[claude-yolo]

Night shift report

WHY THIS MATTERS: Last night's commit bumped the manifest to 2.1.319, but the docs changelog was missing the 2.1.319 section until this run. Now it's in: 19 additions, 26 changes, 16 improvements and 90 bug fixes. Several fixes are security fixes, which is a good reason to upgrade. One change is behavioral and breaks existing scripts: in -p mode, a resume with a pending deferred tool call no longer quietly drops the call. The prompt is held back and the run exits 1. Anyone scripting defer hooks needs to know this.

HIGHLIGHTS:

• Security fixes in 2.1.319: a Bash permission bypass using a crafted environment prefix, a sandbox escape when creating a worktree, a sed command that could skip the permission check in accept-edits/auto mode, Bash deny/ask rules missing commands with quoted words, /rewind following directory symlinks, and --trust-workspace false on self-hosted runners now also blocking repo hooks and skills.
• Deferred tools on resume are reworked (hooks.md, new section "Resume when a deferred tool is unavailable"): if the tool is missing, the prompt doesn't reach Claude and the run exits 1. The new CLAUDE_CODE_DROP_UNAVAILABLE_DEFERRED_TOOL=1 drops the call on purpose. Before v2.1.319 the call was dropped silently.
• PostToolUse after an interrupt (new hooks.md section): with Ctrl+Enter, PostToolUse hooks now run on tool calls that finish after the interrupt, but they get only 10 seconds before being killed. Esc still cancels them. Use async: true for longer hooks.
• Auto mode behind gateways no longer falls back to the local classifier: calls the server can't check are asked about or denied. CLAUDE_CODE_AUTO_MODE_SERVER=0 keeps the old behavior. auto-mode-classifier-billing.md now lists exactly what a gateway must pass through: the anthropic-beta header and safeguards body field together, plus safeguard_results in responses.
• New knobs: permissions.denyInsteadOfPrompting, background MCP tasks (CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND, CLAUDE_CODE_DISABLE_MCP_TASKS), CLAUDE_CODE_DISABLE_FEATURE_FLAGS, CLAUDE_CODE_LOOP_KEEPALIVE (self-paced /loop now ends when a turn doesn't reschedule), CLAUDE_CODE_CONFIG_LOCK_WAIT_MS (for "MCP server was not saved" lock failures, errors.md), CLAUDE_RUNNER_SPAWN_REASON, and /claude-api latency-optimize.
• Desktop managed settings: remoteControlAtStartup: false, browserExternalPageTools, disableMobileSimulatorTools and disableBrowserExternalNavigation set in the highest-ranked MDM/managed file now win over server-managed settings. The iOS simulator pane can be minimized or closed while Claude keeps using the device.
• Cloud sessions don't strictly need GitHub: the requirement is now "to clone a GitHub repository", and --cloud can bundle a local repo instead (web-quickstart.md, sandbox-environments.md). mcp.md adds a guide to why a cloud session shows "3 of 13 tools available".
• Mods are not sandboxed: sandboxing.md now says plainly that a mod's file, network and process access bypasses the Bash sandbox.
• API: compaction (background, keep-recent-turns, on-demand) is now in beta on Amazon Bedrock.
• Product docs: the government seat-tiers page was rewritten. Third-party Claude Desktop installation adds troubleshooting for failed workspace and CLI-binary downloads and a Windows "Allow all trusted apps" requirement. ssh-remote-sessions.md was reworked.
• Support: Team/seat-based Enterprise usage credits expire after 12 months and are non-refundable. Enterprise orgs get project spend tagging by charge or client-matter code (beta). Admins can block sharing chats that use connectors.
• Housekeeping: no deletions, and tombstones.json / discovery.json changed only their updated dates, so no new sources, deaths or resurrections. The GitHub mirror refreshed the knowledge-wiki managed-agents quickstart (new prompts/ dir) and bumped the docx/pdf/pptx/xlsx skills.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning