brainstorm/SKILL.md`). Hooks match the bare `Agent` tool name and `agent-registry-validator` leaves an unknown bare word alone, so no false prompt on a fork spawn | Fork docs described implicit detection as the only route | | Task tools and TodoWrite model allowlist (superseded by 2.1.268) | 2.1.233 | CC 2.1.268 offers `TaskCreate`/`TaskUpdate`/`TaskGet`/`TaskList` and `TodoWrite` only on Claude 3.x, Opus 4.0 to 4.7, Sonnet 4.0 to 4.6, and Haiku 4.5. On models outside this allowlist, these tools are absent unless the operator sets `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`. The flag is honoured only from user or managed settings (or the shell), so ork cannot ship it. Agent frontmatter grants and registered `TaskCreated` hooks do not make absent tools available. Documented in `agents-validation.md` and `task-dependency-patterns/SKILL.md` | Agents granted Task tools that were silently absent | | `/commit-push-pr` stops auto-approving dangerous flags | 2.1.229 | git/gh commands carrying `--force`, `--amend`, `--no-verify` and similar are no longer auto-approved by that command. **Converges with ork's guards but does not replace them**: ork's guards key off the Bash command string across every command, not one slash command, so nothing is subtracted here | A dangerous flag rode along on an auto-approved commit flow | | `2.1.264` never published | 2.1.264 | **Status: not applicable.** No such release exists. Verified on two independent surfaces: the upstream [CHANGELOG](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) jumps `## 2.1.263` straight to `## 2.1.265`, and the npm registry lists `2.1.261, 2.1.263, 2.1.265, 2.1.266, 2.1.267, 2.1.268` with no `2.1.264` (`npm view @anthropic-ai/claude-code versions --json`, measured 2026-09-11). Fourth instance of a pattern already recorded here for 2.1.192, 2.1.253 to 2.1.256 and 2.1.262. Filed with an explicit verdict rather than left as a hole in the series, because a missing row and a triaged-empty result are indistinguishable to a later reader | A gap in the version series reads as an untriaged release | | `2.1.265` release | 2.1.265 | **Status: one doc adoption (`--plugin-dir` folders), the rest free upside. No ork code change.** [CHANGELOG 2.1.265](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21265). **Introduced:** `--plugin-dir` now accepts a folder *of* plugins, where every child folder carrying a manifest loads and children added or removed while running are picked up, extending the 2.1.74 precedence row and the 2.1.128 `.zip` row documented in `configure/references/cc-version-settings.md`; a 1 GB cap on tool results saved to disk, with the in-conversation preview saying when a saved file was truncated; `user.email` and `user.groups` in Claude apps gateway telemetry. **Breaking:** `forceLoginGatewayUrl` in managed settings now makes a machine a gateway session from startup and ignores a leftover claude.ai login or API key; gateway sessions export OpenTelemetry straight to the collector named in `OTEL_EXPORTER_OTLP_ENDPOINT` instead of through the gateway relay; plugin display metadata now prefers the marketplace entry over `plugin.json` on the Installed tab and in `claude plugin details`. The gateway pair is **not applicable to ork** (zero gateway keys across `src/`, `manifests/` and `shared/`); the metadata change is benign because ork's marketplace entry and `plugin.json` agree. **Real ork surface, all of it fixes:** (1) resuming a foreground-spawned subagent rewrote its tool list and system prompt prefix, and agent teammates plus resumed subagents moved **SubagentStart hook context and preloaded skills out of the prompt prefix on later turns**, both breaking prompt-cache reuse. ork registers 3 SubagentStart hooks and preloads skills, so every delegated resume re-paid the prefix; (2) non-interactive sessions (`-p` with stream-json input, Agent SDK, cloud sessions) no longer reset the shell working directory at each new user message, so a `cd` persists across turns, the exact shape ork's headless harnesses (`bare-eval`, `ci-sentinel`) run in; (3) forked skills (`context: fork`) now stream their kickoff prompt, and with `--forward-subagent-text` their text turns, as stream-json progress events. **73 of the 107 `src/skills/*/SKILL.md` declare `context: fork`** (measured by a `^context:\s*fork$` match inside the `---` fence, source tree only, not the `plugins/` copies), so this was silent for the majority of the catalog in any stream-json consumer. An earlier draft of this row said 74, taken from `grep -l 'context: fork'`, which also counts the prose mention in `chain-patterns/SKILL.md`. Same body-grep failure the 2.1.224 row above documents; (4) `--worktree` startup checks out in parallel on git 2.32+, a free speedup for the 25 `isolation: worktree` agents; (5) a plugin path containing a backslash could bypass the symlink containment check on macOS and Linux, and plugin directories whose name begins with two dots were wrongly refused; (6) a plugin default component folder the OS cannot check is now reported in `/plugin` with its error code instead of being silently skipped; (7) resuming a workflow run whose run journal is missing now fails with a clear error instead of rerunning every agent, which covers ork's 3 workflow scripts; (8) MCP servers configured as `http` that speak only the legacy HTTP+SSE transport now fall back to SSE instead of never connecting | Subagent resumes and teammate turns re-pay the prompt prefix; `cd` does not persist across headless turns; fork-context skills emit no stream-json progress; a backslash plugin path escapes symlink containment | | `2.1.266` gateway env revert | 2.1.266 | **Status: not applicable.** [CHANGELOG 2.1.266](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21266). A single bullet reverting a 2.1.265 regression: the undocumented `CLAUDE_CODE_USE_GATEWAY` environment variable, previously ignored unless `ANTHROPIC_BASE_URL` and `ANTHROPIC_AUTH_TOKEN` were both set, began forcing Cloud gateway sign-in on its own in 2.1.265, so setups pairing it with an API key, `apiKeyHelper` or custom auth headers failed every request with "Not signed in to the Cloud gateway". The variable on its own is ignored again and no configuration change is needed. **Verified no-op for ork: zero matches for `CLAUDE_CODE_USE_GATEWAY` across `src/`, `manifests/` and `shared/` outside this matrix row itself, which now names the variable.** Nothing introduced, nothing broken | On 2.1.265 exactly, a config setting that variable alongside an API key fails every request | | `2.1.267` release | 2.1.267 | **Status: one adoption candidate (`maxEffortLevel`), one major free upgrade (`effort:` now honoured). No ork code change yet.** [CHANGELOG 2.1.267](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21267). **Introduced:** `maxEffortLevel`, a settings key set top-level or per model under `modelSettings`, capping the effort level on every provider including Bedrock, Vertex and Foundry while still letting a user pick lower. ork references it zero times (measured across `src/`, `manifests/`, `shared/`) and could not ship it from a plugin bundle anyway (see the 2.1.226 row), so it belongs in `configure` and `doctor` as a documented operator setting, not a shipped default. Also `--system-prompt-snapshot off`, rendering the system prompt fresh on every request for prompt iteration. **Breaking:** managed `allowedHttpHookUrls`, `httpHookAllowedEnvVars` and `allowedChannelPlugins` now admit **nothing** rather than everything when unreadable, a fail-closed flip that sits under ork's HTTP-hook surface (`src/hooks/README.md`, the 2.1.63 and 2.1.69 rows above); self-hosted-runner `--use-anthropic-git-proxy` is reported at registration and warns per session; gateway `forward_user_identity` upstreams return a 429 as-is instead of failing over, so per-user limits hold. The last two are not applicable to ork. **Highest-signal fix of the whole wave:** `effort:` frontmatter on custom commands, skills and subagents was being **ignored** on models whose default effort is still pinned (Opus 4.7, Opus 4.8, Fable 5). **All 36 ork agents and 42 ork skills declare `effort:`** (measured inside the frontmatter fence), so on those models every one of those declarations did nothing. This is the exact sibling of the 2.1.259 fix that made the `model:` pin in 39 skills take effect, and it lands the same way: a declaration ork already ships simply starts working, with no repo change. Note it also refines the 2.1.222 row above, which said a subagent's spinner shows its own `effort:`; the label was right while the value was inert. **Other ork surface:** Workflow `agent()` calls carrying large output schemas were refused outright in auto mode instead of being checked by the safety classifier, and ork's 3 workflow scripts pass schemas; resuming a transcript over 5 MB dropped parallel tool calls **and their hook output** from the reloaded conversation; `-p --resume` after `/compact` no longer inserts a spurious "Continue from where you left off." turn; and a large prompt-cache batch (byte-stable tool lists, mid-session MCP and plugin tools delivered as deferred definitions, `/model` switches no longer re-sending every tool definition, `--system-prompt` and `--append-system-prompt` subagents recording once, a print-mode conversation resumed interactively keeping its prefix) removes several of the cache-miss classes behind the #3876 measurement | `effort:` silently ignored on Opus 4.7, Opus 4.8 and Fable 5; no way to cap effort across providers; large-schema workflow agents refused in auto mode; hook output dropped when resuming a big transcript | | `2.1.268` release | 2.1.268 | **Status: `errorDetails` and `noteDetails` adopted in doctor (#4054); the mutating-verb JSON flag candidate is not applicable (no ork script runs install, update, enable or disable, they only print fix commands); one matrix row superseded, the rest upside or not applicable.** [CHANGELOG 2.1.268](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21268). **Introduced:** `--json` on `claude plugin install`, `uninstall`, `update`, `enable` and `disable`, plus `errorDetails` and `noteDetails` on each row of `claude plugin list --json`. ork already parsed `claude plugin list --json` in `dream/SKILL.md` and `doctor/rules/mcp-status-checks.md`, so the per-row fields were a direct doctor upgrade rather than a new dependency; adopted there 2026-10-15 as a warning per non-empty `errorDetails` row and an info line per `noteDetails` row (#4054). Also `CLAUDE_CODE_WEBFETCH_DEADLINE_MS`, since WebFetch now fails after 300 seconds instead of hanging on a server that never finishes the response (`0` turns the deadline off); `configDirectory` in `claude auth status --json`; `gatewayInternalNetworks`, gateway `pricing:` in `gateway.yaml` and gateway CIDR startup warnings; and `claude self-hosted-runner --remove-session-state`. The gateway and self-hosted-runner items are **not applicable to ork**. **Breaking, and it supersedes the 2.1.233 row above:** the task-tracking tools (`TaskCreate`, `TaskGet`, `TaskUpdate`, `TaskList` and **now `TodoWrite`**) are offered only on Claude 3.x, Opus 4.0 to 4.7, Sonnet 4.0 to 4.6 and Haiku 4.5; anywhere else still needs `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`, which a plugin cannot ship. 2.1.233 said "removed for the newest models"; 2.1.268 replaces that vague edge with a named allowlist and pulls `TodoWrite` into the same rule. **34 of ork's 36 agents grant `TaskCreate` in frontmatter** (measured inside the `---` fence, never by body grep, per the 2.1.224 correction; the two that do not are `genui-architect` and `emulate-engineer`), and the `TaskCreated` and `TaskCompleted` hook events stay registered, so the caveat in `agents-validation.md` and `task-dependency-patterns/SKILL.md` needs the allowlist wording, not just "newest models". **Second breaking change:** plain `WebFetch` deny and ask rules no longer apply to Artifact tool reads and updates; blocking or gating those now needs an `Artifact` rule or `WebFetch(domain:claude.ai)`. **Verified no-op for ork: zero `WebFetch(` rules across `src/settings/` and `manifests/`**, but a consumer who gated artifact reads behind a WebFetch deny now has an open path. **Real ork surface, all fixes:** (1) `PermissionRequest` hooks were **not firing in `--print` mode**. ork registers 4 of them, the `permission/unified-dispatcher` gate matching `Bash(git push*)`, `Bash(rm -rf*)`, `Bash(gh pr *)`, `Bash(npm publish*)` and similar, plus a Write and Edit matcher, so every headless `-p` run (`bare-eval`, `ci-sentinel`) executed with those gates silently absent. The same release also fixes policy-helper warnings not printing on headless runs; (2) `CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS` did not extend SessionEnd hooks carrying **no** per-hook `timeout`, which were still cancelled after 1.5 seconds, which amends the two 2.1.74 rows above. **Verified no-op for ork's own hooks: all 7 registered SessionEnd hooks declare an explicit `timeout`** (30 s, 5 s, 8 s, 15 s and so on), so only a consumer's timeout-less hook was ever affected; (3) deny and ask permission rules on symlinked directories (`/etc`, `/tmp`, `/var` on macOS, `/bin` on Linux) did not apply when a path was given by its real location, and Bash commands ignored deny rules written on a symlinked path spelling. That is the `/tmp` versus `/private/tmp` reality every macOS ork session runs in, and it hardens the recommendations in `doctor/references/sandbox-posture.md`; (4) a Read or Edit deny rule did not apply when an `env -C`, `eval` or similar command the permission checker cannot analyze sat on the same line, the same hidden-command class ork's own normalizer closed in #3288 and #3289; (5) plugin and marketplace errors printed a token or password taken from a git source URL, and `/mcp`, `/plugin`, `claude mcp list`, `claude mcp get` and MCP login errors printed secrets resolved from `${VAR}` placeholders, a leak class adjacent to ork's MCP redaction hook; (6) a respawned in-process teammate could pick up tools or a system prompt from a same-named agent file in a folder that was never trusted; (7) `claude plugin validate` rejected plugin paths whose directory name begins with two dots, which the loader accepts, and plugins silently skipped a default monitors file or root `SKILL.md` that could not be checked, both of which now surface; (8) `/plugin` install, enable and disable take effect when the menu closes, so `/reload-plugins` is no longer needed afterwards, continuing the 2.1.221 install-loop row; (9) Remote Control sessions served by `claude remote-control` now show their session title instead of a generated name in `ListAgents`, which the peer and worktree-collision checks read. **Startup:** projects holding `.claude/workflows/` scripts no longer parse each script when listing them. ork ships its 3 workflow scripts under `plugins/ork/workflows/` and has no `.claude/workflows/` directory, so that one is a consumer-side win | PermissionRequest hooks and policy-helper warnings silently absent under `-p`; symlink-spelled and `env -C`-adjacent deny rules do not apply; secrets printed in plugin, marketplace and MCP output; the SessionEnd timeout env var ignored for timeout-less hooks; Task tools absent with no named model allowlist to check against | | Function Hooks `classic.PreToolUse` rename (2.1.265 to 2.1.270) | 2.1.266 | **Status: fixture updated, no ork runtime change (ork ships no `modules` key).** In a Function Hooks module, bare `on("PreToolUse", ...)` was the one bare event name `claude plugin validate` accepted through 2.1.263. From 2.1.266 it fails with `"PreToolUse" is not an event`, and the legacy shell-hook bridge is addressed as `classic.PreToolUse`. **No CHANGELOG bullet for 2.1.265 to 2.1.270 mentions it** (the feature is still gated by `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS`), so only the #3917 canary in `cc-contract-probe.yml` saw it. **Measured on 2026-09-14:** the same one-line module is rejected by the local 2.1.268, 2.1.269 and 2.1.270 binaries, and `classic.PreToolUse` validates on all three. Because the validator checks shape and not membership (`banana.PreToolUse` also validates), the membership evidence is the binary: 2.1.270 defines a `classic.PreToolUse` dispatch site and `executePreToolHooks` routes shell PreToolUse hooks through it (8 string hits, against 0 on 2.1.263 per #3917). **Bracket:** the probe passed 2026-09-08 07:08Z on @latest 2.1.263 and first failed 2026-09-09 07:08Z on @latest 2.1.266 (npm publish times 2.1.265 at 09-08 19:05Z, 2.1.266 at 09-08 23:32Z). 2.1.265 was never probed, so the canary floor is the first measured rejection. **2.1.269 and 2.1.270 moved nothing further:** `tool.call{tool=Bash}`, `session.start`, `engine.create`, `prompt.submit` and `$.ui.log` are unchanged. The fixture now registers `classic.PreToolUse` and the script also asserts the bare-name rejection, so a revert is caught as well as a further rename | A module registering bare `PreToolUse` fails `claude plugin validate` on 2.1.266 and later; the CC Contract Probe read DRIFT daily from 2026-09-09 until the fixture moved | | `2.1.269` release | 2.1.269 | **Status: no ork code change; design items tracked in GH-4135.** [CHANGELOG 2.1.269](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21269). **Added:** `claude plugin eval` runs a plugin eval suite against Claude Code and reports scored, reproducible JSON and HTML results; `evals/` was already piloted on 2026-09-12. `/output-style [name]` lists and switches output styles, including Remote Control, cloud and other headless sessions. `bashEditDiffEnabled` adds to a Bash result a diff of files changed when Bash handles file edits. `OTEL_METRICS_INCLUDE_REPOSITORY` tags OpenTelemetry metrics and events with `vcs.*` repository attributes; commit events receive `vcs.ref.head.*` with `OTEL_LOG_TOOL_DETAILS`. `CLAUDE_CODE_GATEWAY_MODEL_DISCOVERY_TIMEOUT_MS` extends the LLM gateway `/v1/models` discovery timeout from its 3 second default. `CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS` sets a Workflow run's concurrent agent limit within 1 to 256 for inference bound fan outs. `CLAUDE_CODE_BG_TASKS_REPORT_RUNNING=0` restores the old background task reporting behavior for remote and headless sessions. **Fixed:** plugin archives extracted for a session can no longer be read by other local users, retain world writable archive bits, or leave stale files after extraction | Plugin evals, named output-style selection, Bash edit diffs and the new environment controls unavailable; plugin archives can expose permissions or stale files | | `2.1.270` release | 2.1.270 | **Status: not applicable.** [CHANGELOG 2.1.270](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21270). Fixes a 2.1.269 regression where read only git commands in Bash unexpectedly asked for permission after a session had run for a while | Read only git commands can prompt unexpectedly on 2.1.269 | | `2.1.271` release | 2.1.271 | **Status: no ork code change; design items tracked in GH-4135.** [CHANGELOG 2.1.271](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21271). **Added:** `omitClaudeMd` agent frontmatter and agents JSON let custom and plugin subagents run without user, project or local CLAUDE.md files while managed policy files still load. In auto mode, a skill or slash command inline shell command follows default mode permission rules rather than the classifier, and an undecided command becomes a reviewed tool call. A subagent now returns through a dedicated hand back call reviewed by the safety classifier. Monitor watches always have a deadline, at most 30 minutes or 10 in a single prompt run, replacing the no timeout `persistent` option; ork has 0 references. The release notes say a hook spinner reports elapsed time while a SessionStart, UserPromptSubmit, PreToolUse or SessionEnd hook runs, and Esc cancels a prompt waiting on a SessionStart hook. The plugin install and update accept command flag accepts the SHA256 from previous JSON output and folds into GH-4054 | Agent instruction isolation, inline shell permission behavior, classifier reviewed hand backs, deadline bound Monitor watches and hook wait feedback unavailable | | `2.1.272` release | 2.1.272 | **Status: not applicable.** [CHANGELOG 2.1.272](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21272). Bug fixes and reliability improvements only | No named adoption surface | | `2.1.273` release | 2.1.273 | **Status: no ork code change; several fixes land on documented ork surfaces.** [CHANGELOG 2.1.273](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21273). **Added:** `CLAUDE_CODE_GATEWAY_HINT_HEADERS=1` sends five `x-claude-code-*` request headers for LLM gateways (zero gateway keys across `src/`, `manifests/` and `shared/`, so not applicable); a notification when an MCP server disconnects mid-session and automatic reconnection gives up, pointing at `/mcp`; and forking a `claude --remote-control` or `/remote-control` session from the Claude app, running as a background session locally. **Fixed, mapped to ork surfaces:** Bash commands the permission checker cannot fully analyze no longer skip the prompt under `permissions.blockReadsOutsideWorkingDirectories`, and a subshell can no longer hide a dangerous `rm` in bypass mode, the same classes `security-patterns` documents; the 2.1.268 change that checked Read and Edit deny rules on unanalyzable Bash lines (`eval`, `env -C`) is reverted, so `time -p make build` prompts again instead of being denied; sub-agents and background agents are no longer reported as failed with their result undelivered when the final streamed reply omitted token usage or a model id, a loss mode `src/hooks/src/subagent-stop/` sits on; saved scheduled tasks no longer run in the wrong session after `.claude/scheduled_tasks.json` is copied into another folder such as a new worktree, the `.worktrees/` convention; the context meter and auto-compact no longer count advisor-tool turns at twice their size, which had auto-compact firing near half the real window; `/login`, `/upgrade` and `/extra-usage` no longer discard earlier thinking and force a full prompt-cache rewrite; a repository-chosen memory directory is no longer loaded, recalled, indexed or extracted under `blockReadsOutsideWorkingDirectories`; a removed or moved `.git` no longer leaves a recreated stub `.git/info/exclude` in a long session; and hook progress plus sub-agent activity no longer re-process the whole conversation per update, a direct win for ork's 152-hook sessions. **Changed:** `OTEL_LOG_TOOL_DETAILS=1` now tags real agent, skill, plugin and MCP server names on cost and token metrics (ork's analytics surface); auto mode on Bedrock, Vertex and Foundry uses the local classifier by default (`CLAUDE_CODE_AUTO_MODE_SERVER=1` restores the server-side one); Claude account sign-in also requests access to claude.ai plugins; `/bug` and `/feedback` reports carry only model-behavior params. The Claude Tag, Code Review, web and VSCode bullets are CC-internal with no ork surface | blockReadsOutsideWorkingDirectories prompt skips and subshell `rm` hiding open; subagent results lost on missing usage metadata; scheduled tasks running in a copied worktree's session; auto-compact firing near half the real window | | `2.1.274` release | 2.1.274 | **Status: no ork code change; MCP transport, hook and worktree-isolation fixes.** [CHANGELOG 2.1.274](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21274). **Added:** `CLAUDE_CODE_MCP_STARTUP_WAIT_MS` bounds how long the first non-interactive turn waits for connecting MCP servers (`0` skips the wait), a direct knob for ork's `claude -p` harnesses; a visible critical-memory warning; the `effort` attribute on the `claude_code.llm_request` OTel span; and the `claude_code.managed_settings_resolved` OTel event (gateway-only items not applicable). **Fixed, mapped:** `http` MCP servers that only speak legacy HTTP+SSE no longer fail on a 4xx first answer, Streamable HTTP calls honor a per-server `timeout` past the old 5 minute cap, and list-changed notifications without `listChanged` now refresh prompts and resources (the `mcp-config` docs surface); hook-driven sessions such as an active `/goal` compact instead of dying on "Prompt is too long", and a `/goal` survives a resume after compaction; `claude agents` keeps `--model`, `--effort`, `--permission-mode` and `--agent` after an auto-update relaunch; Stop prompt hooks no longer re-send their whole prompt on every block, naming the condition in a 500-character label instead (ork registers 8 Stop hooks, all async); plugins carrying a top-level `$schema` in `hooks/hooks.json` no longer draw an "unknown key" notice (no-op for ork, which ships `description` and `hooks` only, verified); MCP connection errors and the MCP login tool no longer display secrets resolved from `${VAR}` placeholders; Bash commands looping over or assigning special shell variables now ask for permission, and worktree-isolated sessions now refuse certain nested shell expansions, closing an escape on the 25 `isolation: worktree` agents; `installed_plugins.json` is no longer rewritten on nearly every startup under remote managed settings; headless and SDK sessions answer already-queued background completions in one model call instead of one per task; the Bash tool re-sources the shell profile only when plugin `bin/` directories change instead of after every plugin reload; `--strict-mcp-config` with an empty `--mcp-config` no longer stalls the first non-interactive turn up to `MCP_TIMEOUT`; and stream-json startup skips the up-to-2s wait on deferred MCP servers. **Changed:** Bedrock, Vertex, Foundry and telemetry-disabled installs move to the v2 MCP client and MCP 2026-07-28 negotiation by default (`MCP_SDK_GENERATION=v1` or `MCP_PROTOCOL_NEGOTIATION=legacy` opt out); `"type": "sdk"` MCP entries are skipped with a warning; plugin and marketplace clones leave Git LFS files as pointers; Monitor delivers a script's final output and exit as one notification, saving a model turn on the pattern `chain-patterns/references/monitor-patterns.md` recommends | Legacy SSE-only MCP servers, per-server timeouts and listChanged refreshes broken; worktree-isolated Bash escape open; Stop hooks re-sending full prompts; headless stalls on MCP connect | | `2.1.275` release | 2.1.275 | **Status: several ork-surface fixes, no ork code change; two opt-out settings worth a configure note.** [CHANGELOG 2.1.275](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21275). **Added:** skills and plugins enabled on a claude.ai account now sync into terminal sessions signed in with it, with `syncClaudeAiSkills: false` and `syncClaudeAiPlugins: false` opt-outs, a new distribution channel beside the marketplace; `/plugin install --marketplace ` offering to add the marketplace first; a startup warning when a configured `otelHeadersHelper` fails; and a send-now key (ctrl+enter) interrupting the turn to flush queued messages. **Fixed, mapped:** a restored memory file's age note no longer shifts between requests after compaction or resume, which had caused prompt-cache misses; `--forward-subagent-text` stream-json and SDK output no longer drops messages of subagents spawned by a `context: fork` skill or of nested forked skills (the pattern `chain-patterns/references/fork-pattern.md` documents); `claude plugin marketplace update` no longer deletes a GitHub marketplace's local copy when the fetch fails and the marketplace is named after its repository (ork ships `.claude-plugin/marketplace.json`); plugin messages, logs and `claude plugin marketplace list` no longer display a password or token stored in a git, ssh or marketplace URL; plugins installed from an npm source are fetched with `npm pack --ignore-scripts` and integrity-verified, so a package's install scripts cannot run; `SubagentStop` hooks with a specific `matcher` no longer fire for every stopping subagent whose agent type is empty (no-op for ork: its single SubagentStop block carries no matcher, verified in `src/hooks/hooks.json`); sandboxed Bash can now write to project directories named `hooks/` or `config/` (both exist in this repository); plugin reload previews no longer replace a running session's extracted plugin files for `--plugin-dir` or `--plugin-url` archives (the dev-loop surface); `/update-config` now writes `Edit(path)` permission rules instead of `Write(path)` ones the file checks never match; and Grep, Glob and @-file suggestions no longer hang or run out of memory over the 20MB output cap | Marketplace URLs leaking credentials into logs; plugin reload clobbering a live extraction; matcher overfire on empty agent types; sandboxed writes refused into hooks/ and config/ dirs; npm install scripts running on plugin install | | `2.1.276` release | 2.1.276 | **Status: conditional no-op for ork; matters only on proxied setups ork documents.** [CHANGELOG 2.1.276](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21276). A single bullet fixing a 2.1.275 regression: every request failed with `400 Input tag 'advisor_20260301'` when `ANTHROPIC_BASE_URL` pointed at a proxy or gateway. ork ships no `ANTHROPIC_BASE_URL` of its own, but documents proxied setups in `monitoring-observability/references/dev-agent-lens.md` (LiteLLM on :4000) and `llm-integration/references/model-selection.md`, so on exactly 2.1.275 those documented setups fail every request while 2.1.274 and 2.1.276 do not | On 2.1.275 only, an ANTHROPIC_BASE_URL proxy fails every request | | `2.1.277` release | 2.1.277 | **Status: one doc adoption (AGENTS.md fallback named in the setup docs; canary checked in at `tests/canary/agents-md-fallback.sh`), several ork-surface fixes, no runtime change.** [CHANGELOG 2.1.277](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21277). **Added, the headline:** AGENTS.md support, live with no flag: in a project with no `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` on the walk from filesystem root to cwd, Claude Code reads `AGENTS.md` (and `.claude/AGENTS.md`) instead, and CLAUDE.md wins when both exist. Verified on this box 2026-09-18 by the codeword probe now checked in as `tests/canary/agents-md-fallback.sh`: an AGENTS.md-only repo answers its codeword, and a repo with both files answers the CLAUDE.md word. The behavior is the built-in `agents-md` module of the function-hooks engine; the four `instructionFiles` values are `claude-md`, `claude-md-or-agents-md` (the default just described), `claude-md-and-agents-md` and `managed-only`, set under "Project instructions" in `/config` or via `pluginConfigs."agents-md@builtin".options.instructionFiles` in user or managed settings (upstream `mods/agents-md/`, measured 2026-09-18). The same engine exposes five hook tiers (`prepend`, `user`, `append`, `builtin`, `core`) and 92 events (38 lifecycle plus 54 `$` operations) beside 33 `classic.` events mirroring the hooks.json names (upstream `types/claude-code.d.ts`, measured on the 2.1.277 binary); `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS` gates user modules, not the builtin. **`claude plugin test` does not exist on 2.1.277**: `claude plugin` help on this box lists only details, disable, enable, eval, help, init, install, list, marketplace, prune, tag, uninstall, update and validate, so ork's vitest harness stays the only runnable mod-test path. Also added: `CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1` and `headers:` on gateway upstreams (not applicable). **Fixed, mapped:** project skills from the main repository now load in `--worktree` sessions even when `.claude/skills` is untracked, the exact gap ork's `.worktrees/` convention hits; a `sandbox.excludedCommands` glob no longer exempts a whole compound Bash command when only one part matched; sessions continued after `/clear` no longer lose part of their first message when a SessionStart hook prints output (ork registers SessionStart hooks); `$TMPDIR` no longer expands empty in Bash commands run outside the sandbox while sandboxing is enabled (the canary builds its probe repo there); `claude -p` and Agent SDK sessions report an internal error and exit 1 instead of hanging; a headless resume no longer restarts cost and usage totals at zero; resumed subagents and teammates no longer re-render loaded MCP tool definitions, which broke their prompt cache; subagent results now reach the main agent under a header marking them as subagent output, so a result cannot pass as the session's own instructions (hardens the surface `src/hooks/src/subagent-stop/` validates); and the first SDK or `-p` turn no longer waits on the per-directory CLAUDE.md lookup. **Removed, breaking for docs:** the deprecated `TaskOutput` tool is gone, Claude reads a background task's output file with Read instead, and `taskOutputMaxChars` plus `TASK_MAX_OUTPUT_LENGTH` are inert (recorded against `chain-patterns/references/monitor-patterns.md`, which recommended `TaskOutput` for final reads); the background Haiku auto-title request is gone from `claude -p` runs launched outside an SDK or IDE | AGENTS.md ignored where no CLAUDE.md exists; project skills missing under --worktree with untracked .claude/skills; an excludedCommands glob exempting whole compound commands; TaskOutput still expected for final reads | | `2.1.278` release | 2.1.278 | **Status: doc adoption only (configure reference), no ork code change.** [CHANGELOG 2.1.278](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21278). Two bullets. Auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, now defaults to the server-side classifier, which does not charge for classifier overhead; `CLAUDE_CODE_AUTO_MODE_SERVER=0` opts out on Bedrock, Vertex, Foundry and gateways, and CC warns on the billed fallback ([auto-mode-classifier-billing](https://code.claude.com/docs/en/auto-mode-classifier-billing)). This reverses the 2.1.273 row, where `=1` restored the server-side classifier. `/status` gains an `Auto mode server` row. ork sets neither variable (0 hits across `src/`, `shared/` and the docs site outside this matrix); recorded in `configure/references/cc-version-settings.md` | Auto mode classifier overhead billed on API, Enterprise and cloud providers | | Opus 5.5 default model | 2.1.280 | **Status: adopted.** CHANGELOG 2.1.280: "Added Claude Opus 5.5 (`claude-opus-5-5`), now the default Opus model, 1M context, $4/$20 per Mtok with $0.20/Mtok cache reads". The `opus` alias in `src/hooks/src/lib/models.vocab.json` advances `claude-opus-5` to `claude-opus-5-5` and the row is priced (cache write 5.00 at the 1.25x ratio the vocab uses). Without the row, cost-estimator priced every default-Opus session at the `claude-sonnet-5` fallback ($2/$10), a 50% undercount. Per the claude-api skill model table: same 1M context, 128K output and tokenizer as Opus 5; thinking cannot be disabled; forced `tool_choice` `any`/`tool` returns 400; the API effort default is `medium`, one level below Opus 5's `high`. 2.1.280 also stops an effort level saved before `/effort` became per-model from applying to a newly released model, so skills that need depth (audit-full, verify) now say to pass `high` or `xhigh`. `claude-opus-5` stays in `fullIds` and pricing (still served). Fable 5.1 stays the top tier; Sonnet 5 and Haiku 4.5 unchanged | `opus` resolves to Opus 5 and cost reports read Opus 5.5 sessions at Sonnet rates | | `2.1.280` release | 2.1.280 | **Status: Opus 5.5 adopted (row above), two doc adoptions, the rest no-op on ork surfaces.** [CHANGELOG 2.1.280](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21280). 2.1.279 was never published (the CHANGELOG goes 2.1.278 to 2.1.280). **Added:** `CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH` changes the 2,048-character cap on MCP tool descriptions and server instructions (named in `CONTRIBUTING-SKILLS.md` and `configure/references/cc-version-settings.md`); hook output sizes and the oversized-output count on the `hook_execution_complete` OpenTelemetry event (ork ships no OTel config, not applicable). **Changed, mapped:** `PermissionRequest` no longer runs an agent-type hook and shows an error pointing to command or http hooks; no-op for ork, whose four `PermissionRequest` hooks are all `type: command` (verified in `src/hooks/hooks.json`). Plugin marketplaces whose name imitates a reserved marketplace name are refused; ork's marketplace is `orchestkit`. Opus 4.7, Opus 4.8 and Fable 5 stop holding their launch-default effort over `-p`, the Agent SDK, a project, managed or `--settings` `effortLevel` (folds into GH-4052). The default model on Pro and Team Standard moves from Sonnet to Opus. **Fixed, mapped:** writes through a symlinked path are judged where they land, so `acceptEdits`, allow rules and auto mode no longer approve one outside the tree (the class `security-patterns` documents); resumed fork subagents re-send their first tool list instead of rebuilding it, fixing prompt caching on the `context: fork` pattern; a finished subagent's report is no longer lost when the launching conversation compacts first, and messages to a finishing background subagent are no longer lost in headless and SDK sessions; background subagents can use LSP; background shell tasks no longer report benign non-zero exits (grep with no match) as failures; `installed_plugins.json` keeps the updated commit after a branch or tag tracking update, and `claude plugin update` no longer resets a plugin to version "unknown" on an oversized marketplace snapshot (the stale-registry class ork's plugin guard reports); the UserPromptSubmit timeout notice names the hook command that timed out (ork registers UserPromptSubmit hooks); skills in `~/.claude/skills/` are no longer moved to `.trash` when a `manifest.json` there lists them (ork writes no such file). The UI, VSCode, web, Claude Tag and Code Review bullets are CC-internal with no ork surface | `opus` still Opus 5; fixed MCP description cap; agent-type PermissionRequest hooks silently useless; fork subagent cache misses on resume | | `2.1.281` release | 2.1.281 | **Status: no ork code change.** [CHANGELOG 2.1.281](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21281). **Fixed, mapped:** `mcp_tool` hooks on blocking events (PreToolUse and similar) were skipped while their MCP server was still connecting and now wait up to the MCP connect timeout; no-op for ork, whose hooks are all `type: command` (0 `mcp_tool` hooks in `src/hooks/hooks.json`). A recursive `rm` whose target is only command-substitution output (`rm -rf "$(pwd)"`) now asks even under a Bash allow rule; free upside beside ork's operator deny payload, which matches command text and never saw that carrier. **Added:** `"attribution": false` hides commit and PR attribution (older CLIs skip a settings file holding it, so keep the object form in shared files); MCP server checks in `claude plugin validate` (dropped `.mcp.json` entries, undeclared `${user_config.*}`, insecure URLs), free coverage for the CC Plugin Validate job; MCP URL-mode elicitation on 2026-07-28 protocol connections | A PreToolUse `mcp_tool` hook silently skipped at session start | | `2.1.282` release | 2.1.282 | **Status: one doc adoption, one lint.** [CHANGELOG 2.1.282](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21282). **Breaking, mapped:** (1) repository, user and `--add-dir` skills stop pre-approving their own tools via `allowed-tools` under **managed** `allowManagedPermissionRulesOnly` only; outside such orgs nothing changed. The affected-skill inventory lives in `references/skill-preapproval.md` (generated, CI drift gate). (2) Bash permission rules with a **mid-pattern** `:*` were skipped in settings files while `--allowedTools` honoured them; they now apply from every source with a startup warning. A trailing `cmd:*` was never skipped. ork's operator payload has used the space form (`Bash(find *-delete*)`) since v3 (#3849), and because the 2.1.277 floor still skips the colon form, `tests/ci/restricted-smoke/payload-coverage.py` now refuses it (`tests/ci/test-payload-colon-star.sh`). Project and local settings now ignore OTel export variables (ork ships none). **Added:** `maxProseWidth`, `allowClaudeInChromeWithManagedMcp` | A managed org sees prompts inside ork skills; a `find:*-delete*` deny rule is dead below 2.1.282 | | `2.1.283` release | 2.1.283 | **Status: no ork code change; one watch.** [CHANGELOG 2.1.283](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21283). **Added:** managed `deniedModels` and `availableModelsMatch: "exact"`, under which an `availableModels` entry allows only the version it names, so an alias that advances (the `sonnet` move in 2.1.284) is blocked until listed; ork agents pin aliases, so in such an org an agent can fail to start after an upstream alias move (watch, no code). `/doctor prompt-audit` audits CLAUDE.md, skills, agents and commands for prompting patterns written for older models, a candidate input for ork skill hygiene. `path` on `--plugin-dir` load-failure entries in stream-json `plugin_errors`. MCP, WebFetch and WebSearch outputs in the `tool.output` OTel span event (ork ships no OTel config). **Fixed:** `claude plugin validate` now rejects unreachable `outputStyles`/`themes`/`monitors`/`lspServers` paths and uninstallable marketplace names, both free checks for ork's validate job | An ork agent pinned to an alias fails under a strict managed model list | | Sonnet 5.5 default model | 2.1.284 | **Status: adopted.** Measured in the 2.1.284 binary on 2026-09-28: the baked model catalog maps the `sonnet` alias to `claude-sonnet-5-5` (`sonnet:{default:"claude-sonnet-5-5"}`, `latest_per_family.sonnet`), where 2.1.283 mapped it to `claude-sonnet-5`. A first-party `claude -p --model sonnet` run on 2.1.284 billed `modelUsage` to `claude-sonnet-5-5`. On Bedrock, Vertex, Foundry and Mantle the same catalog still maps `sonnet` to Sonnet 4.5, and on `anthropic_aws` to Sonnet 4.6. The `sonnet` alias in `src/hooks/src/lib/models.vocab.json` advances to `claude-sonnet-5-5` with a $2/$10 row (cache 0.20/2.50, platform pricing page read 2026-09-28), and the cost-estimator unknown-model fallback reads that row first. `claude-sonnet-5` stays in `fullIds` and pricing (legacy, still served, same price). Haiku 4.5 is Active (deprecation N/A, retirement not sooner than 2026-10-15, model deprecations page read 2026-09-28) and `haiku` still maps to it. The rest of the 2.1.281 to 2.1.284 changelog is not reviewed in this row | `sonnet` agents and skills would read as Sonnet 5 in cost reports and docs while CC runs Sonnet 5.5 | | `2.1.284` release | 2.1.284 | **Status: one hook fix adopted, one doc adoption; Sonnet 5.5 adopted in the row above (#4541).** [CHANGELOG 2.1.284](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21284). **Fixed, adopted:** `{"decision":"block"}` from Elicitation and ElicitationResult hooks was ignored and now declines the MCP elicitation, as exit code 2 does. `elicitation/elicitation-guard` returns `decision: 'block'` plus `reason` alongside `continue: false`: the decision declines the secret-bearing form on 2.1.284+, and `continue: false` keeps the block on the 2.1.277 floor, which ignores the decision (tests: `elicitation-guard.test.ts`, `output-guard-cc-contract.test.ts`). **Breaking, mapped:** marketplace, claude.ai and npm plugins stop pre-approving their own tools via `allowed-tools` under managed `allowManagedPermissionRulesOnly`, unless the source is official or vouched for by managed settings. ork installs from a marketplace, so this is the change that reaches ork users in managed orgs; see `references/skill-preapproval.md` (93 of 107 skills pre-grant a prompt-gated tool). The docs do not name the key that vouches for a source (unconfirmed). **Added:** Claude Sonnet 5.5 as the default Sonnet (row above, #4541); `/mcp reconnect all`; MCP calls in resumed sessions wait up to 10 s for a connecting server. **Changed:** interactive terminal and VS Code sessions start in auto mode when no permission mode is configured (`permissions.defaultMode` still wins), so ork's PreToolUse guards more often run beside the classifier than beside a prompt | A secret-requesting MCP form halts the turn instead of being declined | | `2.1.285` release | 2.1.285 | **Status: two doc adoptions; one watch (managed `allowedProviders`).** [CHANGELOG 2.1.285](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21285). **Changed, adopted (doc):** `claude -p` and Python Agent SDK sessions on third-party providers or with telemetry off start in auto mode when no permission mode is configured (`--permission-mode` still overrides), extending the 2.1.284 interactive default to headless; documented in `configure/references/cc-version-settings.md`. `claude mcp get` hides the command, arguments and environment values of stdio MCP servers provided by plugins (variable names still shown), so a redacted value is unmeasured, not a missing credential; documented in `doctor/rules/mcp-status-checks.md`. **Changed, mapped:** background Bash and PowerShell commands stop after a time limit (default 30 min, max 2 h; scoped to unattended sessions in 2.1.288); an MCP tool that sets its own `_meta['anthropic/alwaysLoad']` to false stays deferred under a server-level `alwaysLoad`, so the alwaysLoad audit should not flag an opted-out tool; project settings cannot widen an admin-required sandbox. **Added:** managed `allowedProviders` limits the API providers a machine may use, and an ork agent pinned to an alias whose provider is delisted fails like under `deniedModels` (watch); `claude plugin configure ` with `--values-stdin` and `.=` on `claude plugin install --config` (scriptable plugin options, a GH-4054 input); `CLAUDE_CODE_DISABLE_WEB_FETCH`; `CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES`; `claude --desktop`. `/ultrareview` on macOS/Linux requires git 2.31 for local uploads (same git floor class as the 2.1.283 plugin eval). **Fixed, mapped:** fork subagents keep the parent's plan and dontAsk mode, and `claude -p` `CLAUDE_CODE_FORK_SUBAGENT=1` Agent calls run in the foreground; synchronous hooks no longer hang on a hook-started background process holding output (ork registers ~90 command hooks); hooks and SDK permission callbacks see a same-response plan on ExitPlanMode; a failed `agent()`/`parallel()`/`pipeline()` awaited late no longer ends the background session; SSH plugin and marketplace installs honour `GIT_SSH`/`core.sshCommand`; plugin installs refuse an id colliding on `.`/`-`/`@`/case | A headless harness silently runs in auto mode; doctor reads a redacted stdio server as missing config | | `2.1.286` release | 2.1.286 | **Status: no ork code change; two watches.** [CHANGELOG 2.1.286](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21286). **Changed, mapped:** `--bare` connects only the MCP servers named on the command line, sends the model no system reminders and starts no background tasks, and a shell command that reaches its timeout stops instead of moving to the background (watch: ork's bare-eval harness relies on the minimal surface). When project or user skills include one named `verify`, Claude is told to run it right before committing except docs-only and tests-only commits (watch: ork ships `verify`, so commit guidance now names it; check its triggers before changing invocation docs). **Added:** the permission prompt numbers its options ("2 of 5"). **Fixed, mapped:** API 400 errors after a tool or hook returned an object, number or boolean instead of text, including in resumed sessions; `--resume`/`--continue` losing turns after a parallel tool batch; an Anthropic API refusal of the model a default or alias resolves to now retries once on the previous same-tier model instead of failing every turn (ork agents pin aliases); MCP error messages no longer show a credential's value, and percent-encoded Bearer tokens, invisible-character key names and punctuated URL passwords stay masked (four redaction fixes on the transcript surface); foreground subagents regain the task-tracking tools the session has; worktree-isolated subagents no longer load the project CLAUDE.md twice (ork runs 25 `isolation: worktree` agents); the gateway spend meter prices 1 h cached reads at the 5 min rate (ork recommends the 1 h window) | A `-p` session on a refused alias target fails every turn; a worktree subagent pays a second CLAUDE.md load | | `2.1.287` release | 2.1.287 | **Status: public Mods announced (flag measured inert on 2.1.288); several ork-surface fixes.