chore: Update CHANGELOG.md and feed.xml

Add Claude apps gateway on AWS example deployment assets

.claude-plugin/marketplace.json

@@ -72,7 +72,7 @@
     {
       "name": "frontend-design",
       "description": "Create distinctive, production-grade frontend interfaces with high design quality. Generates creative, polished code that avoids generic AI aesthetics.",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "author": {
         "name": "Prithvi Rajasekaran & Alexander Bricken",
         "email": "prithvi@anthropic.com"

.github/workflows/lock-closed-issues.yml

@@ -22,71 +22,56 @@ jobs:
           script: |
             const sevenDaysAgo = new Date();
             sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+            const cutoff = sevenDaysAgo.toISOString().split('T')[0];
 
             const lockComment = `This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.`;
 
-            let page = 1;
-            let hasMore = true;
+            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:closed is:unlocked updated:<${cutoff}`;
+            console.log(`Search query: ${query}`);
+
+            const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+            const MAX_PER_RUN = 250;
+            const processed = new Set();
             let totalLocked = 0;
 
-            while (hasMore) {
-              // Get closed issues (pagination)
-              const { data: issues } = await github.rest.issues.listForRepo({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                state: 'closed',
+            while (totalLocked < MAX_PER_RUN) {
+              const { data } = await github.rest.search.issuesAndPullRequests({
+                q: query,
                 sort: 'updated',
-                direction: 'asc',
+                order: 'asc',
                 per_page: 100,
-                page: page
               });
-              
-              if (issues.length === 0) {
-                hasMore = false;
-                break;
+
+              if (totalLocked === 0) {
+                console.log(`Total candidates: ${data.total_count}`);
               }
-              
-              for (const issue of issues) {
-                // Skip if already locked
-                if (issue.locked) continue;
-                
-                // Skip pull requests
-                if (issue.pull_request) continue;
-                
-                // Check if updated more than 7 days ago
-                const updatedAt = new Date(issue.updated_at);
-                if (updatedAt > sevenDaysAgo) {
-                  // Since issues are sorted by updated_at ascending, 
-                  // once we hit a recent issue, all remaining will be recent too
-                  hasMore = false;
-                  break;
-                }
-                
+
+              const fresh = data.items.filter((i) => !processed.has(i.number));
+              if (fresh.length === 0) break;
+
+              for (const issue of fresh) {
+                if (totalLocked >= MAX_PER_RUN) break;
+                processed.add(issue.number);
                 try {
-                  // Add comment before locking
                   await github.rest.issues.createComment({
                     owner: context.repo.owner,
                     repo: context.repo.repo,
                     issue_number: issue.number,
-                    body: lockComment
+                    body: lockComment,
                   });
-                  
-                  // Lock the issue
                   await github.rest.issues.lock({
                     owner: context.repo.owner,
                     repo: context.repo.repo,
                     issue_number: issue.number,
-                    lock_reason: 'resolved'
+                    lock_reason: 'resolved',
                   });
-                  
                   totalLocked++;
                   console.log(`Locked issue #${issue.number}: ${issue.title}`);
+                  await sleep(1000);
                 } catch (error) {
                   console.error(`Failed to lock issue #${issue.number}: ${error.message}`);
                 }
               }
-              
-              page++;
             }
 
             console.log(`Total issues locked: ${totalLocked}`);

CHANGELOG.md

@@ -1,5 +1,718 @@
 # Changelog
 
+## 2.1.217
+
+- Added emoji shortcode autocomplete in the prompt input: type `:heart:` to insert ❤️, or `:hea` for suggestions — disable with the `emojiCompletionEnabled` setting
+- Added warnings when transcript writes are failing (e.g. disk full) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently
+- Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
+- Fixed Windows auto-update failures that could leave `claude.exe` missing; failed updates now restore the preserved executable automatically
+- Fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
+- Fixed auto-compact never triggering for Claude Opus 4.8 on Bedrock and `/compact` failing once over the limit
+- Fixed corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions
+- Fixed screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds to update elapsed time and token counts
+- Fixed managed settings that set `OTEL_EXPORTER_OTLP_ENDPOINT` not governing all signals — lower-scope signal-specific overrides no longer redirect telemetry away from the managed endpoint
+- Fixed `--resume`/`--continue` and `/resume` failing with a TypeError when a transcript has a malformed attachment entry
+- Fixed Remote Control sessions not showing a pending permission prompt or dialog to viewers that connected after it appeared
+- Fixed background shells sometimes becoming impossible to stop after a session is sent to the background (`/background` or `←`) or when the session exits on a heavily loaded machine, most visible on Windows
+- Fixed a `CLAUDE.md` or `SKILL.md` paths frontmatter value with many brace groups OOM-killing or stalling the CLI at startup — brace expansion is now budget-bounded
+- Fixed the transcript preview sitting flush against the input area when attaching to a starting background session; it now leaves the same one-line gap as the live layout, so the transcript no longer shifts when the session takes over
+- Improved footer PR badge links to be clickable hyperlinks even when terminal support can't be detected (e.g. over ssh/tmux); set `FORCE_HYPERLINK=0` to opt out
+- Changed the login-expiry warning to appear 3 days before expiry instead of 5
+- Capped the frontend-design plugin suggestion tip at 3 lifetime impressions instead of repeating indefinitely
+- Added a cap on concurrently-running subagents (default 20, override with `CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS`) so one message can't fan out unbounded background agents
+- Changed subagents to no longer spawn nested subagents by default; set `CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH` to allow deeper nesting
+- Fixed `--max-budget-usd` not stopping background subagents: once the cap is reached, new spawns are denied and running background agents are halted
+
+## 2.1.216
+
+- Added `sandbox.filesystem.disabled` setting to skip filesystem isolation while keeping network egress control
+- Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
+- Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
+- Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording
+- Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes
+- Fixed @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of `c`-operators and paste, statusline running twice on resume, and resume-picker hangs on failure
+- Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored
+- Fixed worktree-isolated subagents redirecting git into the shared checkout via `git -C`, `--git-dir`, or `GIT_DIR`/`GIT_WORK_TREE`
+- Fixed worktree sessions landing in another project's leftover worktree when the working directory did not match the selected project
+- Fixed background sessions whose worktree has no git repository being undeletable
+- Fixed `claude daemon stop --any` potentially terminating an unrelated process via a stale legacy daemon lockfile
+- Fixed Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks
+- Fixed Bash command permission checking for compound statements with redirects inside `&&` lists or negations
+- Fixed pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died
+- Fixed background subagents getting cancelled when a high-priority message arrives during their startup window
+- Fixed mouse and focus garbage in the terminal while a GUI editor from `/memory`, `/plan`, `/keybindings`, or Ctrl+G is open; `/memory` no longer waits for the editor to close
+- Fixed Claude-in-Chrome 403-looping on reconnect when the session's OAuth token lacks a required scope
+- Fixed workflow saves and scheduled-task writes following a symlink at `.claude`, which could redirect writes outside the project
+- Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command
+- Fixed read-only commands on Windows accessing network paths without a permission prompt
+- Fixed Bash command parsing of non-ASCII characters to match real shell word boundaries
+- Fixed PowerShell tool permission validation of commands containing invisible Unicode characters
+- Fixed dialogs in fullscreen mode stretching past the right-hand edge of their panel
+- Fixed the `/config` settings list in fullscreen mode clipping its keyboard-hint footer
+- Fixed the transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns
+- Fixed the Prometheus metrics endpoint (`OTEL_METRICS_EXPORTER=prometheus`) emitting invalid `# UNIT` lines
+- Fixed skills and commands changed during a session not appearing in the slash menu until restart
+- Fixed plugin skills with a `name` frontmatter field losing their plugin prefix in slash-command autocomplete
+- Fixed telemetry misreporting permission denials: failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections
+- Improved the `/fork` confirmation to one line with the new session's name, `claude attach` id, and a note when the copy shares your checkout
+- Improved validation of `git` and `gh` command arguments in the PowerShell tool
+- Improved the `/ultrareview` diff-too-large error to show configured limits, measured diff size, and largest contributing files
+- Improved `/code-review ultra` empty-diff message to name the exact base ref and suggest passing an explicit base
+- Improved the spend limit adjustment prompt to show the server's reason when a spend limit change is rejected
+- `/context` now shows an explicit warning when the conversation exceeds the context window, and a failed `/compact` displays as an error
+- `/rewind` no longer restores or deletes files through symlinks or hard links at tracked paths and reports how many paths it skipped
+- Background sessions: `/mcp` and `/install-github-app` now park a "needs input" request in the agent view when no client is attached
+- Updated the bundled dataviz skill: reordered the default chart palette and fixed guidance that suggested direct labels for four-series charts
+- [VSCode] Fixed right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code
+- Fixed cloud sessions dropping the in-flight message when the session's container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive
+
+## 2.1.215
+
+- Claude no longer runs the `/verify` and `/code-review` skills on its own; invoke them with `/verify` or `/code-review` when you want them
+
+## 2.1.214
+
+- Fixed single-segment `dir/**` allow rules like `Edit(src/**)` auto-approving writes to nested `dir/` directories anywhere in the tree instead of only `<cwd>/dir`
+- Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
+- Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
+- Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically
+- Fixed Bash permission checks treating zsh variable subscripts and modifiers in `[[ ]]` comparisons as inert text — these commands now prompt for approval
+- Fixed Bash permission checks to no longer auto-approve certain `help` and `man` commands that could run unsafe options, command substitutions, or backslash paths
+- Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
+- Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations
+- Added a periodic progress heartbeat for long-running tool calls that previously went silent
+- Added an ISO `modified` timestamp to memory file frontmatter
+- Added `message.uuid`, `client_request_id`, and `tool_source` attributes to OpenTelemetry log events for message-level correlation and tool provenance
+- Added `CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH` to configure the 60 KB truncation limit on OpenTelemetry content attributes
+- Added reasoning effort to the `subagentStatusLine` payload, so custom agent rows can render model and effort
+- Added permission prompts for `docker` commands (including the Podman `docker` shim) carrying daemon-redirect flags (`--url`, `--connection`, `--identity`, and Podman's remote mode) that previously ran without one
+- Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags
+- Fixed Bash tool killing the Claude session when a `pkill -f` pattern accidentally matched the CLI's own process (Linux)
+- Fixed unbounded memory growth when `--settings` points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear error
+- Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows
+- Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap
+- Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task
+- Fixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)
+- Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)
+- Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)
+- Fixed the PowerShell tool reporting `where.exe`, `fc.exe`, and `diff.exe` as errors when they return a valid negative answer (Windows)
+- Fixed `>` and `>>` under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8
+- Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon
+- Fixed background sessions parked with `←` or `/background` and left idle keeping the background daemon and a worker process alive indefinitely
+- Fixed completed background sessions being impossible to remove via `claude rm` or the agent view once the background service had gone idle
+- Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view
+- Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store
+- Fixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled
+- Fixed `/install-github-app` and the `/mcp` settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached
+- Fixed plugins enabled via the `--settings` CLI flag not loading (regression since v2.1.181)
+- Fixed feature flags going stale in long-running sessions after the OAuth token rotates
+- Fixed `/ultrareview` refusing to run in repos with no merge base — it now offers to review all tracked files
+- Fixed `claude update` and `claude doctor` hanging silently, and the `/status` System diagnostics section going blank, when a shell-config path is a directory
+- Fixed memory frontmatter values being silently truncated at an inline `#` when memory files are saved
+- Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative `message_delta` frames
+- Fixed a spurious "check your network" warning that appeared while the advisor was thinking
+- Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation
+- Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace context
+- Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources
+- Improved the `claude rc` workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directory
+- Changed single-segment `dir/**` hook `if:` conditions to match only `<cwd>/dir`; write `**/dir/**` for any-depth matching. `deny`/`ask` permission rules keep their any-depth match.
+- Changed `file` commands using `-m`/`--magic-file` or `-f`/`--files-from` to require permission instead of being auto-allowed as read-only
+- Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket
+- Changed SessionStart hooks to report source `"fork"` when a session begins as a fork instead of `"resume"`
+
+## 2.1.212
+
+- `/fork` now copies your conversation into a new background session (its own row in `claude agents`) while you keep working; the in-session subagent it used to launch is now `/subtask`
+- Added `claude auto-mode reset` to restore the default auto-mode configuration, with a confirmation prompt (pass `--yes` to skip)
+- Added a session-wide limit on WebSearch tool calls (default 200, tunable via `CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION`) to stop runaway search loops
+- Added a per-session cap on subagent spawns (default 200, override with `CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION`) to stop runaway delegation loops; `/clear` resets the budget
+- MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with `CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS`
+- Typing `/resume` in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
+- Fixed plan mode auto-running file-modifying Bash commands (e.g. `touch`, `rm`) without a permission prompt or SDK `canUseTool` callback
+- Fixed worktree creation following a repository-committed symlink at `.claude/worktrees`, which could create files outside the repository
+- Fixed a `continue:false` hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections
+- Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143
+- Fixed `/background` and `claude --bg` failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7
+- Fixed shell mode (`!`) not executing commands containing file paths while the path autocomplete popup was open
+- Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji
+- Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the `?` help overlay
+- Fixed `/ultrareview` rejecting PR references like `#123`, `PR 123`, and pasted PR URLs; error hints now name the command you actually typed
+- Fixed `/ultrareview <branch>` not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos
+- Fixed `/ultrareview` skipping the billing confirmation in a new conversation after `/clear`
+- Fixed `/ultrareview`'s "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands
+- Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning
+- Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session
+- Fixed `ExitWorktree` failing with "no active EnterWorktree session" after resuming a session with `--continue`/`--resume` in print/SDK mode
+- Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run
+- Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart
+- Fixed background sessions created with `/fork` losing their live-parent protection after a state write failure
+- Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart
+- Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session
+- Fixed the plan-approval dialog footer splitting "ctrl+g to edit in <editor>" apart when the file path is long
+- Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode
+- Fixed diff previews losing their line numbers and +/- markers in narrow layouts
+- Fixed @-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143
+- Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding
+- Fixed OTLP event log records missing `trace_id`/`span_id` when `TRACEPARENT` is set in SDK/headless mode
+- Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause
+- Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded
+- Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff
+- Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)
+- Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait
+- Reduced token usage in inter-agent messaging: `SendMessage` bodies are no longer duplicated into replayed history and tool results
+- Changed `/fork` to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view
+- Changed bare `/btw` to reopen the side-question panel on your most recent exchange so you can browse earlier answers
+- Changed the `←` footer hint to pulse `N done` for a moment when a background agent finishes while nothing needs your input
+- Deprecated the Task tool's `mode` parameter (now ignored); subagents inherit the parent session's permission mode by default
+- Changed Enterprise `forceLoginMethod` to be enforced for VS Code extension, SDK, `setup-token`, and `install-github-app` logins, not just the terminal
+- Changed session transcripts to record the reasoning effort level on each assistant message
+- Changed headless/SDK sessions to apply a `set_model` control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn
+- Changed agent view / `claude agents --json`: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"
+- Updated the auth status panel title from "Cloud authentication" to "Authentication"
+- Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically
+
+## 2.1.211
+
+- Added `--forward-subagent-text` flag and `CLAUDE_CODE_FORWARD_SUBAGENT_TEXT` environment variable to include subagent text and thinking in stream-json output
+- Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
+- Fixed auto mode overriding a PreToolUse hook's `ask` decision for unsandboxed Bash — a hook `ask` now floors the decision at a prompt
+- Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
+- Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
+- Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
+- Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
+- Fixed nested `.claude/rules/*.md` files loading even when setting sources exclude project settings
+- Fixed file upload validation: filenames ending in a DOS device suffix (`.prn`) or trailing dot are now accepted, and files with multiple hard links are refused
+- Fixed file uploads to Claude in Chrome from remote and CLI sessions
+- Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel
+- Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running
+- Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)
+- Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id
+- Fixed `/loop` hiding the session from `/resume` after a single use
+- Fixed screen reader users losing the audible terminal bell after `/terminal-setup` or onboarding terminal setup
+- Fixed background jobs on LLM gateway auth (`ANTHROPIC_AUTH_TOKEN` + `ANTHROPIC_BASE_URL`) coming back "Not logged in" after the daemon respawns them
+- Fixed `claude agents` jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing
+- Fixed `/clear` not resetting the session cost counter — the statusline's cost now starts at $0 after `/clear`
+- Fixed Claude in Chrome setup pages failing to open in the browser on Windows
+- Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable
+- Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link
+- Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions
+- Fixed routines with no schedule reporting a next run time in the year 1
+- Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after `/clear`
+- Improved terminal layout and rendering performance
+- Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results
+- Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments
+- Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like `1e6` and `64_000`
+- Updated documentation links to the current docs sites
+- Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees
+- Changed `/usage-credits` to ask for confirmation before sending a request to organization admins
+- Changed Vim mode `s` and `S` (substitute char/line) to work in NORMAL mode, matching vim behavior
+- [VSCode] Updated the Remote Control banner to describe what it does
+- Claude in Chrome: hardened file-upload path validation
+- Claude in Chrome: `save_to_disk` on screenshot actions now writes the image to disk and returns the path; previously it did nothing
+- Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.
+
+## 2.1.210
+
+- Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck
+- Added a startup warning for `Write(path)`, `NotebookEdit(path)`, and `Glob(path)` permission rules — use `Edit(path)` or `Read(path)` instead
+- Fixed `isolation: 'worktree'` subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree
+- Fixed the `ultracode` keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
+- Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element
+- Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text
+- Fixed `claude attach` sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes
+- Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element
+- Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait
+- Fixed Claude assuming a `cd` took effect after its command was moved to the background; the tool result now states the working directory is unchanged
+- Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
+- Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
+- Fixed `/doctor` skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in
+- Fixed Grep content mode claiming "No matches found" when paginating past the end of results
+- Fixed unmatched `$1`/`$2` positional placeholders in skills and commands being silently stripped; they are now preserved verbatim
+- Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems
+- Fixed background workers crash-looping when a client resets its connection to the background service
+- Fixed `claude agents --effort ultracode` not reaching dispatched sessions; the value was silently dropped
+- Fixed pressing ← to open the agents view dropping the task tracker when returning to the session
+- Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted
+- Fixed killed background sessions leaving a permanent `git worktree lock` behind; the periodic sweep now releases locks whose owning process is gone
+- Fixed SDK MCP servers registered via an `initialize` control request waiting until the next turn to start connecting
+- Fixed returning to the agents view from a session leaving overlapping ghost frames with `CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1`
+- Fixed late-appearing `.claude/*` symlinks not being reconciled into the sandbox deny-write list
+- Hardened the Agent tool against indirect prompt injection via content a subagent read
+- Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request
+- Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session
+- Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds
+- Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation
+- Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab
+- The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes
+- Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection
+- Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed
+
+## 2.1.209
+
+- Fixed /model and other dialogs being blocked in `claude agents` background sessions (reverts an overly broad guard)
+
+## 2.1.208
+
+- Added screen reader mode: opt-in plain-text rendering for screen reader users. Run `claude --ax-screen-reader`, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.
+- Added `vimInsertModeRemaps` setting: map two-key insert-mode sequences like `jj` to Escape in vim mode
+- Added `CLAUDE_CODE_PROCESS_WRAPPER`: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
+- Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
+- Changed the Fable 5 usage-credits consent prompt to start with the decline option focused
+- Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings
+- Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts
+- Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running `claude agents` process was launched from
+- Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions
+- Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight
+- Fixed truncated stream-json/JSON output and missing result message when piping large responses from `claude -p`
+- Fixed `CLAUDE_CODE_MAX_OUTPUT_TOKENS` and similar env vars silently using the mantissa of scientific-notation values (`1e6` became `1`)
+- Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice
+- Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely
+- Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte
+- Fixed `apiKeyHelper` script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts
+- Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy
+- Fixed `/upgrade` showing a login flow instead of the upgrade URL when the browser fails to open
+- Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts
+- Fixed headless stream-json sessions hanging permanently when a `control_request` carried a non-string `set_model` payload; the CLI now answers with an error response
+- Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary
+- Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped
+- Fixed the Agent tool launching with no tools when a subagent's `tools` list resolves to nothing — it now returns a clear error naming the unrecognized entries
+- Fixed `/usage` showing stale cached bars over fresher data, and `/mcp` not reclassifying placeholder servers after config edits
+- Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task
+- Fixed the workflow save dialog showing `~/.claude/workflows/` instead of the `CLAUDE_CONFIG_DIR` location for user-scope saves
+- Fixed `/release-notes` adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request
+- Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies
+- Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached
+- Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads
+- Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line
+- Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached
+- Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI
+- Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)
+- Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files
+- Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups
+- Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations
+- Completed background agents now stay listed in `/tasks` until cleanup instead of vanishing the moment they finish
+- Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen
+- Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary
+- Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base
+- Catastrophic removals (e.g. `rm -rf ~`) in commands containing `$(…)`/backticks/`<(…)` now prompt in `--dangerously-skip-permissions` and auto mode, matching the plain form
+- `/install-github-app` and the `/mcp` settings menu no longer open in background sessions
+- MCP servers configured with an empty URL now show as "not configured" in `/mcp` instead of a config error
+- `/usage` now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen
+- Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)
+
+## 2.1.207
+
+- Auto mode is now available without `CLAUDE_CODE_ENABLE_AUTO_MODE` opt-in on Bedrock, Vertex AI, and Foundry; disable via `disableAutoMode` in settings
+- Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks
+- Fixed remote managed settings from a non-interactive run (`claude -p`, the SDK) being permanently recorded as consented without ever showing the security consent dialog
+- Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates
+- Fixed the auto-updater overwriting a custom launcher script or symlink at `~/.local/bin/claude` on every release; `/doctor` now reports an externally managed launcher
+- Fixed compound commands with `cd` prompting for permission when the only output redirect was to `/dev/null`
+- Fixed the transcript jumping above the start of the answer when a response finishes streaming
+- Fixed `extensions.worktreeConfig` being left in the repo's `.git/config` (breaking go-git tools like `tea`) after the last `worktree.sparsePaths` worktree was removed
+- Fixed malformed bracket patterns in rules globs, skill paths, `.ignore`, and `.worktreeinclude` breaking file reads, file suggestions, and worktree creation
+- Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted
+- Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row
+- Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list
+- Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh
+- Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web
+- Fixed Deep research runs labeling every Fetch-phase agent "unknown" — chips now show the source hostname
+- Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request
+- Improved agent view: pasting the same text again now expands the collapsed `[Pasted text #N]` placeholder instead of adding a second one
+- Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (`waiting 3m`) instead of the same timestamp twice
+- Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8
+- Changed auto mode to no longer read `autoMode` from `.claude/settings.local.json` (repo-resident); use `~/.claude/settings.json` instead
+- Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck `credential_process`): the 60-second stall guard now fires instead of waiting forever.
+- Plugin hooks/monitors/MCP headersHelper: `${user_config.*}` in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (`args` array) or `$CLAUDE_PLUGIN_OPTION_<KEY>`; monitors and headersHelper: read the value inside the script (config file or the server's `env` block).
+- Plugin option values (`pluginConfigs`) are no longer read from project-level `.claude/settings.json`; only user, `--settings`, and managed settings are honored
+- Fixed `/usage-credits` amount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation
+
+## 2.1.206
+
+- Added directory path suggestions to `/cd`, matching `/add-dir` behavior
+- Added a `/doctor` check that proposes trimming checked-in `CLAUDE.md` files by cutting content Claude could derive from the codebase
+- `/commit-push-pr` now auto-allows `git push` to the repo's configured push remote (`remote.pushDefault`, or the sole remote when only one is configured) in addition to `origin`
+- Gateway: `/login` now supports Anthropic-operated public gateway endpoints
+- `EnterWorktree` now asks for confirmation before entering a git worktree outside the project's `.claude/worktrees/` directory
+- Background agents now upgrade to a new version in the background right after a Claude Code update, instead of paying a slow stale-session upgrade when you attach
+- Fixed an expired login failing every model with a misleading "There's an issue with the selected model" error instead of prompting to run `/login`
+- Fixed `claude --resume` and `--continue` not responding to keyboard input on startup
+- Fixed MCP servers configured via `--mcp-config` or `.mcp.json` ignoring a per-server `request_timeout_ms`, which caused long-running MCP tool calls to time out at the 60s default in fresh sessions
+- Fixed `CLAUDE_CODE_EXTRA_BODY` being silently ignored by `claude agents` / `--bg` background workers; the shell-exported override now follows the dispatching session
+- Fixed OAuth MCP servers requiring manual re-authentication after a single failed token refresh
+- Fixed `--permission-prompt-tool` pointing at an MCP server crashing with "MCP tool not found" on cold start before the server finishes connecting
+- Fixed `/model` picker rows printing a price for a different model than the row named, and stopped quoting first-party list prices on providers that don't bill them
+- Fixed server-provided model rows being misplaced in the `/model` picker when an entitlement or allowlist restriction drops the row they were positioned against
+- Fixed desktop sessions getting stuck showing "running" after a slash command was sent mid-turn
+- Fixed keyboard input being ignored in the agents view when a setup prompt appeared before a bare `claude --resume` on Windows
+- Fixed `claude rm` leaving the removed job in the daemon roster, causing the row to reappear in `claude agents`
+- Fixed `/remote-control` showing "Unknown command" when logged out — it now explains how to sign in
+- Fixed left arrow not stepping back out of a phase or agent in the workflow detail view
+- Fixed `/status` listing the same broken-install warning twice
+- Fixed false "disused plugin" tips and skewed disuse telemetry for LSP plugins
+- Fixed `/doctor`'s update check to compare Homebrew installs against their cask's channel instead of the settings channel
+- Fixed the fullscreen jump-to-bottom pill suggesting Ctrl+End on macOS, not showing rebound chords, and wrapping over the transcript
+- Bedrock: fixed a multi-minute startup hang when using an `awsCredentialExport` helper on networks with restricted egress
+- Improved `/code-review` findings quality on claude-opus-4-8 across all effort levels
+- Improved agents view: status column now uses full terminal width instead of truncating at 64 characters
+- Changed agents view: Ctrl+X now permanently removes a completed session, and sessions no longer render twice; deleted background jobs stay deleted
+
+## 2.1.205
+
+- Added an auto mode rule that blocks tampering with session transcript files
+- Fixed `--json-schema` silently producing unstructured output when the schema was invalid, and schemas using the `format` keyword being rejected
+- Fixed a message sent while Claude was working being silently lost when the turn ended at the `--max-turns` limit
+- Fixed Windows worktree removal deleting files outside the worktree when an NTFS junction or directory symlink existed inside it
+- Fixed background agents staying shown as "failed" or "completed" in the agent list after being resumed with `SendMessage`
+- Fixed background jobs flipping from "needs input" back to "working" in the agent list when the agent's turn contained no readable text
+- Fixed `claude attach` erroring when a background agent was mid-upgrade restart instead of waiting for it to come back
+- Fixed session-to-PR linking missing a PR created in a Bash call whose output exceeded the 30K inline limit
+- Fixed `claude mcp add-from-claude-desktop` getting stuck when a server name contains unsupported characters; invalid names are now reported and remaining servers still import
+- Fixed a plugin LSP server that fails to initialize preventing a valid LSP server from another plugin handling the same file extension
+- Fixed a Windows crash when the directory Claude was launched from is deleted, locked, or unmounted while a command is running
+- Fixed a crash when a file watcher was closed while a directory scan was still in flight
+- Fixed project verify skills being rewritten on every session instead of only when a documented command changed
+- Fixed the agent view rendering one line too high and clipping its header when the job list slightly overflowed the screen
+- Fixed background tasks in the web and mobile Remote Control panels showing stale "Running" status by forwarding full task state on every membership change
+- Improved auto mode to ask before running `rm -rf` on a variable it can't resolve from context
+- Auto-update binary downloads now stream to disk instead of buffering in memory, cutting the updater's peak memory usage by roughly 400 MB
+- Background task notifications now explicitly state that no human input has occurred, preventing fabricated in-transcript approvals from being acted on
+- Improved agent view: sessions that edit, merge, comment on, or push to an existing PR now link it in `claude agents`
+- Improved agent view: rows now show a colored state word and a classifier-written headline instead of raw tool call text, and the peek opens with full status including the exact ask for blocked sessions
+- `/doctor` is now a full setup checkup that can diagnose and fix issues; `/checkup` is its alias
+- Reserved the "Claude Browser" MCP server name (alongside "Claude Preview") ahead of the Claude Desktop pane rename; user-configured MCP servers can no longer register under either name
+- Fixed Cowork VM-mode local-agent sessions failing to start with "Not logged in · Please run /login" on CLI 2.1.203+
+
+## 2.1.204
+
+- Fixed hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook
+
+## 2.1.203
+
+- Added a warning when your login is about to expire, so you can re-authenticate before background sessions are interrupted
+- Added a grey ⏸ badge to the footer when in manual permission mode, making the active mode always visible
+- Added the session's additional working directories to MCP `roots/list`, with `notifications/roots/list_changed` sent when the set changes
+- Fixed opening or switching background agent sessions on macOS stalling for 15–20 seconds due to a false low-memory detection (regression in 2.1.196)
+- Fixed background sessions becoming permanently unresponsive to attach, replies, and stop when the daemon's session token went stale — the session now recovers automatically
+- Fixed returning to `claude agents` silently stopping running subagents and re-running the prompt from scratch — their work now carries over
+- Fixed a memory and per-turn CPU regression in interactive sessions: the context-usage indicator no longer re-analyzes the entire transcript after every turn
+- Fixed background agents inheriting a stale `PATH` from the daemon instead of the dispatching shell, causing missing tools on Windows
+- Fixed background and agent-view sessions dropping a shell-exported `ANTHROPIC_BASE_URL`, which sent API keys to the default endpoint and failed with 401
+- Fixed Bash failing with "argument list too long" in repos with many git worktrees
+- Fixed worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree
+- Fixed worktree creation rejecting nested repositories in multi-repo workspaces, leaving background sessions unable to isolate and edit
+- Fixed background agents crash-looping when their working directory was deleted, replaced by a file, or became an invalid path — they now fail once with a clear error
+- Fixed a background daemon auto-upgrade failure silently killing all running background sessions
+- Fixed `TaskStop` and `TaskOutput` failing to find background agents spawned by another agent — errors now list running agents by id and description
+- Fixed the `claude agents` composer discarding your typed message when a slash command isn't available there
+- Fixed the agent list crashing when opening a stopped session whose conversation was already open in another session
+- Fixed background sessions showing "Needs input" in the agent list after the question was already answered
+- Fixed background agent startup failures showing only "exit_with_message" instead of the actual error
+- Fixed background sessions ignoring `effortLevel` changes in settings.json when forked through the daemon
+- Fixed attached background sessions ignoring `CLAUDE_CODE_DISABLE_MOUSE` and `CLAUDE_CODE_DISABLE_MOUSE_CLICKS` opt-outs
+- Fixed `/exit` incorrectly warning about running background agents after all named agents had completed
+- Fixed background sessions started from a non-git directory unable to edit files when a `WorktreeCreate` hook was configured
+- Fixed the `@` directory picker in `claude agents` not showing registered git worktrees
+- Fixed background task output on Windows being permanently replaced by an empty file after `/clear`
+- Fixed content jumping when scrolling up through long transcript history
+- Fixed the terminal flickering and jumping while typing in bash mode when a shell-history suggestion was shown
+- Fixed literal `^[[I` / `^[[O` escape codes being printed when reattaching to a background session
+- Fixed LSP-only plugins being incorrectly flagged for disuse when their language servers deliver diagnostics or answer navigation requests
+- Improved responsiveness while long responses stream: live-preview updates no longer re-render the whole screen
+- Improved subagent behavior: agents are now less likely to re-delegate their entire task to another subagent
+- Reduced binary size by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily instead of inlining it
+- Changed left arrow to no longer close the background tasks, diff, and workflow detail views — press Esc instead
+- Changed the empty `claude agents` view to always show the organized sections (Needs input / Working / Completed) with descriptions
+- Removed the startup "claude command missing or broken" warnings — they now appear in `/doctor` and `/status` instead
+- Removed a redundant navigation hint from the `claude agents` footer
+- [VSCode] Added a Settings toggle for "Enable Remote Control for all sessions"
+
+## 2.1.202
+
+- Added a "Dynamic workflow size" setting in `/config` for controlling how large Claude generally makes dynamic workflows (small/medium/large agent counts) — an advisory guideline, not an enforced cap
+- Added `workflow.run_id` and `workflow.name` OpenTelemetry attributes to telemetry emitted by workflow-spawned agents, so a workflow run's activity can be reconstructed from OTel data
+- Fixed a crash in the inline Ctrl+R history search when accepting or cancelling while the search was still scanning the history file
+- Fixed `/rename` on background sessions being reverted when the job restarts, which broke addressing the session by its new name
+- Fixed transient mTLS handshake failures when settings were re-applied during an in-place client certificate rotation
+- Fixed commands sent from Remote Control (mobile/web) into an interactive session failing with "Unknown command"
+- Fixed images and files sent from the Remote Control mobile or web app without a caption being silently dropped
+- Fixed the sign-in URL printed by `claude auth login` and `claude mcp login --no-browser` not being reliably clickable when it wraps over SSH — it is now emitted as a single hyperlink
+- Fixed opening a chat from `claude agents` sometimes failing with "currently running as a background agent" followed by a worker crash/respawn loop
+- Fixed workflow scripts with unicode quote escapes in strings being corrupted before parsing; workflow parse errors now show the offending line instead of always blaming TypeScript
+- Fixed voice dictation retrying in an unbounded loop when the microphone or audio recorder fails — repeated capture failures now pause voice input
+- Fixed `/remote-control` sessions showing the wrong permission mode in the mobile and web apps
+- Fixed resuming a session by name, or opening the resume picker, taking minutes and using a large amount of memory in repositories with many git worktrees
+- Fixed installer and updater downloads failing immediately with "aborted" when a proxy or network drops the connection mid-download — transient connection drops now retry
+- Fixed re-invoking an already-loaded skill appending a duplicate copy of its instructions to context
+- Improved `/workflows` agent list layout: wider titles, a dedicated time column, shorter model names, and no per-row tool-call counts
+- Improved MCP error messages: clearer error when a server config has `url` but no `type`, suggesting `"type": "http"` instead of the misleading "command: expected string"
+- Changed `/review <pr>` back to a fast single-pass review; use `/code-review <level> <pr#>` for the multi-agent review at a chosen effort level
+
+## 2.1.201
+
+- Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders
+
+## 2.1.200
+
+- Changed `AskUserQuestion` dialogs to no longer auto-continue by default; opt into an idle timeout via `/config`
+- Changed the "default" permission mode to "Manual" across the CLI, `--help`, VS Code, and JetBrains; `--permission-mode manual` and `"defaultMode": "manual"` are accepted alongside `default`
+- Fixed a crash at startup when `disabledMcpServers` or `enabledMcpServers` in `.claude.json` is set to a non-array value
+- Fixed background sessions silently stopping mid-turn after sleep/wake or when reopening a stalled session
+- Fixed background sessions re-running a turn cancelled with Esc after a stall respawn
+- Fixed background agents never starting again after a crash left a stale `daemon.lock` whose PID the OS reused
+- Fixed background-agent daemon handover so a reinstalled older build can no longer take over the daemon; build recency is now judged by the version's embedded build timestamp
+- Fixed background-agent roster issues: transient corruption permanently disabling orphan cleanup, older binaries not preserving fields written by newer versions, and socket auth tokens being stripped during daemon restarts
+- Fixed subagents cut off by a rate limit before producing any text output returning an empty result instead of failing cleanly
+- Fixed control bytes from background-agent output reaching the terminal in the agent view
+- Fixed `claude agents --plugin-dir <dir>` not showing the plugin's agents and skills in the agent view when the flag is placed after `agents`
+- Fixed project-scoped plugins not loading correctly from git worktrees of the same repository
+- Fixed `/mcp` server list not tracking focus for screen readers and magnifiers
+- Fixed voice dictation showing a misleading "Voice connection failed" message when a recording captures no audio
+- Fixed rendering flicker under tmux 3.4+ by enabling synchronized terminal output
+- Improved screen-reader output: decorative glyphs are now hidden, transcript symbols read as short labels, and nested tables read as `Header: value.` lines
+- Improved the install script to explain when installation is killed by the system running out of memory
+
+## 2.1.199
+
+- Stacked slash-skill invocations like `/skill-a /skill-b do XYZ` now load all leading skills (up to 5), not just the first
+- Fixed SSL certificate errors (TLS-inspecting proxies, missing `NODE_EXTRA_CA_CERTS`, expired certs) burning retries before showing actionable guidance — they now fail immediately with the fix hint
+- Fixed streaming responses being discarded when the API emits a mid-stream overloaded/server error after partial output — the partial is now kept with an incomplete-response notice
+- Fixed subagents cut off by a rate limit or server error silently failing instead of returning their partial work to the parent
+- Fixed subagents reporting API errors (e.g. usage limit reached) as successful results — the error is now reported to the parent agent
+- Fixed the background-agent daemon on Linux killing itself and every running agent every ~50 seconds after an unclean shutdown left a corrupted worker record
+- Fixed background agents failing to cold-start over SSH on macOS with "Could not switch to audit session" (regression in 2.1.196)
+- Fixed `claude stop` being silently undone when it raced a background-agent respawn — the respawn now honors the stop
+- Fixed background job progress indicators stalling for minutes while the job ran long commands
+- Fixed background sessions on memory-starved machines showing a generic error — they now indicate low memory and suggest freeing resources
+- Fixed remote sessions briefly flapping between Working and Idle in the agent view when a background agent completes
+- Fixed idle subagents vanishing from the agent panel while other subagents were still working; surplus idle agents now collapse into an expandable summary row
+- Fixed typing `/model` or `/fast` while viewing a subagent silently opening the lead's model picker — a notice now explains the command applies to the lead
+- Fixed `SessionStart`, `Setup`, and `SubagentStart` hooks silently hiding stderr when exiting with code 2 — the error is now shown in the transcript
+- Fixed `claude --dangerously-skip-permissions daemon <subcommand>` being treated as a chat prompt instead of running the subcommand
+- Fixed `SendMessage` silently misrouting when a re-spawned agent reuses a previous agent's name — the tool now detects the mismatch and asks the caller to retarget
+- Fixed opening or resuming a session with no new messages needlessly growing the transcript file
+- Fixed backgrounding a session with `←` or `/background` dropping its `/color` from the agent view row
+- Fixed resetting a corrupted config file from the startup recovery dialog destroying it unrecoverably — it now backs up the file first
+- Fixed Claude in Chrome repeatedly opening the reconnect page when sessions run from different builds or config directories
+- Fixed plan mode not prompting for state-changing browser tool calls; read-only `browser_batch` calls are now correctly auto-allowed
+- Transient server rate-limit errors (429s unrelated to your usage limit) are now retried automatically with backoff for subscribers instead of failing the turn
+- `CLAUDE_CODE_RETRY_WATCHDOG` now raises the default retry count for non-capacity transient errors to 300 and lifts the cap of 15 on `CLAUDE_CODE_MAX_RETRIES`
+- `claude agents` session rows now show pull-request links as bare `#N` without the redundant "PR" label
+
+## 2.1.198
+
+- Subagents now run in the background by default, so Claude keeps working while they run and is notified when they finish (previously a gradual rollout)
+- Claude in Chrome is now generally available
+- Added background agent notifications in `claude agents` — sessions that need input or finish now fire the `Notification` hook (`agent_needs_input` / `agent_completed`)
+- Added `/dataviz` skill for chart and dashboard design guidance with a runnable color-palette validator
+- Gateway: added Claude Platform on AWS (anthropicAws) as an upstream provider; model-not-found responses now advance the failover chain
+- Background agents launched from `claude agents` now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask
+- The built-in Explore agent now inherits the main session's model (capped at opus) instead of running on haiku
+- Subagents and context compaction now inherit the session's extended thinking configuration, improving output quality on delegated tasks
+- Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing
+- Fixed excessive background classifier requests when sandboxed processes repeatedly accessed the same network host
+- Fixed background tasks in web, desktop, and VS Code task panels getting stuck on "Running" after they finish or after resuming a session
+- Fixed agent teams: a teammate that dies on an API error now reports "failed" to the lead, and messaging a stuck teammate wakes it to retry immediately
+- Fixed the `/diff` panel not refreshing when you switch branches or commit outside the session
+- Fixed markdown tables overflowing and wrapping their right border when rendered in fullscreen mode
+- Fixed Claude Platform on AWS and Mantle sessions dead-ending with "Please run /login" when the STS token expires — `awsAuthRefresh` now runs automatically
+- Fixed "no route to host" for local-network hosts in macOS background agent sessions by declaring Local Network entitlements
+- Fixed `/desktop` failing with "Cannot determine working directory" after entering and exiting a worktree
+- Fixed background agents repeatedly showing "Reconnecting…" every ~52 seconds on macOS while the agents view was open
+- Fixed pressing `←` inside `claude attach <id>` exiting to the shell instead of opening the agent view
+- Fixed `claude --bg` silently creating an unattachable session when combined with `--print`/`-p`; the conflicting flags are now rejected up front
+- Fixed the workflow progress view dropping the earliest agents from the list while the phase counter stayed correct in SDK and desktop-app sessions
+- Fixed `.claude/rules/` conditional rules not loading when the target file is reached via a symlinked path
+- Fixed Cmd+click not opening URLs in fullscreen mode in Warp on macOS
+- Fixed double-click word selection in fullscreen mode to select the entire URL including the scheme
+- Fixed plan mode not auto-allowing read-only tool calls when a session starts in plan mode
+- Fixed `/branch` deriving its default fork name from the compaction summary instead of the first real prompt
+- Improved focus mode: subagents launched in a turn now appear in its activity summary, and completed background notifications fold into a single count
+- Improved syntax highlighting accuracy in code blocks, diffs, and file previews by upgrading to highlight.js 11
+- Keyboard shortcut hints now show opt/cmd instead of alt/super when connected from a Mac over SSH
+- Improved API retry UX: the error reason is now shown after the second attempt, and a status page link replaces the spinner tip when the API is overloaded
+- `/login` now opens the sign-in dialog from the `claude agents` view instead of saying it isn't available
+- Subagents now treat messages from the agent that launched them as normal task direction; an agent's message is still never treated as the user's approval
+- Removed the `/agents` wizard; ask Claude to create or manage subagents, or edit `.claude/agents/` directly
+
+## 2.1.197
+
+- Introducing Claude Sonnet 5: now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31. Update to version 2.1.197 for access. https://www.anthropic.com/news/claude-sonnet-5
+
+## 2.1.196
+
+- Added support for organization default models — admins set it in the org console; it shows as "Org default" (or "Role default") in `/model` when you haven't picked one yourself
+- Added readable default names for sessions at start, making them easier to identify and message
+- Added clickable file attachments in chat — Cmd/Ctrl-click reveals the file in Finder/Explorer
+- Security: `claude mcp list`/`get` no longer spawn `.mcp.json` servers that a repo self-approved via a committed `.claude/settings.json`; untrusted workspaces show `⏸ Pending approval`
+- Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
+- Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit
+- Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry
+- Fixed PowerShell `git diff`/`git grep`, `egrep`/`fgrep`, and quoted search patterns containing `|` being reported as failures when they exit 1, matching Bash behavior
+- Fixed multiple `claude agents` side panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running
+- Fixed `claude agents --dangerously-skip-permissions` silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents
+- Fixed mid-turn crash recovery for Remote sessions — sessions interrupted by a server restart now auto-resume on the next worker
+- Fixed sessions moved with `/cd` reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters
+- Fixed `claude plugin validate` skipping local plugins whose source is "." and stopping after the first error class
+- Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
+- Fixed MCP OAuth requesting the authorization server's full `scopes_supported` catalog when no scope is specified, causing `invalid_scope` failures on GitLab self-hosted and other enterprise IdPs
+- Fixed `/context` showing 0 tokens for all tool groups on Bedrock
+- Fixed `/deep-research` misreporting verifier failures as "all claims refuted" instead of `unverified`
+- Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
+- Fixed `claude agents` session status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link
+- Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
+- Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated — including on Windows, where background shells are handed off instead of being killed
+- Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens
+- Improved `/code-review` workflow: merged five cleanup finders into one, cutting token usage by roughly 25%
+- Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
+- The streaming idle watchdog is now on by default for all providers — it aborts and retries when a response stream produces no events for 5 minutes. Set `CLAUDE_ENABLE_STREAM_WATCHDOG=0` to disable.
+- Remote Control is now disabled when `ANTHROPIC_BASE_URL` points at a non-Anthropic host, matching the existing behavior under `CLAUDE_CODE_USE_BEDROCK`/`_VERTEX`/`_FOUNDRY`
+- Changed opening the agents view from a foreground session to require a single `←` press instead of two, matching the behavior in background sessions
+
+## 2.1.195
+
+- Added `CLAUDE_CODE_DISABLE_MOUSE_CLICKS` to disable mouse click/drag/hover in fullscreen mode while keeping wheel scroll
+- Fixed hook matchers with hyphenated identifiers (e.g. `code-reviewer`, `mcp__brave-search`) accidentally substring-matching — they now exact-match. Use `mcp__brave-search__.*` to match all tools from a hyphenated MCP server.
+- Fixed voice dictation on macOS capturing silence in long-running sessions after the default input device changes
+- Fixed voice dictation auto-submit never firing for languages written without spaces (Japanese, Chinese, Thai)
+- Fixed external plugins enabled only by project `.claude/settings.json` not requiring explicit install consent on every loader path
+- Fixed `/plugin` Enable/Disable not working when a plugin's `plugin.json` `name` differs from its marketplace entry name
+- Fixed background jobs disappearing from `claude agents` or losing data when written by a newer Claude Code version
+- Fixed reopening a crashed background task showing a blank screen for up to 5 seconds instead of its restart
+- Fixed background agent daemons running unreachable when the control socket fails to start, blocking restarts
+- Improved voice mode on Linux: now distinguishes "no microphone" from "SoX not installed" when SoX is present but no audio capture device exists
+- Improved `claude agents` completed list to fill available vertical space; on short terminals the header compacts so live sessions stay visible
+- Improved Remote session startup with a provisioning checklist while the container starts
+
+## 2.1.193
+
+- Added `autoMode.classifyAllShell` setting to route all Bash/PowerShell commands through the auto-mode classifier instead of only arbitrary-code-execution patterns
+- Added auto-mode denial reasons to the transcript, the denial toast, and `/permissions` recent denials
+- Added `claude_code.assistant_response` OpenTelemetry log event containing the model's response text. Redacted unless `OTEL_LOG_ASSISTANT_RESPONSES=1`; when that var is unset it follows `OTEL_LOG_USER_PROMPTS`, so deployments that already log prompt content will start receiving response content on upgrade — set `OTEL_LOG_ASSISTANT_RESPONSES=0` to keep prompts-only.
+- Added live file path autocomplete to bash mode (`!`)
+- Added a startup notice when MCP servers need authentication, pointing at `/mcp`
+- Added automatic memory-pressure reaping for idle background shell commands (disable with `CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1`)
+- Fixed `/model` and other client-data-gated UI showing stale/empty state immediately after `/login`
+- Fixed backgrounding (←←) spuriously cancelling with "N background tasks would be abandoned" when all running tasks carry over to the new session
+- Fixed pinned background agents being re-prompted to "Continue from where you left off" after every auto-update
+- Fixed backgrounding the main turn spawning a phantom "general-purpose (resumed)" subagent that re-ran the main conversation
+- Fixed agent panel hiding sibling agents when viewing a subagent
+- Improved background agents: the launch result no longer instructs Claude to "end your response" — it keeps working on other tasks while the agent runs
+- Improved MCP `headersHelper` auth: the helper now re-runs and reconnects automatically when a tool call returns 401/403
+- Improved plugin auto-rename: marketplace `renames` maps are now followed automatically, updating your settings to the new name
+- Improved `/add-dir` message when the directory is already a working directory
+
+## 2.1.191
+
+- Added `/rewind` support for resuming a conversation from before `/clear` was run
+- Fixed scroll position jumping to the bottom while reading earlier output during a streaming response
+- Fixed background agents resurrecting after being stopped — stopping an agent from the tasks panel is now permanent
+- Fixed `/voice` showing a generic "not available" message when disabled by an organization's policy — it now explains the restriction
+- Fixed `/login` URL opening truncated in Windows Terminal when it wraps across lines
+- Fixed Cmd+click on links in fullscreen mode for Ghostty over ssh/tmux
+- Fixed `claude agents` sending builtin slash commands like `/usage` to background sessions as prompt text instead of showing a hint
+- Fixed `claude agents` job rows showing full filesystem paths for pasted images instead of the `[Image #N]` placeholder
+- Fixed hooks with comma-separated matchers (e.g. `"Bash,PowerShell"`) silently never firing
+- Fixed `/permissions` Recently-denied tab: approving a denial now persists on close instead of being silently discarded
+- Fixed the agent panel jumping by one row when scrolling the roster past the overflow cap
+- Fixed the welcome splash art overflowing the default 80×24 macOS Terminal window
+- Fixed managed settings: `forceRemoteSettingsRefresh` now takes effect when set via MDM or file policy, and the fetch sends `Cache-Control: no-cache` to prevent proxies from serving stale responses
+- Improved sandbox network permission dialog: hosts you allow with "Yes" are now remembered for the rest of the session instead of re-prompting on every connection
+- Improved MCP server reliability: capability discovery (`tools/list`, `prompts/list`, `resources/list`) now retries transient network errors with short backoff
+- Improved MCP OAuth: discovery and token requests now retry once after transient network errors, and headless environments skip the browser popup and go straight to the paste-the-URL prompt
+- Improved MCP error messages: HTTP 404 errors now show the URL and point to your MCP config
+- Improved vim mode prompt-history search (NORMAL `/`) to hint how to reach slash commands
+- Reduced CPU usage during streaming responses by ~37% by coalescing text updates to 100ms
+- Reduced long-session memory growth from terminal output cache
+
+## 2.1.190
+
+- Bug fixes and reliability improvements
+
+## 2.1.187
+
+- Added `sandbox.credentials` setting to block sandboxed commands from reading credential files and secret environment variables
+- Added org-configured model restrictions to the model picker, `--model`, `/model`, and `ANTHROPIC_MODEL`, with a "restricted by your organization's settings" message when a restricted model is selected
+- Added mouse click support to select menus (permission prompts, `/model`, `/config`, etc.) in fullscreen mode
+- Fixed `--resume` failing with "No conversation found" when the original `-p` run produced no model turns
+- Fixed `--json-schema` and workflow `agent({schema})` structured output: the model can no longer re-call `StructuredOutput` indefinitely after a successful call, and follow-up turns now reliably return structured output
+- Fixed remote MCP tool calls that hang with no response for 5 minutes — they now abort with an error instead of blocking indefinitely (override with `CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT`)
+- Fixed Claude Code Remote sessions taking ~2.7s longer to start after the agent proxy CA system-trust install was added
+- Fixed pasted Korean/CJK text turning into mojibake in terminals that deliver paste as per-byte extended-key events
+- Fixed `/update` over Remote Control hanging when a startup trust dialog would have shown
+- Fixed background jobs in the agents view getting stuck in "working" indefinitely when the agent ended a turn without producing structured output
+- Fixed channel connections dropping after navigating to the agents view and back, and after `/bg`, `/tui`, or `/update`
+- Fixed agent stop notifications not correctly attributing who stopped the agent, and improved wording ("finished"/"stopped" instead of "came to rest")
+- Fixed subagent depth tracking: resumed subagents now restore their original spawn depth, and forked subagents now count toward the depth cap
+- Fixed leaked agent worktree registrations: locked `.git/worktrees/` entries from killed agents are now cleaned up automatically
+- Fixed Cmd+click not opening URLs in fullscreen mode in Ghostty on macOS
+- Fixed `claude --help` not listing the `--bg`/`--background` flag
+- Fixed Esc, Ctrl-C, and Ctrl-D not working while `/share` is uploading
+- Improved `/install-github-app`: GitHub Actions workflow setup is now optional — you can install just the GitHub App and skip the workflow/secret steps
+- Improved `/btw` with ←/→ arrow navigation to step through earlier answers
+- Improved `/plugin` to surface plugins you haven't used recently so you can clean them up
+- [VSCode] Fixed extension becoming unresponsive when resuming a large session
+
+## 2.1.186
+
+- Added `claude mcp login <name>` and `claude mcp logout <name>` to authenticate MCP servers from the CLI without opening the interactive `/mcp` menu, with `--no-browser` stdin redirect support for completing over SSH
+- Added status filtering (press `f`) to the `/workflows` agent detail view
+- Added a "Skills" section to the `/plugin` Installed tab
+- Added `teammateMode: "iterm2"` setting with a warning when auto mode cannot find the `it2` CLI
+- Added "Claude Platform on AWS - refresh credentials" option to `/login` when `awsAuthRefresh` is configured
+- `!` bash commands now trigger Claude to respond to the output automatically; set `"respondToBashCommands": false` in settings.json to keep the previous context-only behavior
+- Fixed streaming requests failing with "Content block not found" or JSON parse errors after the machine wakes from sleep
+- Fixed subagent transcript scroll position bleeding into the main transcript on exit
+- Fixed background task previews flashing raw tool names before the agent's plan loaded
+- Fixed Chrome tab-group isolation not applying when the in-product permissions gate is off for concurrent CLI sessions
+- Fixed background session recaps being duplicated; the agent's own end-of-turn summary now shows as the recap line
+- Fixed opening a background session from `claude agents` leaving the previous screen painted behind it
+- Fixed `Agent(type)` deny rules and `Agent(x,y)` allowed-types restrictions not being enforced for named subagent spawns
+- Fixed Esc and Ctrl+C not responding while background agents are still running after the main turn ends
+- Fixed misaligned option numbers in permission prompts when the option text overflows
+- Fixed pressing `x` on a finished subagent in the agent panel not dismissing it
+- Fixed a misleading "MCP server disconnected" notice for intentionally retired tools when resuming older sessions
+- Fixed `/plugin` Installed showing a "more above" indicator when already scrolled to the top
+- Fixed `~~strikethrough~~` showing literal tildes in assistant messages instead of rendering as strikethrough
+- Fixed `--tools` allowing feature-gated tools to slip through before flags loaded on a cold first launch
+- Fixed background job status in `claude agents` showing a stale "needs input" message after replying
+- Fixed a dark-theme flash when opening a background session from `claude agents` on a light terminal
+- Fixed mouse-selected text staying highlighted after deleting it in `claude agents`
+- Fixed session cost not showing for usage-based Enterprise and Team subscribers
+- Fixed agent teams: teammates spawned via tmux/pane backends now inherit the leader's `--effort` level
+- Fixed Workflow `agent({schema})` subagents looping forever on repeated schema validation failures instead of aborting after 5 attempts
+- Improved `claude mcp get` and `claude mcp remove` to suggest the closest configured server name on a typo and truncate long server lists
+- Improved memory: the agent is now reminded to compact its `MEMORY.md` index when nearing the size limit
+- Improved skill frontmatter: `display-name`, `default-enabled`, `fallback`, and `metadata.*` keys now accept kebab-case, snake_case, and camelCase
+- Improved malformed `SKILL.md` YAML frontmatter handling: loads the skill body with empty metadata instead of failing silently
+- Changed `CLAUDE_CODE_MAX_RETRIES` to cap at 15; for unattended sessions, use `CLAUDE_CODE_RETRY_WATCHDOG` instead
+- Changed background subagents to surface permission prompts in the main session instead of auto-denying; the dialog shows which agent is asking, and Esc denies just that tool
+- Changed `/review <pr>` to use the same review engine as `/code-review medium`
+
+## 2.1.185
+
+- The stream-stall hint now reads "Waiting for API response · will retry in …" instead of "No response from API · Retrying in …", and triggers after 20s of silence instead of 10s
+
+## 2.1.183
+
+- Improved auto mode safety: destructive git commands (`git reset --hard`, `git checkout -- .`, `git clean -fd`, `git stash drop`) are now blocked when you didn't ask to discard local work, `git commit --amend` is blocked when the commit wasn't made by the agent this session, and `terraform destroy`/`pulumi destroy`/`cdk destroy` are blocked unless you asked for the specific stack
+- Added a warning when the requested model is deprecated or automatically updated to a newer model, shown on stderr in print mode (`-p`) and now also covering models set in agent frontmatter
+- Added `attribution.sessionUrl` setting to omit the claude.ai session link from commits and PRs in web and Remote Control sessions
+- Added `/config --help` to list all available shorthand keys for `/config key=value`
+- Changed `/config` toggle behavior: Enter and Space both change the selected setting, and Esc now saves and closes instead of reverting
+- Removed the startup "setup issues" line under the logo — run `/doctor` to see configuration issues or use `--debug`
+- Fixed `thinking.disabled.display: Extra inputs are not permitted` 400 errors on subagent spawns and session-title generation for affected configurations
+- Fixed WebSearch returning empty results in subagents
+- Fixed the terminal cursor being stranded above the prompt after navigating history in vim mode with the native cursor enabled
+- Fixed fullscreen TUI corruption (statusline mid-screen, duplicated spinner rows, merged text) in Windows Terminal under heavy nested-subagent load
+- Fixed turns silently completing with no visible output when the model returned only a thinking block; Claude now re-prompts once
+- Fixed user-level skills appearing multiple times in slash-command autocomplete when multiple plugins are enabled
+- Fixed MCP servers requiring authentication exposing auth-stub tools to the model in headless/SDK mode
+- Fixed tmux teammate panes failing to launch when the shell has slow rc-file initialization, and keystrokes typed during agent spawn leaking into the new tmux pane instead of the leader prompt
+- Fixed background tasks started by a teammate being killed when the teammate finishes a turn
+- Fixed scheduled task and webhook trigger deliveries being treated as keyboard input; they now classify as task notifications and can no longer approve a pending action or set the session title in auto mode
+- Fixed focus mode showing "Ran N PostToolUse hooks" timing lines under each response
+
 ## 2.1.181
 
 - Added `/config key=value` syntax to set any setting from the prompt (e.g. `/config thinking=false`) — works in interactive, `-p`, and Remote Control
@@ -56,6 +769,7 @@
 
 ## 2.1.178
 
+- Agent teams: removed the `TeamCreate` and `TeamDelete` tools. With `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` set, every session now has one implicit team — spawn teammates directly with the Agent tool's `name` parameter, no setup step needed. The `team_name` parameter on the Agent tool is still accepted but ignored.
 - Added `Tool(param:value)` syntax for permission rules to match a tool's input parameters (with `*` wildcard), e.g. `Agent(model:opus)` to block Opus subagents
 - Skills in nested `.claude/skills` directories now load when working on files there; on a name clash, the nested skill appears as `<dir>:<name>` so both stay available
 - Nested `.claude/` directories: the agent, workflow, and output-style closest to the working directory now wins when names collide; project-scope workflow saves now target the closest existing `.claude/workflows/`
@@ -3017,7 +3731,7 @@
 
 ## 2.1.15
 
-- Added deprecation notification for npm installations - run `claude install` or see https://docs.anthropic.com/en/docs/claude-code/getting-started for more options
+- Added deprecation notification for npm installations - run `claude install` or see https://code.claude.com/docs/en/setup for more options
 - Improved UI rendering performance with React Compiler
 - Fixed the "Context left until auto-compact" warning not disappearing after running `/compact`
 - Fixed MCP stdio server timeout not killing child process, which could cause UI freezes

examples/gateway/aws/.dockerignore

@@ -0,0 +1,19 @@
+# Keep secrets and generated artifacts out of the build context. The Dockerfile
+# COPYs the binary, gateway.yaml (unlike the GCP example, the config is baked
+# into the image — ECS injects only the secrets it references, as env vars),
+# and the RDS CA bundle. BuildKit (the default builder) only syncs the
+# referenced COPY sources anyway, so this is a denylist for the classic
+# builder (DOCKER_BUILDKIT=0) and a conventional signal that the .gitignore'd
+# secrets in this directory aren't part of the image build.
+terraform/
+**/.terraform/
+*.tfstate*
+terraform.tfvars
+secrets/
+*.pem
+# The RDS CA bundle is public trust-anchor material (no secret), and the
+# Dockerfile COPYs it — carve it out of the *.pem exclusion above.
+!rds-global-bundle.pem
+*.iam.json
+claude.download
+claude.bad

examples/gateway/aws/.gitignore

@@ -0,0 +1,18 @@
+# Local, environment-specific config — copy gateway.yaml.example -> gateway.yaml
+# (gateway.yaml.example IS committed; your filled-in gateway.yaml is not)
+gateway.yaml
+
+# Secrets / credentials — never commit. Also covers rds-global-bundle.pem:
+# not a secret, but downloaded by setup.sh when absent (delete it to refresh
+# after an RDS CA rotation), so it stays out of git.
+secrets/
+*.pem
+
+# Scratch IAM policy documents written by setup.sh (no secrets, but generated)
+*.iam.json
+
+# Vendored release binary — download per release (see setup.sh DIST_URL).
+# claude.bad is a checksum-mismatched binary that setup.sh set aside.
+claude
+claude.download
+claude.bad

examples/gateway/aws/Dockerfile

@@ -0,0 +1,67 @@
+# Runtime image for `claude gateway`.
+#
+# This image does NOT build the binary. It expects a prebuilt native
+# linux-x64 `claude` executable in the build context — the Claude Code release
+# binary, which includes the `gateway` subcommand. setup.sh places it at
+# ./claude (downloading and checksum-verifying it via DIST_URL/DIST_SHA256 if
+# missing). Override CLAUDE_BINARY to point at a different path.
+#
+# Unlike the GCP example (which mounts the config from Secret Manager at
+# runtime), this image BAKES gateway.yaml in at /etc/claude/gateway.yaml — on
+# ECS the task definition injects only the secrets the YAML references, as env
+# vars. gateway.yaml therefore must be fully filled in (no REPLACE_ME) before
+# building; setup.sh enforces this. A config edit means a rebuild under a new
+# tag. The file contains no secret values — every credential resolves at boot
+# via ${ENV_VAR} expansion.
+#
+# The image also bakes in the AWS RDS CA bundle (rds-global-bundle.pem —
+# setup.sh downloads it from https://truststore.pki.rds.amazonaws.com before
+# the build) and trusts it via NODE_EXTRA_CA_CERTS, so the store connection
+# string's `?sslmode=verify-full` verifies the RDS server certificate chain
+# and hostname. NOTE the gateway's driver reads `sslmode` from the URL but NOT
+# a libpq-style `sslrootcert=` param — the CA must come from this env var.
+#
+# Build:
+#   docker build --platform=linux/amd64 --provenance=false \
+#     --build-arg CLAUDE_BINARY=./claude -t claude-gateway .
+#
+#   (For Fargate on ARM64/Graviton: build --platform=linux/arm64 with the
+#   linux-arm64 binary and set the task definition's cpuArchitecture to ARM64.)
+#
+# Run:
+#   docker run --rm -p 8080:8080 \
+#     -e OIDC_CLIENT_SECRET -e GATEWAY_JWT_SECRET -e GATEWAY_POSTGRES_URL \
+#     claude-gateway
+
+ARG CLAUDE_BINARY=./claude
+ARG GATEWAY_CONFIG=./gateway.yaml
+ARG RDS_CA_BUNDLE=./rds-global-bundle.pem
+
+# distroless/cc provides glibc + libstdc++ (required by the Bun-compiled
+# native binary). The :nonroot tag runs as uid/gid 65532. Pinned by digest so
+# the build never silently takes new upstream bytes (the digest is the
+# multi-arch OCI index, so --platform still selects amd64/arm64). To refresh
+# the pin after reviewing upstream changes:
+#   docker manifest inspect -v gcr.io/distroless/cc-debian12:nonroot   # prints the index digest
+FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151
+
+ARG CLAUDE_BINARY
+ARG GATEWAY_CONFIG
+ARG RDS_CA_BUNDLE
+COPY --chmod=0755 ${CLAUDE_BINARY} /usr/local/bin/claude
+# WORKDIR pre-creates /etc/claude with 0755 — without it, COPY --chmod would
+# also stamp the auto-created parent directory 0644 (no execute bit), making
+# the config unreadable for the nonroot user.
+WORKDIR /etc/claude
+COPY --chmod=0644 ${GATEWAY_CONFIG} /etc/claude/gateway.yaml
+COPY --chmod=0644 ${RDS_CA_BUNDLE} /etc/claude/rds-global-bundle.pem
+WORKDIR /
+
+ENV CLAUDE_CONFIG_DIR=/tmp/.claude
+# Trust anchor for the store's sslmode=verify-full (see header comment).
+ENV NODE_EXTRA_CA_CERTS=/etc/claude/rds-global-bundle.pem
+
+EXPOSE 8080
+USER nonroot
+
+ENTRYPOINT ["/usr/local/bin/claude", "gateway", "--config", "/etc/claude/gateway.yaml"]

examples/gateway/aws/README.md

@@ -0,0 +1,19 @@
+# Claude apps gateway on AWS
+
+Reference deployment artifacts for running Claude apps gateway on AWS with
+Amazon Bedrock as the upstream: ECS on Fargate or EKS, Amazon RDS for
+PostgreSQL, AWS Secrets Manager, and IAM-role auth to Bedrock.
+
+These files are provided as a working example rather than a supported production
+deployment. Adapt them to your own environment.
+
+- **Walkthrough**: https://code.claude.com/docs/en/claude-apps-gateway-on-aws
+- **Related**: AWS-maintained samples for various customer environments at
+  https://github.com/aws-samples/anthropic-on-aws/tree/main/claude-apps-gateway
+
+| File | Purpose |
+|---|---|
+| `setup.sh` | Scripts the walkthrough end to end via the `aws` CLI |
+| `Dockerfile` | Runtime image for the `claude gateway` binary (bakes in `gateway.yaml`) |
+| `gateway.yaml.example` | Gateway config template, AWS-shaped (Bedrock upstream, Okta IdP) |
+| `terraform/` | Provisions the full architecture (two-pass apply — see `terraform/README.md`) |

examples/gateway/aws/gateway.yaml.example

@@ -0,0 +1,174 @@
+# gateway.yaml.example — Claude apps gateway config template, AWS-shaped (walkthrough §4).
+#
+# Okta IdP + Bedrock upstream, following the walkthrough at
+# https://code.claude.com/docs/en/claude-apps-gateway-on-aws. The active sections
+# below are a strict subset of the full configuration reference at
+# https://code.claude.com/docs/en/claude-apps-gateway-config; optional keys are
+# included commented-out.
+#
+# USAGE — this is the shippable TEMPLATE. Copy it to gateway.yaml and fill it in:
+#     cp gateway.yaml.example gateway.yaml
+#   setup.sh and terraform/ read gateway.yaml (your filled-in copy, which is
+#   gitignored). Unlike the GCP example it is NOT published to a secret store:
+#   the Dockerfile bakes it into the image at /etc/claude/gateway.yaml — the
+#   container ENTRYPOINT runs `claude gateway --config /etc/claude/gateway.yaml`.
+#   It holds no secret values; a config edit means an image rebuild (setup.sh
+#   tags images with a hash of this file, so a re-run rebuilds automatically).
+#
+# Secret expansion: ${ENV_VAR} reads an env var; ${file:/path} reads a mounted file.
+# On ECS, the task definition injects the JWT / OIDC / Postgres secrets as ENV
+# VARS via its `secrets` field (valueFrom -> Secrets Manager ARN). On EKS you
+# may mount them as files instead and use ${file:/secrets/...}.
+#
+# BEFORE BUILD — replace every REPLACE_ME placeholder below (setup.sh refuses to
+# build the image while any remain — the config is baked in, so a half-filled
+# config would ship), and create the referenced secrets:
+#   gateway-jwt-secret           (setup.sh generates this)
+#   gateway-oidc-client-secret   (from the Okta admin console OIDC web app)
+#   gateway-postgres-url         (setup.sh generates this)
+
+# ── Listener ─────────────────────────────────────────────────────────────────
+listen:
+  host: 0.0.0.0
+  port: 8080                      # the target group forwards ALB :443 -> :8080
+  # Required. Fixes the IdP redirect_uri, the OIDC discovery doc, and the
+  # gateway-token issuer so none are derived from the client-controlled Host
+  # header (X-Forwarded-Host/-Proto are likewise never trusted). Set it to the
+  # internal hostname you picked in the prerequisites — the Route 53 private
+  # zone name your ACM certificate covers (e.g.
+  # https://claude-gateway.internal.example.com). Unlike Cloud Run there is no
+  # first-deploy placeholder dance: you choose the hostname up front, alias it
+  # to the internal ALB after the deploy, and register the same host's
+  # /oauth/callback on the Okta app.
+  public_url: REPLACE_ME
+  # Register this exact redirect URI on the Okta OIDC web application:
+  #   https://<public_url host>/oauth/callback
+  #
+  # Behind the internal ALB every request arrives via the load balancer, so the
+  # gateway sees ALB-node peer IPs for all developers — set trusted_proxies so
+  # X-Forwarded-For from those proxies is trusted and per-IP rate limiting /
+  # audit IPs record the real client. ALB nodes take addresses from the subnets
+  # the ALB is attached to, so list those subnets' CIDRs (the private subnets
+  # from the prerequisites).
+  #
+  # NOTE: listing the ALB subnets' CIDRs trusts every host in those subnets as a
+  # proxy — any co-located workload that can reach the ALB can then spoof the
+  # client IP via X-Forwarded-For (audit logs, per-IP rate limits, IP
+  # allowlists). Keep the ALB :443 ingress source (CORP_CIDR / corporate_cidr)
+  # from overlapping these subnets, and don't share the subnets with untrusted
+  # workloads.
+  trusted_proxies: [REPLACE_ME]   # e.g. [10.0.1.0/24, 10.0.2.0/24]
+  #
+  # Alternative — terminate TLS in the gateway itself instead of at the ALB:
+  # tls:
+  #   cert: /certs/gateway.crt
+  #   key:  /certs/gateway.key
+
+# ── Identity provider — Okta ─────────────────────────────────────────────────
+oidc:
+  issuer: REPLACE_ME                                 # e.g. https://example.okta.com (or your custom auth server URL)
+  client_id: REPLACE_ME                              # Okta OIDC web app client ID (not secret)
+  client_secret: ${OIDC_CLIENT_SECRET}               # EKS file mounts: ${file:/secrets/oidc-client-secret}
+  allowed_email_domains: [REPLACE_ME]                # e.g. [example.com] — reject id_tokens outside your org
+  # The Okta org authorization server returns a thin id_token that omits email
+  # and groups; the gateway fills them from /userinfo.
+  userinfo_fallback: true
+  # offline_access yields refresh tokens (silent renewal + the deprovision
+  # leash); Okta emits groups only when the `groups` scope is requested AND the
+  # app's groups claim filter allows them (Okta admin console -> the app's
+  # Sign On tab -> OpenID Connect ID Token -> Groups claim filter).
+  scopes: [openid, profile, email, offline_access, groups]
+  # groups_claim: groups          # Okta default. Entra app roles=roles; see the config reference
+  # ca_cert_pem: ${file:/secrets/idp-ca.pem}   # only for an IdP behind a private CA
+
+# ── Sessions ─────────────────────────────────────────────────────────────────
+session:
+  jwt_secret: ${GATEWAY_JWT_SECRET}   # >= 32 bytes; openssl rand -base64 32
+  # Okta issues refresh tokens (offline_access above), so sessions renew
+  # silently and this mainly bounds deprovision latency. 8 is a sane default;
+  # lower toward 1 for tighter revocation. Array form rotates keys:
+  # [new, old] (index 0 signs, all verify).
+  ttl_hours: 8
+
+# ── Store (REQUIRED — the gateway refuses to boot without it) ─────────────────
+store:
+  postgres_url: ${GATEWAY_POSTGRES_URL}   # private-subnet RDS; built with ?sslmode=verify-full by setup.sh
+                                          # (the image trusts the RDS CA bundle via NODE_EXTRA_CA_CERTS — see Dockerfile)
+
+# ── Upstreams — Amazon Bedrock ───────────────────────────────────────────────
+upstreams:
+  - provider: bedrock
+    # Must equal the region you provision in (setup.sh's AWS_REGION /
+    # terraform's region): the IAM policy's inference-profile ARNs are scoped
+    # to that region, and Bedrock model access is enabled there (cross-region
+    # us.anthropic.* profiles need access in every spanned region). NOTE: the
+    # walkthrough is scoped to US regions — the built-in model catalog maps to
+    # us.anthropic.* (US-geo) profiles; a non-US region also needs a models:
+    # list below (see the model catalog section).
+    region: REPLACE_ME            # e.g. us-east-1
+    auth: {}                      # AWS default credential chain: ECS task role / IRSA on EKS (preferred — no static keys)
+    # base_url: https://bedrock-runtime.us-east-1.amazonaws.com   # bedrock-runtime interface VPC endpoint, to keep model traffic off the public path
+  # Add more upstreams for failover (tried top→bottom on 5xx/timeout/501): a
+  # second region, or an anthropic/vertex fallback. See
+  # https://code.claude.com/docs/en/claude-apps-gateway.
+
+# ── Telemetry fan-out (OPTIONAL) ─────────────────────────────────────────────
+# The CLI sends OTLP/HTTP to the gateway; the gateway fans out, stamping
+# user.id/user.email/user.groups server-side. On AWS, point at an OpenTelemetry
+# Collector (e.g. the AWS Distro for OpenTelemetry -> CloudWatch / Managed
+# Prometheus). When forward_to and public_url are both configured the gateway
+# pushes CLAUDE_CODE_ENABLE_TELEMETRY and the OTEL exporter selectors to every
+# client automatically — no per-developer config needed.
+# telemetry:
+#   forward_to:
+#     - url: https://otel-collector.internal.example.com:4318
+#       headers:
+#         Authorization: ${file:/secrets/otlp-token}
+#       metrics: true     # safe aggregate counters (default)
+#       logs: false       # carries bash commands / tool inputs — opt in deliberately
+#       traces: false
+
+# ── RBAC + managed settings (OPTIONAL; first-match-wins, top -> bottom) ───────
+# With Okta as IdP, match on the group names the `groups` scope emits (subject
+# to the app's groups claim filter), or on email_domain.
+# managed:
+#   policies:
+#     - match: { groups: [engineering] }
+#       cli:
+#         availableModels: [claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5]
+#         permissions: { deny: ["Read(./.env)", "Read(./secrets/**)"] }
+#     - match: {}        # catch-all floor — keep LAST
+#       cli:
+#         availableModels: [claude-sonnet-4-6, claude-haiku-4-5]
+
+# ── Admin API (OPTIONAL — enables db-mode runtime config + spend caps) ───────
+# admin_groups needs a groups claim — Okta provides one via the `groups` scope
+# above — or use the bootstrap keys below instead. Named keys for attribution
+# in the audit log; 32-char minimum on key values. On ECS add these to the task
+# definition's `secrets` field (valueFrom -> a Secrets Manager ARN), same as the
+# JWT/OIDC/Postgres secrets above; on EKS you may use ${file:...}.
+# admin:
+#   write_keys:
+#     - id: terraform
+#       key: ${GATEWAY_ADMIN_WRITE_KEY}
+#   read_keys:
+#     - id: reporting
+#       key: ${GATEWAY_ADMIN_READ_KEY}
+#   # admin_groups: [platform-finops]   # Okta group names via the groups scope
+
+# ── Model catalog (OPTIONAL for US regions) ──────────────────────────────────
+# Default true: every built-in Claude model is exposed and auto-translated per
+# upstream (the built-in table already maps to us.anthropic.* cross-region
+# inference profiles). Set false + a models: list to pin IDs (e.g. an
+# application or provisioned-throughput inference-profile ARN).
+# NON-US REGIONS: the built-in us.anthropic.* mappings do not exist outside
+# the US geo — set auto_include_builtin_models: false and list your region's
+# inference profiles (eu.anthropic.*, apac.anthropic.*, ...) here, and widen
+# the geo prefix in the deploy's bedrock-invoke IAM policy to match. See the
+# models: guidance in the config reference:
+# https://code.claude.com/docs/en/claude-apps-gateway-config
+# auto_include_builtin_models: true
+# models:
+#   - id: claude-opus-4-8
+#     label: Claude Opus 4.8
+#     upstream_model: { bedrock: us.anthropic.claude-opus-4-8 }