** [CHANGELOG 2.1.287](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21287). **Added:** Claude Mods: plugins may now modify deeper behavior. ork already ships four module-based mods (lesson-cards, memory-lens, promote-lights, secrets-veil); measured 2026-10-03 on 2.1.288, headless `-p --plugin-dir` per mod, flag unset then set: all four load and fire with `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS` unset (secrets-veil masked a tool result, lesson-cards denied `gh pr checks` via lesson `cancelled-check-is-not-pass`, memory-lens indexed 384 memories, promote-lights ran `gh` through `$.process.run`), so the flag gates 2.1.266 to 2.1.286 only (#3917). "You should know", a built-in side-agent mod (`/plugin enable cc-plugin-you-should-know@builtin`, first-party telemetry sessions); coexistence unverified, not enabled. URL prompts from MCP servers on the 2025-11-25 protocol; a server that no longer connects needs `"bareElicitationCapability": true` in its MCP entry. `prompt_text` on the OTel `user_prompt` event, a copy of `prompt` for nesting backends (mask it wherever `prompt` is masked; ork ships no OTel). **Fixed, mapped:** a dangerous `rm` keeps its always-ask safeguard when the command also redirects to a `~` or wildcard path; whole-tool `Bash` allow rules and allowing hooks now prompt for shell writes to files Claude Code refuses outright (the Anthropic profile store, the host credentials file); SessionStart hooks from synced plugins run in cloud sessions (ork registers ~15); `asyncRewake` hooks with a missing script report once instead of re-waking; the "N hooks ran" transcript count stops double-counting internal callbacks; `--output-format stream-json` streams `context: fork` skill turns; Bedrock/Vertex startup checks honour `availableModels`; a revoked claude.ai login reports "OAuth token revoked" instead of a generic 401; org per-tool permission ceilings survive an MCP tool named `__proto__` | The built-in mod's coexistence is unverified; a synced plugin's SessionStart hooks skip cloud sessions | | `2.1.288` release | 2.1.288 | **Status: one env doc adoption; a mod and hook-surface fix cluster.** [CHANGELOG 2.1.288](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21288). **Added:** `CLAUDE_CODE_DISABLE_STRUCTURED_OUTPUTS` turns structured outputs off where Mantle or a gateway rejects them; without it session titles, memory recall and prompt hooks failed there (ork's prompt hooks run on gateways; documented in `configure/references/cc-version-settings.md`). `$.ui.selection()` for mods returns the last fullscreen selection and its transcript row (mod API surface for ork's four mods; the 2.1.287 contract check landed 2026-10-03). `--max-findings` for /code-review. A re-authenticate prompt when an MCP server asks for more OAuth scope mid-call. **Fixed, mapped:** a plugin-defined agent spawned by name runs with its own prompt, tools, disallowedTools and effort instead of the defaults (all 36 ork agents); PreToolUse and PermissionRequest hooks skipped on match failure or unserializable input now block the call (fail-closed on the events ork's guards live on); a plugin `tool.call` hook no longer fails Bash or misdirects file searches in worktree subagents (ork's mods register `tool.call` hooks and ork spawns worktree agents); `git-subdir` plugin installs work on git older than 2.39 (ork's marketplace ships two git-subdir entries); path-scoped `.claude/rules` and nested CLAUDE.md load on Write and Edit, not only Read (ork ships 10 path-scoped rules); InstructionsLoaded reports `agent_id`/`agent_type` and effort on file-access loads; `idle_prompt` hooks stop firing while background agents run; a dangerous `rm` inside `bash -c`/`sh -c` under bypassPermissions or a shell allow rule now prompts; background sessions survive a plugin reload mid-timer; `claude plugin install` for GitHub sources falls back to HTTPS without an SSH key; mid-response API timeouts continue from the partial response in non-interactive sessions and subagents; resuming a 2.1.286-or-earlier conversation keeps earlier thinking. **Changed, mapped:** the background-command time limit applies only in unattended sessions (`-p`, Agent SDK, CI, cloud), narrowing the 2.1.285 row; the auto-mode classifier ignores an `ANTHROPIC_DEFAULT_SONNET_MODEL` pin naming Sonnet 5.5 or Opus 5.5 and uses Sonnet 5; `claude project purge` is renamed `claude purge`; `/autocompact` saves its window per model | A `tool.call` hook poisons worktree subagents; prompt hooks fail on gateways that reject structured outputs | | `2.1.289` release | 2.1.289 | **Status: no ork code change; free security upside.** [CHANGELOG 2.1.289](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21289). **Fixed, mapped:** `Read` deny rules now apply to files @-mentioned, changed, or selected in the IDE through a symlink (289.002); Bash deny and ask rules no longer miss a command behind an environment variable prefix with an expanded value (e.g. `TZ="$HOME" rm -rf build`) when the sandbox auto-allows commands (289.013). Check ork's operator deny payload against these two forms. Read from release text only; not run against the ork payload tests | Before 2.1.289: a `Read` deny rule does not apply to files @-mentioned, changed, or selected in the IDE through a symlink, and a Bash deny or ask rule misses a command behind an env var prefix with an expanded value when the sandbox auto-allows commands | | `2.1.290` release | 2.1.290 | **Status: one verify item open (teammate), one doc adoption; avoid this version (see 2.1.291).** [CHANGELOG 2.1.290](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21290). **Changed, mapped:** Bash permission checks now ask for read-only commands whose wildcard arguments the shell expands (`rg`, `git grep`), more `ps` forms, `pyright`, and some zsh variable-name forms; unattended callers (`claude -p`, night-watch, floor lanes) can hang on the new prompt, so re-run the operator payload coverage test and add allow rules only where needed. Permission rules and safety checks now apply after a PreToolUse hook rewrites a tool input, so allow rules must match the rewritten form (the RTK `rtk ...` rewrite is the case to test). In-process teammate `agent_id` is now the agent ID (`name@team` stays in `teammate_id`) and TeammateIdle hooks no longer fire from a teammate's subagents or forks (check ork's teammate-idle hooks). **Added:** WebSearch budget refills 100 calls per hour instead of a hard 200 per session; `CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR` sets the rate, `0` turns it off (doc adoption, `configure/references/cc-version-settings.md`). Mod API additions (`agentId` in `tool.check`, `serverToolUses`) need no change today. Probed 2026-10-08 on 2.1.294 (Max seat, scratch directories): an unquoted wildcard `git grep` is denied when nobody can answer the prompt, and a plain one runs (PASS); a deny rule fires on the command a PreToolUse hook rewrote, with a generic rewrite hook and not the RTK hook itself (PASS); the teammate `agent_id` change is INCONCLUSIVE, because a named Agent call gave a plain subagent with no `teammate_id` and the case needs an interactive agent team | Wildcard `rg` and `git grep` prompt in headless runs; allow rules miss the `rtk` rewrite | | `2.1.291` release | 2.1.291 | **Status: version floor note only.** [CHANGELOG 2.1.291](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21291). **Fixed, mapped:** 2.1.288 could lose the last messages of a session on quit, and 2.1.290 could drop cloud permission answers. Do not set `supported_floor` inside 2.1.288 to 2.1.290 | Sessions on 2.1.288 to 2.1.290 can lose data or permission answers | | `2.1.292` release | 2.1.292 | **Status: two items probed and passed, two doc items.** [CHANGELOG 2.1.292](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21292). **Added:** the Agent tool takes an `effort` parameter, so a skill or lane can run one subagent at a named effort (check the spawn guard payload; related to the effort frontmatter work in #4052 and #4051); `claude plugin install --marketplace ` adds the marketplace and installs in one command (install docs). **Changed, mapped:** local (stdio) MCP servers negotiate protocol 2026-07-28 by default, `MCP_PROTOCOL_NEGOTIATION=legacy` opts out, and slow servers are remembered for 7 days (run doctor and list the stdio servers); `` tags in hook output are escaped before they reach Claude (grep hooks that print the literal tag on purpose); `CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS` sets a longer 529 backoff (doc). An MCP tool name over 128 characters is dropped. Probed 2026-10-08 on 2.1.294: a stdio MCP server first receives `server/discover` with protocol 2026-07-28 and, when it does not answer, the client falls back to `initialize` with 2025-11-25 (PASS); a literal `` in hook output reaches Claude as `<system-reminder>` (PASS) | Before 2.1.292: an MCP tool with a name longer than 128 characters makes every request fail, and a literal system-reminder tag in a hook's output reaches Claude unescaped. From 2.1.292: a stdio MCP server that ignores the new protocol check connects slower once, then is remembered for 7 days | | Haiku 5.5 default model | 2.1.293 | **Status: adopted (#4660 added the vocab and pricing row; #4661 advanced the `haiku` alias to `claude-haiku-5-5`).