examples/gateway/aws/setup.sh

@@ -0,0 +1,964 @@
+#!/usr/bin/env bash
+#
+# setup.sh — AWS setup for Claude apps gateway (walkthrough §1–7, ECS track).
+#
+# Provisions, in this order: the three security groups (§1), the task +
+# execution IAM roles (§2), the gateway container image in Amazon ECR (§6),
+# an RDS for PostgreSQL instance in the private subnets with no public
+# address (§3), the JWT + postgres-url secrets (§5), and an ECS Fargate
+# service behind an internal Application Load Balancer (§7).
+#
+# gateway.yaml (§4 of the walkthrough) is BAKED INTO THE IMAGE on this track —
+# the task definition injects only the secrets it references, as env vars — so
+# the config step here lives inside the image build (§6): the build is gated on
+# a fully filled-in gateway.yaml and the image tag carries a hash of it, so a
+# config edit triggers a rebuild on the next run.
+#
+#   Section markers (§N) below map to the walkthrough:
+#   https://code.claude.com/docs/en/claude-apps-gateway-on-aws
+#
+# Covers here:  security groups (§1) -> IAM roles + Bedrock model-access note (§2)
+#               -> build & push image, config baked in (§6 + §4) -> DB subnet group
+#               + RDS instance (§3) -> jwt + postgres-url secrets (§5) -> ECS
+#               cluster/task definition/service + internal ALB (§7, ECS Fargate tab).
+# Not covered:  EKS track (§7's EKS tab) — ECS Fargate is the lower-friction path here.
+#               Bedrock model access (§2) — console-only; the script reminds you.
+#               Route 53 alias — see the next steps it prints. Client MDM
+#               push (§8) is covered by the walkthrough, not this script.
+#
+# Idempotent: existing resources are detected and skipped, so it is safe to re-run.
+# Reuse is by NAME, so a pre-existing resource may not match what this script
+# would have created: reuse that would change the exposure model is fatal (an
+# ALB that is not internal/in ${VPC_ID}); upsert-able settings are converged on
+# every run; other posture drift (extra security group ingress, a public or
+# unencrypted RDS instance, wrong-VPC target group) is checked and warned
+# about, never silently adopted.
+# Override any default below via environment variable, e.g. `AWS_REGION=us-west-2 ./setup.sh`.
+
+set -euo pipefail
+
+# ---- configuration (env-overridable) ----------------------------------------
+AWS_REGION="${AWS_REGION:-$(aws configure get region 2>/dev/null || true)}"   # guide uses us-east-1 (a region where Bedrock serves the Claude models you need)
+ACCOUNT_ID="${ACCOUNT_ID:-$(aws sts get-caller-identity --query Account --output text 2>/dev/null || true)}"
+
+VPC_ID="${VPC_ID:-}"                                       # REQUIRED — the VPC from the prerequisites
+PRIVATE_SUBNETS="${PRIVATE_SUBNETS:-}"                     # REQUIRED — two+ private subnet IDs in different AZs, space-separated
+CORP_CIDR="${CORP_CIDR:-}"                                 # REQUIRED — your corporate network CIDR (ALB :443 ingress source)
+                                                           # Must not overlap PRIVATE_SUBNETS: hosts there are trusted_proxies (gateway.yaml) and could spoof client IPs via X-Forwarded-For.
+
+# §1 security groups
+ALB_SG_NAME="${ALB_SG_NAME:-claude-gateway-alb}"
+GW_SG_NAME="${GW_SG_NAME:-claude-gateway-svc}"
+DB_SG_NAME="${DB_SG_NAME:-claude-gateway-db}"
+
+# §2 IAM roles (task role = the gateway's runtime AWS identity; execution role
+# = the ECS agent's identity for pulling the image and injecting secrets)
+TASK_ROLE="${TASK_ROLE:-claude-gateway-task}"
+EXEC_ROLE="${EXEC_ROLE:-claude-gateway-execution}"
+
+# §6 image
+ECR_REPO="${ECR_REPO:-claude-gateway}"                     # ECR repository name
+VERSION="${VERSION:-}"                                     # REQUIRED — the gateway release tag you build and push (e.g. the linux-x64 binary's version)
+DOCKERFILE="${DOCKERFILE:-./Dockerfile}"
+CLAUDE_BINARY="${CLAUDE_BINARY:-./claude}"                 # prebuilt linux-x64 Claude Code release binary (includes the gateway subcommand)
+DIST_URL="${DIST_URL:-}"                                   # optional: download URL, used only if $CLAUDE_BINARY is missing
+DIST_SHA256="${DIST_SHA256:-}"                             # REQUIRED with DIST_URL: expected sha256 of the binary (verified fail-closed)
+DIST_SHA256="${DIST_SHA256,,}"                                # normalize to lowercase — openssl emits lowercase hex; some tools (PowerShell Get-FileHash) publish uppercase
+# Obtain DIST_SHA256 out-of-band — never from the server that serves DIST_URL.
+# For binaries from the standard Claude Code release channel, verify the
+# release's GPG-signed manifest.json and copy the platform checksum from it:
+# https://code.claude.com/docs/en/setup#binary-integrity-and-code-signing
+# For any other distribution channel, use the checksum published alongside the
+# download link on that channel.
+GATEWAY_YAML="${GATEWAY_YAML:-./gateway.yaml}"             # §4 config file — BAKED into the image
+RDS_CA_BUNDLE="${RDS_CA_BUNDLE:-./rds-global-bundle.pem}"  # RDS CA trust anchor — BAKED into the image (downloaded below if missing)
+# Official AWS RDS truststore. AWS rotates this bundle (new regional CAs get
+# appended), so no checksum is pinned — a pinned hash would break on every
+# rotation. The script downloads it only when absent (an existing file is never
+# re-downloaded); to pick up a rotation, delete the file — and since the image
+# tag hashes only gateway.yaml, also bump VERSION or set IMAGE_TAG so the
+# next run rebuilds rather than reusing the existing tag. Operators who want
+# to pin may pre-place a reviewed copy at ${RDS_CA_BUNDLE}.
+RDS_CA_BUNDLE_URL="${RDS_CA_BUNDLE_URL:-https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem}"
+REGISTRY="${ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
+
+# §3 RDS
+DB_SUBNET_GROUP="${DB_SUBNET_GROUP:-claude-gateway-db}"
+DB_PARAM_GROUP="${DB_PARAM_GROUP:-claude-gateway-db}"      # carries rds.force_ssl=1 (server-side TLS enforcement)
+DB_INSTANCE="${DB_INSTANCE:-claude-gateway-db}"
+DB_CLASS="${DB_CLASS:-db.t4g.micro}"
+DB_STORAGE_GB="${DB_STORAGE_GB:-20}"
+DB_NAME="${DB_NAME:-claude_gateway}"
+DB_USER="${DB_USER:-gateway}"
+# PG14+ supported; 16 is the recommended default (matches terraform/'s).
+# Always pinned: the instance's engine version and the parameter group's
+# family must name the same major, so both derive from this one value.
+DB_ENGINE_VERSION="${DB_ENGINE_VERSION:-16}"
+
+SECRET_NAME="${SECRET_NAME:-gateway-postgres-url}"         # §5 store.postgres_url
+JWT_SECRET_NAME="${JWT_SECRET_NAME:-gateway-jwt-secret}"   # §5 session.jwt_secret
+OIDC_SECRET_NAME="${OIDC_SECRET_NAME:-gateway-oidc-client-secret}"   # operator-created (Okta OIDC web app)
+# NOTE: the execution role's secrets-read policy (§2) is built from these
+# three names, one per-secret ARN prefix each — a rename is picked up on the
+# next run (put-role-policy is an upsert).
+
+# §7 ECS + internal ALB deploy
+CLUSTER="${CLUSTER:-claude-gateway}"
+SERVICE="${SERVICE:-claude-gateway}"
+TASK_FAMILY="${TASK_FAMILY:-claude-gateway}"
+LOG_GROUP="${LOG_GROUP:-/ecs/claude-gateway}"
+LOG_RETENTION_DAYS="${LOG_RETENTION_DAYS:-90}"             # CloudWatch retention — the group carries the gateway's audit events, so align with your audit retention policy
+ALB_NAME="${ALB_NAME:-claude-gateway}"
+TG_NAME="${TG_NAME:-claude-gateway}"
+# Explicit modern TLS policy — omitting it falls back to the legacy
+# ELBSecurityPolicy-2016-08 default, which still accepts TLS 1.0/1.1.
+ALB_SSL_POLICY="${ALB_SSL_POLICY:-ELBSecurityPolicy-TLS13-1-2-2021-06}"
+ACM_CERT_ARN="${ACM_CERT_ARN:-}"                           # REQUIRED for deploy — ACM cert for your internal gateway hostname
+TASK_CPU="${TASK_CPU:-1024}"
+TASK_MEMORY="${TASK_MEMORY:-2048}"
+DESIRED_COUNT="${DESIRED_COUNT:-1}"                        # each task opens a Postgres pool of up to 5 connections (store.max_connections default); keep DESIRED_COUNT × 5 below the DB class's max_connections (~80 on db.t4g.micro)
+DEPLOY="${DEPLOY:-1}"                                      # set DEPLOY=0 to provision only, no ECS/ALB deploy
+
+# ---- helpers ----------------------------------------------------------------
+log()  { printf '\n==> %s\n' "$*"; }
+skip() { printf '    (exists) %s\n' "$*"; }
+curl_https() { curl --proto '=https' --proto-redir '=https' --tlsv1.2 "$@"; }  # refuse plaintext/protocol-downgrade
+sha_of() { openssl dgst -sha256 "$1" | awk '{print $NF}'; }  # openssl avoids shasum/sha256sum portability gaps
+
+# authorize-security-group-ingress is NOT idempotent (re-adding a rule errors),
+# so tolerate exactly the duplicate-rule error and fail on anything else.
+authorize_ingress() {
+  local out
+  if out="$(aws ec2 authorize-security-group-ingress "$@" 2>&1)"; then
+    return 0
+  elif grep -q 'InvalidPermission.Duplicate' <<<"${out}"; then
+    skip "ingress rule already present"
+  else
+    printf '%s\n' "${out}" >&2
+    return 1
+  fi
+}
+
+# Security-group lookup by name within the VPC; prints the GroupId or "None".
+sg_id() {
+  aws ec2 describe-security-groups \
+    --filters "Name=group-name,Values=$1" "Name=vpc-id,Values=${VPC_ID}" \
+    --query 'SecurityGroups[0].GroupId' --output text 2>/dev/null || echo None
+}
+
+# Name-based reuse can adopt a pre-existing group carrying ingress this script
+# never added. Audit after the intended rule is ensured: each group's traffic
+# path is exactly one rule (tcp <port> from <cidr-or-source-group>), so anything
+# else is flagged on stderr. Non-fatal — an extra rule may be a deliberate
+# operator addition — but every one widens the path, so it must be visible.
+warn_unexpected_ingress() { # <group-id> <group-name> <port> <expected cidr or source group-id>
+  local perms
+  if ! perms="$(aws ec2 describe-security-groups --group-ids "$1" \
+      --query 'SecurityGroups[0].IpPermissions' --output json 2>/dev/null)"; then
+    echo "    WARN — could not audit ingress rules on $2 ($1)." >&2
+    return 0
+  fi
+  # `|| echo` keeps a parse hiccup non-fatal — this audit must never abort a run.
+  _SG_ID="$1" _SG_NAME="$2" _SG_PORT="$3" _SG_EXPECTED="$4" python3 -c "
+import json, os, sys
+perms = json.load(sys.stdin) or []
+port, expected = int(os.environ[\"_SG_PORT\"]), os.environ[\"_SG_EXPECTED\"]
+extras = []
+for p in perms:
+    proto, lo, hi = p.get(\"IpProtocol\"), p.get(\"FromPort\"), p.get(\"ToPort\")
+    scope_ok = proto == \"tcp\" and lo == port and hi == port
+    sources = (
+        [r.get(\"CidrIp\", \"?\") for r in p.get(\"IpRanges\", [])]
+        + [r.get(\"CidrIpv6\", \"?\") for r in p.get(\"Ipv6Ranges\", [])]
+        + [r.get(\"GroupId\", \"?\") for r in p.get(\"UserIdGroupPairs\", [])]
+        + [r.get(\"PrefixListId\", \"?\") for r in p.get(\"PrefixListIds\", [])]
+    )
+    extras += [(proto, lo, hi, s) for s in sources if not (scope_ok and s == expected)]
+if extras:
+    name, gid = os.environ[\"_SG_NAME\"], os.environ[\"_SG_ID\"]
+    print(f\"    WARN — security group {name} ({gid}) has ingress beyond the intended rule\", file=sys.stderr)
+    print(f\"           (tcp {port} from {expected}) — review it; remove anything you did not add deliberately:\", file=sys.stderr)
+    for proto, lo, hi, src in extras:
+        scope = \"all traffic\" if proto == \"-1\" else (f\"{proto} {lo}\" if lo == hi else f\"{proto} {lo}-{hi}\")
+        print(f\"             {scope} from {src}\", file=sys.stderr)
+" <<<"${perms}" || echo "    WARN — could not audit ingress rules on $2 ($1)." >&2
+}
+
+secret_arn() {
+  aws secretsmanager describe-secret --secret-id "$1" \
+    --query ARN --output text 2>/dev/null || true
+}
+
+# Existence check that fails closed: 0 = exists, 1 = definitively absent
+# (ResourceNotFoundException), anything else ABORTS the run. Gating on a bare
+# exit status would let a transient failure (throttle, expired token, network
+# blip) masquerade as "secret missing" — and the missing-secret branches below
+# do destructive work (the §3 self-heal resets the DB password), so they must
+# run only on a definitive not-found.
+secret_exists() { # <secret-id>
+  local out
+  if out="$(aws secretsmanager describe-secret --secret-id "$1" 2>&1 >/dev/null)"; then
+    return 0
+  elif grep -q 'ResourceNotFoundException' <<<"${out}"; then
+    return 1
+  else
+    echo "ERROR: could not determine whether secret $1 exists (transient AWS error?):" >&2
+    printf '%s\n' "${out}" >&2
+    echo "       Refusing to guess — re-run once the call succeeds." >&2
+    exit 1
+  fi
+}
+
+# Secret values must never appear on a process argv (argv is world-readable
+# via /proc and routinely recorded by EDR/auditd), so every aws call that
+# carries one takes it via --cli-input-json file://<0600 temp file> instead —
+# explicit flags on the same command line override/merge with the JSON, so
+# only the secret parameter needs to live in the file. secret_json writes
+# {"<Key>": "<value>"} to a fresh temp file and returns the path in the named
+# variable (printf -v, not command substitution — a subshell would lose the
+# SECRET_TMP_FILES bookkeeping below): the value crosses into python3 via the
+# environment (never argv) and json.dumps escapes it, so any characters
+# survive. Callers rm -f the file as soon as the aws call returns; the EXIT
+# trap sweeps whatever an aborted run leaves.
+SECRET_TMP_FILES=()
+cleanup_secret_tmp() { rm -f "${SECRET_TMP_FILES[@]+"${SECRET_TMP_FILES[@]}"}"; }
+trap cleanup_secret_tmp EXIT
+secret_json() { # secret_json <outvar> <JsonKey> <value>  -> path in <outvar>
+  local file
+  file="$(mktemp)"    # mktemp creates 0600
+  chmod 600 "${file}" # belt and braces if TMPDIR overrides umask semantics
+  SECRET_TMP_FILES+=("${file}")
+  _JSON_KEY="$2" _JSON_VALUE="$3" python3 -c \
+    'import json, os; print(json.dumps({os.environ["_JSON_KEY"]: os.environ["_JSON_VALUE"]}))' \
+    > "${file}"
+  printf -v "$1" '%s' "${file}"
+}
+
+for required in AWS_REGION ACCOUNT_ID VPC_ID PRIVATE_SUBNETS CORP_CIDR VERSION; do
+  if [[ -z "${!required}" ]]; then
+    echo "ERROR: ${required} is not set." >&2
+    case "${required}" in
+      AWS_REGION)      echo "       Set it to a region where Bedrock serves the Claude models you need, e.g. export AWS_REGION=us-east-1" >&2 ;;
+      ACCOUNT_ID)      echo "       Could not resolve it from STS — is the AWS CLI authenticated? (aws sts get-caller-identity)" >&2 ;;
+      VPC_ID)          echo "       Set it to the VPC from the prerequisites, e.g. export VPC_ID=vpc-..." >&2 ;;
+      PRIVATE_SUBNETS) echo "       Set it to two+ private subnet IDs in different AZs, e.g. export PRIVATE_SUBNETS='subnet-a subnet-b'" >&2 ;;
+      CORP_CIDR)       echo "       Set it to your corporate network CIDR (the ALB's :443 ingress source), e.g. export CORP_CIDR=10.0.0.0/8" >&2 ;;
+      VERSION)         echo "       Set it to the gateway release version — it tags the image you build and push, e.g. export VERSION=<version>" >&2 ;;
+    esac
+    exit 1
+  fi
+done
+
+# The walkthrough (and this bundle) is scoped to commercial US regions: the
+# task role's Bedrock policy (§2) and the gateway's built-in model catalog
+# both use the us.anthropic.* geo-prefixed cross-region inference profiles,
+# which only exist in the commercial US regions — an explicit list, not a
+# `us-*` prefix match, because GovCloud (us-gov-*) and ISO (us-iso-*) regions
+# share the prefix but live in different AWS partitions where those profiles
+# and this bundle's arn:aws: ARNs are wrong. Anywhere else the deploy
+# provisions fine and then every model call fails. Other-region deploys must
+# pin region-appropriate inference profiles via a models: block in
+# gateway.yaml (see the config reference:
+# https://code.claude.com/docs/en/claude-apps-gateway-config) and adjust the
+# inference-profile ARN prefix in bedrock-invoke.iam.json below — set
+# ALLOW_NON_US_REGION=1 once that's done to proceed.
+case "${AWS_REGION}" in
+  us-east-1|us-east-2|us-west-1|us-west-2) ;;
+  *)
+    if [[ "${ALLOW_NON_US_REGION:-0}" != "1" ]]; then
+      echo "ERROR: AWS_REGION=${AWS_REGION} is not a commercial US region, but this bundle's IAM policy" >&2
+      echo "       and model IDs use the US-geo (us.anthropic.*) cross-region inference profiles" >&2
+      echo "       (GovCloud/ISO regions are different partitions — the profiles and arn:aws: ARNs" >&2
+      echo "       here do not exist there)." >&2
+      echo "       Either deploy to us-east-1/us-east-2/us-west-1/us-west-2, or pin region-appropriate" >&2
+      echo "       inference profiles in a models: block in gateway.yaml" >&2
+      echo "       (https://code.claude.com/docs/en/claude-apps-gateway-config), adjust the" >&2
+      echo "       inference-profile ARN in the bedrock-invoke policy, and re-run with" >&2
+      echo "       ALLOW_NON_US_REGION=1." >&2
+      exit 1
+    fi
+    ;;
+esac
+
+if ! command -v python3 >/dev/null 2>&1; then
+  echo "ERROR: python3 is required (it JSON-escapes secret values for --cli-input-json; the AWS CLI itself ships on Python)." >&2
+  exit 1
+fi
+
+# shellcheck disable=SC2086  # PRIVATE_SUBNETS is intentionally word-split everywhere below
+set -- ${PRIVATE_SUBNETS}
+if (( $# < 2 )); then
+  echo "ERROR: PRIVATE_SUBNETS must list at least two subnets in different AZs (the internal ALB requires two)." >&2
+  exit 1
+fi
+# Normalize whatever whitespace (spaces, tabs, newlines) separates the list —
+# `set --` above word-split on IFS, so join those same words with commas
+# rather than only converting single spaces.
+SUBNETS_CSV="$(printf '%s,' "$@")"; SUBNETS_CSV="${SUBNETS_CSV%,}"
+
+log "Account: ${ACCOUNT_ID}   Region: ${AWS_REGION}   VPC: ${VPC_ID}"
+
+# ---- 1 Security groups -----------------------------------------------------
+# Three groups chain the traffic path (walkthrough §1): corp network -> ALB :443,
+# ALB -> gateway :8080, gateway -> Postgres :5432. Nothing else is reachable.
+log "Creating security groups (§1)"
+ALB_SG="$(sg_id "${ALB_SG_NAME}")"
+if [[ "${ALB_SG}" != "None" ]]; then
+  skip "security group ${ALB_SG_NAME} (${ALB_SG})"
+else
+  ALB_SG="$(aws ec2 create-security-group --group-name "${ALB_SG_NAME}" \
+    --description "Claude gateway ALB" --vpc-id "${VPC_ID}" \
+    --query GroupId --output text)"
+fi
+
+GW_SG="$(sg_id "${GW_SG_NAME}")"
+if [[ "${GW_SG}" != "None" ]]; then
+  skip "security group ${GW_SG_NAME} (${GW_SG})"
+else
+  GW_SG="$(aws ec2 create-security-group --group-name "${GW_SG_NAME}" \
+    --description "Claude gateway service" --vpc-id "${VPC_ID}" \
+    --query GroupId --output text)"
+fi
+
+DB_SG="$(sg_id "${DB_SG_NAME}")"
+if [[ "${DB_SG}" != "None" ]]; then
+  skip "security group ${DB_SG_NAME} (${DB_SG})"
+else
+  DB_SG="$(aws ec2 create-security-group --group-name "${DB_SG_NAME}" \
+    --description "Claude gateway Postgres" --vpc-id "${VPC_ID}" \
+    --query GroupId --output text)"
+fi
+
+authorize_ingress --group-id "${ALB_SG}" --protocol tcp --port 443  --cidr "${CORP_CIDR}"
+authorize_ingress --group-id "${GW_SG}"  --protocol tcp --port 8080 --source-group "${ALB_SG}"
+authorize_ingress --group-id "${DB_SG}"  --protocol tcp --port 5432 --source-group "${GW_SG}"
+
+# Flag any ingress beyond the three rules above (pre-existing groups may carry more).
+warn_unexpected_ingress "${ALB_SG}" "${ALB_SG_NAME}" 443  "${CORP_CIDR}"
+warn_unexpected_ingress "${GW_SG}"  "${GW_SG_NAME}"  8080 "${ALB_SG}"
+warn_unexpected_ingress "${DB_SG}"  "${DB_SG_NAME}"  5432 "${GW_SG}"
+
+# ---- 2 IAM roles ------------------------------------------------------------
+# Task role: the gateway's runtime identity — its ONLY permission is invoking
+# Claude models on Bedrock (the upstream's `auth: {}` resolves to this role via
+# the AWS default credential chain). The policy must cover both the cross-region
+# inference-profile ARNs and the underlying foundation-model ARNs.
+# Execution role: the ECS agent's identity — pulls the image from ECR and
+# injects the Secrets Manager values; the gateway never uses it.
+log "Creating IAM roles ${TASK_ROLE} + ${EXEC_ROLE} (§2)"
+cat > ecs-trust.iam.json <<'EOF'
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Service": "ecs-tasks.amazonaws.com" },
+    "Action": "sts:AssumeRole"
+  }]
+}
+EOF
+cat > bedrock-invoke.iam.json <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
+    "Resource": [
+      "arn:aws:bedrock:${AWS_REGION}:${ACCOUNT_ID}:inference-profile/us.anthropic.*",
+      "arn:aws:bedrock:*::foundation-model/anthropic.*"
+    ]
+  }]
+}
+EOF
+# One ARN per secret (never a bare gateway-* wildcard, which would also match
+# unrelated secrets in a shared account). The trailing -?????? matches exactly
+# the random 6-character suffix Secrets Manager appends to every secret's ARN
+# (AWS's documented pattern; a trailing -* would be a plain prefix glob and
+# also match longer names like ${SECRET_NAME}-prod) — the exact ARNs aren't
+# knowable here because the role is created before the secrets are.
+cat > secrets-read.iam.json <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": "secretsmanager:GetSecretValue",
+    "Resource": [
+      "arn:aws:secretsmanager:${AWS_REGION}:${ACCOUNT_ID}:secret:${JWT_SECRET_NAME}-??????",
+      "arn:aws:secretsmanager:${AWS_REGION}:${ACCOUNT_ID}:secret:${OIDC_SECRET_NAME}-??????",
+      "arn:aws:secretsmanager:${AWS_REGION}:${ACCOUNT_ID}:secret:${SECRET_NAME}-??????"
+    ]
+  }]
+}
+EOF
+
+if aws iam get-role --role-name "${TASK_ROLE}" >/dev/null 2>&1; then
+  skip "role ${TASK_ROLE}"
+else
+  aws iam create-role --role-name "${TASK_ROLE}" \
+    --assume-role-policy-document file://ecs-trust.iam.json >/dev/null
+fi
+# put-role-policy is an upsert — safe to re-run (it also picks up region changes).
+aws iam put-role-policy --role-name "${TASK_ROLE}" \
+  --policy-name bedrock-invoke --policy-document file://bedrock-invoke.iam.json
+
+if aws iam get-role --role-name "${EXEC_ROLE}" >/dev/null 2>&1; then
+  skip "role ${EXEC_ROLE}"
+else
+  aws iam create-role --role-name "${EXEC_ROLE}" \
+    --assume-role-policy-document file://ecs-trust.iam.json >/dev/null
+fi
+# attach-role-policy is idempotent (re-attaching is a no-op).
+aws iam attach-role-policy --role-name "${EXEC_ROLE}" \
+  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
+aws iam put-role-policy --role-name "${EXEC_ROLE}" \
+  --policy-name read-gateway-secrets --policy-document file://secrets-read.iam.json
+
+echo "    NOTE: Bedrock model access is console-only — enable it for the Claude models"
+echo "          you need (Bedrock console -> Model access), and submit the one-time use"
+echo "          case form for the account. Cross-region inference profiles"
+echo "          (us.anthropic.*) need access in EACH region the profile spans."
+
+# ---- 6 Build & push image to Amazon ECR (config baked in — §6 + §4) ---------
+log "Ensuring ECR repository and image (§6)"
+if aws ecr describe-repositories --repository-names "${ECR_REPO}" >/dev/null 2>&1; then
+  skip "ECR repository ${ECR_REPO}"
+  # Integrity-critical settings: converge on re-runs so a pre-existing MUTABLE repo can't slip through.
+  aws ecr put-image-tag-mutability --repository-name "${ECR_REPO}" \
+    --image-tag-mutability IMMUTABLE >/dev/null
+  aws ecr put-image-scanning-configuration --repository-name "${ECR_REPO}" \
+    --image-scanning-configuration scanOnPush=true >/dev/null
+else
+  # IMMUTABLE tags + scan-on-push: the ECS service pulls whatever this repo
+  # serves under the deployed tag, so a pushed tag must never be silently
+  # re-pointed. For production, also restrict push rights on this repo to your
+  # CI / image-promotion pipeline rather than operator credentials — this
+  # walkthrough pushes directly for simplicity.
+  aws ecr create-repository --repository-name "${ECR_REPO}" \
+    --image-tag-mutability IMMUTABLE \
+    --image-scanning-configuration scanOnPush=true >/dev/null
+fi
+
+# The config is baked into the image, so the build is gated the way the GCP
+# example gates its config-secret publish: gateway.yaml must exist and be fully
+# filled in (REPLACE_ME checked on non-comment lines so commented examples and
+# the file's header don't trip the guard). The tag carries a hash of the config
+# so an edit produces a NEW tag (required by tag immutability) and a re-run
+# rebuilds automatically.
+IMAGE=""
+if [[ ! -f "${GATEWAY_YAML}" ]]; then
+  echo "    (skip) ${GATEWAY_YAML} not found — run 'cp gateway.yaml.example gateway.yaml', fill it in, then re-run (§4)."
+elif grep -vE '^[[:space:]]*#' "${GATEWAY_YAML}" | grep -q 'REPLACE_ME'; then
+  echo "    (skip) ${GATEWAY_YAML} still has REPLACE_ME placeholders to fill:"
+  grep -nE 'REPLACE_ME' "${GATEWAY_YAML}" | grep -vE '^[0-9]+:[[:space:]]*#' | sed 's/^/        /'
+  echo "        Fill them in, then re-run to build the image (the config is baked in)."
+else
+  CONFIG_SHA="$(sha_of "${GATEWAY_YAML}" | cut -c1-8)"
+  IMAGE_TAG="${IMAGE_TAG:-${VERSION}-cfg${CONFIG_SHA}}"
+  IMAGE="${REGISTRY}/${ECR_REPO}:${IMAGE_TAG}"
+
+  # Image is the expensive, already-done step: skip the build+push entirely if
+  # the tag already exists in the registry.
+  if aws ecr describe-images --repository-name "${ECR_REPO}" \
+       --image-ids "imageTag=${IMAGE_TAG}" >/dev/null 2>&1; then
+    skip "image ${IMAGE}"
+  else
+    # When the expected checksum is known, verify a PRE-EXISTING binary too:
+    # the [[ ! -f ]] guard below otherwise trusts whatever is on disk, so a
+    # stale binary from an earlier VERSION (or a tampered one) would be baked
+    # into the image silently. On mismatch, set it aside (never delete — the
+    # mismatch may be a typo'd DIST_SHA256, not a bad binary) and fall through
+    # to the fail-closed download path. Without DIST_SHA256 the operator-
+    # provided-binary flow is unchanged — no checksum was declared, so none is
+    # checked.
+    QUARANTINED_SHA=""
+    if [[ -n "${DIST_SHA256}" && -f "${CLAUDE_BINARY}" ]]; then
+      existing_sha="$(sha_of "${CLAUDE_BINARY}")"
+      if [[ "${existing_sha}" != "${DIST_SHA256}" ]]; then
+        log "Existing ${CLAUDE_BINARY} sha256 ${existing_sha} does not match DIST_SHA256 — setting it aside as ${CLAUDE_BINARY}.bad"
+        mv -f "${CLAUDE_BINARY}" "${CLAUDE_BINARY}.bad"
+        QUARANTINED_SHA="${existing_sha}"
+      fi
+    fi
+    if [[ ! -f "${CLAUDE_BINARY}" ]]; then
+      if [[ -n "${DIST_URL}" ]]; then
+        # Fail closed: never download an executable we can't verify.
+        if [[ -z "${DIST_SHA256}" ]]; then
+          echo "ERROR: DIST_SHA256 must be set when DIST_URL is used — refusing to download an unverified binary." >&2
+          echo "       Set DIST_SHA256 to the expected sha256 of the binary at DIST_URL, obtained out-of-band:" >&2
+          echo "       for standard-release binaries, from the release's GPG-signed manifest.json (verify the" >&2
+          echo "       manifest signature first — see code.claude.com/docs/en/setup#binary-integrity-and-code-signing);" >&2
+          echo "       otherwise from the channel that published the download link, never from the download server." >&2
+          exit 1
+        fi
+        log "Downloading gateway binary from ${DIST_URL}"
+        # Download to a temp path and only mv into place after the checksum
+        # verifies, so an interrupted download can't leave a partial CLAUDE_BINARY
+        # that the [[ ! -f ]] guard above would skip — and silently push — on re-run.
+        # Refuse plaintext/protocol-downgrade; only follow HTTPS redirects.
+        dl_tmp="${CLAUDE_BINARY}.download"
+        rm -f "${dl_tmp}"
+        curl_https -fL -o "${dl_tmp}" "${DIST_URL}"
+        actual_sha="$(sha_of "${dl_tmp}")"
+        if [[ "${actual_sha}" != "${DIST_SHA256}" ]]; then
+          echo "ERROR: checksum mismatch for ${dl_tmp} (expected ${DIST_SHA256}, got ${actual_sha}) — refusing to build." >&2
+          rm -f "${dl_tmp}"
+          exit 1
+        fi
+        log "Verified binary sha256 ${actual_sha}"
+        chmod +x "${dl_tmp}"
+        mv -f "${dl_tmp}" "${CLAUDE_BINARY}"
+      else
+        echo "ERROR: build binary not found at ${CLAUDE_BINARY} and DIST_URL is not set." >&2
+        if [[ -n "${QUARANTINED_SHA}" ]]; then
+          echo "       The binary that WAS there had sha256 ${QUARANTINED_SHA}, which does not match" >&2
+          echo "       DIST_SHA256=${DIST_SHA256} — it was preserved as ${CLAUDE_BINARY}.bad." >&2
+          echo "       If DIST_SHA256 was a typo, fix it and move the file back:" >&2
+          echo "         mv '${CLAUDE_BINARY}.bad' '${CLAUDE_BINARY}'" >&2
+          echo "       Otherwise treat that file as untrusted and obtain a verified binary." >&2
+        fi
+        echo "       Provide the prebuilt linux-x64 Claude Code release binary at that path" >&2
+        echo "       or set DIST_URL to its download URL (see the walkthrough, §6)." >&2
+        exit 1
+      fi
+    fi
+    # The RDS CA bundle is baked into the image as the trust anchor for the
+    # connection string's sslmode=verify-full (§3/§5). Fail closed: no bundle,
+    # no build. AWS rotates the bundle, so no checksum is pinned (see the
+    # RDS_CA_BUNDLE_URL comment up top); the sanity check below catches an
+    # error page or truncated download.
+    if [[ ! -f "${RDS_CA_BUNDLE}" ]]; then
+      log "Downloading RDS CA bundle from ${RDS_CA_BUNDLE_URL}"
+      curl_https -fL -o "${RDS_CA_BUNDLE}" "${RDS_CA_BUNDLE_URL}"
+    fi
+    if ! grep -q 'BEGIN CERTIFICATE' "${RDS_CA_BUNDLE}" \
+       || (( "$(wc -c < "${RDS_CA_BUNDLE}")" < 10000 )); then
+      echo "ERROR: ${RDS_CA_BUNDLE} does not look like the RDS CA bundle (missing PEM blocks or implausibly small) — refusing to build." >&2
+      echo "       Delete it and re-run to re-download, or place the bundle from ${RDS_CA_BUNDLE_URL} there yourself." >&2
+      exit 1
+    fi
+    log "Building and pushing ${IMAGE}"
+    aws ecr get-login-password --region "${AWS_REGION}" \
+      | docker login --username AWS --password-stdin "${REGISTRY}"
+    # The task definition below runs linux/amd64 (cpuArchitecture X86_64);
+    # --platform forces it (e.g. when building on an Apple Silicon Mac), and
+    # --provenance=false keeps buildx from wrapping the result in an OCI image
+    # index that some pullers reject. For Fargate on ARM64 (Graviton), build
+    # linux/arm64 with the linux-arm64 binary and set cpuArchitecture to ARM64.
+    docker build --platform=linux/amd64 --provenance=false \
+      -f "${DOCKERFILE}" \
+      --build-arg CLAUDE_BINARY="${CLAUDE_BINARY}" \
+      --build-arg GATEWAY_CONFIG="${GATEWAY_YAML}" \
+      --build-arg RDS_CA_BUNDLE="${RDS_CA_BUNDLE}" \
+      -t "${IMAGE}" .
+    docker push "${IMAGE}"
+  fi
+fi
+
+# ---- 3 RDS for PostgreSQL (private subnets, no public address) --------------
+log "Creating DB subnet group ${DB_SUBNET_GROUP} (§3)"
+if aws rds describe-db-subnet-groups --db-subnet-group-name "${DB_SUBNET_GROUP}" >/dev/null 2>&1; then
+  skip "DB subnet group ${DB_SUBNET_GROUP}"
+else
+  # shellcheck disable=SC2086  # subnet IDs are separate arguments by design
+  aws rds create-db-subnet-group --db-subnet-group-name "${DB_SUBNET_GROUP}" \
+    --db-subnet-group-description "Claude gateway" --subnet-ids ${PRIVATE_SUBNETS} >/dev/null
+fi
+
+# Parameter group with rds.force_ssl=1: the server side of TLS enforcement —
+# the client side is sslmode=verify-full in the connection string (§5). The
+# family must match the engine major version, so it derives from the same
+# DB_ENGINE_VERSION that create-db-instance pins below.
+log "Ensuring DB parameter group ${DB_PARAM_GROUP} (rds.force_ssl=1)"
+PG_FAMILY="postgres${DB_ENGINE_VERSION%%.*}"
+if aws rds describe-db-parameter-groups --db-parameter-group-name "${DB_PARAM_GROUP}" >/dev/null 2>&1; then
+  skip "DB parameter group ${DB_PARAM_GROUP}"
+else
+  aws rds create-db-parameter-group --db-parameter-group-name "${DB_PARAM_GROUP}" \
+    --db-parameter-group-family "${PG_FAMILY}" \
+    --description "Claude gateway - require TLS on every connection" >/dev/null
+fi
+# modify-db-parameter-group is an upsert — applied every run so a pre-existing
+# group converges too. rds.force_ssl is dynamic; no reboot needed.
+aws rds modify-db-parameter-group --db-parameter-group-name "${DB_PARAM_GROUP}" \
+  --parameters "ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=immediate" >/dev/null
+
+# hex (not base64) keeps the password URL-safe for the connection string below.
+# The password reaches every aws call via --cli-input-json (never argv — see
+# the secret_json helper); explicit flags merge with (and would override) the
+# JSON, so only the password lives in the temp file.
+log "Creating RDS instance ${DB_INSTANCE} (private subnets, --no-publicly-accessible)"
+DB_PASSWORD=""
+DB_POSTURE="$(aws rds describe-db-instances --db-instance-identifier "${DB_INSTANCE}" \
+  --query 'DBInstances[0].[PubliclyAccessible,StorageEncrypted]' --output text 2>/dev/null || true)"
+if [[ -n "${DB_POSTURE}" ]]; then
+  # Name-based reuse: a pre-existing instance may not carry the posture this
+  # script would have created it with. Non-fatal (the operator may be migrating
+  # an existing DB on purpose), but drift from the guide's baseline must be seen.
+  read -r DB_PUBLIC DB_ENCRYPTED <<<"${DB_POSTURE}"
+  if [[ "${DB_PUBLIC}" == "True" ]]; then
+    echo "    WARN — RDS instance ${DB_INSTANCE} is PubliclyAccessible; this script would have" >&2
+    echo "           created it with --no-publicly-accessible. Fix: aws rds modify-db-instance" >&2
+    echo "           --db-instance-identifier ${DB_INSTANCE} --no-publicly-accessible --apply-immediately" >&2
+  fi
+  if [[ "${DB_ENCRYPTED}" == "False" ]]; then
+    echo "    WARN — RDS instance ${DB_INSTANCE} has StorageEncrypted=false; this script would" >&2
+    echo "           have created it with --storage-encrypted (encryption cannot be enabled in" >&2
+    echo "           place — restore an encrypted snapshot copy to migrate)." >&2
+  fi
+  if secret_exists "${SECRET_NAME}"; then
+    skip "instance ${DB_INSTANCE} (password unchanged; secret not rewritten)"
+  else
+    # Self-heal: a previous run died after creating the instance but before
+    # writing the connection-string secret, losing the only copy of the
+    # password. The secret is the password's only consumer, so resetting it is
+    # safe and keeps re-runs able to recover from any partial state.
+    # secret_exists (not a bare exit-status check) gates this: only a
+    # definitive ResourceNotFoundException may trigger a password reset.
+    # ORDERING INVARIANT: the secret write (§5 below) is the heal's commit
+    # point — everything that can fail must happen BEFORE it, so a crash at
+    # any point leaves the secret still missing and the next run simply
+    # repeats the heal. Writing the secret first would invert that: a crash
+    # between secret write and modify-db-instance would leave an existing
+    # secret whose password the DB never received, and every later run would
+    # skip the heal while the gateway can't connect.
+    # NOTE: the parameter group is attached on create only — an instance that
+    # predates it keeps its current group (attach via modify-db-instance
+    # --db-parameter-group-name yourself if you want force_ssl retrofitted).
+    log "Instance ${DB_INSTANCE} exists but secret ${SECRET_NAME} is missing — resetting password"
+    DB_PASSWORD="$(openssl rand -hex 24)"
+    pw_json=""; secret_json pw_json MasterUserPassword "${DB_PASSWORD}"
+    aws rds modify-db-instance --db-instance-identifier "${DB_INSTANCE}" \
+      --cli-input-json "file://${pw_json}" --apply-immediately >/dev/null
+    rm -f "${pw_json}"
+  fi
+else
+  DB_PASSWORD="$(openssl rand -hex 24)"
+  pw_json=""; secret_json pw_json MasterUserPassword "${DB_PASSWORD}"
+  aws rds create-db-instance --db-instance-identifier "${DB_INSTANCE}" \
+    --engine postgres --engine-version "${DB_ENGINE_VERSION}" \
+    --db-instance-class "${DB_CLASS}" \
+    --allocated-storage "${DB_STORAGE_GB}" --db-name "${DB_NAME}" \
+    --master-username "${DB_USER}" --cli-input-json "file://${pw_json}" \
+    --db-subnet-group-name "${DB_SUBNET_GROUP}" \
+    --db-parameter-group-name "${DB_PARAM_GROUP}" \
+    --vpc-security-group-ids "${DB_SG}" \
+    --no-publicly-accessible \
+    --storage-encrypted >/dev/null
+  rm -f "${pw_json}"
+fi
+
+log "Waiting for ${DB_INSTANCE} to become available (first creation takes ~10 min)"
+aws rds wait db-instance-available --db-instance-identifier "${DB_INSTANCE}"
+DB_HOST="$(aws rds describe-db-instances --db-instance-identifier "${DB_INSTANCE}" \
+  --query 'DBInstances[0].Endpoint.Address' --output text)"
+
+# ---- 5 Connection string + JWT secret -> Secrets Manager --------------------
+# No per-secret IAM grants are needed: the execution role's read-gateway-secrets
+# policy (§2) names each of the three secrets by its ARN prefix.
+# Secret values go to aws via --cli-input-json temp files, never argv.
+if [[ -n "${DB_PASSWORD}" ]]; then
+  # RDS private endpoint (guide §3); the gateway connects directly over the
+  # VPC — the DB security group only admits ${GW_SG_NAME}.
+  # sslmode=verify-full: the gateway's driver honors sslmode from the URL and
+  # verifies the RDS certificate chain AND hostname against the CA bundle the
+  # image trusts via NODE_EXTRA_CA_CERTS (see the Dockerfile). Do NOT add a
+  # libpq-style `sslrootcert=` query param — the driver doesn't read it and
+  # forwards it to Postgres as a startup parameter, which the server rejects.
+  CONN="postgres://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:5432/${DB_NAME}?sslmode=verify-full"
+  log "Storing connection string in Secrets Manager secret ${SECRET_NAME} (§5)"
+  conn_json=""; secret_json conn_json SecretString "${CONN}"
+  if secret_exists "${SECRET_NAME}"; then
+    aws secretsmanager put-secret-value --secret-id "${SECRET_NAME}" \
+      --cli-input-json "file://${conn_json}" >/dev/null
+  else
+    aws secretsmanager create-secret --name "${SECRET_NAME}" \
+      --cli-input-json "file://${conn_json}" >/dev/null
+  fi
+  rm -f "${conn_json}"
+else
+  log "Skipping postgres-url secret write (instance already existed, password not available this run)"
+fi
+
+# JWT signing secret — generated once (re-runs do NOT rotate it).
+log "Ensuring JWT signing secret ${JWT_SECRET_NAME} (§5)"
+if secret_exists "${JWT_SECRET_NAME}"; then
+  skip "secret ${JWT_SECRET_NAME}"
+else
+  jwt_json=""; secret_json jwt_json SecretString "$(openssl rand -base64 32)"
+  aws secretsmanager create-secret --name "${JWT_SECRET_NAME}" \
+    --cli-input-json "file://${jwt_json}" >/dev/null
+  rm -f "${jwt_json}"
+fi
+
+# OIDC client secret — operator-created (the script can't generate it; it comes
+# from the Okta OIDC web application). Checked here so the deploy step below can
+# gate on it with a clear message instead of a raw ECS secret-injection failure.
+OIDC_ARN="$(secret_arn "${OIDC_SECRET_NAME}")"
+
+# ---- 7 ECS Fargate service + internal ALB ----------------------------------
+# Self-gating: deploy only once its inputs exist (image pushed — i.e.
+# gateway.yaml was filled in — plus the operator-provided OIDC client secret
+# and the ACM certificate for the internal hostname). On a first run these are
+# usually missing and it cleanly skips.
+ALB_DNS=""
+missing=""
+[[ -n "${IMAGE}" ]] || missing="${missing} image(fill ${GATEWAY_YAML})"
+[[ -n "${OIDC_ARN}" ]] || missing="${missing} ${OIDC_SECRET_NAME}"
+[[ -n "${ACM_CERT_ARN}" ]] || missing="${missing} ACM_CERT_ARN"
+SECRET_ARN="$(secret_arn "${SECRET_NAME}")"
+JWT_ARN="$(secret_arn "${JWT_SECRET_NAME}")"
+[[ -n "${SECRET_ARN}" ]] || missing="${missing} ${SECRET_NAME}"
+[[ -n "${JWT_ARN}"    ]] || missing="${missing} ${JWT_SECRET_NAME}"
+
+if [[ "${DEPLOY}" != "1" ]]; then
+  log "Skipping ECS/ALB deploy (DEPLOY=${DEPLOY}) (§7)"
+elif [[ -n "${missing// }" ]]; then
+  log "Skipping ECS/ALB deploy — missing input(s):${missing} (§7)"
+  echo "        Fill ${GATEWAY_YAML} and re-run to build the image; create ${OIDC_SECRET_NAME}"
+  echo "        from the Okta client secret; set ACM_CERT_ARN to the certificate for your"
+  echo "        internal gateway hostname. Then re-run to deploy."
+else
+  log "Creating ECS cluster ${CLUSTER} and log group ${LOG_GROUP} (§7)"
+  if [[ "$(aws ecs describe-clusters --clusters "${CLUSTER}" \
+        --query 'clusters[0].status' --output text 2>/dev/null)" == "ACTIVE" ]]; then
+    skip "cluster ${CLUSTER}"
+  else
+    aws ecs create-cluster --cluster-name "${CLUSTER}" >/dev/null
+  fi
+  # The gateway's stderr carries both its audit events and operational logs.
+  if aws logs describe-log-groups --log-group-name-prefix "${LOG_GROUP}" \
+       --query 'logGroups[?logGroupName==`'"${LOG_GROUP}"'`]' --output text 2>/dev/null | grep -q .; then
+    skip "log group ${LOG_GROUP}"
+  else
+    aws logs create-log-group --log-group-name "${LOG_GROUP}"
+  fi
+  # Retention is a separate API (create-log-group has no retention flag) and an
+  # upsert — applied every run so pre-existing groups converge too. Without it
+  # the group keeps logs forever and cost grows unbounded.
+  aws logs put-retention-policy --log-group-name "${LOG_GROUP}" \
+    --retention-in-days "${LOG_RETENTION_DAYS}"
+
+  # Task definition: the task role carries the Bedrock permission; the
+  # execution role injects the secrets. Registering is an append (a new
+  # revision) — the service below always points at the latest.
+  log "Registering task definition ${TASK_FAMILY}"
+  taskdef_tmp="$(mktemp)"
+  cat > "${taskdef_tmp}" <<EOF
+{
+  "family": "${TASK_FAMILY}",
+  "networkMode": "awsvpc",
+  "requiresCompatibilities": ["FARGATE"],
+  "cpu": "${TASK_CPU}",
+  "memory": "${TASK_MEMORY}",
+  "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" },
+  "executionRoleArn": "arn:aws:iam::${ACCOUNT_ID}:role/${EXEC_ROLE}",
+  "taskRoleArn": "arn:aws:iam::${ACCOUNT_ID}:role/${TASK_ROLE}",
+  "containerDefinitions": [
+    {
+      "name": "gateway",
+      "image": "${IMAGE}",
+      "portMappings": [{ "containerPort": 8080 }],
+      "secrets": [
+        { "name": "GATEWAY_JWT_SECRET",   "valueFrom": "${JWT_ARN}" },
+        { "name": "OIDC_CLIENT_SECRET",   "valueFrom": "${OIDC_ARN}" },
+        { "name": "GATEWAY_POSTGRES_URL", "valueFrom": "${SECRET_ARN}" }
+      ],
+      "logConfiguration": {
+        "logDriver": "awslogs",
+        "options": {
+          "awslogs-group": "${LOG_GROUP}",
+          "awslogs-region": "${AWS_REGION}",
+          "awslogs-stream-prefix": "gateway"
+        }
+      }
+    }
+  ]
+}
+EOF
+  aws ecs register-task-definition --cli-input-json "file://${taskdef_tmp}" >/dev/null
+  rm -f "${taskdef_tmp}"
+
+  # Internal ALB. --ip-address-type ipv4: an internal dual-stack ALB publishes
+  # public-range AAAA records, which the CLI's /login private-network check
+  # rejects.
+  log "Creating internal ALB ${ALB_NAME} + target group + HTTPS listener"
+  read -r ALB_ARN ALB_SCHEME ALB_VPC ALB_IP_TYPE <<<"$(aws elbv2 describe-load-balancers --names "${ALB_NAME}" \
+    --query 'LoadBalancers[0].[LoadBalancerArn,Scheme,VpcId,IpAddressType]' --output text 2>/dev/null || true)"
+  if [[ -n "${ALB_ARN}" && "${ALB_ARN}" != "None" ]]; then
+    # Reuse is by name, and scheme/VPC are immutable on an ALB — so posture is
+    # asserted, fail-closed: attaching the gateway to an internet-facing or
+    # wrong-VPC load balancer would change the exposure model, not just drift.
+    if [[ "${ALB_SCHEME}" != "internal" || "${ALB_VPC}" != "${VPC_ID}" ]]; then
+      echo "ERROR: load balancer ${ALB_NAME} exists but is not the internal ALB this script expects:" >&2
+      echo "       scheme=${ALB_SCHEME} (need internal), vpc=${ALB_VPC} (need ${VPC_ID})." >&2
+      echo "       Refusing to deploy the gateway behind it. Delete that load balancer, or set" >&2
+      echo "       ALB_NAME to an unused name, then re-run." >&2
+      exit 1
+    fi
+    skip "load balancer ${ALB_NAME} (internal, ${ALB_VPC})"
+    # ip-address-type IS mutable (unlike scheme/VPC) — converge a reused
+    # dualstack ALB back to ipv4, matching the Terraform sibling: dual-stack
+    # publishes public-range AAAA records that /login rejects (see above).
+    if [[ "${ALB_IP_TYPE}" != "ipv4" ]]; then
+      aws elbv2 set-ip-address-type --load-balancer-arn "${ALB_ARN}" \
+        --ip-address-type ipv4 >/dev/null
+    fi
+  else
+    # shellcheck disable=SC2086
+    ALB_ARN="$(aws elbv2 create-load-balancer --name "${ALB_NAME}" \
+      --scheme internal --type application --ip-address-type ipv4 \
+      --subnets ${PRIVATE_SUBNETS} --security-groups "${ALB_SG}" \
+      --query 'LoadBalancers[0].LoadBalancerArn' --output text)"
+  fi
+
+  # The ALB closes a connection after 60 seconds with no data by default, which
+  # cuts off streams during quiet periods (long prompt processing before the
+  # first token, extended thinking). Attribute setting is idempotent.
+  aws elbv2 modify-load-balancer-attributes --load-balancer-arn "${ALB_ARN}" \
+    --attributes Key=idle_timeout.timeout_seconds,Value=3600 >/dev/null
+
+  read -r TG_ARN TG_VPC <<<"$(aws elbv2 describe-target-groups --names "${TG_NAME}" \
+    --query 'TargetGroups[0].[TargetGroupArn,VpcId]' --output text 2>/dev/null || true)"
+  if [[ -n "${TG_ARN}" && "${TG_ARN}" != "None" ]]; then
+    skip "target group ${TG_NAME}"
+    # VPC is immutable on a target group; a wrong-VPC one can't reach the tasks.
+    if [[ "${TG_VPC}" != "${VPC_ID}" ]]; then
+      echo "    WARN — target group ${TG_NAME} is in ${TG_VPC}, not ${VPC_ID}; the service's tasks" >&2
+      echo "           will not become healthy behind it. Delete it or set TG_NAME to an unused" >&2
+      echo "           name, then re-run." >&2
+    fi
+  else
+    # /readyz verifies the store is reachable, so a task that can't reach
+    # Postgres never enters rotation (the gateway also serves liveness-only
+    # /healthz — see the deploy guide's outage-behavior tradeoff).
+    TG_ARN="$(aws elbv2 create-target-group --name "${TG_NAME}" \
+      --protocol HTTP --port 8080 --vpc-id "${VPC_ID}" --target-type ip \
+      --health-check-path /readyz \
+      --query 'TargetGroups[0].TargetGroupArn' --output text)"
+  fi
+
+  # Select the HTTPS:443 listener specifically — a reused ALB may carry other
+  # listeners (say HTTP:80); those stay untouched, and the 443 listener is
+  # still created when it's the one that's missing.
+  # shellcheck disable=SC2016  # backticks are JMESPath literals, not expansion
+  LISTENER_ARN="$(aws elbv2 describe-listeners --load-balancer-arn "${ALB_ARN}" \
+    --query 'Listeners[?Port==`443`]|[0].ListenerArn' --output text 2>/dev/null || true)"
+  if [[ -n "${LISTENER_ARN}" && "${LISTENER_ARN}" != "None" ]]; then
+    skip "HTTPS:443 listener on ${ALB_NAME}"
+    # Converge everything this script owns on pre-existing listeners
+    # (modify-listener is an upsert): the TLS policy (so re-runs pick up an
+    # ALB_SSL_POLICY change, and listeners created before this script pinned
+    # one lose the legacy default), the certificate (so a changed ACM_CERT_ARN
+    # — e.g. a renewal under a new ARN — is not silently ignored), and the
+    # default action (so the listener always forwards to this target group).
+    aws elbv2 modify-listener --listener-arn "${LISTENER_ARN}" \
+      --ssl-policy "${ALB_SSL_POLICY}" \
+      --certificates "CertificateArn=${ACM_CERT_ARN}" \
+      --default-actions "Type=forward,TargetGroupArn=${TG_ARN}" >/dev/null
+  else
+    aws elbv2 create-listener --load-balancer-arn "${ALB_ARN}" \
+      --protocol HTTPS --port 443 \
+      --ssl-policy "${ALB_SSL_POLICY}" \
+      --certificates "CertificateArn=${ACM_CERT_ARN}" \
+      --default-actions "Type=forward,TargetGroupArn=${TG_ARN}" >/dev/null
+  fi
+
+  # Service: created once, then rolled forward — a re-run points it at the
+  # latest task-definition revision (which carries the current image tag, and
+  # therefore the current gateway.yaml) and forces a new deployment.
+  log "Creating/updating ECS service ${SERVICE} (Fargate, private subnets, no public IP)"
+  svc_status="$(aws ecs describe-services --cluster "${CLUSTER}" --services "${SERVICE}" \
+    --query 'services[0].status' --output text 2>/dev/null || true)"
+  if [[ "${svc_status}" == "ACTIVE" ]]; then
+    aws ecs update-service --cluster "${CLUSTER}" --service "${SERVICE}" \
+      --task-definition "${TASK_FAMILY}" --desired-count "${DESIRED_COUNT}" \
+      --deployment-configuration "deploymentCircuitBreaker={enable=true,rollback=true}" \
+      --health-check-grace-period-seconds 60 \
+      --force-new-deployment >/dev/null
+    echo "        service updated to the latest task-definition revision."
+  else
+    # All egress (Bedrock, the IdP, Secrets Manager, ECR, CloudWatch Logs) goes
+    # through the NAT gateway — assignPublicIp stays DISABLED.
+    # The deployment circuit breaker stops a rollout whose tasks keep failing
+    # (bad image, unbootable config) and rolls back to the last steady state
+    # instead of relaunching failing tasks forever. The health-check grace
+    # period gives a cold task (image pull + store connect + first /readyz)
+    # time before ECS counts it unhealthy — without it the circuit breaker can
+    # declare the very first rollout failed (matches terraform/'s
+    # health_check_grace_period_seconds).
+    aws ecs create-service --cluster "${CLUSTER}" --service-name "${SERVICE}" \
+      --task-definition "${TASK_FAMILY}" --desired-count "${DESIRED_COUNT}" \
+      --launch-type FARGATE \
+      --deployment-configuration "deploymentCircuitBreaker={enable=true,rollback=true}" \
+      --health-check-grace-period-seconds 60 \
+      --network-configuration "awsvpcConfiguration={subnets=[${SUBNETS_CSV}],securityGroups=[${GW_SG}],assignPublicIp=DISABLED}" \
+      --load-balancers "targetGroupArn=${TG_ARN},containerName=gateway,containerPort=8080" >/dev/null
+  fi
+
+  ALB_DNS="$(aws elbv2 describe-load-balancers --load-balancer-arns "${ALB_ARN}" \
+    --query 'LoadBalancers[0].DNSName' --output text)"
+  log "Internal ALB DNS: ${ALB_DNS}"
+
+  # Post-deploy smoke check: the ALB is internal (unreachable from this
+  # machine), but target health is visible through the API — poll until the
+  # /readyz health check passes. Non-fatal; a cold task needs a minute or two
+  # (image pull + store connect).
+  log "Smoke check: polling target health on ${TG_NAME} (health check: GET /readyz)"
+  tg_state="unknown"
+  for _ in $(seq 1 24); do
+    tg_state="$(aws elbv2 describe-target-health --target-group-arn "${TG_ARN}" \
+      --query 'TargetHealthDescriptions[0].TargetHealth.State' --output text 2>/dev/null || true)"
+    [[ "${tg_state}" == "healthy" ]] && break
+    sleep 10
+  done
+  if [[ "${tg_state}" == "healthy" ]]; then
+    echo "        OK — a gateway task is healthy behind the ALB (store reachable)."
+  else
+    echo "        WARN — last target state: ${tg_state:-none}; the task may still be starting."
+    echo "               Check the service events and the gateway's logs:"
+    echo "                 aws ecs describe-services --cluster ${CLUSTER} --services ${SERVICE} --query 'services[0].events[:5]'"
+    echo "                 aws logs tail ${LOG_GROUP} --since 10m"
+  fi
+
+  # public_url is baked into the image, so verify the operator's chosen
+  # hostname is in place (the redirect URI and discovery doc derive from it).
+  CFG_PUBLIC_URL="$(grep -E '^[[:space:]]*public_url:' "${GATEWAY_YAML}" 2>/dev/null \
+    | head -1 \
+    | sed -E 's/^[[:space:]]*public_url:[[:space:]]*//; s/[[:space:]]+#.*$//; s/[[:space:]]*$//' \
+    || true)"
+  CFG_PUBLIC_URL="${CFG_PUBLIC_URL#[\'\"]}"; CFG_PUBLIC_URL="${CFG_PUBLIC_URL%[\'\"]}"
+  CFG_PUBLIC_URL="${CFG_PUBLIC_URL%/}"
+  echo "        1. In your Route 53 private hosted zone, alias the host of"
+  echo "           ${CFG_PUBLIC_URL:-<public_url>} to the ALB: ${ALB_DNS}"
+  echo "           (the ALB's own *.elb.amazonaws.com name can't carry your ACM certificate)."
+  echo "        2. Register this redirect URI on the Okta OIDC web app: ${CFG_PUBLIC_URL:-<public_url>}/oauth/callback"
+  echo "        3. Verify from inside your corporate network:"
+  echo "             curl -s ${CFG_PUBLIC_URL:-<public_url>}/.well-known/oauth-authorization-server"
+fi
+
+# ---- summary ----------------------------------------------------------------
+cat <<EOF
+
+==> Done.
+
+  Security groups       ${ALB_SG_NAME}=${ALB_SG}  ${GW_SG_NAME}=${GW_SG}  ${DB_SG_NAME}=${DB_SG}
+  IAM roles             ${TASK_ROLE} (bedrock-invoke), ${EXEC_ROLE} (pull + secrets)
+  Image                 ${IMAGE:-(not built yet — fill ${GATEWAY_YAML})}
+  RDS instance          ${DB_INSTANCE} -> ${DB_HOST}
+  Database / user       ${DB_NAME} / ${DB_USER}
+  Secrets               ${SECRET_NAME}, ${JWT_SECRET_NAME}, ${OIDC_SECRET_NAME}$( [[ -n "${OIDC_ARN}" ]] || printf ' (MISSING — create it)' )
+  ECS service           ${CLUSTER}/${SERVICE} behind ${ALB_DNS:-(not deployed yet)}
+
+Next steps (see https://code.claude.com/docs/en/claude-apps-gateway-on-aws):
+  - Create the one operator-provided secret (from the Okta OIDC web app). Put the
+    client secret in a 0600 file first — passing it as a literal argument would
+    leave it readable in the process table and in audit/EDR logs:
+      aws secretsmanager create-secret --name ${OIDC_SECRET_NAME} \\
+        --secret-string file:///path/to/okta-client-secret.txt
+  - Fill in the REPLACE_ME values in ${GATEWAY_YAML}, then re-run: setup.sh builds the
+    image (config baked in) and deploys once the secret and ACM_CERT_ARN exist.
+  - Enable Bedrock model access in the console for the Claude models you need (per
+    region the us.anthropic.* profiles span) and submit the one-time use case form.
+  - Alias your internal hostname (gateway.yaml public_url) to the ALB in a Route 53
+    private hosted zone, and register <public_url>/oauth/callback on the Okta app.
+  - The gateway runs its own schema migrations at boot, so ${DB_USER} needs CREATE TABLE.
+EOF

examples/gateway/aws/terraform/.gitignore

@@ -0,0 +1,19 @@
+# Never commit state (contains secrets) or local var files
+*.tfstate
+*.tfstate.*
+.terraform/
+terraform.tfvars
+*.auto.tfvars
+crash.log
+
+# The lock file holds no secrets. It's ignored here so consumers who copy this
+# example into their own repo generate (and commit) their own platform-complete
+# lock at first init — committing one from this repo would carry only one
+# platform's provider hashes. In your copy, drop this line and commit the lock
+# produced by:
+#   terraform providers lock -platform=linux_amd64 -platform=linux_arm64 \
+#     -platform=darwin_amd64 -platform=darwin_arm64 -platform=windows_amd64
+# versions.tf pins by range only, so without a committed lock the registry
+# serves the newest in-range build; a platform-complete lock gives hash
+# continuity across machines/CI and makes provider upgrades reviewable diffs.
+.terraform.lock.hcl

examples/gateway/aws/terraform/README.md

@@ -0,0 +1,182 @@
+# Claude apps gateway — Terraform (ECS Fargate)
+
+Terraform equivalent of `../setup.sh`. Lets end-users provision and manage
+the gateway with `terraform apply`. Covers the same scope ([walkthrough](https://code.claude.com/docs/en/claude-apps-gateway-on-aws) §1–7,
+ECS track): security groups → task + execution IAM roles → ECR repository →
+private-subnet RDS for PostgreSQL → Secrets Manager secrets → ECS Fargate
+service behind an internal ALB. The VPC and private subnets are walkthrough
+prerequisites, passed in as variables — unlike the GCP example, no network is
+created here.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `versions.tf` | Provider pins (aws, random) |
+| `variables.tf` | All inputs (defaults match `setup.sh`'s) |
+| `main.tf` | Resources |
+| `outputs.tf` | ALB DNS name + zone ID, image, roles, DB endpoint |
+| `terraform.tfvars.example` | Copy to `terraform.tfvars` and edit |
+
+## Prerequisites
+
+1. **`../gateway.yaml` created and FULLY filled in** — copy the template first:
+   `cp ../gateway.yaml.example ../gateway.yaml`, then replace every `REPLACE_ME`
+   (Terraform reads this file and enforces no `REPLACE_ME` via a precondition).
+   Unlike the GCP example there is no placeholder-first-pass: the config is
+   **baked into the image**, and `public_url` is your own internal hostname,
+   which you choose up front (you already hold its ACM certificate).
+   `gateway.yaml` is gitignored; the committed template is `gateway.yaml.example`.
+2. The **prebuilt linux-x64 `claude` binary at `../claude`** — the Claude Code
+   release binary, which includes the `gateway` subcommand (see the
+   [walkthrough](https://code.claude.com/docs/en/claude-apps-gateway-on-aws)).
+   See `../setup.sh`'s `DIST_URL`/`DIST_SHA256` download path for a
+   checksum-verified fetch.
+3. A **VPC with two+ private subnets** in different AZs and NAT egress, an **ACM
+   certificate** for your internal gateway hostname, and **Bedrock model access**
+   enabled in the console (cross-region `us.anthropic.*` profiles need it in each
+   region the profile spans), with the one-time use case form submitted.
+4. A **remote backend** for shared use (see below). State holds secrets — never commit it.
+
+## Deploy
+
+Terraform creates the ECR repository but does **not** build/push the image, so
+the apply is two passes: a targeted apply to create the repo, then build/push,
+then the full apply.
+
+```bash
+cp terraform.tfvars.example terraform.tfvars   # edit it
+terraform init
+
+# Pin providers in your copy (once, then commit .terraform.lock.hcl and drop
+# its .gitignore line): versions.tf pins by range only, so without a committed
+# lock the registry serves the newest in-range build — a platform-complete
+# lock gives hash continuity across machines/CI and makes provider upgrades
+# reviewable diffs.
+terraform providers lock -platform=linux_amd64 -platform=linux_arm64 \
+  -platform=darwin_amd64 -platform=darwin_arm64 -platform=windows_amd64
+
+# 1. Create just the ECR repository (the -target warning is expected):
+terraform apply -target=aws_ecr_repository.repo
+
+# 2. Build and push the image (gateway.yaml and the RDS CA bundle are baked in;
+#    the COPY sources are context-relative — the build context `..` is aws/, so
+#    `claude`, `gateway.yaml`, and `rds-global-bundle.pem`).
+#    The CA bundle is the trust anchor for the connection string's
+#    sslmode=verify-full (AWS rotates it; download it when absent — don't commit it):
+curl -fL --proto '=https' -o ../rds-global-bundle.pem \
+  https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
+aws ecr get-login-password --region us-east-1 \
+  | docker login --username AWS --password-stdin <account-id>.dkr.ecr.us-east-1.amazonaws.com
+docker build --platform=linux/amd64 --provenance=false \
+  -f ../Dockerfile --build-arg CLAUDE_BINARY=claude --build-arg GATEWAY_CONFIG=gateway.yaml \
+  -t <account-id>.dkr.ecr.us-east-1.amazonaws.com/claude-gateway:<version> ..
+docker push <account-id>.dkr.ecr.us-east-1.amazonaws.com/claude-gateway:<version>
+
+# 3. Full apply:
+terraform apply
+```
+
+Set in `terraform.tfvars`:
+
+- `region`, `vpc_id`, `private_subnet_ids`, `corporate_cidr`
+- `acm_certificate_arn` — the certificate for your internal gateway hostname
+  (`gateway.yaml`'s `public_url` host), served by the ALB's HTTPS listener
+- `image_tag` (after building/pushing — step 2 above). The repo enforces
+  **immutable tags**, so a `gateway.yaml` edit means a rebuild under a **new**
+  tag and an `image_tag` bump (`../setup.sh` automates this by tagging
+  `<version>-cfg<sha8-of-gateway.yaml>`)
+- **`oidc_client_secret`** — required (the ECS tasks inject `latest` of this
+  secret at start; with no version they fail with
+  `ResourceInitializationError`). Terraform creates the secret + version from it.
+
+## Tear down
+
+Tear down a trial with `terraform destroy`: set `deletion_protection = false`,
+run `terraform apply` to record that on RDS and the ALB (and to flip RDS to
+`skip_final_snapshot` — the provider checks the value in **state**, not config,
+so destroy would still refuse otherwise), then `terraform destroy`.
+
+The same switch drives the Secrets Manager recovery window: the three secrets
+have **fixed names**, and a secret deleted with the default 30-day recovery
+window keeps its name reserved — a later `terraform apply` would fail with a
+name conflict until the window elapses. With `deletion_protection = false` the
+destroy deletes them immediately (`recovery_window_in_days = 0`). If you
+destroyed a deployment that still had `deletion_protection = true` (or tore
+down an older copy of this module), clear the scheduled deletions before
+re-applying:
+
+```bash
+for s in gateway-postgres-url gateway-jwt-secret gateway-oidc-client-secret; do
+  aws secretsmanager delete-secret --secret-id "$s" --force-delete-without-recovery
+done
+```
+
+## Guard rails
+
+Tuned so accidental deletion is hard but greenfield teardown stays easy:
+
+- `deletion_protection = true` (variable, default true) on RDS and the ALB —
+  blocks accidental deletion; set `false` when you intend to `terraform destroy`.
+  The same switch controls RDS `skip_final_snapshot`, so a protected instance
+  always leaves a final snapshot.
+- ECR tags are **immutable** and **scanned on push** — a deployed tag can never
+  be silently re-pointed at different bytes. For production, also restrict push
+  rights on the repo to your CI / image-promotion pipeline rather than operator
+  credentials.
+- The IAM roles carry only the walkthrough's least-privilege documents: Bedrock
+  invoke on the Anthropic model ARNs (task role) and `secretsmanager:GetSecretValue`
+  on exactly the three secrets this module creates (by ARN) plus the AWS-managed
+  ECS execution policy (execution role). Inline policies are scoped to these
+  roles, so nothing else in the account is touched.
+- TLS everywhere it terminates: the ALB listener pins
+  `ELBSecurityPolicy-TLS13-1-2-2021-06` (no TLS 1.0/1.1), and the store
+  connection uses `sslmode=verify-full` against the RDS CA bundle baked into
+  the image, with `rds.force_ssl=1` enforcing TLS server-side.
+
+## Private access
+
+The ALB is **internal** with `ip_address_type = "ipv4"` (a dual-stack internal
+ALB publishes public-range AAAA records, which the CLI's `/login`
+private-network check rejects), and its security group admits only
+`corporate_cidr` on 443. Reaching it from on-prem requires your existing
+routing into the VPC (Direct Connect / VPN) — **operator / network-team-owned**
+plumbing this module does not create.
+
+After the apply, give developers a privately resolvable hostname: in a Route 53
+private hosted zone, alias the host of `gateway.yaml`'s `public_url` to the ALB
+(`alb_dns_name` / `alb_zone_id` outputs). The ALB's own `*.elb.amazonaws.com`
+name can't carry your ACM certificate, so use your own name.
+
+The tasks run in the private subnets with no public IP; all egress (Bedrock,
+the IdP, Secrets Manager, ECR, CloudWatch Logs) goes through the NAT gateway.
+To keep Bedrock traffic off the public path, create a `bedrock-runtime`
+interface VPC endpoint and point the upstream's `base_url` at it (see
+`../gateway.yaml.example`); the IdP still needs internet egress.
+
+## Remote state (recommended for teams)
+
+Add a backend so state is shared and locked (and out of git):
+
+```hcl
+# backend.tf
+terraform {
+  backend "s3" {
+    bucket       = "<your-tf-state-bucket>"
+    key          = "claude-gateway/ecs"
+    region       = "us-east-1"
+    use_lockfile = true # S3-native locking (Terraform >= 1.10); or set dynamodb_table
+  }
+}
+```
+
+## After deploy
+
+- `terraform output alb_dns_name` / `alb_zone_id` — create the Route 53 alias.
+- Register `<public_url>/oauth/callback` on the Okta OIDC web app and make sure
+  `../gateway.yaml` `public_url` matches the host you aliased.
+- Notes: Terraform does not build the image. To ship a new gateway version **or
+  a config edit**, rerun the docker build/push under a new tag and bump
+  `image_tag` — secrets-only rotations roll the service without a rebuild (the
+  task definition stamps a hash of the managed secret values), but a
+  `gateway.yaml` edit reaches the container only through the rebuilt image.

examples/gateway/aws/terraform/main.tf

@@ -0,0 +1,510 @@
+# Claude apps gateway on ECS Fargate — Terraform equivalent of setup.sh.
+# Section markers (§N) map to setup.sh and the walkthrough:
+# https://code.claude.com/docs/en/claude-apps-gateway-on-aws
+#
+# Unlike the GCP example this module does NOT create the network — the VPC and
+# private subnets are walkthrough prerequisites, passed in as variables.
+
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+# Read (not created) so a typo'd VPC or subnet ID fails the plan up front
+# instead of half-applying.
+data "aws_vpc" "this" {
+  id = var.vpc_id
+}
+
+data "aws_subnet" "private" {
+  for_each = toset(var.private_subnet_ids)
+  id       = each.value
+}
+
+locals {
+  config_path    = var.gateway_config_path != "" ? var.gateway_config_path : "${path.module}/../gateway.yaml"
+  gateway_config = file(local.config_path)
+  image          = "${aws_ecr_repository.repo.repository_url}:${var.image_tag}"
+}
+
+# ── 1 Security groups ───────────────────────────────────────────────────────
+# Three groups chain the traffic path: corp network -> ALB :443, ALB ->
+# gateway :8080, gateway -> Postgres :5432. Nothing else is reachable.
+# Rules are separate resources (not inline) so they never fight other tooling.
+resource "aws_security_group" "alb" {
+  name        = "claude-gateway-alb"
+  description = "Claude gateway ALB"
+  vpc_id      = var.vpc_id
+}
+
+resource "aws_security_group" "gateway" {
+  name        = "claude-gateway-svc"
+  description = "Claude gateway service"
+  vpc_id      = var.vpc_id
+}
+
+resource "aws_security_group" "db" {
+  name        = "claude-gateway-db"
+  description = "Claude gateway Postgres"
+  vpc_id      = var.vpc_id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "alb_https" {
+  security_group_id = aws_security_group.alb.id
+  description       = "HTTPS from the corporate network"
+  ip_protocol       = "tcp"
+  from_port         = 443
+  to_port           = 443
+  cidr_ipv4         = var.corporate_cidr
+}
+
+resource "aws_vpc_security_group_ingress_rule" "gateway_from_alb" {
+  security_group_id            = aws_security_group.gateway.id
+  description                  = "Gateway port from the ALB"
+  ip_protocol                  = "tcp"
+  from_port                    = 8080
+  to_port                      = 8080
+  referenced_security_group_id = aws_security_group.alb.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "db_from_gateway" {
+  security_group_id            = aws_security_group.db.id
+  description                  = "Postgres from the gateway"
+  ip_protocol                  = "tcp"
+  from_port                    = 5432
+  to_port                      = 5432
+  referenced_security_group_id = aws_security_group.gateway.id
+}
+
+# Egress: the ALB only needs to reach its targets; the gateway needs the NAT
+# path out (Bedrock, the IdP, Secrets Manager, ECR, CloudWatch Logs) plus
+# Postgres. The DB group needs no egress (security groups are stateful).
+resource "aws_vpc_security_group_egress_rule" "alb_to_gateway" {
+  security_group_id            = aws_security_group.alb.id
+  description                  = "Health checks + forwarding to gateway tasks"
+  ip_protocol                  = "tcp"
+  from_port                    = 8080
+  to_port                      = 8080
+  referenced_security_group_id = aws_security_group.gateway.id
+}
+
+resource "aws_vpc_security_group_egress_rule" "gateway_all" {
+  security_group_id = aws_security_group.gateway.id
+  description       = "Egress to Bedrock, the IdP, Secrets Manager, ECR, CloudWatch Logs, Postgres"
+  ip_protocol       = "-1"
+  cidr_ipv4         = "0.0.0.0/0"
+}
+
+# ── 2 IAM roles (least-privilege) ───────────────────────────────────────────
+# Task role: the gateway's runtime identity. Its ONLY permission is invoking
+# Claude models on Bedrock — the upstream's `auth: {}` resolves to this role
+# via the AWS default credential chain. The policy must cover both the
+# cross-region inference-profile ARNs and the underlying foundation-model ARNs.
+data "aws_iam_policy_document" "ecs_trust" {
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "task" {
+  name               = var.task_role_name
+  assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
+}
+
+resource "aws_iam_role_policy" "bedrock_invoke" {
+  name = "bedrock-invoke"
+  role = aws_iam_role.task.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
+      Resource = [
+        "arn:aws:bedrock:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:inference-profile/us.anthropic.*",
+        "arn:aws:bedrock:*::foundation-model/anthropic.*",
+      ]
+    }]
+  })
+
+  # The walkthrough is scoped to commercial US regions: this policy and the
+  # gateway's built-in model catalog both use the us.anthropic.* geo-prefixed
+  # cross-region inference profiles, which only exist in the commercial US
+  # regions — an explicit list, not a `us-` prefix match, because GovCloud
+  # (us-gov-*) and ISO (us-iso-*) regions share the prefix but live in
+  # different AWS partitions where those profiles and this module's arn:aws:
+  # ARNs are wrong. Anywhere else the deploy provisions fine and then every
+  # model call fails. Other-region deploys must pin region-appropriate
+  # profiles via a models: block in gateway.yaml (see the config reference's
+  # models: guidance: https://code.claude.com/docs/en/claude-apps-gateway-config),
+  # widen the inference-profile ARN geo prefix above, and set
+  # allow_non_us_region = true.
+  lifecycle {
+    precondition {
+      condition     = var.allow_non_us_region || contains(["us-east-1", "us-east-2", "us-west-1", "us-west-2"], var.region)
+      error_message = "region is not a commercial US region (GovCloud/ISO share the us- prefix but are different partitions), and this module's IAM policy and the built-in model catalog use the US-geo (us.anthropic.*) inference profiles. Pin your region's inference profiles in a models: block in gateway.yaml, adjust the bedrock-invoke ARN prefix, then set allow_non_us_region = true."
+    }
+  }
+}
+
+# Execution role: the ECS agent's identity — pulls the image from ECR and
+# injects the Secrets Manager values into the container; the gateway never
+# uses it. AmazonECSTaskExecutionRolePolicy covers the ECR pull + awslogs;
+# the inline policy adds read on exactly the three secrets this module
+# creates — their full ARNs, not a name-prefix wildcard, so nothing else
+# in a shared account (present or future) is readable through this role.
+resource "aws_iam_role" "execution" {
+  name               = var.execution_role_name
+  assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
+}
+
+resource "aws_iam_role_policy_attachment" "execution_managed" {
+  role       = aws_iam_role.execution.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+resource "aws_iam_role_policy" "secrets_read" {
+  name = "read-gateway-secrets"
+  role = aws_iam_role.execution.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = "secretsmanager:GetSecretValue"
+      Resource = [
+        aws_secretsmanager_secret.jwt.arn,
+        aws_secretsmanager_secret.oidc.arn,
+        aws_secretsmanager_secret.postgres_url.arn,
+      ]
+    }]
+  })
+}
+
+# ── 6 ECR repository ────────────────────────────────────────────────────────
+# NOTE: image build/push is a separate step (see README) — Terraform only makes
+# the repo. IMMUTABLE tags + scan-on-push: the ECS service pulls whatever this
+# repo serves under the deployed tag, so a pushed tag must never be silently
+# re-pointed. For production, also restrict push rights on this repo to your
+# CI / image-promotion pipeline rather than operator credentials.
+resource "aws_ecr_repository" "repo" {
+  name                 = var.ecr_repo
+  image_tag_mutability = "IMMUTABLE"
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
+# ── 3 RDS for PostgreSQL (private subnets, no public address) ───────────────
+resource "aws_db_subnet_group" "db" {
+  name        = var.db_instance
+  description = "Claude gateway"
+  subnet_ids  = var.private_subnet_ids
+}
+
+# rds.force_ssl: reject plaintext connections server-side — the client-side
+# counterpart is sslmode=verify-full in the connection string (§5). The family
+# tracks the major version in var.db_engine_version.
+#
+# name_prefix + create_before_destroy: a major engine bump changes `family`,
+# which forces replacement — with a static name that deadlocks (the new group
+# can't be created under the taken name; the old can't be destroyed while the
+# live instance uses it: "parameter group is currently in use"). With this
+# shape the replacement group gets a fresh unique name, the instance is
+# repointed, then the old group is destroyed. (The subnet group above needs
+# neither: subnet_ids update in place and an engine bump never touches it.)
+resource "aws_db_parameter_group" "db" {
+  name_prefix = "${var.db_instance}-"
+  family      = "postgres${split(".", var.db_engine_version)[0]}"
+  description = "Claude gateway - require TLS on every connection"
+
+  parameter {
+    name  = "rds.force_ssl"
+    value = "1"
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# URL-safe (alphanumeric) so it drops cleanly into the connection string.
+# nosemgrep: terraform-generic-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote S3 backend (see README "Remote state")
+resource "random_password" "db" {
+  length  = 32
+  special = false
+}
+
+# nosemgrep: terraform-aws-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote S3 backend (see README "Remote state")
+resource "aws_db_instance" "db" {
+  identifier            = var.db_instance
+  engine                = "postgres"
+  engine_version        = var.db_engine_version
+  instance_class        = var.db_instance_class
+  allocated_storage     = var.db_allocated_storage
+  db_name               = var.db_name
+  username              = var.db_user
+  password              = random_password.db.result
+  db_subnet_group_name  = aws_db_subnet_group.db.name
+  parameter_group_name  = aws_db_parameter_group.db.name
+  vpc_security_group_ids = [aws_security_group.db.id]
+  publicly_accessible   = false
+  storage_encrypted     = true
+  deletion_protection   = var.deletion_protection
+  # Greenfield teardown: skip the final snapshot only once deletion protection
+  # is deliberately turned off (the same switch — see README "Tear down").
+  skip_final_snapshot       = !var.deletion_protection
+  final_snapshot_identifier = "${var.db_instance}-final"
+}
+
+# ── 5 Secrets Manager ───────────────────────────────────────────────────────
+# postgres-url: connection string built from the instance's private endpoint.
+# The execution role's policy (§2) grants read on these three secrets' ARNs
+# and nothing else.
+#
+# recovery_window_in_days rides the same switch as skip_final_snapshot: the
+# secrets have fixed names, so a destroy that leaves them in the default
+# 30-day scheduled-deletion state makes the next apply fail with a name
+# conflict. Greenfield teardown (deletion_protection = false) deletes them
+# immediately; a protected deployment keeps the 30-day recovery window.
+resource "aws_secretsmanager_secret" "postgres_url" {
+  name                    = var.secret_name
+  recovery_window_in_days = var.deletion_protection ? 30 : 0
+}
+
+# sslmode=verify-full: the gateway's driver (Bun.SQL) honors sslmode from the
+# URL and verifies the server certificate chain AND hostname. The trust anchor
+# is the AWS RDS CA bundle baked into the image at /etc/claude/rds-global-bundle.pem
+# and loaded via NODE_EXTRA_CA_CERTS (see ../Dockerfile) — do NOT add a
+# libpq-style `sslrootcert=` query param: the driver doesn't read it and
+# forwards it to Postgres as a startup parameter, which the server rejects.
+# nosemgrep: terraform-aws-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote S3 backend (see README "Remote state")
+resource "aws_secretsmanager_secret_version" "postgres_url" {
+  secret_id     = aws_secretsmanager_secret.postgres_url.id
+  secret_string = "postgres://${var.db_user}:${random_password.db.result}@${aws_db_instance.db.address}:5432/${var.db_name}?sslmode=verify-full"
+}
+
+# jwt: session signing key.
+# nosemgrep: terraform-generic-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote S3 backend (see README "Remote state")
+resource "random_password" "jwt" {
+  length  = 48
+  special = false
+}
+
+resource "aws_secretsmanager_secret" "jwt" {
+  name                    = var.jwt_secret_name
+  recovery_window_in_days = var.deletion_protection ? 30 : 0 # see postgres_url
+}
+
+# nosemgrep: terraform-aws-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote S3 backend (see README "Remote state")
+resource "aws_secretsmanager_secret_version" "jwt" {
+  secret_id     = aws_secretsmanager_secret.jwt.id
+  secret_string = random_password.jwt.result
+}
+
+# oidc client secret: operator-provided (from the Okta OIDC web app).
+resource "aws_secretsmanager_secret" "oidc" {
+  name                    = var.oidc_secret_name
+  recovery_window_in_days = var.deletion_protection ? 30 : 0 # see postgres_url
+}
+
+# nosemgrep: terraform-aws-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote S3 backend (see README "Remote state")
+resource "aws_secretsmanager_secret_version" "oidc" {
+  count         = var.oidc_client_secret != "" ? 1 : 0
+  secret_id     = aws_secretsmanager_secret.oidc.id
+  secret_string = var.oidc_client_secret
+}
+
+# Warn (not block) at plan time when the OIDC secret value isn't set: the task
+# definition references the secret unconditionally, so an empty value with no
+# out-of-band version means the tasks fail to start late, at container init
+# (ResourceInitializationError). A warning (not a precondition) keeps the
+# documented out-of-band-version mode usable.
+check "oidc_client_secret_set" {
+  assert {
+    condition     = var.oidc_client_secret != ""
+    error_message = "oidc_client_secret is empty — set it in terraform.tfvars, or add a version to the gateway-oidc-client-secret secret out-of-band before applying (the ECS tasks inject it at start and will fail without one)."
+  }
+}
+
+# ── 7 ECS Fargate service + internal ALB ────────────────────────────────────
+resource "aws_ecs_cluster" "cluster" {
+  name = var.cluster_name
+}
+
+# The gateway's stderr carries both its audit events and operational logs.
+# Bounded retention — without it the group keeps logs forever and cost grows
+# unbounded; the default (90 days) is sized for audit-trail review windows.
+resource "aws_cloudwatch_log_group" "gateway" {
+  name              = var.log_group_name
+  retention_in_days = var.log_retention_days
+}
+
+# Task definition. gateway.yaml ships INSIDE the image (unlike the GCP example,
+# which mounts it from Secret Manager), so Terraform reads ../gateway.yaml only
+# to (a) enforce the no-REPLACE_ME guard before a deploy and (b) stamp a hash
+# of the config + every managed secret value into the container environment —
+# secrets are injected at task start, so rotating one (tainting
+# random_password.db ALTERs the DB password; a new oidc_client_secret) would
+# otherwise leave running tasks on stale values with nothing forcing a roll.
+# NOTE the hash only forces a roll; a config EDIT still reaches the container
+# only via a rebuilt image — push under a new tag (the repo enforces
+# immutability) and bump image_tag, or the roll redeploys the old config.
+resource "aws_ecs_task_definition" "gateway" {
+  family                   = var.service_name
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = tostring(var.task_cpu)
+  memory                   = tostring(var.task_memory)
+  execution_role_arn       = aws_iam_role.execution.arn
+  task_role_arn            = aws_iam_role.task.arn
+
+  runtime_platform {
+    cpu_architecture        = "X86_64" # build the image linux/amd64; ARM64 for Graviton (see ../Dockerfile)
+    operating_system_family = "LINUX"
+  }
+
+  container_definitions = jsonencode([
+    {
+      name  = "gateway"
+      image = local.image
+      portMappings = [{ containerPort = 8080 }]
+      environment = [
+        {
+          name = "GATEWAY_CONFIG_SHA"
+          value = substr(sha256(join("", [
+            local.gateway_config,
+            random_password.db.result,
+            random_password.jwt.result,
+            var.oidc_client_secret,
+          ])), 0, 16)
+        },
+      ]
+      secrets = [
+        { name = "GATEWAY_JWT_SECRET", valueFrom = aws_secretsmanager_secret.jwt.arn },
+        { name = "OIDC_CLIENT_SECRET", valueFrom = aws_secretsmanager_secret.oidc.arn },
+        { name = "GATEWAY_POSTGRES_URL", valueFrom = aws_secretsmanager_secret.postgres_url.arn },
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.gateway.name
+          awslogs-region        = data.aws_region.current.region
+          awslogs-stream-prefix = "gateway"
+        }
+      }
+    }
+  ])
+
+  # Guard mirrors setup.sh's REPLACE_ME check (non-comment lines): the config
+  # is baked into the image this task definition deploys, so a half-filled
+  # gateway.yaml at apply time means the pushed image is half-filled too.
+  lifecycle {
+    precondition {
+      condition = length([
+        for line in split("\n", local.gateway_config) :
+        line
+        if !startswith(trimspace(line), "#") && strcontains(line, "REPLACE_ME")
+      ]) == 0
+      error_message = "gateway.yaml still has REPLACE_ME on a non-comment line — fill it in (and rebuild/push the image) before applying."
+    }
+  }
+
+  depends_on = [
+    aws_secretsmanager_secret_version.postgres_url,
+    aws_secretsmanager_secret_version.jwt,
+  ]
+}
+
+# Internal ALB. ip_address_type ipv4: an internal dual-stack ALB publishes
+# public-range AAAA records, which the CLI's /login private-network check
+# rejects. idle_timeout 3600: the 60-second default closes a streaming
+# response at the first quiet period (long prompt processing before the first
+# token, extended thinking with no streamed output).
+resource "aws_lb" "gateway" {
+  name                       = var.service_name
+  internal                   = true
+  load_balancer_type         = "application"
+  ip_address_type            = "ipv4"
+  subnets                    = var.private_subnet_ids
+  security_groups            = [aws_security_group.alb.id]
+  idle_timeout               = 3600
+  enable_deletion_protection = var.deletion_protection
+}
+
+# /readyz verifies the store is reachable, so a task that can't reach Postgres
+# never enters rotation (the gateway also serves liveness-only /healthz — see
+# the deploy guide's outage-behavior tradeoff).
+resource "aws_lb_target_group" "gateway" {
+  name        = var.service_name
+  protocol    = "HTTP"
+  port        = 8080
+  vpc_id      = var.vpc_id
+  target_type = "ip"
+
+  health_check {
+    path = "/readyz"
+  }
+}
+
+resource "aws_lb_listener" "https" {
+  load_balancer_arn = aws_lb.gateway.arn
+  protocol          = "HTTPS"
+  port              = 443
+  # Explicit modern policy — omitting ssl_policy falls back to the legacy
+  # ELBSecurityPolicy-2016-08 default, which still accepts TLS 1.0/1.1.
+  ssl_policy      = "ELBSecurityPolicy-TLS13-1-2-2021-06"
+  certificate_arn = var.acm_certificate_arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.gateway.arn
+  }
+}
+
+resource "aws_ecs_service" "gateway" {
+  name            = var.service_name
+  cluster         = aws_ecs_cluster.cluster.id
+  task_definition = aws_ecs_task_definition.gateway.arn
+  desired_count   = var.desired_count
+  launch_type     = "FARGATE"
+
+  # Stop a rollout whose tasks keep failing (bad image, unbootable config) and
+  # roll back to the last steady state instead of relaunching failing tasks
+  # forever.
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  network_configuration {
+    subnets         = var.private_subnet_ids
+    security_groups = [aws_security_group.gateway.id]
+    # All egress (Bedrock, the IdP, Secrets Manager, ECR, CloudWatch Logs)
+    # goes through the NAT gateway — tasks get no public IP.
+    assign_public_ip = false
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.gateway.arn
+    container_name   = "gateway"
+    container_port   = 8080
+  }
+
+  # Tasks register with the ALB at start — give a cold task (image pull +
+  # store connect + first /readyz) time before ECS replaces it as unhealthy.
+  health_check_grace_period_seconds = 60
+
+  # The listener must exist before targets register; the secrets must be
+  # readable before the first task starts.
+  depends_on = [
+    aws_lb_listener.https,
+    aws_iam_role_policy.secrets_read,
+    aws_iam_role_policy_attachment.execution_managed,
+    aws_secretsmanager_secret_version.postgres_url,
+    aws_secretsmanager_secret_version.jwt,
+    aws_secretsmanager_secret_version.oidc,
+    aws_db_instance.db,
+  ]
+}