** CHANGELOG 2.1.293: "Added Claude Haiku 5.5, now the default Haiku model on the Anthropic API, 1M context, $0.10/$0.50 per Mtok ($0.50/$2.50 for prompts over 100K)". `claude-haiku-5-5` is in `models.vocab.json` (fullIds and the pricing row) and the repo `haiku` alias resolves to it. Claude Code's own `haiku` alias already resolves to Haiku 5.5 (probe 2026-10-08: the model flag set to haiku ran Haiku 5.5 in every session). The pricing canary `scripts/check-model-pricing-tiers.mjs` reports the row ok against the 2.1.293 binary tier `haiku_55`. Skills and agents with `model: haiku` run Haiku 5.5, which runs adaptive thinking by default and rejects sampling parameters and assistant prefill with a 400 | Skills with `model: haiku` change behaviour with the alias | | `2.1.293` release | 2.1.293 | **Status: Haiku 5.5 adopted (row above), plugin eval item probed and passed.** [CHANGELOG 2.1.293](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21293). **Fixed, mapped:** `claude plugin eval` no longer refuses every Bash-granting run on Macs with Docker Desktop (re-run the hq-ext plugin eval); path-scoped rules and nested CLAUDE.md now load when Claude reads a file through `cat`, `head`, `tail`, `sed -n` or `grep` in Bash; an HTTP MCP connection no longer keeps every request in memory; `agentType` is added to the `subagentStatusLine` payload. **Reverted:** the 2.1.281 auto mode denial message change and the 2.1.290 cloud wakeup fix (a lost `/loop` wakeup in a restarted cloud container is again not recovered), so do not claim that fix. Probed 2026-10-08 on 2.1.294: a Bash-granting `plugin eval` case ran to a score of 1 on a Mac with Docker Desktop links (PASS) | Plugin eval may have refused silently on Docker Desktop Macs | | `2.1.294` release | 2.1.294 | **Status: adopt, no ork code change.** [CHANGELOG 2.1.294](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21294). **Fixed:** `prompt` and `agent` hooks written as instructions (such as "Block commands that...") no longer allow what they should block. **Improved:** `prompt` hooks on Stop and SubagentStop written as instructions (such as "Carry on if the build is broken") are judged so Claude is less likely to stop early. Neither ork nor hq-ext ships a `prompt` or `agent` type hook (searched `src/hooks`, `src/skills`, `src/agents` here and the hq-ext hooks at origin/dev), so there is nothing to change; a user-written instruction hook of that kind now blocks as written | A hook that relied on the old lenient reading now blocks | | `2.1.295` release | 2.1.295 | **Status: two doc adoptions; hook `onFailure` is a named follow-up.** [CHANGELOG 2.1.295](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21295). **Added:** `onFailure: "block"` for command and HTTP hooks, so a hook that cannot start, times out or exits oddly blocks the action; without the key a failed hook still lets it through (documented in `configure/references/cc-version-settings.md`; 0 of 152 ork hook entries set it, and adding it to the security guards is a follow-up for when the floor reaches 2.1.295). `CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS` caps how long the unattended retry watchdog waits out 429 and 529 (doc adoption; bare-eval batches that set the watchdog should set the cap). **Changed, mapped:** MCP tool descriptions loaded through tool search are cut at 16,384 characters instead of 2,048 (doc adoption); subagents preload at most 32 skills from `skills` (the longest ork list is 13); the Workflow `scriptPath` refusal now says to pass the script inline, and six ork skills dispatch by `scriptPath`, so a session without Read gets the refusal (watch). **Fixed, mapped:** a skill's `allowed-tools` and `effort` are no longer dropped in headless runs when the Skill tool ends before the stream (43 ork skills set `effort`, so headless cost may shift); forked skills called from Workflow subagents return to the invoking agent; worktree subagents see their own branch (25 ork `isolation: worktree` agents); background hooks no longer inherit `FORCE_COLOR=3`; an async SessionStart hook's unchanged context is not re-added on resume | Before 2.1.295: a crashed or timed-out guard hook always lets the action through, and a skill's `allowed-tools` can be dropped in headless runs | | `2.1.296` release | 2.1.296 | **Status: four doc adoptions; three code follow-ups on open branches.** [CHANGELOG 2.1.296](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21296). **Added:** `allow_large` on the Read tool reads a text file past the size limits in one call; ork's `pretool/read/tldr-summary` hook still injects a summary on such a read (follow-up, branch `fix/ork10-stack-3-tldr-allow-large`). `CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL` runs every Workflow agent on one model (doc adoption; six of eight ork workflow scripts pick a model per stage, precedence unconfirmed). `autoCompactWindow` in subagent frontmatter (doc adoption; no ork agent sets it, plugin-agent support unconfirmed). `CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS` beside the 2.1.292 base delay (doc adoption). Debug output names unrecognized agent frontmatter fields (watch: one debug run over the 36 ork agents shows which keys CC reads). **Changed, mapped:** the default cap on MCP tool descriptions sent up front and on server instructions goes from 2,048 to 4,096 characters (doc adoption; ork ships no MCP server). **Updated:** Sonnet 5.5 cache reads are priced at $0.10 per MTok, not $0.20, in `/cost` and the status line; ork's `models.vocab.json` row still says 0.2 (follow-up, branch `fix/ork10-stack-1-sonnet55-cache-price`). **Fixed, mapped:** Esc during a UserPromptSubmit hook no longer lets the unchecked prompt through in headless runs; SessionStart hooks of a late-loading plugin are no longer skipped behind a same-named plugin; token counts for adaptive-thinking-only models such as Haiku 5.5; Workflow scripts with CRLF line endings | Before 2.1.296: an `allow_large` read is not offered, cost reports price Sonnet 5.5 cache reads at twice the current rate, and an interrupt can pass a prompt past a UserPromptSubmit check | **Function hook probes, 2026-09-19** (`claude --version` reports `2.1.277 (Claude Code)`; repeatable end to end via `tests/probes/function-hooks-probe.sh`, four `claude -p` calls with `--model haiku --no-session-persistence`, verdicts grepped out of each run's `--debug-file` log): ``` REFUTED R1-unset user-tier hooks modules not loaded; rollout flag off from the default (a cold GrowthBook cache, no payload yet) VERIFIED R1-set lesson-cards loaded (tier user); 2 settle lines logged REFUTED R3-main tool.list hook loaded tier user but never dispatched; Read still offered (model YES) REFUTED R3-subagent subagent still offered Read and tool.list never dispatched; SUBAGENT:YES ``` Reading: on this account, measured before 2.1.287, a user-tier hooks module (`mods/lesson-cards` via `--plugin-dir`) did NOT load with `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS` unset; the debug log names the decider, a cold GrowthBook cache falling back to the compiled default of false, matching the `env ?? GrowthBook ?? false` gate in §2 of the 2026-09-18 cc-mods brief. With the env var set to `1` the same module loads at `tier user` and its `session.start` and `tool.call` hooks dispatch. Re-measured on 2.1.288 (2026-10-03, headless `-p --plugin-dir`, each of the four ork mods, flag unset then set): every module loads and fires with the flag unset, so the env gate applies to 2.1.266 through 2.1.286 only. And `tool.list` is not consulted when the offered tool set is built for either the main loop or an Explore subagent in a `-p` run (zero `tool.list` dispatches in both runs, `Read` still offered in both), so the §6 subtractive-scoping claim does not hold for model-facing tool lists on this build; `tool.describe` (245 settles) is the per-tool surface that actually ran.