examples/gateway/aws/terraform/outputs.tf

@@ -0,0 +1,34 @@
+output "alb_dns_name" {
+  description = "Internal ALB DNS name. Alias your gateway hostname (the host in gateway.yaml's public_url) to this in a Route 53 private hosted zone — the *.elb.amazonaws.com name itself can't carry your ACM certificate."
+  value       = aws_lb.gateway.dns_name
+}
+
+output "alb_zone_id" {
+  description = "ALB hosted zone ID, for the Route 53 alias record."
+  value       = aws_lb.gateway.zone_id
+}
+
+output "image" {
+  description = "Image the service runs (build/push this separately — see README)."
+  value       = local.image
+}
+
+output "ecr_repository_url" {
+  description = "ECR repository URL to push the gateway image to."
+  value       = aws_ecr_repository.repo.repository_url
+}
+
+output "task_role_arn" {
+  description = "Gateway runtime task role (Bedrock invoke)."
+  value       = aws_iam_role.task.arn
+}
+
+output "execution_role_arn" {
+  description = "ECS execution role (image pull + secret injection)."
+  value       = aws_iam_role.execution.arn
+}
+
+output "db_endpoint" {
+  description = "RDS private endpoint (host only; the connection string lives in the gateway-postgres-url secret)."
+  value       = aws_db_instance.db.address
+}

examples/gateway/aws/terraform/terraform.tfvars.example

@@ -0,0 +1,27 @@
+# Copy to terraform.tfvars and edit. terraform.tfvars is gitignored (see .gitignore).
+
+region = "us-east-1" # a region where Bedrock serves the Claude models you need
+
+# Prerequisite networking (NOT created by this module): the VPC and two+ private
+# subnets in different AZs with outbound internet via a NAT gateway.
+vpc_id             = "vpc-..."
+private_subnet_ids = ["subnet-...a", "subnet-...b"]
+
+# The only source the ALB admits on 443. Must not overlap the private subnets
+# above — hosts in the ALB subnets are trusted_proxies (gateway.yaml) and could
+# spoof client IPs via X-Forwarded-For.
+corporate_cidr = "10.0.0.0/8"
+
+# ACM certificate for your internal gateway hostname (the host in gateway.yaml's
+# public_url), imported or issued by AWS Private CA.
+acm_certificate_arn = "arn:aws:acm:..."
+
+image_tag = "<version>" # REQUIRED — the tag you build and push as linux/amd64 with
+                        # gateway.yaml baked in (setup.sh tags <version>-cfg<sha8>;
+                        # see README Deploy)
+
+# Okta OIDC client secret: REQUIRED — uncomment and set it (Terraform creates the
+# secret version; the ECS tasks inject `gateway-oidc-client-secret` at start, so
+# without a version they fail with ResourceInitializationError). Leave empty only
+# if you add the secret version out-of-band.
+# oidc_client_secret = "..."

examples/gateway/aws/terraform/variables.tf

@@ -0,0 +1,189 @@
+# Inputs — mirror the env-overridable knobs in setup.sh (same defaults).
+
+variable "region" {
+  description = "AWS region for everything this module creates. Pick one where Bedrock serves the Claude models you need. (The Bedrock region the gateway calls is set separately inside gateway.yaml — keep the two equal.) The walkthrough is scoped to the commercial US regions (us-east-1/us-east-2/us-west-1/us-west-2 — GovCloud and ISO regions are different partitions); see allow_non_us_region."
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "allow_non_us_region" {
+  description = "The bedrock-invoke IAM policy and the gateway's built-in model catalog use the US-geo (us.anthropic.*) cross-region inference profiles, so any region outside the commercial US four (including GovCloud/ISO, which are different partitions) fails a plan-time precondition. Set true ONLY after pinning region-appropriate inference profiles via a models: block in gateway.yaml (see the config reference) and widening the ARN geo prefix in main.tf's bedrock-invoke policy."
+  type        = bool
+  default     = false
+}
+
+# ── Networking inputs (prerequisites — NOT created here) ────────────────────
+variable "vpc_id" {
+  description = "Existing VPC ID (the walkthrough's prerequisite VPC). Unlike the GCP example, this module does not create the network."
+  type        = string
+}
+
+variable "private_subnet_ids" {
+  description = "Two+ private subnet IDs in different AZs, with outbound internet via a NAT gateway. The internal ALB, the ECS tasks, and the RDS subnet group all attach here."
+  type        = list(string)
+  validation {
+    condition     = length(var.private_subnet_ids) >= 2
+    error_message = "private_subnet_ids needs at least two subnets in different AZs (the internal ALB requires two)."
+  }
+}
+
+variable "corporate_cidr" {
+  description = "Your corporate network CIDR — the only source the ALB security group admits on 443. Must not overlap private_subnet_ids: hosts there are trusted_proxies (gateway.yaml) and could spoof client IPs via X-Forwarded-For."
+  type        = string
+}
+
+# ── IAM (§2) ────────────────────────────────────────────────────────────────
+variable "task_role_name" {
+  description = "ECS task role name (the gateway's runtime identity; its only permission is Bedrock invoke)."
+  type        = string
+  default     = "claude-gateway-task"
+}
+
+variable "execution_role_name" {
+  description = "ECS execution role name (the ECS agent's identity: pulls the image, injects the secrets)."
+  type        = string
+  default     = "claude-gateway-execution"
+}
+
+# ── Image (§6) ──────────────────────────────────────────────────────────────
+# Terraform creates the ECR repository but does NOT build/push the image (that's
+# a docker build step — see README). It references the image by tag.
+variable "ecr_repo" {
+  description = "ECR repository name."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "image_tag" {
+  description = "Image tag — the tag you built and pushed (must already exist in the repo as linux/amd64, with gateway.yaml baked in). setup.sh tags as <version>-cfg<sha8 of gateway.yaml>; see the README Deploy section for the build command."
+  type        = string
+  validation {
+    condition     = can(regex("^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$", var.image_tag))
+    error_message = "image_tag must be a valid OCI tag — set it to the tag you pushed (the '<version>' in terraform.tfvars.example is a placeholder)."
+  }
+}
+
+variable "gateway_config_path" {
+  description = "Path to gateway.yaml. Empty = ../gateway.yaml relative to this module. Read for the REPLACE_ME guard and the config-sha that rolls the service; the file itself ships inside the image."
+  type        = string
+  default     = ""
+}
+
+# ── RDS (§3) ────────────────────────────────────────────────────────────────
+variable "db_instance" {
+  description = "RDS instance identifier."
+  type        = string
+  default     = "claude-gateway-db"
+}
+
+variable "db_engine_version" {
+  description = "Postgres major version. The gateway supports PostgreSQL 14 or newer; 16 is the recommended default."
+  type        = string
+  default     = "16"
+}
+
+variable "db_instance_class" {
+  description = "RDS instance class."
+  type        = string
+  default     = "db.t4g.micro"
+}
+
+variable "db_allocated_storage" {
+  description = "RDS allocated storage in GiB."
+  type        = number
+  default     = 20
+}
+
+variable "db_name" {
+  description = "Database name."
+  type        = string
+  default     = "claude_gateway"
+}
+
+variable "db_user" {
+  description = "Database master user (the gateway connects as this role)."
+  type        = string
+  default     = "gateway"
+}
+
+# ── Secrets (§5) ────────────────────────────────────────────────────────────
+# The execution role's secrets-read policy grants read on exactly these three
+# secrets' ARNs, so renames are picked up automatically on the next apply.
+variable "secret_name" {
+  description = "Secrets Manager secret holding the Postgres connection string."
+  type        = string
+  default     = "gateway-postgres-url"
+}
+
+variable "jwt_secret_name" {
+  description = "Secrets Manager secret holding the session JWT signing key."
+  type        = string
+  default     = "gateway-jwt-secret"
+}
+
+variable "oidc_secret_name" {
+  description = "Secrets Manager secret holding the Okta OIDC client secret."
+  type        = string
+  default     = "gateway-oidc-client-secret"
+}
+
+variable "oidc_client_secret" {
+  description = "Okta OIDC client secret value. Leave empty to NOT manage the version via Terraform (only if you add the secret version out-of-band — without one the tasks fail to start)."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+# ── ECS + ALB (§7) ──────────────────────────────────────────────────────────
+variable "cluster_name" {
+  description = "ECS cluster name."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "service_name" {
+  description = "ECS service name (also used for the ALB and target group)."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "log_group_name" {
+  description = "CloudWatch Logs group for the gateway's stderr (audit events + operational logs)."
+  type        = string
+  default     = "/ecs/claude-gateway"
+}
+
+variable "log_retention_days" {
+  description = "CloudWatch Logs retention in days. The group carries the gateway's audit events, so align with your audit retention policy."
+  type        = number
+  default     = 90
+}
+
+variable "acm_certificate_arn" {
+  description = "ACM certificate ARN for the internal gateway hostname (the host in gateway.yaml's public_url), served by the ALB's HTTPS listener."
+  type        = string
+}
+
+variable "task_cpu" {
+  description = "Fargate task CPU units."
+  type        = number
+  default     = 1024
+}
+
+variable "task_memory" {
+  description = "Fargate task memory (MiB)."
+  type        = number
+  default     = 2048
+}
+
+variable "desired_count" {
+  description = "ECS service desired task count. Each task opens a Postgres pool of up to 5 connections (the gateway's store.max_connections default) and db.t4g.micro caps at ~80 max_connections — keep desired_count × 5 below the DB class's limit, or raise the class before raising this."
+  type        = number
+  default     = 1
+}
+
+variable "deletion_protection" {
+  description = "Deletion protection on RDS and the ALB (and whether RDS skips the final snapshot on destroy). Keep true to avoid accidental deletion of the running deployment."
+  type        = bool
+  default     = true
+}

examples/gateway/aws/terraform/versions.tf

@@ -0,0 +1,18 @@
+# Provider + version pins for the Claude apps gateway ECS Fargate deployment.
+terraform {
+  required_version = ">= 1.5"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.0, < 7.0" # 6.0 renames data.aws_region's attribute to `region`
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.region
+}

examples/gateway/gcp/.dockerignore

@@ -0,0 +1,13 @@
+# Keep the build context to just the binary the Dockerfile COPYs. BuildKit (the
+# default, selected via the Dockerfile's syntax directive) only syncs the
+# referenced COPY source anyway, so this is a no-op there — it matters for the
+# classic builder (DOCKER_BUILDKIT=0) and as a conventional signal that the
+# .gitignore'd secrets in this directory aren't part of the image build.
+terraform/
+**/.terraform/
+*.tfstate*
+terraform.tfvars
+gateway.yaml
+secrets/
+*.pem
+client_secret_*.json

examples/gateway/gcp/.gitignore

@@ -0,0 +1,12 @@
+# Local, environment-specific config — copy gateway.yaml.example -> gateway.yaml
+# (gateway.yaml.example IS committed; your filled-in gateway.yaml is not)
+gateway.yaml
+
+# Secrets / credentials — never commit
+secrets/
+client_secret_*.json
+*.pem
+
+# Release binary and pinned version — setup.sh downloads/writes these per release
+claude
+.claude-version

examples/gateway/gcp/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+
+# Runtime image for `claude gateway`.
+#
+# This image does NOT build the binary. It expects a prebuilt native
+# linux-x64 `claude` executable in the build context — the public Claude Code
+# release binary, which includes the `gateway` subcommand. setup.sh places it
+# at ./claude (downloading it from the public release endpoint and verifying
+# it against the release manifest if missing). Override CLAUDE_BINARY to
+# point at a different path.
+#
+# Build (with the binary at ./claude; otherwise add --build-arg CLAUDE_BINARY=<path>):
+#   docker build --platform=linux/amd64 --provenance=false -t claude-gateway .
+#
+# Run:
+#   docker run --rm -p 8080:8080 \
+#     -v "$PWD/gateway.yaml:/etc/claude/gateway.yaml:ro" \
+#     -e OIDC_CLIENT_SECRET -e GATEWAY_JWT_SECRET -e GATEWAY_POSTGRES_URL \
+#     claude-gateway
+
+ARG CLAUDE_BINARY=./claude
+
+# distroless/cc provides glibc + libstdc++ (required by the Bun-compiled
+# native binary). The :nonroot tag runs as uid/gid 65532.
+FROM gcr.io/distroless/cc-debian12:nonroot
+
+ARG CLAUDE_BINARY
+COPY --chmod=0755 ${CLAUDE_BINARY} /usr/local/bin/claude
+
+ENV CLAUDE_CONFIG_DIR=/tmp/.claude
+
+EXPOSE 8080
+USER nonroot
+
+ENTRYPOINT ["/usr/local/bin/claude", "gateway", "--config", "/etc/claude/gateway.yaml"]

examples/gateway/gcp/README.md

@@ -0,0 +1,17 @@
+# Claude Gateway on Google Cloud
+
+Reference deployment artifacts for running Claude Gateway on GCP with Agent
+Platform (formerly Vertex AI) as the upstream: Cloud Run or GKE, Cloud SQL for
+PostgreSQL, Secret Manager, and service-account auth to Agent Platform.
+
+These files are provided as a working example rather than a supported production
+deployment. Adapt them to your own environment.
+
+- **Walkthrough**: https://code.claude.com/docs/en/claude-apps-gateway-on-gcp
+
+| File | Purpose |
+|---|---|
+| `setup.sh` | Scripts the walkthrough end to end via `gcloud` |
+| `Dockerfile` | Runtime image for the `claude gateway` binary |
+| `gateway.yaml.example` | Gateway config template, GCP-shaped (Agent Platform upstream, Google Workspace IdP) |
+| `terraform/` | Provisions the full architecture (two-pass apply — see `terraform/README.md`) |

examples/gateway/gcp/gateway.yaml.example

@@ -0,0 +1,156 @@
+# gateway.yaml.example — Claude Gateway config template, GCP-shaped (walkthrough §6).
+#
+# Google Workspace IdP + Agent Platform (formerly Vertex AI) upstream, following
+# the walkthrough at https://code.claude.com/docs/en/claude-apps-gateway-on-gcp.
+# The active sections
+# below are a strict subset of the full configuration reference at
+# https://code.claude.com/docs/en/claude-apps-gateway; optional keys are included
+# commented-out.
+#
+# USAGE — this is the shippable TEMPLATE. Copy it to gateway.yaml and fill it in:
+#     cp gateway.yaml.example gateway.yaml
+#   setup.sh and terraform/ read gateway.yaml (your filled-in copy, which is
+#   gitignored). It is published as the Secret Manager secret `gateway-config`
+#   (§6) and mounted at /etc/claude/gateway.yaml — the container ENTRYPOINT runs
+#   `claude gateway --config /etc/claude/gateway.yaml`.
+#
+# Secret expansion: ${ENV_VAR} reads an env var; ${file:/path} reads a mounted file.
+# On Cloud Run, setup.sh injects the JWT / OIDC / Postgres secrets as ENV VARS
+# (Cloud Run can't mount multiple secrets into a single directory), and mounts
+# only gateway.yaml itself as a file at /etc/claude. On GKE you may use file mounts.
+#
+# BEFORE DEPLOY — replace every REPLACE_ME placeholder below (setup.sh refuses to
+# publish the config secret while any remain), and create the referenced secrets:
+#   gateway-jwt-secret           (setup.sh generates this)
+#   gateway-oidc-client-secret   (from the Google Cloud Console OAuth client)
+#   gateway-postgres-url         (setup.sh generates this)
+
+# ── Listener ─────────────────────────────────────────────────────────────────
+listen:
+  host: 0.0.0.0
+  port: 8080                      # Cloud Run sets PORT=8080; leave as-is
+  # Required. Fixes the IdP redirect_uri, the OIDC discovery doc, and the
+  # gateway-token issuer so none are derived from the client-controlled Host
+  # header (X-Forwarded-Host/-Proto are likewise never trusted). On Cloud Run
+  # the run.app URL is only assigned on the first deploy, so this starts as a
+  # placeholder for the provisioning-only first pass (login does NOT work until
+  # the real URL is set). After the first deploy, setup.sh prints the run.app
+  # URL: set it here (or your LB hostname) and re-run; setup.sh republishes the
+  # config and redeploys. Register the same host's /oauth/callback on the
+  # Google OAuth client.
+  public_url: https://set-after-first-deploy.invalid
+  # Register this exact redirect URI on the Google OAuth client:
+  #   https://<public_url host>/oauth/callback
+  #
+  # On Cloud Run (or behind any L7 LB) every request arrives via Google's front
+  # end, so the gateway sees one peer IP for all developers — set trusted_proxies
+  # so X-Forwarded-For from those proxies is trusted and per-IP rate limiting /
+  # audit IPs record the real client. 169.254.0.0/16 is Cloud Run's fixed
+  # link-local serving range; the proxy-only subnet is the one your internal ALB
+  # uses in this VPC.
+  # trusted_proxies:
+  #   - 169.254.0.0/16              # Cloud Run serving proxy (link-local peer)
+  #   - <proxy-only-subnet-cidr>    # add if fronted by your internal ALB (its proxy-only subnet)
+  #
+  # Alternative — terminate TLS in the gateway itself instead of at a proxy:
+  # tls:
+  #   cert: /certs/gateway.crt
+  #   key:  /certs/gateway.key
+
+# ── Identity provider — Google Workspace ─────────────────────────────────────
+oidc:
+  issuer: https://accounts.google.com
+  client_id: REPLACE_ME                              # Google OAuth client ID (not secret; from Cloud Console)
+  client_secret: ${OIDC_CLIENT_SECRET}
+  allowed_email_domains: [REPLACE_ME]                # e.g. [example.com] — reject id_tokens outside your org
+  # Google ignores the default offline_access scope; these two are what actually
+  # yield refresh tokens (silent renewal + the deprovision leash) from Google.
+  scopes: [openid, profile, email]
+  extra_auth_params: { access_type: offline, prompt: consent }
+  # NOTE: Google id_tokens carry NO groups claim. For group-based RBAC with
+  # Google as IdP, set `google_groups` (below) and the gateway fetches each
+  # user's Workspace groups at login via the Admin SDK Directory API.
+  # Otherwise, use email_domain matching (see managed.policies below).
+  # google_groups:
+  #   service_account_json_path: /secrets/google-sa.json  # SA with domain-wide delegation on admin.directory.group.readonly
+  #   admin_email: admin@example.com                       # a Workspace admin the SA impersonates
+  # groups_claim: groups          # Okta=groups, Entra app roles=roles — NOT Google
+  # ca_cert_pem: ${file:/secrets/idp-ca.pem}   # only for an IdP behind a private CA
+
+# ── Sessions ─────────────────────────────────────────────────────────────────
+session:
+  jwt_secret: ${GATEWAY_JWT_SECRET}   # >= 32 bytes; openssl rand -base64 32
+  # Google issues refresh tokens (above), so sessions renew silently and this
+  # mainly bounds deprovision latency. 8 is a sane default; lower toward 1 for
+  # tighter revocation. Array form rotates keys: [new, old] (index 0 signs, all verify).
+  ttl_hours: 8
+
+# ── Store (REQUIRED — the gateway refuses to boot without it) ─────────────────
+store:
+  postgres_url: ${GATEWAY_POSTGRES_URL}   # private-IP Cloud SQL; built with ?sslmode=require by setup.sh
+
+# ── Upstreams — Agent Platform ───────────────────────────────────────────────
+upstreams:
+  - provider: vertex
+    region: us-east5              # a region where the Claude models you need are published in Model Garden
+    project_id: REPLACE_ME        # your GCP project ID for Agent Platform access
+    auth: {}                      # ADC via Cloud Run SA / GKE Workload Identity (preferred — no static keys)
+    # base_url: https://us-east5-aiplatform.p.googleapis.com   # Private Service Connect endpoint
+  # Add more upstreams for failover (tried top→bottom on 5xx/timeout/501): a
+  # second region, or an anthropic/bedrock fallback. See
+  # https://code.claude.com/docs/en/claude-apps-gateway.
+
+# ── Telemetry fan-out (OPTIONAL) ─────────────────────────────────────────────
+# The CLI sends OTLP/HTTP to the gateway; the gateway fans out, stamping
+# user.id/user.email/user.groups server-side. On GCP, point at an OpenTelemetry
+# Collector with the googlecloud exporter (-> Cloud Trace / Managed Prometheus).
+# Takes effect after the second pass (once public_url is the real URL, not the
+# placeholder): when forward_to and public_url are both configured the gateway pushes
+# CLAUDE_CODE_ENABLE_TELEMETRY and the OTEL exporter selectors to every client
+# automatically — no per-developer config needed.
+# telemetry:
+#   forward_to:
+#     - url: https://otel-collector.internal.example.com:4318
+#       headers:
+#         Authorization: ${file:/secrets/otlp-token}
+#       metrics: true     # safe aggregate counters (default)
+#       logs: false       # carries bash commands / tool inputs — opt in deliberately
+#       traces: false
+
+# ── RBAC + managed settings (OPTIONAL; first-match-wins, top -> bottom) ───────
+# With Google as IdP, match on email_domain, or on group email addresses
+# (e.g. eng@example.com) once oidc.google_groups is configured above.
+# managed:
+#   policies:
+#     - match: { email_domain: example.com }
+#       cli:
+#         availableModels: [claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5]
+#         permissions: { deny: ["Read(./.env)", "Read(./secrets/**)"] }
+#     - match: {}        # catch-all floor — keep LAST
+#       cli:
+#         availableModels: [claude-sonnet-4-6, claude-haiku-4-5]
+
+# ── Admin API (OPTIONAL — enables db-mode runtime config + spend caps) ───────
+# admin_groups needs a groups claim — with Google as IdP, set
+# oidc.google_groups (above) so Workspace group email addresses populate the
+# claim, or use the bootstrap keys below instead. Named keys for
+# attribution in the audit log; 32-char minimum on key values. On Cloud Run add
+# these as env vars to --set-secrets (or terraform env value_source blocks),
+# same as the JWT/OIDC/Postgres secrets above; on GKE you may use ${file:...}.
+# admin:
+#   write_keys:
+#     - id: terraform
+#       key: ${GATEWAY_ADMIN_WRITE_KEY}
+#   read_keys:
+#     - id: reporting
+#       key: ${GATEWAY_ADMIN_READ_KEY}
+#   # admin_groups: [platform-finops@example.com]   # group emails via oidc.google_groups, or any groups-capable IdP
+
+# ── Model catalog (OPTIONAL) ─────────────────────────────────────────────────
+# Default true: every built-in Claude model is exposed and auto-translated per
+# upstream. Set false + a models: list to pin IDs (e.g. provisioned throughput).
+# auto_include_builtin_models: true
+# models:
+#   - id: claude-opus-4-8
+#     label: Claude Opus 4.8
+#     upstream_model: { vertex: claude-opus-4-8 }

examples/gateway/gcp/setup.sh

@@ -0,0 +1,558 @@
+#!/usr/bin/env bash
+#
+# setup.sh — GCP setup for Claude Gateway (walkthrough §1–7b).
+#
+# Provisions, in doc order: APIs (§1), service account + IAM (§2), the gateway
+# container image in Artifact Registry (§3), a Cloud SQL (PostgreSQL) backend
+# with PRIVATE IP only (§4), the JWT + postgres-url secrets (§5), the
+# gateway.yaml config secret (§6), and a Cloud Run deploy with Direct VPC
+# egress (§7b).
+#
+# Private IP is required because public IP is disallowed by the org-policy constraint
+# `constraints/sql.restrictPublicIp`. A Cloud SQL private IP is an address inside a VPC,
+# so §4 here also provisions the prerequisite VPC + Private Services Access — the
+# one-time, irreducible networking required for private IP.
+#
+#   Section markers (§N) below map to the walkthrough:
+#   https://code.claude.com/docs/en/claude-apps-gateway-on-gcp
+#
+# Covers here:  APIs (§1) -> service account + IAM (§2) -> build & push image (§3)
+#               -> VPC + Private Services Access -> Cloud SQL (private IP only) -> database
+#               + user (§4) -> jwt + postgres-url secrets (§5) -> gateway-config
+#               secret from gateway.yaml (§6) -> Cloud Run deploy (§7b).
+# Not covered:  GKE track (§7a) — Cloud Run is the lower-friction path here.
+#
+# Idempotent: existing resources are detected and skipped, so it is safe to re-run.
+# Override any default below via environment variable, e.g. `REGION=us-east5 ./setup.sh`.
+
+set -euo pipefail
+
+# ---- configuration (env-overridable) ----------------------------------------
+PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project 2>/dev/null)}"
+REGION="${REGION:-${CLOUDSDK_COMPUTE_REGION:-us-east5}}"   # guide §1 uses us-east5 (Agent Platform model region)
+
+SA_NAME="${SA_NAME:-claude-gateway}"                       # §2 service account
+SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"
+
+# §3 image
+AR_REPO="${AR_REPO:-claude-gateway}"                       # Artifact Registry repository
+IMAGE_NAME="${IMAGE_NAME:-gateway}"
+RELEASES_URL="${RELEASES_URL:-https://downloads.claude.ai/claude-code-releases}"   # public Claude Code release endpoint
+VERSION="${VERSION:-}"                                     # Claude Code release to deploy; empty = latest release (resolved below)
+VERSION_FILE="${VERSION_FILE:-./.claude-version}"          # pins the resolved release across re-runs; delete it (or set VERSION) to upgrade
+DOCKERFILE="${DOCKERFILE:-./Dockerfile}"
+CLAUDE_BINARY="${CLAUDE_BINARY:-./claude}"                 # linux-x64 Claude Code binary; downloaded from RELEASES_URL if missing
+CLAUDE_SHA256="${CLAUDE_SHA256:-}"                         # optional: out-of-band sha256 pin for the downloaded binary, checked in addition to the release manifest
+
+VPC_NETWORK="${VPC_NETWORK:-cc-gateway-vpc}"
+SUBNET="${SUBNET:-cc-gateway-subnet}"
+SUBNET_RANGE="${SUBNET_RANGE:-10.0.0.0/24}"
+
+PSA_RANGE_NAME="${PSA_RANGE_NAME:-google-managed-services-${VPC_NETWORK}}"
+PSA_PREFIX_LENGTH="${PSA_PREFIX_LENGTH:-16}"               # /16 is GCP's recommendation; reserved, not consumed
+
+DB_INSTANCE="${DB_INSTANCE:-claude-gateway-db}"
+DB_VERSION="${DB_VERSION:-POSTGRES_16}"   # PG14+ supported; 16 is the recommended default (§4)
+DB_TIER="${DB_TIER:-db-g1-small}"
+DB_NAME="${DB_NAME:-claude_gateway}"
+DB_USER="${DB_USER:-gateway}"
+
+SECRET_NAME="${SECRET_NAME:-gateway-postgres-url}"         # §5 store.postgres_url
+JWT_SECRET_NAME="${JWT_SECRET_NAME:-gateway-jwt-secret}"   # §5 session.jwt_secret
+
+GATEWAY_YAML="${GATEWAY_YAML:-./gateway.yaml}"             # §6 config file
+CONFIG_SECRET="${CONFIG_SECRET:-gateway-config}"           # §6 mounted at /etc/claude/gateway.yaml
+
+# §7 Cloud Run deploy
+SERVICE_NAME="${SERVICE_NAME:-claude-gateway}"
+OIDC_SECRET_NAME="${OIDC_SECRET_NAME:-gateway-oidc-client-secret}"   # operator-created (Google OAuth client)
+DEPLOY="${DEPLOY:-1}"                                      # set DEPLOY=0 to provision only, no Cloud Run deploy
+INGRESS="${INGRESS:-internal}"                             # internal (default; no public URL) | internal-and-cloud-load-balancing (only if you front it with your own internal ALB)
+MAX_INSTANCES="${MAX_INSTANCES:-8}"                        # keep MAX_INSTANCES × store.max_connections (default 5) below the DB tier's max_connections (~50 on db-g1-small); raise the tier before raising this
+
+# ---- helpers ----------------------------------------------------------------
+log()  { printf '\n==> %s\n' "$*"; }
+skip() { printf '    (exists) %s\n' "$*"; }
+curl_https() { curl --proto '=https' --proto-redir '=https' --tlsv1.2 "$@"; }  # refuse plaintext/protocol-downgrade
+sha_of() { openssl dgst -sha256 "$1" | awk '{print $NF}'; }  # openssl avoids shasum/sha256sum portability gaps
+
+if [[ -z "${PROJECT_ID}" ]]; then
+  echo "ERROR: PROJECT_ID is not set and no gcloud default project is configured." >&2
+  echo "       Set it with: export PROJECT_ID=<your-project>   (or 'gcloud config set project ...')" >&2
+  exit 1
+fi
+# VERSION tags the image and selects the public Claude Code release to download.
+# The first resolved value is pinned to ${VERSION_FILE} so the documented
+# re-runs (fill gateway.yaml -> re-run; set public_url -> re-run) don't silently
+# build and deploy a newer release mid-bootstrap.
+if [[ -z "${VERSION}" && -f "${VERSION_FILE}" ]]; then
+  VERSION="$(< "${VERSION_FILE}")"
+  log "Using release pinned in ${VERSION_FILE}: ${VERSION}   (delete the file or set VERSION to change it)"
+elif [[ -z "${VERSION}" ]]; then
+  # /latest is the channel the official installer (claude.ai/install.sh) uses.
+  VERSION="$(curl_https -fsSL "${RELEASES_URL}/latest" | tr -d '[:space:]' || true)"
+  if [[ -z "${VERSION}" ]]; then
+    echo "ERROR: could not resolve the latest release from ${RELEASES_URL}/latest." >&2
+    echo "       Set VERSION to a Claude Code release version, e.g. export VERSION=2.1.195" >&2
+    exit 1
+  fi
+  log "VERSION not set — using latest Claude Code release: ${VERSION}"
+fi
+# Reject non-version content (e.g. an HTML error page served with HTTP 200)
+# before it reaches the image tag and download URLs.
+if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+  echo "ERROR: '${VERSION}' is not a release version (from VERSION, ${VERSION_FILE}, or ${RELEASES_URL}/latest)." >&2
+  exit 1
+fi
+printf '%s' "${VERSION}" > "${VERSION_FILE}"
+IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${AR_REPO}/${IMAGE_NAME}:${VERSION}"
+# Claude Code only connects to a gateway whose hostname resolves to private
+# addresses (a client-side /login check), so public ingress can never serve
+# clients — mirror the terraform module's validation and refuse it up front.
+if [[ "${INGRESS}" != "internal" && "${INGRESS}" != "internal-and-cloud-load-balancing" ]]; then
+  echo "ERROR: INGRESS must be 'internal' or 'internal-and-cloud-load-balancing' — Claude Code's" >&2
+  echo "       /login only accepts gateway hosts on private addresses, so public ingress cannot serve clients." >&2
+  exit 1
+fi
+
+log "Project: ${PROJECT_ID}   Region: ${REGION}   VPC: ${VPC_NETWORK}"
+
+# ---- 1 Project & API setup ------------------------------------------------
+# walkthrough §1 list (aiplatform, artifactregistry, sqladmin, secretmanager, iamcredentials)
+# plus iam/compute/servicenetworking required for the SA + private-IP networking below.
+# container.googleapis.com is for the GKE track (§7a) — harmless if you stay on Cloud Run.
+# We pass --project on every call rather than mutating your gcloud config.
+log "Enabling required APIs (§1)"
+gcloud services enable \
+  aiplatform.googleapis.com \
+  artifactregistry.googleapis.com \
+  sqladmin.googleapis.com \
+  secretmanager.googleapis.com \
+  iamcredentials.googleapis.com \
+  iam.googleapis.com \
+  compute.googleapis.com \
+  container.googleapis.com \
+  servicenetworking.googleapis.com \
+  run.googleapis.com \
+  --project="${PROJECT_ID}"
+
+# ---- 2 Service account & IAM ----------------------------------------------
+log "Creating service account ${SA_EMAIL} and granting project roles (§2)"
+if gcloud iam service-accounts describe "${SA_EMAIL}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "service account ${SA_EMAIL}"
+else
+  gcloud iam service-accounts create "${SA_NAME}" \
+    --display-name="Claude Gateway" --project="${PROJECT_ID}"
+fi
+
+# add-iam-policy-binding is idempotent (re-adding an existing binding is a no-op).
+# --condition=None avoids the interactive condition prompt in non-interactive runs.
+#
+# Only aiplatform.user is granted: the gateway reaches Cloud SQL over the VPC at
+# its PRIVATE IP with a password user (§4/§7b — direct TCP, not the Cloud SQL
+# Auth Proxy / connector), so it never calls cloudsql.instances.connect and no
+# roles/cloudsql.client grant is needed. Direct private-IP is used because the
+# gateway's store is a plain postgres_url — no proxy sidecar/socket plumbing,
+# one less moving part, and the connection string is portable across Cloud Run
+# and GKE.
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+  --member="serviceAccount:${SA_EMAIL}" \
+  --role="roles/aiplatform.user" --condition=None >/dev/null    # Agent Platform inference (§2)
+
+# ---- 3 Build & push image to Artifact Registry ----------------------------
+log "Ensuring Artifact Registry repo and image (§3)"
+if gcloud artifacts repositories describe "${AR_REPO}" \
+     --location="${REGION}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "Artifact Registry repo ${AR_REPO}"
+else
+  gcloud artifacts repositories create "${AR_REPO}" \
+    --repository-format=docker --location="${REGION}" --project="${PROJECT_ID}"
+fi
+
+# Image is the expensive, already-done step: skip the build+push entirely if the
+# tag already exists in the registry.
+if gcloud artifacts docker images describe "${IMAGE}" >/dev/null 2>&1; then
+  skip "image ${IMAGE}"
+else
+  # The public Claude Code release includes the gateway subcommand, so the
+  # binary comes straight from the release endpoint, verified against the
+  # release manifest's sha256. A pre-existing ${CLAUDE_BINARY} (stale version,
+  # interrupted download, hand-placed file) is verified the same way and
+  # re-downloaded on mismatch, so an unverified binary can never reach the image.
+  manifest="$(curl_https -fsSL "${RELEASES_URL}/${VERSION}/manifest.json" | tr -d '[:space:]' || true)"
+  sha_re='"linux-x64"[^}]*"checksum":"([a-f0-9]{64})"'  # structure-based: survives pretty-printed, minified, and one-line-per-platform manifests
+  if [[ ! "${manifest}" =~ ${sha_re} ]]; then
+    echo "ERROR: could not read the linux-x64 sha256 from ${RELEASES_URL}/${VERSION}/manifest.json — refusing to build." >&2
+    exit 1
+  fi
+  expected_sha="${BASH_REMATCH[1]}"
+  if [[ -f "${CLAUDE_BINARY}" && "$(sha_of "${CLAUDE_BINARY}")" == "${expected_sha}" ]]; then
+    skip "binary ${CLAUDE_BINARY} (sha256 matches release ${VERSION})"
+  else
+    if [[ -f "${CLAUDE_BINARY}" ]]; then
+      log "Existing ${CLAUDE_BINARY} does not match release ${VERSION} — re-downloading"
+    else
+      log "Downloading Claude Code ${VERSION} (linux-x64) from ${RELEASES_URL}"
+    fi
+    # Until verification passes, ANY exit (curl failure, set -e, signal, the
+    # error exit below) removes the file, so a partial download can't be
+    # silently picked up by a later run.
+    trap 'rm -f "${CLAUDE_BINARY}"' EXIT INT TERM
+    curl_https -fL -o "${CLAUDE_BINARY}" "${RELEASES_URL}/${VERSION}/linux-x64/claude"
+    actual_sha="$(sha_of "${CLAUDE_BINARY}")"
+    if [[ "${actual_sha}" != "${expected_sha}" ]]; then
+      echo "ERROR: sha256 of ${CLAUDE_BINARY} is ${actual_sha} but the release manifest says ${expected_sha} — refusing to build." >&2
+      exit 1
+    fi
+    trap - EXIT INT TERM
+    log "Verified binary sha256 ${actual_sha}"
+  fi
+  # Optional out-of-band pin, checked even for a pre-existing binary: the
+  # manifest shares an origin with the binary, so it can't defend against a
+  # compromised endpoint — CLAUDE_SHA256 can.
+  if [[ -n "${CLAUDE_SHA256}" && "$(sha_of "${CLAUDE_BINARY}")" != "${CLAUDE_SHA256}" ]]; then
+    echo "ERROR: sha256 of ${CLAUDE_BINARY} does not match CLAUDE_SHA256 (${CLAUDE_SHA256}) — refusing to build." >&2
+    exit 1
+  fi
+  chmod +x "${CLAUDE_BINARY}"
+  log "Building and pushing ${IMAGE}"
+  gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
+  # Cloud Run requires linux/amd64. --platform forces it (e.g. when building on an
+  # Apple Silicon Mac), and --provenance=false keeps buildx from wrapping the result
+  # in an OCI image index that Cloud Run rejects ("manifest ... must support amd64/linux").
+  docker build --platform=linux/amd64 --provenance=false \
+    -f "${DOCKERFILE}" --build-arg CLAUDE_BINARY="${CLAUDE_BINARY}" -t "${IMAGE}" .
+  docker push "${IMAGE}"
+fi
+
+# ---- 4 VPC + Private Services Access (private-IP prerequisite) -------------
+log "Creating VPC network and subnet"
+if gcloud compute networks describe "${VPC_NETWORK}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "network ${VPC_NETWORK}"
+else
+  gcloud compute networks create "${VPC_NETWORK}" \
+    --subnet-mode=custom --project="${PROJECT_ID}"
+fi
+
+if gcloud compute networks subnets describe "${SUBNET}" \
+     --region="${REGION}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "subnet ${SUBNET}"
+else
+  gcloud compute networks subnets create "${SUBNET}" \
+    --network="${VPC_NETWORK}" --region="${REGION}" \
+    --range="${SUBNET_RANGE}" --project="${PROJECT_ID}"
+fi
+
+log "Configuring Private Services Access (allocated range + VPC peering)"
+if gcloud compute addresses describe "${PSA_RANGE_NAME}" \
+     --global --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "allocated range ${PSA_RANGE_NAME}"
+else
+  gcloud compute addresses create "${PSA_RANGE_NAME}" \
+    --global --purpose=VPC_PEERING --prefix-length="${PSA_PREFIX_LENGTH}" \
+    --network="${VPC_NETWORK}" --project="${PROJECT_ID}"
+fi
+
+if gcloud services vpc-peerings list --network="${VPC_NETWORK}" --project="${PROJECT_ID}" \
+     --format='value(peering)' 2>/dev/null | grep -q servicenetworking; then
+  skip "servicenetworking VPC peering"
+else
+  gcloud services vpc-peerings connect \
+    --service=servicenetworking.googleapis.com \
+    --ranges="${PSA_RANGE_NAME}" \
+    --network="${VPC_NETWORK}" --project="${PROJECT_ID}"
+fi
+
+# ---- 4 Cloud SQL instance (private IP only) -------------------------------
+log "Creating Cloud SQL instance ${DB_INSTANCE} (private IP only)"
+if gcloud sql instances describe "${DB_INSTANCE}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "instance ${DB_INSTANCE}"
+else
+  gcloud sql instances create "${DB_INSTANCE}" \
+    --database-version="${DB_VERSION}" \
+    --tier="${DB_TIER}" \
+    --region="${REGION}" \
+    --network="projects/${PROJECT_ID}/global/networks/${VPC_NETWORK}" \
+    --no-assign-ip \
+    --project="${PROJECT_ID}"
+fi
+
+log "Creating database ${DB_NAME}"
+if gcloud sql databases describe "${DB_NAME}" \
+     --instance="${DB_INSTANCE}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "database ${DB_NAME}"
+else
+  gcloud sql databases create "${DB_NAME}" \
+    --instance="${DB_INSTANCE}" --project="${PROJECT_ID}"
+fi
+
+# hex (not base64) keeps the password URL-safe for the connection string below.
+log "Creating database user ${DB_USER}"
+DB_PASSWORD=""
+if gcloud sql users list --instance="${DB_INSTANCE}" --project="${PROJECT_ID}" \
+     --format='value(name)' 2>/dev/null | grep -qx "${DB_USER}"; then
+  if gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    skip "user ${DB_USER} (password unchanged; secret not rewritten)"
+  else
+    # Self-heal: a previous run died after creating the user but before writing
+    # the connection-string secret, losing the only copy of the password. The
+    # secret is the password's only consumer, so resetting it is safe and keeps
+    # re-runs able to recover from any partial state.
+    log "User ${DB_USER} exists but secret ${SECRET_NAME} is missing — resetting password"
+    DB_PASSWORD="$(openssl rand -hex 24)"
+    gcloud sql users set-password "${DB_USER}" \
+      --instance="${DB_INSTANCE}" --password="${DB_PASSWORD}" \
+      --project="${PROJECT_ID}"
+  fi
+else
+  DB_PASSWORD="$(openssl rand -hex 24)"
+  gcloud sql users create "${DB_USER}" \
+    --instance="${DB_INSTANCE}" --password="${DB_PASSWORD}" \
+    --project="${PROJECT_ID}"
+fi
+
+# ---- 5 Connection string -> Secret Manager + secretAccessor ---------------
+PRIVATE_IP="$(gcloud sql instances describe "${DB_INSTANCE}" --project="${PROJECT_ID}" \
+  --format='value(ipAddresses[0].ipAddress)')"
+
+if [[ -n "${DB_PASSWORD}" ]]; then
+  # direct private-IP form, ?sslmode=require (guide §4)
+  CONN="postgres://${DB_USER}:${DB_PASSWORD}@${PRIVATE_IP}:5432/${DB_NAME}?sslmode=require"
+  log "Storing connection string in Secret Manager secret ${SECRET_NAME}"
+  if gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    printf '%s' "${CONN}" | gcloud secrets versions add "${SECRET_NAME}" \
+      --data-file=- --project="${PROJECT_ID}"
+  else
+    printf '%s' "${CONN}" | gcloud secrets create "${SECRET_NAME}" \
+      --replication-policy=automatic --data-file=- --project="${PROJECT_ID}"
+  fi
+else
+  log "Skipping secret write (user already existed, password not available this run)"
+fi
+
+if gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  log "Granting ${SA_EMAIL} secretAccessor on ${SECRET_NAME}"
+  gcloud secrets add-iam-policy-binding "${SECRET_NAME}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None --project="${PROJECT_ID}" >/dev/null
+fi
+
+# JWT signing secret — generated once (re-runs do NOT rotate it).
+log "Ensuring JWT signing secret ${JWT_SECRET_NAME} (§5)"
+if gcloud secrets describe "${JWT_SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "secret ${JWT_SECRET_NAME}"
+else
+  openssl rand -base64 32 | tr -d '\n' | gcloud secrets create "${JWT_SECRET_NAME}" \
+    --replication-policy=automatic --data-file=- --project="${PROJECT_ID}"
+fi
+gcloud secrets add-iam-policy-binding "${JWT_SECRET_NAME}" \
+  --member="serviceAccount:${SA_EMAIL}" \
+  --role="roles/secretmanager.secretAccessor" \
+  --condition=None --project="${PROJECT_ID}" >/dev/null
+
+# OIDC client secret — operator-created (the script can't generate it). Grant
+# accessor here once it exists so the deploy step doesn't fail on permission.
+if gcloud secrets describe "${OIDC_SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  log "Granting ${SA_EMAIL} secretAccessor on ${OIDC_SECRET_NAME}"
+  gcloud secrets add-iam-policy-binding "${OIDC_SECRET_NAME}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None --project="${PROJECT_ID}" >/dev/null
+fi
+
+# ---- 6 gateway.yaml -> Secret Manager (gateway-config) --------------------
+# Published only when fully filled in: refuse to push a config that still has
+# REPLACE_ME placeholders (checked on non-comment lines so commented examples
+# and this file's header don't trip the guard).
+log "Publishing ${GATEWAY_YAML} as Secret Manager secret ${CONFIG_SECRET} (§6)"
+if [[ ! -f "${GATEWAY_YAML}" ]]; then
+  echo "    (skip) ${GATEWAY_YAML} not found — run 'cp gateway.yaml.example gateway.yaml', fill it in, then re-run (§6)."
+elif grep -vE '^[[:space:]]*#' "${GATEWAY_YAML}" | grep -q 'REPLACE_ME'; then
+  echo "    (skip) ${GATEWAY_YAML} still has REPLACE_ME placeholders to fill:"
+  grep -nE 'REPLACE_ME' "${GATEWAY_YAML}" | grep -vE '^[0-9]+:[[:space:]]*#' | sed 's/^/        /'
+  echo "        Fill them in, then re-run to publish ${CONFIG_SECRET}."
+else
+  if gcloud secrets describe "${CONFIG_SECRET}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    gcloud secrets versions add "${CONFIG_SECRET}" \
+      --data-file="${GATEWAY_YAML}" --project="${PROJECT_ID}"
+  else
+    gcloud secrets create "${CONFIG_SECRET}" --replication-policy=automatic \
+      --data-file="${GATEWAY_YAML}" --project="${PROJECT_ID}"
+  fi
+  gcloud secrets add-iam-policy-binding "${CONFIG_SECRET}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None --project="${PROJECT_ID}" >/dev/null
+fi
+
+# ---- 7 Cloud Run deploy (Direct VPC egress) -------------------------------
+# Direct VPC egress (--network/--subnet/--vpc-egress) puts the service on the
+# VPC so it reaches the Cloud SQL PRIVATE IP directly — matching the private-IP
+# connection string in the postgres-url secret. private-ranges-only keeps public
+# egress (Agent Platform, accounts.google.com) off the VPC, so no Cloud NAT is needed.
+# We deliberately do NOT use --add-cloudsql-instances (that's the Auth Proxy /
+# socket path, which would need a different connection string).
+#
+# Secrets: gateway.yaml is mounted as a FILE at /etc/claude (alone in its dir).
+# The JWT / OIDC / Postgres secrets are injected as ENV VARS — Cloud Run cannot
+# mount multiple secrets into one directory, and gateway.yaml references them via
+# ${ENV_VAR}. (See the env-var names in gateway.yaml: GATEWAY_JWT_SECRET etc.)
+#
+# Self-gating: deploy only once its inputs exist (config secret published + the
+# operator-provided OIDC client secret). On a first run these are missing and it
+# cleanly skips.
+RUN_URL=""
+missing=""
+gcloud secrets describe "${CONFIG_SECRET}" --project="${PROJECT_ID}" >/dev/null 2>&1 || missing="${missing} ${CONFIG_SECRET}"
+gcloud secrets describe "${OIDC_SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1 || missing="${missing} ${OIDC_SECRET_NAME}"
+# Also gate on the postgres-url secret (referenced by --set-secrets below): if it
+# is somehow absent, skip with a clear message rather than failing the deploy with
+# a raw Cloud Run missing-secret error.
+gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1 || missing="${missing} ${SECRET_NAME}"
+
+if [[ "${DEPLOY}" != "1" ]]; then
+  log "Skipping Cloud Run deploy (DEPLOY=${DEPLOY}) (§7)"
+elif [[ -n "${missing// }" ]]; then
+  log "Skipping Cloud Run deploy — missing secret(s):${missing} (§7)"
+  echo "        Fill ${GATEWAY_YAML} and re-run to publish ${CONFIG_SECRET}; create ${OIDC_SECRET_NAME}"
+  echo "        from the Google OAuth client. Then re-run to deploy."
+else
+  SECRET_MOUNTS="/etc/claude/gateway.yaml=${CONFIG_SECRET}:latest"          # file mount (alone in /etc/claude)
+  SECRET_MOUNTS="${SECRET_MOUNTS},GATEWAY_JWT_SECRET=${JWT_SECRET_NAME}:latest"        # env var
+  SECRET_MOUNTS="${SECRET_MOUNTS},OIDC_CLIENT_SECRET=${OIDC_SECRET_NAME}:latest"       # env var
+  SECRET_MOUNTS="${SECRET_MOUNTS},GATEWAY_POSTGRES_URL=${SECRET_NAME}:latest"          # env var
+
+  log "Deploying Cloud Run service ${SERVICE_NAME} (§7b, Direct VPC egress)"
+  # Deploy private (--no-allow-unauthenticated avoids the interactive prompt and
+  # keeps allUsers OUT of the deploy, so a Domain-Restricted-Sharing org doesn't
+  # fail the deploy on the IAM step). Public access is attempted separately below.
+  #
+  # --ingress is passed EXPLICITLY because it is sticky across redeploys (omitting
+  # it keeps the previous value). The default, internal, keeps the *.run.app URL
+  # off the public internet — reachable only from this VPC, or from corp networks
+  # with the PSC endpoint + private run.app DNS plumbing (see terraform/README.md
+  # "Private access"). Public ingress cannot serve clients (see the INGRESS
+  # guard at the top of this script), so the two-pass OAuth bootstrap has to be
+  # completed from inside the VPC (or a PSC-connected corp network). Use
+  # internal-and-cloud-load-balancing instead if you front the service with
+  # your own internal ALB.
+  #
+  # --timeout=3600 raises Cloud Run's default 300s request timeout, which would
+  # otherwise cut off long streaming /v1/messages responses mid-stream.
+  #
+  # --max-instances bounds the Postgres connection footprint: each instance
+  # opens a pool of up to 5 connections (store.max_connections default) and
+  # db-g1-small caps at ~50 max_connections, so the default ceiling of 100
+  # instances would crash-loop new instances under load. Keep
+  # max-instances × 5 below the DB tier's max_connections; raise the DB tier
+  # (or set store.max_connections lower) before raising this.
+  gcloud run deploy "${SERVICE_NAME}" \
+    --image="${IMAGE}" \
+    --region="${REGION}" \
+    --service-account="${SA_EMAIL}" \
+    --min-instances=1 \
+    --max-instances="${MAX_INSTANCES}" \
+    --port=8080 \
+    --timeout=3600 \
+    --ingress="${INGRESS}" \
+    --network="${VPC_NETWORK}" \
+    --subnet="${SUBNET}" \
+    --vpc-egress=private-ranges-only \
+    --set-secrets="${SECRET_MOUNTS}" \
+    --no-allow-unauthenticated \
+    --project="${PROJECT_ID}"
+
+  # The gateway runs its OWN OIDC, so the Cloud Run IAM layer must allow
+  # unauthenticated. Attempt it separately and tolerate failure: Domain Restricted
+  # Sharing (iam.allowedPolicyMemberDomains) blocks allUsers in hardened orgs.
+  log "Granting public invoker (allUsers) — required for the gateway's OIDC login"
+  if gcloud run services add-iam-policy-binding "${SERVICE_NAME}" \
+       --region="${REGION}" --member=allUsers --role=roles/run.invoker \
+       --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    echo "        public invoker granted."
+  else
+    echo "        WARN: allUsers rejected (likely Domain Restricted Sharing). The service is"
+    echo "              deployed but the invoker IAM check is still enabled, so requests 403"
+    echo "              before reaching the container. Preferred fix (where available):"
+    echo "                gcloud run services update ${SERVICE_NAME} --no-invoker-iam-check \\"
+    echo "                  --region=${REGION} --project=${PROJECT_ID}"
+    echo "              Alternatively: request a DRS exception for ${SERVICE_NAME}, or use the GKE"
+    echo "              track, which exposes the gateway at the network layer with no allUsers"
+    echo "              binding. An LB is NOT a fix — it does not bypass the invoker IAM check."
+  fi
+
+  RUN_URL="$(gcloud run services describe "${SERVICE_NAME}" --region="${REGION}" \
+    --project="${PROJECT_ID}" --format='value(status.url)')"
+  log "Cloud Run URL: ${RUN_URL}"
+
+  # public_url is now required (config validation refuses a non-loopback bind
+  # without it), so the template ships a placeholder for the first pass. Once we
+  # know the real URL, warn on any mismatch so the operator doesn't leave the
+  # placeholder — or a stale hostname — in place. Normalize quotes / inline
+  # comments / a trailing slash so schema-equivalent spellings compare equal.
+  # Only checked with internal ingress, where public_url should be the run.app
+  # URL; behind an internal ALB it is the ALB hostname, which this script
+  # cannot know.
+  CFG_PUBLIC_URL="$(grep -E '^[[:space:]]*public_url:' "${GATEWAY_YAML}" 2>/dev/null \
+    | head -1 \
+    | sed -E 's/^[[:space:]]*public_url:[[:space:]]*//; s/[[:space:]]+#.*$//; s/[[:space:]]*$//' \
+    || true)"
+  CFG_PUBLIC_URL="${CFG_PUBLIC_URL#[\'\"]}"; CFG_PUBLIC_URL="${CFG_PUBLIC_URL%[\'\"]}"
+  CFG_PUBLIC_URL="${CFG_PUBLIC_URL%/}"
+  if [[ "${INGRESS}" == "internal" && -n "${RUN_URL}" && "${CFG_PUBLIC_URL}" != "${RUN_URL%/}" ]]; then
+    echo "        NOTE — ${GATEWAY_YAML} has public_url: ${CFG_PUBLIC_URL:-<unset>}"
+    echo "               but this service's URL is ${RUN_URL}."
+    echo "               Set listen.public_url to ${RUN_URL} (or your LB hostname) and re-run."
+  fi
+
+  if [[ -n "${RUN_URL}" ]]; then
+    # gcloud run deploy already fails the script if the revision can't boot (it
+    # waits for the Ready condition), so what's left to verify is that the
+    # gateway is serving. The OAuth discovery document below returns 200 only
+    # after config load, OIDC discovery, upstream construction, and Postgres
+    # migration all succeed, so it doubles as an end-to-end boot check (the
+    # readiness probe proper is GET /readyz). With internal ingress the URL is
+    # reachable only from inside the VPC (or a PSC-connected corp network), so
+    # verification is left to the operator rather than attempted from here.
+    log "Verify the gateway is serving (from inside the VPC, or a PSC-connected corp network):"
+    echo "          curl -s ${RUN_URL}/.well-known/oauth-authorization-server"
+    echo "        If it isn't responding yet, check logs:"
+    echo "          gcloud run services logs read ${SERVICE_NAME} --region=${REGION} --project=${PROJECT_ID}"
+
+    log "Finish the OAuth bootstrap:"
+    echo "        1. Register this redirect URI on the Google OAuth client: ${RUN_URL}/oauth/callback"
+    echo "        2. Set listen.public_url in ${GATEWAY_YAML} to ${RUN_URL}, then re-run: INGRESS=${INGRESS} ./setup.sh"
+    echo "           (republishes ${CONFIG_SECRET} and redeploys so the IdP redirect_uri matches)."
+    echo "           With INGRESS=internal-and-cloud-load-balancing, use your internal ALB hostname"
+    echo "           instead of the run.app URL in both steps."
+  fi
+fi
+
+# ---- summary ----------------------------------------------------------------
+cat <<EOF
+
+==> Done.
+
+  Service account       ${SA_EMAIL}
+                        roles: aiplatform.user, secretmanager.secretAccessor
+  Image                 ${IMAGE}
+  Instance              ${DB_INSTANCE}
+  Connection name       ${PROJECT_ID}:${REGION}:${DB_INSTANCE}
+  Private IP            ${PRIVATE_IP}
+  Database / user       ${DB_NAME} / ${DB_USER}
+  Secrets               ${SECRET_NAME}, ${JWT_SECRET_NAME}, ${CONFIG_SECRET}
+  Cloud Run service     ${SERVICE_NAME} -> ${RUN_URL:-(not deployed yet)}   (ingress: ${INGRESS})
+
+Next steps (see https://code.claude.com/docs/en/claude-apps-gateway-on-gcp):
+  - Create the one operator-provided secret (from the Google Cloud Console OAuth client):
+      printf '%s' "<client-secret>" | gcloud secrets create ${OIDC_SECRET_NAME} \\
+        --data-file=- --project="${PROJECT_ID}"
+    setup.sh grants ${SA_EMAIL} secretAccessor on it on the next re-run.
+  - Fill in the REPLACE_ME values in ${GATEWAY_YAML}, then re-run: setup.sh publishes
+    ${CONFIG_SECRET} and deploys ${SERVICE_NAME} once both secrets exist.
+  - After the first deploy: set listen.public_url to the Cloud Run URL above (or your
+    internal ALB hostname) and register <url>/oauth/callback on the Google OAuth client,
+    then re-run to redeploy.
+  - The gateway runs its own schema migrations at boot, so ${DB_USER} needs CREATE TABLE.
+EOF

examples/gateway/gcp/terraform/.gitignore

@@ -0,0 +1,13 @@
+# Never commit state (contains secrets) or local var files
+*.tfstate
+*.tfstate.*
+.terraform/
+terraform.tfvars
+*.auto.tfvars
+crash.log
+
+# The lock file holds no secrets. It's ignored here so consumers who copy this
+# example into their own repo generate (and commit) their own platform-complete
+# lock at first init — committing one from this repo would carry only one
+# platform's provider hashes.
+.terraform.lock.hcl

examples/gateway/gcp/terraform/README.md

@@ -0,0 +1,160 @@
+# Claude Gateway — Terraform (Cloud Run)
+
+Terraform equivalent of `../setup.sh`. Lets end-users provision and manage
+the gateway with `terraform apply`. Covers the same scope ([walkthrough](https://code.claude.com/docs/en/claude-apps-gateway-on-gcp) §1–7): APIs →
+service account + IAM → Artifact Registry repo → VPC + Private Services Access →
+private-IP Cloud SQL (PG16) → secrets → Cloud Run with Direct VPC egress.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `versions.tf` | Provider pins (google, random) |
+| `variables.tf` | All inputs (defaults match `setup.sh`'s) |
+| `main.tf` | Resources |
+| `outputs.tf` | Service URL, OAuth redirect URI, SA, DB info |
+| `terraform.tfvars.example` | Copy to `terraform.tfvars` and edit |
+
+## Prerequisites
+
+1. **`../gateway.yaml` created and filled in** — copy the template first:
+   `cp ../gateway.yaml.example ../gateway.yaml`, then replace every `REPLACE_ME`
+   (Terraform reads this file and enforces no `REPLACE_ME` via a precondition).
+   Leave `public_url` at its placeholder for the first apply; set it to the
+   `run.app` URL (the `service_url` output) or your LB hostname and re-apply.
+   `gateway.yaml` is gitignored; the committed template is `gateway.yaml.example`.
+2. A **remote backend** for shared use (see below). State holds secrets — never commit it.
+
+## Deploy
+
+Terraform creates the Artifact Registry repo but does **not** build/push the
+image, so the apply is two passes: a targeted apply to create the repo, then
+build/push, then the full apply.
+
+```bash
+cp terraform.tfvars.example terraform.tfvars   # edit it
+terraform init
+
+# 1. Create just the Artifact Registry repo (the -target warning is expected):
+terraform apply -target=google_artifact_registry_repository.repo
+
+# 2. Download the public Claude Code linux-x64 release binary (it includes the
+#    `gateway` subcommand; the Dockerfile picks it up at gcp/claude), verify its
+#    sha256 against the release manifest, then build and push the image:
+BASE="https://downloads.claude.ai/claude-code-releases"
+VERSION="$(curl -fsSL --proto '=https' "${BASE}/latest")"
+curl -fL --proto '=https' --proto-redir '=https' -o ../claude \
+  "${BASE}/${VERSION}/linux-x64/claude"
+WANT="$(curl -fsSL --proto '=https' "${BASE}/${VERSION}/manifest.json" \
+  | tr -d '[:space:]' | grep -oE '"linux-x64"[^}]*' | grep -oE '[a-f0-9]{64}' | head -1)"
+[ "$(openssl dgst -sha256 ../claude | awk '{print $NF}')" = "${WANT}" ] \
+  && echo "sha256 OK" || { echo "checksum mismatch" >&2; rm -f ../claude; }
+gcloud auth configure-docker us-east5-docker.pkg.dev --quiet
+docker build --platform=linux/amd64 --provenance=false \
+  -f ../Dockerfile -t "us-east5-docker.pkg.dev/<project>/claude-gateway/gateway:${VERSION}" ..
+docker push "us-east5-docker.pkg.dev/<project>/claude-gateway/gateway:${VERSION}"
+
+# 3. Full apply:
+terraform apply
+```
+
+(`../setup.sh` §3 automates the same download-and-verify.)
+
+Set in `terraform.tfvars`:
+
+- `project_id`, `region`
+- `image_tag` (after building/pushing — step 2 above)
+- **`oidc_client_secret`** — required (the Cloud Run service mounts `latest` of
+  this secret; with no version the deploy fails). Terraform creates the
+  secret + version from it.
+- `invoker_iam_disabled` / `allow_unauthenticated` — the gateway runs its own
+  OIDC, so the Cloud Run invoker IAM check must be opened or disabled.
+  **Preferred:** `invoker_iam_disabled = true` (no `allUsers` binding; works
+  under Domain Restricted Sharing). **Fallback:** `allow_unauthenticated = true`
+  grants `allUsers` `run.invoker` — fine on a normal org, but DRS orgs reject
+  `allUsers` (set it `false` there, since an LB does **not** bypass the IAM
+  check). If both paths are blocked by org policy, use the GKE track.
+- `ingress` — defaults to **internal-only** (no public URL). Claude Code's `/login`
+  only accepts gateway hosts on private addresses, so public ingress cannot serve
+  clients; the two-pass OAuth bootstrap must be completed from inside the VPC (or a
+  PSC-connected corp network). See "Private access" below.
+
+Tear down a trial with `terraform destroy`: set `deletion_protection = false`,
+run `terraform apply` to record that in state (the provider checks the value in
+**state**, not config, so destroy would still refuse otherwise), then `terraform
+destroy`. The destroy will stop at the VPC network
+because the Private Services Access peering is intentionally left in place
+(`deletion_policy = ABANDON` — see Guard rails below); finish by deleting the
+peering manually once the Cloud SQL instance is gone, then re-run destroy:
+
+```bash
+gcloud services vpc-peerings delete --service=servicenetworking.googleapis.com \
+  --network=cc-gateway-vpc --project=<project>
+terraform destroy
+```
+
+## Guard rails
+
+Tuned so accidental deletion is hard but greenfield teardown stays easy:
+
+- `deletion_protection = true` (variable, default true) on Cloud SQL and Cloud Run —
+  blocks accidental deletion; set `false` when you intend to `terraform destroy`.
+- `disable_on_destroy = false` on APIs — tearing down config never disables APIs.
+- `deletion_policy = ABANDON` on the PSA peering — never tears down the
+  service-networking peering automatically (it's shared by every private-IP
+  service on the VPC). On the dedicated VPC this module creates, that means
+  `terraform destroy` stops at the network step; delete the peering manually
+  per the teardown note above.
+- IAM uses non-authoritative `_member` resources, so other project/secret bindings
+  are never clobbered.
+
+## Private access (internal ingress) — the default
+
+By default the service has **no public URL** (`ingress = "INGRESS_TRAFFIC_INTERNAL_ONLY"`),
+and there is no public-ingress option: Claude Code's `/login` rejects gateway hosts that
+resolve to public addresses, so public exposure cannot serve clients. Reach the service
+from inside the VPC, or via the private-access plumbing below.
+
+With internal-only ingress, `public_url` stays the `run.app` URL (Google-managed cert) —
+**no load balancer or your own certificate required**. But internal ingress alone does
+**not** let corporate on-prem clients reach `run.app`; that needs **operator /
+network-team-owned** plumbing that Cloud Run does **not** create for you (validate it's in
+place before relying on internal ingress):
+
+1. A **Private Service Connect endpoint** for Google APIs (an internal VIP in the VPC).
+2. A **Cloud DNS private zone for `run.app`** resolving `*.run.app` to that endpoint IP.
+3. **On-prem routing** to the endpoint over Cloud VPN / Interconnect.
+
+This is normally managed centrally in the network/hub project, so the module does not
+provision it. See [Private networking and Cloud Run](https://cloud.google.com/run/docs/securing/private-networking).
+For a greenfield trial without this plumbing, complete the OAuth bootstrap from inside
+the VPC — e.g. a browser proxied through an in-VPC VM (SSH SOCKS tunnel over IAP).
+
+For a **custom internal hostname or your own TLS cert**, use
+`INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER` and front the service with your own internal
+Application Load Balancer (also not provisioned by this module).
+
+## Remote state (recommended for teams)
+
+Add a backend so state is shared and locked (and out of git):
+
+```hcl
+# backend.tf
+terraform {
+  backend "gcs" {
+    bucket = "<your-tf-state-bucket>"
+    prefix = "claude-gateway/cloudrun"
+  }
+}
+```
+
+## After deploy
+
+- `terraform output service_url` / `oauth_redirect_uri`.
+- Register the redirect URI on the Google OAuth client and make sure
+  `../gateway.yaml` `public_url` matches the host.
+- Notes: Terraform does not build the image. To ship a new gateway version,
+  rerun the docker build/push under a new tag and bump `image_tag` — a bare
+  re-apply under an unchanged tag does **not** roll a new revision (Cloud Run
+  resolves the tag to a digest only at revision creation, and an unchanged
+  `image` attribute means no new revision).

examples/gateway/gcp/terraform/main.tf

@@ -0,0 +1,399 @@
+# Claude Gateway on Cloud Run — Terraform equivalent of setup.sh.
+# Section markers (§N) map to setup.sh and the walkthrough:
+# https://code.claude.com/docs/en/claude-apps-gateway-on-gcp
+
+locals {
+  config_path    = var.gateway_config_path != "" ? var.gateway_config_path : "${path.module}/../gateway.yaml"
+  gateway_config = file(local.config_path)
+  image          = "${var.region}-docker.pkg.dev/${var.project_id}/${var.ar_repo}/${var.image_name}:${var.image_tag}"
+
+  apis = [
+    "aiplatform.googleapis.com",
+    "artifactregistry.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "sqladmin.googleapis.com",
+    "secretmanager.googleapis.com",
+    "iamcredentials.googleapis.com",
+    "iam.googleapis.com",
+    "compute.googleapis.com",
+    "servicenetworking.googleapis.com",
+    "run.googleapis.com",
+  ]
+}
+
+# ── 1 Project & API setup ───────────────────────────────────────────────────
+resource "google_project_service" "apis" {
+  for_each = toset(local.apis)
+  project  = var.project_id
+  service  = each.value
+  # Don't disable APIs (or delete anything) when this config is torn down.
+  disable_on_destroy         = false
+  disable_dependent_services = false
+}
+
+# ── 2 Service account & IAM (least-privilege) ───────────────────────────────
+resource "google_service_account" "gateway" {
+  project      = var.project_id
+  account_id   = var.sa_name
+  display_name = "Claude Gateway"
+  depends_on   = [google_project_service.apis]
+}
+
+# Non-authoritative (_member) so we never clobber other project bindings.
+#
+# Only aiplatform.user is granted: the gateway reaches Cloud SQL over the VPC at
+# its private IP with a password user (direct TCP via Direct VPC egress — see §7
+# below), not via the Cloud SQL Auth Proxy / connector, so it never calls
+# cloudsql.instances.connect and no roles/cloudsql.client grant is needed.
+# Direct private-IP keeps the gateway's store a plain postgres_url with no proxy
+# sidecar/socket plumbing, and the connection string is portable across Cloud
+# Run and GKE.
+resource "google_project_iam_member" "vertex" {
+  project = var.project_id
+  role    = "roles/aiplatform.user" # Agent Platform inference
+  member  = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+# ── 3 Artifact Registry repo ────────────────────────────────────────────────
+# NOTE: image build/push is a separate step (see README) — Terraform only makes the repo.
+resource "google_artifact_registry_repository" "repo" {
+  project       = var.project_id
+  location      = var.region
+  repository_id = var.ar_repo
+  format        = "DOCKER"
+  description   = "Claude Gateway container images"
+  depends_on    = [google_project_service.apis]
+}
+
+# ── 4 VPC + Private Services Access ──────────────────────────────────────────
+resource "google_compute_network" "vpc" {
+  project                 = var.project_id
+  name                    = var.vpc_network
+  auto_create_subnetworks = false
+  depends_on              = [google_project_service.apis]
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  project       = var.project_id
+  name          = var.subnet
+  region        = var.region
+  network       = google_compute_network.vpc.id
+  ip_cidr_range = var.subnet_range
+}
+
+resource "google_compute_global_address" "psa_range" {
+  project       = var.project_id
+  name          = "google-managed-services-${var.vpc_network}"
+  purpose       = "VPC_PEERING"
+  address_type  = "INTERNAL"
+  prefix_length = var.psa_prefix_length
+  network       = google_compute_network.vpc.id
+}
+
+resource "google_service_networking_connection" "psa" {
+  network                 = google_compute_network.vpc.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.psa_range.name]
+  # ABANDON: on destroy, leave the producer peering in place (deleting it can hang
+  # and would affect any other private-IP service on this VPC).
+  deletion_policy = "ABANDON"
+  # If the peering already exists (e.g. a previous apply failed partway), patch it
+  # instead of failing the create.
+  update_on_creation_fail = true
+  depends_on              = [google_project_service.apis]
+}
+
+# ── 4 Cloud SQL (private IP only) ───────────────────────────────────────────
+resource "google_sql_database_instance" "db" {
+  project             = var.project_id
+  name                = var.db_instance
+  region              = var.region
+  database_version    = var.db_version
+  deletion_protection = var.deletion_protection
+  depends_on          = [google_service_networking_connection.psa]
+
+  settings {
+    tier = var.db_tier
+    ip_configuration {
+      ipv4_enabled    = false # private IP only (org policy: sql.restrictPublicIp)
+      private_network = google_compute_network.vpc.id
+      ssl_mode        = "ENCRYPTED_ONLY"
+    }
+  }
+}
+
+resource "google_sql_database" "db" {
+  project  = var.project_id
+  name     = var.db_name
+  instance = google_sql_database_instance.db.name
+}
+
+# URL-safe (alphanumeric) so it drops cleanly into the connection string.
+# nosemgrep: terraform-generic-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "random_password" "db" {
+  length  = 32
+  special = false
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_sql_user" "gateway" {
+  project  = var.project_id
+  name     = var.db_user
+  instance = google_sql_database_instance.db.name
+  password = random_password.db.result
+  # On destroy the role owns the tables it migrated at boot, so DROP ROLE can
+  # fail (and races google_sql_database.db). ABANDON is harmless on the
+  # greenfield teardown — the whole instance is deleted anyway.
+  deletion_policy = "ABANDON"
+}
+
+# ── 5/6 Secrets + secretAccessor ────────────────────────────────────────────
+# postgres-url: connection string built from the instance's private IP.
+resource "google_secret_manager_secret" "postgres_url" {
+  project   = var.project_id
+  secret_id = var.secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "postgres_url" {
+  secret      = google_secret_manager_secret.postgres_url.id
+  secret_data = "postgres://${var.db_user}:${random_password.db.result}@${google_sql_database_instance.db.private_ip_address}:5432/${var.db_name}?sslmode=require"
+}
+
+# jwt: session signing key.
+# nosemgrep: terraform-generic-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "random_password" "jwt" {
+  length  = 48
+  special = false
+}
+
+resource "google_secret_manager_secret" "jwt" {
+  project   = var.project_id
+  secret_id = var.jwt_secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "jwt" {
+  secret      = google_secret_manager_secret.jwt.id
+  secret_data = random_password.jwt.result
+}
+
+# oidc client secret: operator-provided (from the Google OAuth client).
+resource "google_secret_manager_secret" "oidc" {
+  project   = var.project_id
+  secret_id = var.oidc_secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "oidc" {
+  count       = var.oidc_client_secret != "" ? 1 : 0
+  secret      = google_secret_manager_secret.oidc.id
+  secret_data = var.oidc_client_secret
+}
+
+# Warn (not block) at plan time when the OIDC secret value isn't set: the Cloud
+# Run service mounts gateway-oidc-client-secret:latest unconditionally, so an
+# empty value with no out-of-band version means the apply fails late at
+# revision creation. A warning (not a precondition) keeps the documented
+# out-of-band-version mode usable.
+check "oidc_client_secret_set" {
+  assert {
+    condition     = var.oidc_client_secret != ""
+    error_message = "oidc_client_secret is empty — set it in terraform.tfvars, or add a version to the gateway-oidc-client-secret secret out-of-band before applying (the Cloud Run revision mounts it at :latest and will fail without one)."
+  }
+}
+
+# config: gateway.yaml. Guard mirrors the bash REPLACE_ME check (non-comment lines).
+resource "google_secret_manager_secret" "config" {
+  project   = var.project_id
+  secret_id = var.config_secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "config" {
+  secret      = google_secret_manager_secret.config.id
+  secret_data = local.gateway_config
+
+  lifecycle {
+    precondition {
+      condition = length([
+        for line in split("\n", local.gateway_config) :
+        line
+        if !startswith(trimspace(line), "#") && strcontains(line, "REPLACE_ME")
+      ]) == 0
+      error_message = "gateway.yaml still has REPLACE_ME on a non-comment line — fill it in before applying."
+    }
+  }
+}
+
+resource "google_secret_manager_secret_iam_member" "postgres_url" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.postgres_url.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "jwt" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.jwt.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "oidc" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.oidc.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "config" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.config.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+# ── 7 Cloud Run (Direct VPC egress) ─────────────────────────────────────────
+resource "google_cloud_run_v2_service" "gateway" {
+  project              = var.project_id
+  name                 = var.service_name
+  location             = var.region
+  ingress              = var.ingress
+  invoker_iam_disabled = var.invoker_iam_disabled
+  deletion_protection  = var.deletion_protection
+
+  template {
+    service_account = google_service_account.gateway.email
+    scaling {
+      min_instance_count = var.min_instances
+      max_instance_count = var.max_instances
+    }
+    # Secrets are mounted at version=latest, so a config edit or secret
+    # rotation alone wouldn't diff this resource and the warm min_instances=1
+    # revision would keep the old values. Stamping a hash of the rendered
+    # config + every managed secret value forces a new revision whenever any
+    # of them change — without this, tainting random_password.db ALTERs the
+    # SQL role to the new password while the running revision keeps the old
+    # connection string and breaks on its next reconnect, and rotating the
+    # OIDC client secret leaves login failing invalid_client.
+    labels = {
+      config-sha = substr(sha256(join("", [
+        local.gateway_config,
+        random_password.db.result,
+        random_password.jwt.result,
+        var.oidc_client_secret,
+      ])), 0, 63)
+    }
+    # Cloud Run's default 300s request timeout would cut off long streaming
+    # /v1/messages responses mid-stream.
+    timeout = "3600s"
+
+    vpc_access {
+      network_interfaces {
+        network    = google_compute_network.vpc.id
+        subnetwork = google_compute_subnetwork.subnet.id
+      }
+      egress = "PRIVATE_RANGES_ONLY" # public egress (Agent Platform, accounts.google.com) bypasses the VPC -> no Cloud NAT needed
+    }
+
+    containers {
+      image = local.image
+      ports { container_port = 8080 }
+
+      # gateway.yaml mounted as a file at /etc/claude/gateway.yaml (alone in its dir).
+      volume_mounts {
+        name       = "config"
+        mount_path = "/etc/claude"
+      }
+
+      # Cloud Run can't mount multiple secrets in one dir, so the rest are env vars
+      # (gateway.yaml references them via ${ENV_VAR}).
+      env {
+        name = "GATEWAY_JWT_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.jwt.secret_id
+            version = "latest"
+          }
+        }
+      }
+      env {
+        name = "OIDC_CLIENT_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.oidc.secret_id
+            version = "latest"
+          }
+        }
+      }
+      env {
+        name = "GATEWAY_POSTGRES_URL"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.postgres_url.secret_id
+            version = "latest"
+          }
+        }
+      }
+    }
+
+    volumes {
+      name = "config"
+      secret {
+        secret = google_secret_manager_secret.config.secret_id
+        items {
+          path    = "gateway.yaml"
+          version = "latest"
+        }
+      }
+    }
+  }
+
+  depends_on = [
+    google_secret_manager_secret_iam_member.config,
+    google_secret_manager_secret_iam_member.jwt,
+    google_secret_manager_secret_iam_member.oidc,
+    google_secret_manager_secret_iam_member.postgres_url,
+    google_secret_manager_secret_version.config,
+    google_secret_manager_secret_version.postgres_url,
+    google_secret_manager_secret_version.jwt,
+    google_secret_manager_secret_version.oidc,
+    google_sql_database.db,
+    google_sql_user.gateway,
+    google_project_service.apis,
+  ]
+}
+
+# Public access at the Cloud Run IAM layer — the gateway runs its own OIDC, so the
+# invoker check must be opened or disabled (real auth stays the gateway's SSO):
+#   Preferred — disable it: invoker_iam_disabled=true on the service above. No allUsers
+#     binding at all, and it works under Domain Restricted Sharing.
+#   Fallback  — open it: this allUsers run.invoker grant. Domain Restricted Sharing orgs
+#     reject allUsers, and an LB does NOT bypass that (ingress is network-layer; the IAM
+#     check still runs) — use invoker_iam_disabled, a DRS exception, or GKE.
+# Skipped when invoker_iam_disabled=true (the grant would be redundant, and DRS rejects it).
+resource "google_cloud_run_v2_service_iam_member" "public" {
+  count    = var.allow_unauthenticated && !var.invoker_iam_disabled ? 1 : 0
+  project  = var.project_id
+  location = var.region
+  name     = google_cloud_run_v2_service.gateway.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}

examples/gateway/gcp/terraform/outputs.tf

@@ -0,0 +1,34 @@
+output "service_url" {
+  description = "Cloud Run service URL."
+  value       = google_cloud_run_v2_service.gateway.uri
+}
+
+output "oauth_redirect_uri" {
+  description = "Register this exact URI on the Google OAuth client, and ensure gateway.yaml public_url matches the host."
+  value       = "${google_cloud_run_v2_service.gateway.uri}/oauth/callback"
+}
+
+output "service_account_email" {
+  description = "Gateway runtime service account."
+  value       = google_service_account.gateway.email
+}
+
+output "image" {
+  description = "Image the service runs (build/push this separately — see README)."
+  value       = local.image
+}
+
+output "db_connection_name" {
+  description = "Cloud SQL instance connection name (project:region:instance)."
+  value       = google_sql_database_instance.db.connection_name
+}
+
+output "db_private_ip" {
+  description = "Cloud SQL private IP."
+  value       = google_sql_database_instance.db.private_ip_address
+}
+
+output "public_invoker_granted" {
+  description = "Whether the allUsers run.invoker binding was applied (false when invoker_iam_disabled handles public access instead, or on Domain-Restricted-Sharing orgs)."
+  value       = length(google_cloud_run_v2_service_iam_member.public) > 0
+}

examples/gateway/gcp/terraform/terraform.tfvars.example

@@ -0,0 +1,26 @@
+# Copy to terraform.tfvars and edit. terraform.tfvars is gitignored (see .gitignore).
+
+project_id = "your-gcp-project-id"
+region     = "us-east5"
+
+image_tag = "<version>" # REQUIRED — the Claude Code release version you build and push as linux/amd64 (see README Deploy)
+
+# Public access at the Cloud Run IAM layer (the gateway runs its own OIDC):
+#   Preferred — disable the invoker check: no allUsers binding, works under Domain
+#   Restricted Sharing. Needs google provider >= 6.8 and the feature enabled for your org:
+# invoker_iam_disabled = true
+#   Fallback — grant allUsers (fine on a normal org; Domain Restricted Sharing rejects it,
+#   so there prefer invoker_iam_disabled, or use a DRS exception / GKE):
+allow_unauthenticated = true
+
+# Network reachability — a separate axis from the IAM choice above. Default is internal-only:
+# no public URL (Claude Code's /login only accepts gateway hosts on private addresses, so
+# public ingress cannot serve clients); corp on-prem reaches run.app via a PSC endpoint +
+# private run.app DNS — see README "Private access" for the prerequisites. The only
+# alternative to the internal-only default:
+# ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"   # only if you front it with your OWN internal ALB (custom hostname/cert; not provisioned here)
+
+# Google OAuth client secret: REQUIRED — uncomment and set it (Terraform creates the
+# secret version; the Cloud Run service mounts `latest`, so without a version the
+# deploy fails). Leave empty only if you add the secret version out-of-band.
+# oidc_client_secret = "GOCSPX-..."

examples/gateway/gcp/terraform/variables.tf

@@ -0,0 +1,184 @@
+# Inputs — mirror the env-overridable knobs in setup.sh (same defaults).
+
+variable "project_id" {
+  description = "GCP project ID."
+  type        = string
+}
+
+variable "region" {
+  description = "Infra region for Artifact Registry, Cloud SQL, subnet, and Cloud Run. (Agent Platform region is set separately inside gateway.yaml.)"
+  type        = string
+  default     = "us-east5"
+}
+
+# ── Service account (§2) ────────────────────────────────────────────────────
+variable "sa_name" {
+  description = "Service account account_id (the part before @)."
+  type        = string
+  default     = "claude-gateway"
+}
+
+# ── Image (§3) ──────────────────────────────────────────────────────────────
+# Terraform creates the Artifact Registry repo but does NOT build/push the image
+# (that's a docker build step — see README). It references the image by tag.
+variable "ar_repo" {
+  description = "Artifact Registry Docker repository ID."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "image_name" {
+  description = "Image name within the repo."
+  type        = string
+  default     = "gateway"
+}
+
+variable "image_tag" {
+  description = "Image tag — the Claude Code release version you build and push (must already be pushed as linux/amd64). See the README Deploy section for the build command."
+  type        = string
+  validation {
+    condition     = can(regex("^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$", var.image_tag))
+    error_message = "image_tag must be a valid OCI tag — set it to the Claude Code release version you pushed (the '<version>' in terraform.tfvars.example is a placeholder)."
+  }
+}
+
+# ── Networking (§4) ─────────────────────────────────────────────────────────
+variable "vpc_network" {
+  description = "Custom VPC network name."
+  type        = string
+  default     = "cc-gateway-vpc"
+}
+
+variable "subnet" {
+  description = "Subnet name (Cloud Run Direct VPC egress attaches here)."
+  type        = string
+  default     = "cc-gateway-subnet"
+}
+
+variable "subnet_range" {
+  description = "Subnet primary CIDR."
+  type        = string
+  default     = "10.0.0.0/24"
+}
+
+variable "psa_prefix_length" {
+  description = "Prefix length for the Private Services Access allocated range (/16 is GCP's recommendation)."
+  type        = number
+  default     = 16
+}
+
+# ── Cloud SQL (§4) ──────────────────────────────────────────────────────────
+variable "db_instance" {
+  description = "Cloud SQL instance name."
+  type        = string
+  default     = "claude-gateway-db"
+}
+
+variable "db_version" {
+  description = "Postgres major version. The gateway supports PostgreSQL 14 or newer; 16 is the recommended default."
+  type        = string
+  default     = "POSTGRES_16"
+}
+
+variable "db_tier" {
+  description = "Cloud SQL machine tier."
+  type        = string
+  default     = "db-g1-small"
+}
+
+variable "db_name" {
+  description = "Database name."
+  type        = string
+  default     = "claude_gateway"
+}
+
+variable "db_user" {
+  description = "Database user (the gateway connects as this role)."
+  type        = string
+  default     = "gateway"
+}
+
+# ── Secrets (§5 / §6) ─────────────────────────────────────────────────────
+variable "secret_name" {
+  description = "Secret Manager secret holding the Postgres connection string."
+  type        = string
+  default     = "gateway-postgres-url"
+}
+
+variable "jwt_secret_name" {
+  description = "Secret Manager secret holding the session JWT signing key."
+  type        = string
+  default     = "gateway-jwt-secret"
+}
+
+variable "oidc_secret_name" {
+  description = "Secret Manager secret holding the Google OAuth client secret."
+  type        = string
+  default     = "gateway-oidc-client-secret"
+}
+
+variable "config_secret_name" {
+  description = "Secret Manager secret holding gateway.yaml (mounted at /etc/claude/gateway.yaml)."
+  type        = string
+  default     = "gateway-config"
+}
+
+variable "oidc_client_secret" {
+  description = "Google OAuth client secret value. Leave empty to NOT manage the version via Terraform (only if you add the secret version out-of-band — without one the deploy fails)."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "gateway_config_path" {
+  description = "Path to gateway.yaml. Empty = ../gateway.yaml relative to this module."
+  type        = string
+  default     = ""
+}
+
+# ── Cloud Run (§7) ──────────────────────────────────────────────────────────
+variable "service_name" {
+  description = "Cloud Run service name."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "min_instances" {
+  description = "Minimum Cloud Run instances (1 avoids cold OIDC discovery)."
+  type        = number
+  default     = 1
+}
+
+variable "max_instances" {
+  description = "Maximum Cloud Run instances. Each instance opens a Postgres pool of up to 5 connections (the gateway's store.max_connections default) and db-g1-small caps at ~50 max_connections — keep max_instances × 5 below the DB tier's limit, or raise the tier before raising this."
+  type        = number
+  default     = 8
+}
+
+variable "ingress" {
+  description = "Cloud Run ingress — Claude Code's /login only accepts gateway hosts on private addresses, so public ingress cannot serve clients: INGRESS_TRAFFIC_INTERNAL_ONLY (default; no public URL — VPC-only; reaches corp on-prem only with the private-access prerequisites in the README; public_url stays the run.app URL, so no LB or custom cert needed) or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER (front with your own internal ALB for a custom hostname/cert)."
+  type        = string
+  default     = "INGRESS_TRAFFIC_INTERNAL_ONLY"
+  validation {
+    condition     = contains(["INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"], var.ingress)
+    error_message = "ingress must be INGRESS_TRAFFIC_INTERNAL_ONLY or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER — Claude Code only connects to gateways on private addresses."
+  }
+}
+
+variable "invoker_iam_disabled" {
+  description = "PREFERRED public-access path: disable the Cloud Run invoker IAM check so requests reach the container with no allUsers binding (works under Domain Restricted Sharing). Real auth stays the gateway's own OIDC. When true, the allUsers grant below is skipped. May be blocked by org policy constraints/run.managed.requireInvokerIam, or unavailable for the org (\"invoker_iam_disabled is not currently available for your organization\") — then fall back to allow_unauthenticated. Requires google provider >= 6.8."
+  type        = bool
+  default     = false
+}
+
+variable "allow_unauthenticated" {
+  description = "Fallback public-access path: grant allUsers run.invoker (the gateway needs the IAM layer open for its own OIDC). Prefer invoker_iam_disabled. Domain Restricted Sharing orgs reject allUsers — set false there and use invoker_iam_disabled, a DRS exception, or GKE."
+  type        = bool
+  default     = true
+}
+
+variable "deletion_protection" {
+  description = "Provider-level deletion protection on Cloud SQL and Cloud Run. Keep true to avoid accidental deletion of the running deployment."
+  type        = bool
+  default     = true
+}

examples/gateway/gcp/terraform/versions.tf

@@ -0,0 +1,19 @@
+# Provider + version pins for the Claude Gateway Cloud Run deployment.
+terraform {
+  required_version = ">= 1.5"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 6.8, < 7.0" # 6.8 adds invoker_iam_disabled on google_cloud_run_v2_service
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}

feed.xml

@@ -6,422 +6,604 @@
   <author><name>Anthropic</name></author>
   <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md"/>
   <link rel="self" type="application/atom+xml" href="https://raw.githubusercontent.com/anthropics/claude-code/main/feed.xml"/>
-  <updated>2026-06-17T22:07:34Z</updated>
+  <updated>2026-07-21T21:35:04Z</updated>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.181</id>
-    <title>Claude Code v2.1.181</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.181"/>
-    <updated>2026-06-17T22:07:34Z</updated>
-    <content type="html">&lt;p&gt;• Added /config key=value syntax to set any setting from the prompt (e.g. /config thinking=false) — works in interactive, -p, and Remote Control&lt;/p&gt;
-&lt;p&gt;• Added sandbox.allowAppleEvents opt-in setting that lets sandboxed commands send Apple Events on macOS&lt;/p&gt;
-&lt;p&gt;• Added CLAUDE_CLIENT_PRESENCE_FILE environment variable: point it at a marker file to suppress mobile push notifications while you're at the machine&lt;/p&gt;
-&lt;p&gt;• Upgraded the bundled Bun runtime to 1.4&lt;/p&gt;
-&lt;p&gt;• Improved streaming of long paragraphs: text now appears line-by-line instead of waiting for the first line break&lt;/p&gt;
-&lt;p&gt;• Improved auto-retry: API connection drops mid-thinking now automatically retry instead of showing "Connection closed while thinking"&lt;/p&gt;
-&lt;p&gt;• Improved the subagent panel: idle subagents auto-hide after 30s, the list caps at 5 rows with scroll hints, and keyboard hints now show in the footer&lt;/p&gt;
-&lt;p&gt;• Improved the MCP OAuth browser page to match Claude Code's visual style and auto-close on success&lt;/p&gt;
-&lt;p&gt;• Changed fullscreen mode URL opening to require Cmd+click (macOS) / Ctrl+click, matching native terminal behavior&lt;/p&gt;
-&lt;p&gt;• Changed the Improved N memories line to no longer list individual files outside verbose mode&lt;/p&gt;
-&lt;p&gt;• Fixed prompt caching not reading on custom ANTHROPIC_BASE_URL and on Foundry due to a per-request attestation token changing every turn&lt;/p&gt;
-&lt;p&gt;• Fixed Write/Edit producing 0-byte or truncated files on network drives and cloud-synced folders&lt;/p&gt;
-&lt;p&gt;• Fixed open, osascript, and browser-based auth flows failing with error -600 on macOS by adding the Apple Events entitlement&lt;/p&gt;
-&lt;p&gt;• Fixed a startup regression (~120ms per launch in fresh environments, introduced in 2.1.169): the first prompt no longer waits for the managed-settings fetch when no MCP servers are configured&lt;/p&gt;
-&lt;p&gt;• Fixed startup blocking with a blank terminal for up to 15 seconds when the account settings fetch is slow on a degraded network&lt;/p&gt;
-&lt;p&gt;• Fixed startup crash (TypeError: Cannot read properties of null) when .claude.json contains corrupted null project entries&lt;/p&gt;
-&lt;p&gt;• Fixed macOS TUI freezing at session start (Ctrl+C unresponsive) when Spotlight is busy reindexing&lt;/p&gt;
-&lt;p&gt;• Fixed long-running idle sessions losing their history when another Claude Code process ran the 30-day transcript cleanup&lt;/p&gt;
-&lt;p&gt;• Fixed foreground subagents spawning unbounded nested chains; they now respect the same 5-level depth limit as background subagents&lt;/p&gt;
-&lt;p&gt;• Fixed /recap and conversation forks using the previous model immediately after a model switch&lt;/p&gt;
-&lt;p&gt;• Fixed subagent "Thinking" duration showing the parent agent's elapsed time instead of the subagent's own&lt;/p&gt;
-&lt;p&gt;• Fixed subagents blocked on a nested agent showing a ticking elapsed time instead of "waiting" in the agent panel&lt;/p&gt;
-&lt;p&gt;• Fixed the API retry indicator ("Retrying in 0s · attempt N/10") staying on screen after the retry succeeded&lt;/p&gt;
-&lt;p&gt;• Fixed AWS awsCredentialExport credentials with a short remaining lifetime causing credential refreshes every minute, and now accepts the JSON shape from aws configure export-credentials&lt;/p&gt;
-&lt;p&gt;• Fixed claude mcp get/list showing ✓ Connected when tools/list fails; they now show ! Connected · tools fetch failed with the error detail&lt;/p&gt;
-&lt;p&gt;• Fixed /remote-control leaving a stale "connecting…" line; it now confirms in the transcript once connected&lt;/p&gt;
-&lt;p&gt;• Fixed ExitWorktree refusing to remove a clean worktree with "Could not verify worktree state" when bare git cannot be resolved on Windows&lt;/p&gt;
-&lt;p&gt;• Fixed settings changes (such as /effort or /model) failing with ENOENT when ~/.claude/settings.json is a relative symlink under a symlinked ~/.claude&lt;/p&gt;
-&lt;p&gt;• Fixed IDE selection line numbers in context reminders being off by one (IntelliJ and VS Code)&lt;/p&gt;
-&lt;p&gt;• Fixed Ctrl+C in fullscreen after a native terminal selection (modifier+drag) overwriting the clipboard with the app's prior selection&lt;/p&gt;
-&lt;p&gt;• Fixed Ctrl+V showing "No image found in clipboard" instead of pasting when the clipboard contains text&lt;/p&gt;
-&lt;p&gt;• Fixed agent creation failing with "EEXIST: file already exists" when the agents directory already exists (Windows/OneDrive)&lt;/p&gt;
-&lt;p&gt;• Fixed AskUserQuestion preview content being cut off at the dialog edge instead of word-wrapping&lt;/p&gt;
-&lt;p&gt;• Fixed AskUserQuestion multi-select questions silently dropping a typed "Other" free-text answer when submitting&lt;/p&gt;
-&lt;p&gt;• Fixed /stats "Most active day" and daily token chart dates showing one day early in UTC-negative timezones&lt;/p&gt;
-&lt;p&gt;• Fixed /copy and copy-on-select on Linux not detecting a clipboard utility installed after Claude Code started&lt;/p&gt;
-&lt;p&gt;• Fixed tab-indented code rendering with incorrect indentation in the Write (create-file) preview&lt;/p&gt;
-&lt;p&gt;• Fixed user prompts queued mid-turn not showing a full-width background highlight in the transcript&lt;/p&gt;
-&lt;p&gt;• Fixed the activity spinner's pulse dwelling on the wrong glyph size in Ghostty&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.217</id>
+    <title>Claude Code v2.1.217</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.217"/>
+    <updated>2026-07-21T21:35:04Z</updated>
+    <content type="html">&lt;p&gt;• Added emoji shortcode autocomplete in the prompt input: type :heart: to insert ❤️, or :hea for suggestions — disable with the emojiCompletionEnabled setting&lt;/p&gt;
+&lt;p&gt;• Added warnings when transcript writes are failing (e.g. disk full) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently&lt;/p&gt;
+&lt;p&gt;• Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session&lt;/p&gt;
+&lt;p&gt;• Fixed Windows auto-update failures that could leave claude.exe missing; failed updates now restore the preserved executable automatically&lt;/p&gt;
+&lt;p&gt;• Fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder&lt;/p&gt;
+&lt;p&gt;• Fixed auto-compact never triggering for Claude Opus 4.8 on Bedrock and /compact failing once over the limit&lt;/p&gt;
+&lt;p&gt;• Fixed corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions&lt;/p&gt;
+&lt;p&gt;• Fixed screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds to update elapsed time and token counts&lt;/p&gt;
+&lt;p&gt;• Fixed managed settings that set OTEL_EXPORTER_OTLP_ENDPOINT not governing all signals — lower-scope signal-specific overrides no longer redirect telemetry away from the managed endpoint&lt;/p&gt;
+&lt;p&gt;• Fixed --resume/--continue and /resume failing with a TypeError when a transcript has a malformed attachment entry&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control sessions not showing a pending permission prompt or dialog to viewers that connected after it appeared&lt;/p&gt;
+&lt;p&gt;• Fixed background shells sometimes becoming impossible to stop after a session is sent to the background (/background or ←) or when the session exits on a heavily loaded machine, most visible on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed a CLAUDE.md or SKILL.md paths frontmatter value with many brace groups OOM-killing or stalling the CLI at startup — brace expansion is now budget-bounded&lt;/p&gt;
+&lt;p&gt;• Fixed the transcript preview sitting flush against the input area when attaching to a starting background session; it now leaves the same one-line gap as the live layout, so the transcript no longer shifts when the session takes over&lt;/p&gt;
+&lt;p&gt;• Improved footer PR badge links to be clickable hyperlinks even when terminal support can't be detected (e.g. over ssh/tmux); set FORCE_HYPERLINK=0 to opt out&lt;/p&gt;
+&lt;p&gt;• Changed the login-expiry warning to appear 3 days before expiry instead of 5&lt;/p&gt;
+&lt;p&gt;• Capped the frontend-design plugin suggestion tip at 3 lifetime impressions instead of repeating indefinitely&lt;/p&gt;
+&lt;p&gt;• Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) so one message can't fan out unbounded background agents&lt;/p&gt;
+&lt;p&gt;• Changed subagents to no longer spawn nested subagents by default; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting&lt;/p&gt;
+&lt;p&gt;• Fixed --max-budget-usd not stopping background subagents: once the cap is reached, new spawns are denied and running background agents are halted&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.179</id>
-    <title>Claude Code v2.1.179</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.179"/>
-    <updated>2026-06-16T20:22:06Z</updated>
-    <content type="html">&lt;p&gt;• Fixed mid-stream connection drops: partial responses are now preserved instead of showing a raw error, and the spinner no longer gets stuck at "running tool"&lt;/p&gt;
-&lt;p&gt;• Fixed mouse-wheel scrolling in WSL2 under Windows Terminal and VS Code (regression in 2.1.172)&lt;/p&gt;
-&lt;p&gt;• Fixed a sandbox denyRead/allowRead glob over a large directory tree making the Bash tool description enormous and the session unusable on Linux&lt;/p&gt;
-&lt;p&gt;• Fixed the feedback survey capturing a single-digit reply as a session rating immediately after a turn completes&lt;/p&gt;
-&lt;p&gt;• Fixed the welcome screen stacking multiple promotional banners — at most one promo now shows per session&lt;/p&gt;
-&lt;p&gt;• Fixed Ctrl+O not showing the subagent's transcript when viewing a subagent&lt;/p&gt;
-&lt;p&gt;• Fixed clicking the prompt input not returning focus from the subagent/footer panel&lt;/p&gt;
-&lt;p&gt;• Fixed remote session background tasks appearing stuck as "still running" between turns&lt;/p&gt;
-&lt;p&gt;• Improved plugin loading performance in remote sessions&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.216</id>
+    <title>Claude Code v2.1.216</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.216"/>
+    <updated>2026-07-20T22:13:53Z</updated>
+    <content type="html">&lt;p&gt;• Added sandbox.filesystem.disabled setting to skip filesystem isolation while keeping network egress control&lt;/p&gt;
+&lt;p&gt;• Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes&lt;/p&gt;
+&lt;p&gt;• Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session&lt;/p&gt;
+&lt;p&gt;• Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording&lt;/p&gt;
+&lt;p&gt;• Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes&lt;/p&gt;
+&lt;p&gt;• Fixed @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of c-operators and paste, statusline running twice on resume, and resume-picker hangs on failure&lt;/p&gt;
+&lt;p&gt;• Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored&lt;/p&gt;
+&lt;p&gt;• Fixed worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE&lt;/p&gt;
+&lt;p&gt;• Fixed worktree sessions landing in another project's leftover worktree when the working directory did not match the selected project&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions whose worktree has no git repository being undeletable&lt;/p&gt;
+&lt;p&gt;• Fixed claude daemon stop --any potentially terminating an unrelated process via a stale legacy daemon lockfile&lt;/p&gt;
+&lt;p&gt;• Fixed Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks&lt;/p&gt;
+&lt;p&gt;• Fixed Bash command permission checking for compound statements with redirects inside &amp;amp;&amp;amp; lists or negations&lt;/p&gt;
+&lt;p&gt;• Fixed pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died&lt;/p&gt;
+&lt;p&gt;• Fixed background subagents getting cancelled when a high-priority message arrives during their startup window&lt;/p&gt;
+&lt;p&gt;• Fixed mouse and focus garbage in the terminal while a GUI editor from /memory, /plan, /keybindings, or Ctrl+G is open; /memory no longer waits for the editor to close&lt;/p&gt;
+&lt;p&gt;• Fixed Claude-in-Chrome 403-looping on reconnect when the session's OAuth token lacks a required scope&lt;/p&gt;
+&lt;p&gt;• Fixed workflow saves and scheduled-task writes following a symlink at .claude, which could redirect writes outside the project&lt;/p&gt;
+&lt;p&gt;• Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command&lt;/p&gt;
+&lt;p&gt;• Fixed read-only commands on Windows accessing network paths without a permission prompt&lt;/p&gt;
+&lt;p&gt;• Fixed Bash command parsing of non-ASCII characters to match real shell word boundaries&lt;/p&gt;
+&lt;p&gt;• Fixed PowerShell tool permission validation of commands containing invisible Unicode characters&lt;/p&gt;
+&lt;p&gt;• Fixed dialogs in fullscreen mode stretching past the right-hand edge of their panel&lt;/p&gt;
+&lt;p&gt;• Fixed the /config settings list in fullscreen mode clipping its keyboard-hint footer&lt;/p&gt;
+&lt;p&gt;• Fixed the transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns&lt;/p&gt;
+&lt;p&gt;• Fixed the Prometheus metrics endpoint (OTEL_METRICS_EXPORTER=prometheus) emitting invalid # UNIT lines&lt;/p&gt;
+&lt;p&gt;• Fixed skills and commands changed during a session not appearing in the slash menu until restart&lt;/p&gt;
+&lt;p&gt;• Fixed plugin skills with a name frontmatter field losing their plugin prefix in slash-command autocomplete&lt;/p&gt;
+&lt;p&gt;• Fixed telemetry misreporting permission denials: failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections&lt;/p&gt;
+&lt;p&gt;• Improved the /fork confirmation to one line with the new session's name, claude attach id, and a note when the copy shares your checkout&lt;/p&gt;
+&lt;p&gt;• Improved validation of git and gh command arguments in the PowerShell tool&lt;/p&gt;
+&lt;p&gt;• Improved the /ultrareview diff-too-large error to show configured limits, measured diff size, and largest contributing files&lt;/p&gt;
+&lt;p&gt;• Improved /code-review ultra empty-diff message to name the exact base ref and suggest passing an explicit base&lt;/p&gt;
+&lt;p&gt;• Improved the spend limit adjustment prompt to show the server's reason when a spend limit change is rejected&lt;/p&gt;
+&lt;p&gt;• /context now shows an explicit warning when the conversation exceeds the context window, and a failed /compact displays as an error&lt;/p&gt;
+&lt;p&gt;• /rewind no longer restores or deletes files through symlinks or hard links at tracked paths and reports how many paths it skipped&lt;/p&gt;
+&lt;p&gt;• Background sessions: /mcp and /install-github-app now park a "needs input" request in the agent view when no client is attached&lt;/p&gt;
+&lt;p&gt;• Updated the bundled dataviz skill: reordered the default chart palette and fixed guidance that suggested direct labels for four-series charts&lt;/p&gt;
+&lt;p&gt;• [VSCode] Fixed right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code&lt;/p&gt;
+&lt;p&gt;• Fixed cloud sessions dropping the in-flight message when the session's container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.178</id>
-    <title>Claude Code v2.1.178</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.178"/>
-    <updated>2026-06-15T21:35:48Z</updated>
-    <content type="html">&lt;p&gt;• Added Tool(param:value) syntax for permission rules to match a tool's input parameters (with * wildcard), e.g. Agent(model:opus) to block Opus subagents&lt;/p&gt;
-&lt;p&gt;• Skills in nested .claude/skills directories now load when working on files there; on a name clash, the nested skill appears as &amp;lt;dir&amp;gt;:&amp;lt;name&amp;gt; so both stay available&lt;/p&gt;
-&lt;p&gt;• Nested .claude/ directories: the agent, workflow, and output-style closest to the working directory now wins when names collide; project-scope workflow saves now target the closest existing .claude/workflows/&lt;/p&gt;
-&lt;p&gt;• Improved auto mode: subagent spawns are now evaluated by the classifier before launch, closing a gap where a subagent could request a blocked action without review&lt;/p&gt;
-&lt;p&gt;• Improved /doctor with consistent flat tree layout across all sections, clearer section status icons, and highlighted command names&lt;/p&gt;
-&lt;p&gt;• Improved the skill listing truncation warning to show how many skill descriptions are affected&lt;/p&gt;
-&lt;p&gt;• Changed the workflow prompt keyword to use a purple shimmer highlight and trigger only on explicit phrases like "run a workflow" or "workflow:", not on any mention of the word&lt;/p&gt;
-&lt;p&gt;• Improved Remote Control error messages: connection failures now show a persistent red "/rc failed" indicator in the footer, and the "not yet enabled" error now explains whether it's a gate, a check failure, stale entitlement, or org policy&lt;/p&gt;
-&lt;p&gt;• /bug now requires a description before submitting, and no longer uses model-refusal text as the GitHub issue title&lt;/p&gt;
-&lt;p&gt;• Fixed a crash (out-of-memory) when the CLI inherits a stale websocket/OAuth file-descriptor environment variable from a parent process&lt;/p&gt;
-&lt;p&gt;• Fixed Claude in Chrome silently failing to connect when the OAuth token belongs to a different account than the Claude Code login&lt;/p&gt;
-&lt;p&gt;• Fixed nested .claude/skills skills with directory-qualified names being blocked by permission prompts in non-interactive runs&lt;/p&gt;
-&lt;p&gt;• Fixed several subagent issues: viewing a subagent's transcript now shows tool results and live progress, messages sent while it finishes its turn are no longer dropped, and backgrounding a running subagent (ctrl+b) no longer restarts it from scratch&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents workers failing with 401 Invalid bearer token when the daemon was started from a shell with a custom API gateway via ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN&lt;/p&gt;
-&lt;p&gt;• Fixed compaction not honoring --fallback-model: compaction now falls back to the configured fallback model chain on overload or model-availability errors&lt;/p&gt;
-&lt;p&gt;• Fixed model requests continuing to fail with auth errors after credentials were refreshed outside the session, due to a stale cached request configuration&lt;/p&gt;
-&lt;p&gt;• Fixed background sessions created with /bg or ←← after a turn finished showing "Working" forever in the agents list&lt;/p&gt;
-&lt;p&gt;• Fixed Linux sandbox failing to start when .claude/skills or .claude/hooks is a symlink&lt;/p&gt;
-&lt;p&gt;• Fixed CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1 preventing fresh marketplace installs from cloning&lt;/p&gt;
-&lt;p&gt;• Fixed MCP server-level specs (mcp__server, mcp__server__*, mcp__*) in subagent disallowedTools being silently ignored&lt;/p&gt;
-&lt;p&gt;• Fixed vim mode undo: u now steps through NORMAL/VISUAL-mode commands one at a time instead of merging commands in quick succession into a single undo step&lt;/p&gt;
-&lt;p&gt;• Fixed statusline links with custom URI schemes (e.g. vscode://) not opening when clicked in claude agents&lt;/p&gt;
-&lt;p&gt;• [VSCode] Fixed pressing Esc to dismiss a CJK IME candidate window canceling the running Claude task&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.215</id>
+    <title>Claude Code v2.1.215</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.215"/>
+    <updated>2026-07-19T02:55:54Z</updated>
+    <content type="html">&lt;p&gt;• Claude no longer runs the /verify and /code-review skills on its own; invoke them with /verify or /code-review when you want them&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.176</id>
-    <title>Claude Code v2.1.176</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.176"/>
-    <updated>2026-06-12T21:53:21Z</updated>
-    <content type="html">&lt;p&gt;• Session titles are now generated in the language of your conversation (set the language setting to pin a specific language)&lt;/p&gt;
-&lt;p&gt;• Added footerLinksRegexes setting for regex-matched link badges in the footer row, configurable via user or managed settings&lt;/p&gt;
-&lt;p&gt;• Improved Bedrock credential caching: credentials from awsCredentialExport are now cached until their Expiration instead of a fixed 1 hour&lt;/p&gt;
-&lt;p&gt;• Fixed availableModels enforcement: alias model picks can no longer be redirected to a blocked model via ANTHROPIC_DEFAULT_*_MODEL environment variables, and /fast now refuses to toggle when it would switch to a model outside the allowlist&lt;/p&gt;
-&lt;p&gt;• Fixed auto mode failing on Fable 5 for organizations without Opus 4.8 enabled — the classifier now falls back to the best available Opus model&lt;/p&gt;
-&lt;p&gt;• Fixed hook if conditions for Read/Edit/Write tool paths: documented patterns like Edit(src/), Read(~/.ssh/), and Read(.env) now match correctly&lt;/p&gt;
-&lt;p&gt;• Fixed Linux sandbox failing to start when .claude/settings.json is a symlink with an absolute target&lt;/p&gt;
-&lt;p&gt;• Fixed /copy and mouse-selection copy not reaching the system clipboard inside tmux over SSH, and tmux paste buffer not loading on versions older than 3.2&lt;/p&gt;
-&lt;p&gt;• Fixed Remote Control connecting from web/mobile silently switching the session's model&lt;/p&gt;
-&lt;p&gt;• Fixed Remote Control disconnect notifications showing a bare numeric code instead of a human-readable reason, and connection failures adding a duplicate line to the conversation transcript&lt;/p&gt;
-&lt;p&gt;• Fixed Remote Control sessions not disconnecting when you sign in to a different account&lt;/p&gt;
-&lt;p&gt;• Fixed /cd and worktree moves leaving the session reporting the previous directory's git branch&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents: pressing back in one window no longer detaches other windows attached to the same session&lt;/p&gt;
-&lt;p&gt;• Fixed backgrounded sessions showing "Working" forever when /bg mid-turn had nothing left to continue&lt;/p&gt;
-&lt;p&gt;• Fixed background agent search by PR URL: PRs opened during scheduled wakeups or while a job was blocked now appear in claude agents search&lt;/p&gt;
-&lt;p&gt;• Fixed the agents view input showing no text cursor on Windows&lt;/p&gt;
-&lt;p&gt;• Fixed claude --bg -cn &amp;lt;name&amp;gt; not seeding the session name&lt;/p&gt;
-&lt;p&gt;• Fixed background sessions to neutralize Windows network paths in persisted state before respawn&lt;/p&gt;
-&lt;p&gt;• Fixed background-session respawn rejecting malformed resume IDs from corrupted state files&lt;/p&gt;
-&lt;p&gt;• Fixed the Windows background-service daemon not starting when ~/.claude/daemon has the ReadOnly attribute set&lt;/p&gt;
-&lt;p&gt;• Fixed cloud sessions failing with "Could not resolve authentication method" when idle for too long before being claimed&lt;/p&gt;
-&lt;p&gt;• Background sessions now show clearer guidance when a window left open across an auto-update can't submit a reply, and claude daemon status explains version-skew behavior&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.214</id>
+    <title>Claude Code v2.1.214</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.214"/>
+    <updated>2026-07-18T01:20:23Z</updated>
+    <content type="html">&lt;p&gt;• Fixed single-segment dir/ allow rules like Edit(src/) auto-approving writes to nested dir/ directories anywhere in the tree instead of only &amp;lt;cwd&amp;gt;/dir&lt;/p&gt;
+&lt;p&gt;• Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks to no longer auto-approve certain help and man commands that could run unsafe options, command substitutions, or backslash paths&lt;/p&gt;
+&lt;p&gt;• Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog&lt;/p&gt;
+&lt;p&gt;• Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations&lt;/p&gt;
+&lt;p&gt;• Added a periodic progress heartbeat for long-running tool calls that previously went silent&lt;/p&gt;
+&lt;p&gt;• Added an ISO modified timestamp to memory file frontmatter&lt;/p&gt;
+&lt;p&gt;• Added message.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenance&lt;/p&gt;
+&lt;p&gt;• Added CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributes&lt;/p&gt;
+&lt;p&gt;• Added reasoning effort to the subagentStatusLine payload, so custom agent rows can render model and effort&lt;/p&gt;
+&lt;p&gt;• Added permission prompts for docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode) that previously ran without one&lt;/p&gt;
+&lt;p&gt;• Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags&lt;/p&gt;
+&lt;p&gt;• Fixed Bash tool killing the Claude session when a pkill -f pattern accidentally matched the CLI's own process (Linux)&lt;/p&gt;
+&lt;p&gt;• Fixed unbounded memory growth when --settings points at a device file or multi-GB file; oversized (&amp;gt;2 MiB) settings files now fail at startup with a clear error&lt;/p&gt;
+&lt;p&gt;• Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap&lt;/p&gt;
+&lt;p&gt;• Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task&lt;/p&gt;
+&lt;p&gt;• Fixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed the PowerShell tool reporting where.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed &amp;gt; and &amp;gt;&amp;gt; under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8&lt;/p&gt;
+&lt;p&gt;• Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions parked with ← or /background and left idle keeping the background daemon and a worker process alive indefinitely&lt;/p&gt;
+&lt;p&gt;• Fixed completed background sessions being impossible to remove via claude rm or the agent view once the background service had gone idle&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store&lt;/p&gt;
+&lt;p&gt;• Fixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled&lt;/p&gt;
+&lt;p&gt;• Fixed /install-github-app and the /mcp settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached&lt;/p&gt;
+&lt;p&gt;• Fixed plugins enabled via the --settings CLI flag not loading (regression since v2.1.181)&lt;/p&gt;
+&lt;p&gt;• Fixed feature flags going stale in long-running sessions after the OAuth token rotates&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview refusing to run in repos with no merge base — it now offers to review all tracked files&lt;/p&gt;
+&lt;p&gt;• Fixed claude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory&lt;/p&gt;
+&lt;p&gt;• Fixed memory frontmatter values being silently truncated at an inline # when memory files are saved&lt;/p&gt;
+&lt;p&gt;• Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames&lt;/p&gt;
+&lt;p&gt;• Fixed a spurious "check your network" warning that appeared while the advisor was thinking&lt;/p&gt;
+&lt;p&gt;• Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation&lt;/p&gt;
+&lt;p&gt;• Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace context&lt;/p&gt;
+&lt;p&gt;• Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources&lt;/p&gt;
+&lt;p&gt;• Improved the claude rc workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directory&lt;/p&gt;
+&lt;p&gt;• Changed single-segment dir/ hook if: conditions to match only &amp;lt;cwd&amp;gt;/dir; write /dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.&lt;/p&gt;
+&lt;p&gt;• Changed file commands using -m/--magic-file or -f/--files-from to require permission instead of being auto-allowed as read-only&lt;/p&gt;
+&lt;p&gt;• Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket&lt;/p&gt;
+&lt;p&gt;• Changed SessionStart hooks to report source "fork" when a session begins as a fork instead of "resume"&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.175</id>
-    <title>Claude Code v2.1.175</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.175"/>
-    <updated>2026-06-12T04:23:45Z</updated>
-    <content type="html">&lt;p&gt;• Added enforceAvailableModels managed setting — when enabled, the availableModels allowlist also constrains the Default model (a Default that would resolve to a disallowed model now falls back to the first allowed model), and user or project settings can no longer widen a managed availableModels list&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.212</id>
+    <title>Claude Code v2.1.212</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.212"/>
+    <updated>2026-07-17T00:26:21Z</updated>
+    <content type="html">&lt;p&gt;• /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask&lt;/p&gt;
+&lt;p&gt;• Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)&lt;/p&gt;
+&lt;p&gt;• Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops&lt;/p&gt;
+&lt;p&gt;• Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget&lt;/p&gt;
+&lt;p&gt;• MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS&lt;/p&gt;
+&lt;p&gt;• Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session&lt;/p&gt;
+&lt;p&gt;• Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback&lt;/p&gt;
+&lt;p&gt;• Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository&lt;/p&gt;
+&lt;p&gt;• Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections&lt;/p&gt;
+&lt;p&gt;• Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143&lt;/p&gt;
+&lt;p&gt;• Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7&lt;/p&gt;
+&lt;p&gt;• Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open&lt;/p&gt;
+&lt;p&gt;• Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji&lt;/p&gt;
+&lt;p&gt;• Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview &amp;lt;branch&amp;gt; not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands&lt;/p&gt;
+&lt;p&gt;• Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning&lt;/p&gt;
+&lt;p&gt;• Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session&lt;/p&gt;
+&lt;p&gt;• Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode&lt;/p&gt;
+&lt;p&gt;• Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run&lt;/p&gt;
+&lt;p&gt;• Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions created with /fork losing their live-parent protection after a state write failure&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart&lt;/p&gt;
+&lt;p&gt;• Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session&lt;/p&gt;
+&lt;p&gt;• Fixed the plan-approval dialog footer splitting "ctrl+g to edit in &amp;lt;editor&amp;gt;" apart when the file path is long&lt;/p&gt;
+&lt;p&gt;• Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode&lt;/p&gt;
+&lt;p&gt;• Fixed diff previews losing their line numbers and +/- markers in narrow layouts&lt;/p&gt;
+&lt;p&gt;• Fixed @-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143&lt;/p&gt;
+&lt;p&gt;• Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding&lt;/p&gt;
+&lt;p&gt;• Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode&lt;/p&gt;
+&lt;p&gt;• Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause&lt;/p&gt;
+&lt;p&gt;• Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded&lt;/p&gt;
+&lt;p&gt;• Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff&lt;/p&gt;
+&lt;p&gt;• Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)&lt;/p&gt;
+&lt;p&gt;• Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait&lt;/p&gt;
+&lt;p&gt;• Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results&lt;/p&gt;
+&lt;p&gt;• Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view&lt;/p&gt;
+&lt;p&gt;• Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers&lt;/p&gt;
+&lt;p&gt;• Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input&lt;/p&gt;
+&lt;p&gt;• Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default&lt;/p&gt;
+&lt;p&gt;• Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal&lt;/p&gt;
+&lt;p&gt;• Changed session transcripts to record the reasoning effort level on each assistant message&lt;/p&gt;
+&lt;p&gt;• Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn&lt;/p&gt;
+&lt;p&gt;• Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"&lt;/p&gt;
+&lt;p&gt;• Updated the auth status panel title from "Cloud authentication" to "Authentication"&lt;/p&gt;
+&lt;p&gt;• Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.174</id>
-    <title>Claude Code v2.1.174</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.174"/>
-    <updated>2026-06-12T01:16:30Z</updated>
-    <content type="html">&lt;p&gt;• Added wheelScrollAccelerationEnabled setting to disable mouse-wheel scroll acceleration in fullscreen mode&lt;/p&gt;
-&lt;p&gt;• Fixed the /model picker hiding the model family that Default resolves to — Opus now appears as its own row on Max/Team Premium/Enterprise plans, Sonnet on Pro/Team plans, and Opus on pay-as-you-go API accounts&lt;/p&gt;
-&lt;p&gt;• Fixed /model picker showing a hardcoded Sonnet version label when ANTHROPIC_DEFAULT_SONNET_MODEL pins a different Sonnet&lt;/p&gt;
-&lt;p&gt;• Fixed the "Fable 5 is now consuming usage credits" banner incorrectly showing for enterprise accounts with usage-based billing&lt;/p&gt;
-&lt;p&gt;• Fixed Bedrock GovCloud regions (us-gov-*) deriving the wrong inference profile prefix (global instead of us-gov), causing 400 errors on derived model IDs&lt;/p&gt;
-&lt;p&gt;• Fixed background sessions inheriting another session's ANTHROPIC_* provider env (gateway URL, custom headers, /model aliases) from the shell that started the background daemon&lt;/p&gt;
-&lt;p&gt;• Fixed a 1-2 second pause when exiting Claude Code shortly after a shell command was interrupted or killed on macOS and Linux&lt;/p&gt;
-&lt;p&gt;• Fixed git commit co-author attribution showing an incorrect model name for some models&lt;/p&gt;
-&lt;p&gt;• Fixed the /advisor dialog pre-selecting a saved advisor model that is blocked by the availableModels allowlist&lt;/p&gt;
-&lt;p&gt;• Fixed skill hot-reload re-sending the entire skill listing when a single skill changed; only changed skills are now re-announced&lt;/p&gt;
-&lt;p&gt;• Fixed Workflow tool agent() subagents missing per-agent attribution headers&lt;/p&gt;
-&lt;p&gt;• [VSCode] Added usage attribution to the Account &amp;amp; usage dialog (/usage) showing cache misses, long context, subagents, and per-skill/agent/plugin/MCP breakdowns over the last 24h or 7d&lt;/p&gt;
-&lt;p&gt;• Fixed pre-warmed background workers failing with "Could not resolve authentication method" when claimed after sitting idle&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.211</id>
+    <title>Claude Code v2.1.211</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.211"/>
+    <updated>2026-07-15T23:02:29Z</updated>
+    <content type="html">&lt;p&gt;• Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output&lt;/p&gt;
+&lt;p&gt;• Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message&lt;/p&gt;
+&lt;p&gt;• Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt&lt;/p&gt;
+&lt;p&gt;• Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store&lt;/p&gt;
+&lt;p&gt;• Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message&lt;/p&gt;
+&lt;p&gt;• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured&lt;/p&gt;
+&lt;p&gt;• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message&lt;/p&gt;
+&lt;p&gt;• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings&lt;/p&gt;
+&lt;p&gt;• Fixed file upload validation: filenames ending in a DOS device suffix (.prn) or trailing dot are now accepted, and files with multiple hard links are refused&lt;/p&gt;
+&lt;p&gt;• Fixed file uploads to Claude in Chrome from remote and CLI sessions&lt;/p&gt;
+&lt;p&gt;• Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel&lt;/p&gt;
+&lt;p&gt;• Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running&lt;/p&gt;
+&lt;p&gt;• Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id&lt;/p&gt;
+&lt;p&gt;• Fixed /loop hiding the session from /resume after a single use&lt;/p&gt;
+&lt;p&gt;• Fixed screen reader users losing the audible terminal bell after /terminal-setup or onboarding terminal setup&lt;/p&gt;
+&lt;p&gt;• Fixed background jobs on LLM gateway auth (ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing&lt;/p&gt;
+&lt;p&gt;• Fixed /clear not resetting the session cost counter — the statusline's cost now starts at $0 after /clear&lt;/p&gt;
+&lt;p&gt;• Fixed Claude in Chrome setup pages failing to open in the browser on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable&lt;/p&gt;
+&lt;p&gt;• Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link&lt;/p&gt;
+&lt;p&gt;• Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions&lt;/p&gt;
+&lt;p&gt;• Fixed routines with no schedule reporting a next run time in the year 1&lt;/p&gt;
+&lt;p&gt;• Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after /clear&lt;/p&gt;
+&lt;p&gt;• Improved terminal layout and rendering performance&lt;/p&gt;
+&lt;p&gt;• Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results&lt;/p&gt;
+&lt;p&gt;• Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments&lt;/p&gt;
+&lt;p&gt;• Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like 1e6 and 64_000&lt;/p&gt;
+&lt;p&gt;• Updated documentation links to the current docs sites&lt;/p&gt;
+&lt;p&gt;• Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees&lt;/p&gt;
+&lt;p&gt;• Changed /usage-credits to ask for confirmation before sending a request to organization admins&lt;/p&gt;
+&lt;p&gt;• Changed Vim mode s and S (substitute char/line) to work in NORMAL mode, matching vim behavior&lt;/p&gt;
+&lt;p&gt;• [VSCode] Updated the Remote Control banner to describe what it does&lt;/p&gt;
+&lt;p&gt;• Claude in Chrome: hardened file-upload path validation&lt;/p&gt;
+&lt;p&gt;• Claude in Chrome: save_to_disk on screenshot actions now writes the image to disk and returns the path; previously it did nothing&lt;/p&gt;
+&lt;p&gt;• Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.173</id>
-    <title>Claude Code v2.1.173</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.173"/>
-    <updated>2026-06-11T05:41:48Z</updated>
-    <content type="html">&lt;p&gt;• Fixed Fable 5 model names with a [1m] suffix not being normalized — Fable 5 includes 1M context by default, so the suffix is now stripped automatically&lt;/p&gt;
-&lt;p&gt;• Fixed a spurious "sandbox dependencies missing" startup warning on Windows when sandbox was enabled in settings&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.210</id>
+    <title>Claude Code v2.1.210</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.210"/>
+    <updated>2026-07-14T23:45:19Z</updated>
+    <content type="html">&lt;p&gt;• Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck&lt;/p&gt;
+&lt;p&gt;• Added a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead&lt;/p&gt;
+&lt;p&gt;• Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree&lt;/p&gt;
+&lt;p&gt;• Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments&lt;/p&gt;
+&lt;p&gt;• Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element&lt;/p&gt;
+&lt;p&gt;• Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text&lt;/p&gt;
+&lt;p&gt;• Fixed claude attach sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes&lt;/p&gt;
+&lt;p&gt;• Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element&lt;/p&gt;
+&lt;p&gt;• Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait&lt;/p&gt;
+&lt;p&gt;• Fixed Claude assuming a cd took effect after its command was moved to the background; the tool result now states the working directory is unchanged&lt;/p&gt;
+&lt;p&gt;• Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session&lt;/p&gt;
+&lt;p&gt;• Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot&lt;/p&gt;
+&lt;p&gt;• Fixed /doctor skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in&lt;/p&gt;
+&lt;p&gt;• Fixed Grep content mode claiming "No matches found" when paginating past the end of results&lt;/p&gt;
+&lt;p&gt;• Fixed unmatched $1/$2 positional placeholders in skills and commands being silently stripped; they are now preserved verbatim&lt;/p&gt;
+&lt;p&gt;• Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems&lt;/p&gt;
+&lt;p&gt;• Fixed background workers crash-looping when a client resets its connection to the background service&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents --effort ultracode not reaching dispatched sessions; the value was silently dropped&lt;/p&gt;
+&lt;p&gt;• Fixed pressing ← to open the agents view dropping the task tracker when returning to the session&lt;/p&gt;
+&lt;p&gt;• Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted&lt;/p&gt;
+&lt;p&gt;• Fixed killed background sessions leaving a permanent git worktree lock behind; the periodic sweep now releases locks whose owning process is gone&lt;/p&gt;
+&lt;p&gt;• Fixed SDK MCP servers registered via an initialize control request waiting until the next turn to start connecting&lt;/p&gt;
+&lt;p&gt;• Fixed returning to the agents view from a session leaving overlapping ghost frames with CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1&lt;/p&gt;
+&lt;p&gt;• Fixed late-appearing .claude/* symlinks not being reconciled into the sandbox deny-write list&lt;/p&gt;
+&lt;p&gt;• Hardened the Agent tool against indirect prompt injection via content a subagent read&lt;/p&gt;
+&lt;p&gt;• Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request&lt;/p&gt;
+&lt;p&gt;• Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session&lt;/p&gt;
+&lt;p&gt;• Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds&lt;/p&gt;
+&lt;p&gt;• Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation&lt;/p&gt;
+&lt;p&gt;• Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab&lt;/p&gt;
+&lt;p&gt;• The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes&lt;/p&gt;
+&lt;p&gt;• Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection&lt;/p&gt;
+&lt;p&gt;• Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.172</id>
-    <title>Claude Code v2.1.172</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.172"/>
-    <updated>2026-06-10T20:44:09Z</updated>
-    <content type="html">&lt;p&gt;• Sub-agents can now spawn their own sub-agents (up to 5 levels deep)&lt;/p&gt;
-&lt;p&gt;• Amazon Bedrock now reads the AWS region from ~/.aws config files when AWS_REGION isn't set, matching AWS SDK precedence; /status shows where the region came from&lt;/p&gt;
-&lt;p&gt;• Added a search bar when browsing a marketplace's plugins in /plugin&lt;/p&gt;
-&lt;p&gt;• Added model attribute to the claude_code.lines_of_code.count OTEL metric&lt;/p&gt;
-&lt;p&gt;• Fixed sessions using 1M context without usage credits getting permanently stuck — the session now automatically compacts back under the standard context limit&lt;/p&gt;
-&lt;p&gt;• Fixed a repeating "an image in the conversation could not be processed and was removed" error when the conversation contained multiple images&lt;/p&gt;
-&lt;p&gt;• Fixed the agents view keeping a session under Working with a busy spinner for up to 30 seconds after the worker replied&lt;/p&gt;
-&lt;p&gt;• Fixed background agents potentially reading another directory's project settings (.mcp.json approvals, trust) when dispatched onto a pre-warmed worker&lt;/p&gt;
-&lt;p&gt;• Fixed background-session attach failing with EAUTH for sessions started on an older version after the daemon auto-updated&lt;/p&gt;
-&lt;p&gt;• Fixed a background sub-agent staying stuck as "active" in the agent panel after a nested agent it spawned was stopped&lt;/p&gt;
-&lt;p&gt;• Fixed /model suggestions in the claude agents dispatch input rendering with a misleading slash prefix and showing models disabled for your org&lt;/p&gt;
-&lt;p&gt;• Fixed availableModels restrictions not being applied to subagent model overrides, the agent dispatch model picker, and the advisor model&lt;/p&gt;
-&lt;p&gt;• Fixed availableModels allowlists hiding the /model picker's Opus and Sonnet 1M rows when entries use version-specific IDs like claude-opus-4-8&lt;/p&gt;
-&lt;p&gt;• Fixed the /model picker on Bedrock offering models the provider doesn't serve — selecting one silently switched the session model and lit the selection marker on multiple rows&lt;/p&gt;
-&lt;p&gt;• Fixed model IDs getting a doubled 1M-context suffix (e.g. [1M][1m]) when ANTHROPIC_DEFAULT_OPUS_MODEL already includes one&lt;/p&gt;
-&lt;p&gt;• Fixed opusplan model setting not shipping with 1M context in plan mode for entitled users; the opusplan[1m] workaround now also correctly switches to Opus in plan mode&lt;/p&gt;
-&lt;p&gt;• Fixed WebFetch(domain:*.example.com) wildcard domain rules never matching subdomains in allow, deny, and ask position, and file permission rules with mid-pattern wildcards (e.g. Read(secrets-*/config.json)) being rejected at startup&lt;/p&gt;
-&lt;p&gt;• Fixed up-arrow prompt history showing the main agent's prompts while a subagent's chat tab is open&lt;/p&gt;
-&lt;p&gt;• Fixed memory recall not finding mounted team memory stores (CLAUDE_MEMORY_STORES) in remote sessions&lt;/p&gt;
-&lt;p&gt;• Fixed workflow validation rejecting scripts whose prompt strings or comments merely mention Date.now()/Math.random()&lt;/p&gt;
-&lt;p&gt;• Disable mouse tracking on Windows consoles that don't fully support it&lt;/p&gt;
-&lt;p&gt;• Fixed the /plugin marketplace list losing its cursor after backing out of a long plugin list, and Esc from the plugin browser returning to the wrong tab&lt;/p&gt;
-&lt;p&gt;• Improved performance in long conversations by removing redundant message normalization and avoiding full message-history transforms when streaming tool-use state is unchanged&lt;/p&gt;
-&lt;p&gt;• Reduced idle CPU usage: /goal status chip no longer re-renders the terminal at 5 Hz while idle, and fewer UI re-renders while subagents run in parallel&lt;/p&gt;
-&lt;p&gt;• Improved Claude in Chrome tool loading: browser tools now load in a single batched call instead of one per tool&lt;/p&gt;
-&lt;p&gt;• Improved the non-interactive Usage Policy refusal message to suggest starting a new session or changing your model&lt;/p&gt;
-&lt;p&gt;• /code-review now keeps the ultra option visible when you're not signed in to claude.ai, with an explanation that the cloud review requires a claude.ai account&lt;/p&gt;
-&lt;p&gt;• Shortened the Remote Control footer indicator to "/rc active" and hid it on narrow terminals&lt;/p&gt;
-&lt;p&gt;• Stopped promoting /loop in remote sessions, where pending loops don't keep the container alive&lt;/p&gt;
-&lt;p&gt;• [VSCode] Fixed PowerShell tool calls rendering as raw JSON instead of a proper command display and permission dialog, and stripped ANSI escape codes from displayed shell output&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.209</id>
+    <title>Claude Code v2.1.209</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.209"/>
+    <updated>2026-07-14T06:36:21Z</updated>
+    <content type="html">&lt;p&gt;• Fixed /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard)&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.170</id>
-    <title>Claude Code v2.1.170</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.170"/>
-    <updated>2026-06-09T17:23:03Z</updated>
-    <content type="html">&lt;p&gt;• Introducing Claude Fable 5: a Mythos-class model that we’ve made safe for general use. Fable’s capabilities exceed those of any model we’ve ever made generally available. Update to version 2.1.170 for access. https://www.anthropic.com/news/claude-fable-5-mythos-5&lt;/p&gt;
-&lt;p&gt;• Fixed sessions not saving transcripts (and not appearing in --resume) when launched from the VS Code integrated terminal or any shell that inherited Claude Code environment variables.&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.208</id>
+    <title>Claude Code v2.1.208</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.208"/>
+    <updated>2026-07-14T01:10:34Z</updated>
+    <content type="html">&lt;p&gt;• Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.&lt;/p&gt;
+&lt;p&gt;• Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode&lt;/p&gt;
+&lt;p&gt;• Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable&lt;/p&gt;
+&lt;p&gt;• Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode&lt;/p&gt;
+&lt;p&gt;• Changed the Fable 5 usage-credits consent prompt to start with the decline option focused&lt;/p&gt;
+&lt;p&gt;• Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings&lt;/p&gt;
+&lt;p&gt;• Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts&lt;/p&gt;
+&lt;p&gt;• Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from&lt;/p&gt;
+&lt;p&gt;• Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions&lt;/p&gt;
+&lt;p&gt;• Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight&lt;/p&gt;
+&lt;p&gt;• Fixed truncated stream-json/JSON output and missing result message when piping large responses from claude -p&lt;/p&gt;
+&lt;p&gt;• Fixed CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)&lt;/p&gt;
+&lt;p&gt;• Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice&lt;/p&gt;
+&lt;p&gt;• Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely&lt;/p&gt;
+&lt;p&gt;• Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte&lt;/p&gt;
+&lt;p&gt;• Fixed apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts&lt;/p&gt;
+&lt;p&gt;• Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy&lt;/p&gt;
+&lt;p&gt;• Fixed /upgrade showing a login flow instead of the upgrade URL when the browser fails to open&lt;/p&gt;
+&lt;p&gt;• Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts&lt;/p&gt;
+&lt;p&gt;• Fixed headless stream-json sessions hanging permanently when a control_request carried a non-string set_model payload; the CLI now answers with an error response&lt;/p&gt;
+&lt;p&gt;• Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped&lt;/p&gt;
+&lt;p&gt;• Fixed the Agent tool launching with no tools when a subagent's tools list resolves to nothing — it now returns a clear error naming the unrecognized entries&lt;/p&gt;
+&lt;p&gt;• Fixed /usage showing stale cached bars over fresher data, and /mcp not reclassifying placeholder servers after config edits&lt;/p&gt;
+&lt;p&gt;• Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task&lt;/p&gt;
+&lt;p&gt;• Fixed the workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves&lt;/p&gt;
+&lt;p&gt;• Fixed /release-notes adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request&lt;/p&gt;
+&lt;p&gt;• Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies&lt;/p&gt;
+&lt;p&gt;• Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached&lt;/p&gt;
+&lt;p&gt;• Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads&lt;/p&gt;
+&lt;p&gt;• Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line&lt;/p&gt;
+&lt;p&gt;• Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached&lt;/p&gt;
+&lt;p&gt;• Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI&lt;/p&gt;
+&lt;p&gt;• Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)&lt;/p&gt;
+&lt;p&gt;• Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files&lt;/p&gt;
+&lt;p&gt;• Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups&lt;/p&gt;
+&lt;p&gt;• Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations&lt;/p&gt;
+&lt;p&gt;• Completed background agents now stay listed in /tasks until cleanup instead of vanishing the moment they finish&lt;/p&gt;
+&lt;p&gt;• Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen&lt;/p&gt;
+&lt;p&gt;• Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary&lt;/p&gt;
+&lt;p&gt;• Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base&lt;/p&gt;
+&lt;p&gt;• Catastrophic removals (e.g. rm -rf ~) in commands containing $(…)/backticks/&amp;lt;(…) now prompt in --dangerously-skip-permissions and auto mode, matching the plain form&lt;/p&gt;
+&lt;p&gt;• /install-github-app and the /mcp settings menu no longer open in background sessions&lt;/p&gt;
+&lt;p&gt;• MCP servers configured with an empty URL now show as "not configured" in /mcp instead of a config error&lt;/p&gt;
+&lt;p&gt;• /usage now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen&lt;/p&gt;
+&lt;p&gt;• Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.169</id>
-    <title>Claude Code v2.1.169</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.169"/>
-    <updated>2026-06-08T21:57:10Z</updated>
-    <content type="html">&lt;p&gt;• Self-hosted runner: added a post-session lifecycle hook that runs after the session ends and before the workspace is deleted, so you can snapshot uncommitted work or export logs; also made the child-process SIGTERM→SIGKILL window configurable (default unchanged at 5s)&lt;/p&gt;
-&lt;p&gt;• Added --safe-mode flag (and CLAUDE_CODE_SAFE_MODE) to start Claude Code with all customizations (CLAUDE.md, plugins, skills, hooks, MCP servers) disabled for troubleshooting&lt;/p&gt;
-&lt;p&gt;• Added /cd command to move a session to a new working directory without breaking the prompt cache mid-session&lt;/p&gt;
-&lt;p&gt;• Added a disableBundledSkills setting and CLAUDE_CODE_DISABLE_BUNDLED_SKILLS environment variable to hide bundled skills, workflows, and built-in slash commands from the model&lt;/p&gt;
-&lt;p&gt;• Fixed Up/Down arrows jumping to command history past the wrapped rows of a long input line — they now move through each visual row first, and history recall enters at the near edge&lt;/p&gt;
-&lt;p&gt;• Fixed enterprise managed MCP policies (allowedMcpServers/deniedMcpServers) not being enforced on reconnect, IDE-typed configs, --mcp-config servers during the first session after install, or before remote settings loaded; also fixed slow cold starts for orgs without remote settings&lt;/p&gt;
-&lt;p&gt;• Fixed a ~30-50ms UI stall at the start of each turn for macOS users logged in with claude.ai credentials&lt;/p&gt;
-&lt;p&gt;• Fixed claude -p being slow or appearing to hang on Windows while waiting for the slash-command/skill scan (regression in 2.1.161)&lt;/p&gt;
-&lt;p&gt;• Fixed Remote Control getting stuck on "reconnecting" after resuming a session when an OAuth token refresh happened at the same time&lt;/p&gt;
-&lt;p&gt;• Fixed Git Credential Manager's "Connect to GitHub" popup appearing on Windows at startup when background git commands ran without cached credentials&lt;/p&gt;
-&lt;p&gt;• Fixed footer hints (e.g. "esc to interrupt") not showing for users with a custom statusline&lt;/p&gt;
-&lt;p&gt;• Fixed stale permission and dialog prompts reappearing every time you reattached to a remote session whose worker had died while waiting on them&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents --json omitting blocked and just-dispatched background sessions; added --all to include completed sessions, plus new id and state fields&lt;/p&gt;
-&lt;p&gt;• Fixed agents view leaving a stale/garbled frame after navigating back from an agent on WSL in Windows Terminal&lt;/p&gt;
-&lt;p&gt;• Fixed background agents ignoring project-level settings env values (e.g. ANTHROPIC_MODEL) when dispatched onto a pre-warmed worker&lt;/p&gt;
-&lt;p&gt;• Fixed MCPB plugin cache being spuriously invalidated on Windows, causing unnecessary re-extraction&lt;/p&gt;
-&lt;p&gt;• Fixed plugin .in_use PID lock files accumulating without bound; stale markers from crashed sessions are now swept once per day&lt;/p&gt;
-&lt;p&gt;• Fixed untrusted project settings being able to set OTEL client-certificate paths without trust confirmation&lt;/p&gt;
-&lt;p&gt;• /workflows now opens immediately even while a turn is in progress&lt;/p&gt;
-&lt;p&gt;• Improved TaskCreate reliability: malformed inputs are repaired automatically and validation errors for unloaded tools include the schema&lt;/p&gt;
-&lt;p&gt;• Improved the error message shown when your organization has disabled API key authentication, with guidance based on where the active API key comes from&lt;/p&gt;
-&lt;p&gt;• Reduced CPU usage while responses stream and during spinner animations&lt;/p&gt;
-&lt;p&gt;• Restored a default 5-minute idle timeout on Vertex/Foundry so a stalled stream aborts instead of hanging indefinitely; set API_FORCE_IDLE_TIMEOUT=0 to opt out&lt;/p&gt;
-&lt;p&gt;• Remote-managed settings with an invalid entry now apply their remaining valid policies and surface the validation error, instead of silently dropping the whole payload&lt;/p&gt;
-&lt;p&gt;• Background sessions now preserve --ide, --chrome, --bare, --remote-control, and other flags across retire→wake, and respawn state validation was hardened&lt;/p&gt;
-&lt;p&gt;• Background sessions are now told that shared-checkout edits are blocked until they enter a worktree, avoiding a wasted rejected edit before EnterWorktree&lt;/p&gt;
-&lt;p&gt;• The "CLAUDE.md is too long" warning threshold now scales with the model's context window&lt;/p&gt;
-&lt;p&gt;• Auto-updater on Windows now stops retrying within a session once claude.exe is held by another process&lt;/p&gt;
-&lt;p&gt;• Improved color contrast for skill tags in the slash-command menu&lt;/p&gt;
-&lt;p&gt;• Promo credit claims for Apple/Google-billed subscribers without a payment method now explain where to add one&lt;/p&gt;
-&lt;p&gt;• Added a tip suggesting claude agents when running multiple concurrent sessions&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.207</id>
+    <title>Claude Code v2.1.207</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.207"/>
+    <updated>2026-07-11T00:52:04Z</updated>
+    <content type="html">&lt;p&gt;• Auto mode is now available without CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry; disable via disableAutoMode in settings&lt;/p&gt;
+&lt;p&gt;• Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks&lt;/p&gt;
+&lt;p&gt;• Fixed remote managed settings from a non-interactive run (claude -p, the SDK) being permanently recorded as consented without ever showing the security consent dialog&lt;/p&gt;
+&lt;p&gt;• Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates&lt;/p&gt;
+&lt;p&gt;• Fixed the auto-updater overwriting a custom launcher script or symlink at ~/.local/bin/claude on every release; /doctor now reports an externally managed launcher&lt;/p&gt;
+&lt;p&gt;• Fixed compound commands with cd prompting for permission when the only output redirect was to /dev/null&lt;/p&gt;
+&lt;p&gt;• Fixed the transcript jumping above the start of the answer when a response finishes streaming&lt;/p&gt;
+&lt;p&gt;• Fixed extensions.worktreeConfig being left in the repo's .git/config (breaking go-git tools like tea) after the last worktree.sparsePaths worktree was removed&lt;/p&gt;
+&lt;p&gt;• Fixed malformed bracket patterns in rules globs, skill paths, .ignore, and .worktreeinclude breaking file reads, file suggestions, and worktree creation&lt;/p&gt;
+&lt;p&gt;• Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web&lt;/p&gt;
+&lt;p&gt;• Fixed Deep research runs labeling every Fetch-phase agent "unknown" — chips now show the source hostname&lt;/p&gt;
+&lt;p&gt;• Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request&lt;/p&gt;
+&lt;p&gt;• Improved agent view: pasting the same text again now expands the collapsed [Pasted text #N] placeholder instead of adding a second one&lt;/p&gt;
+&lt;p&gt;• Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (waiting 3m) instead of the same timestamp twice&lt;/p&gt;
+&lt;p&gt;• Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8&lt;/p&gt;
+&lt;p&gt;• Changed auto mode to no longer read autoMode from .claude/settings.local.json (repo-resident); use ~/.claude/settings.json instead&lt;/p&gt;
+&lt;p&gt;• Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck credential_process): the 60-second stall guard now fires instead of waiting forever.&lt;/p&gt;
+&lt;p&gt;• Plugin hooks/monitors/MCP headersHelper: ${user_config.*} in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (args array) or $CLAUDE_PLUGIN_OPTION_&amp;lt;KEY&amp;gt;; monitors and headersHelper: read the value inside the script (config file or the server's env block).&lt;/p&gt;
+&lt;p&gt;• Plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json; only user, --settings, and managed settings are honored&lt;/p&gt;
+&lt;p&gt;• Fixed /usage-credits amount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.168</id>
-    <title>Claude Code v2.1.168</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.168"/>
-    <updated>2026-06-06T23:41:47Z</updated>
-    <content type="html">&lt;p&gt;• Bug fixes and reliability improvements&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.206</id>
+    <title>Claude Code v2.1.206</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.206"/>
+    <updated>2026-07-09T23:34:23Z</updated>
+    <content type="html">&lt;p&gt;• Added directory path suggestions to /cd, matching /add-dir behavior&lt;/p&gt;
+&lt;p&gt;• Added a /doctor check that proposes trimming checked-in CLAUDE.md files by cutting content Claude could derive from the codebase&lt;/p&gt;
+&lt;p&gt;• /commit-push-pr now auto-allows git push to the repo's configured push remote (remote.pushDefault, or the sole remote when only one is configured) in addition to origin&lt;/p&gt;
+&lt;p&gt;• Gateway: /login now supports Anthropic-operated public gateway endpoints&lt;/p&gt;
+&lt;p&gt;• EnterWorktree now asks for confirmation before entering a git worktree outside the project's .claude/worktrees/ directory&lt;/p&gt;
+&lt;p&gt;• Background agents now upgrade to a new version in the background right after a Claude Code update, instead of paying a slow stale-session upgrade when you attach&lt;/p&gt;
+&lt;p&gt;• Fixed an expired login failing every model with a misleading "There's an issue with the selected model" error instead of prompting to run /login&lt;/p&gt;
+&lt;p&gt;• Fixed claude --resume and --continue not responding to keyboard input on startup&lt;/p&gt;
+&lt;p&gt;• Fixed MCP servers configured via --mcp-config or .mcp.json ignoring a per-server request_timeout_ms, which caused long-running MCP tool calls to time out at the 60s default in fresh sessions&lt;/p&gt;
+&lt;p&gt;• Fixed CLAUDE_CODE_EXTRA_BODY being silently ignored by claude agents / --bg background workers; the shell-exported override now follows the dispatching session&lt;/p&gt;
+&lt;p&gt;• Fixed OAuth MCP servers requiring manual re-authentication after a single failed token refresh&lt;/p&gt;
+&lt;p&gt;• Fixed --permission-prompt-tool pointing at an MCP server crashing with "MCP tool not found" on cold start before the server finishes connecting&lt;/p&gt;
+&lt;p&gt;• Fixed /model picker rows printing a price for a different model than the row named, and stopped quoting first-party list prices on providers that don't bill them&lt;/p&gt;
+&lt;p&gt;• Fixed server-provided model rows being misplaced in the /model picker when an entitlement or allowlist restriction drops the row they were positioned against&lt;/p&gt;
+&lt;p&gt;• Fixed desktop sessions getting stuck showing "running" after a slash command was sent mid-turn&lt;/p&gt;
+&lt;p&gt;• Fixed keyboard input being ignored in the agents view when a setup prompt appeared before a bare claude --resume on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed claude rm leaving the removed job in the daemon roster, causing the row to reappear in claude agents&lt;/p&gt;
+&lt;p&gt;• Fixed /remote-control showing "Unknown command" when logged out — it now explains how to sign in&lt;/p&gt;
+&lt;p&gt;• Fixed left arrow not stepping back out of a phase or agent in the workflow detail view&lt;/p&gt;
+&lt;p&gt;• Fixed /status listing the same broken-install warning twice&lt;/p&gt;
+&lt;p&gt;• Fixed false "disused plugin" tips and skewed disuse telemetry for LSP plugins&lt;/p&gt;
+&lt;p&gt;• Fixed /doctor's update check to compare Homebrew installs against their cask's channel instead of the settings channel&lt;/p&gt;
+&lt;p&gt;• Fixed the fullscreen jump-to-bottom pill suggesting Ctrl+End on macOS, not showing rebound chords, and wrapping over the transcript&lt;/p&gt;
+&lt;p&gt;• Bedrock: fixed a multi-minute startup hang when using an awsCredentialExport helper on networks with restricted egress&lt;/p&gt;
+&lt;p&gt;• Improved /code-review findings quality on claude-opus-4-8 across all effort levels&lt;/p&gt;
+&lt;p&gt;• Improved agents view: status column now uses full terminal width instead of truncating at 64 characters&lt;/p&gt;
+&lt;p&gt;• Changed agents view: Ctrl+X now permanently removes a completed session, and sessions no longer render twice; deleted background jobs stay deleted&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.167</id>
-    <title>Claude Code v2.1.167</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.167"/>
-    <updated>2026-06-06T01:33:29Z</updated>
-    <content type="html">&lt;p&gt;• Bug fixes and reliability improvements&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.205</id>
+    <title>Claude Code v2.1.205</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.205"/>
+    <updated>2026-07-08T21:21:58Z</updated>
+    <content type="html">&lt;p&gt;• Added an auto mode rule that blocks tampering with session transcript files&lt;/p&gt;
+&lt;p&gt;• Fixed --json-schema silently producing unstructured output when the schema was invalid, and schemas using the format keyword being rejected&lt;/p&gt;
+&lt;p&gt;• Fixed a message sent while Claude was working being silently lost when the turn ended at the --max-turns limit&lt;/p&gt;
+&lt;p&gt;• Fixed Windows worktree removal deleting files outside the worktree when an NTFS junction or directory symlink existed inside it&lt;/p&gt;
+&lt;p&gt;• Fixed background agents staying shown as "failed" or "completed" in the agent list after being resumed with SendMessage&lt;/p&gt;
+&lt;p&gt;• Fixed background jobs flipping from "needs input" back to "working" in the agent list when the agent's turn contained no readable text&lt;/p&gt;
+&lt;p&gt;• Fixed claude attach erroring when a background agent was mid-upgrade restart instead of waiting for it to come back&lt;/p&gt;
+&lt;p&gt;• Fixed session-to-PR linking missing a PR created in a Bash call whose output exceeded the 30K inline limit&lt;/p&gt;
+&lt;p&gt;• Fixed claude mcp add-from-claude-desktop getting stuck when a server name contains unsupported characters; invalid names are now reported and remaining servers still import&lt;/p&gt;
+&lt;p&gt;• Fixed a plugin LSP server that fails to initialize preventing a valid LSP server from another plugin handling the same file extension&lt;/p&gt;
+&lt;p&gt;• Fixed a Windows crash when the directory Claude was launched from is deleted, locked, or unmounted while a command is running&lt;/p&gt;
+&lt;p&gt;• Fixed a crash when a file watcher was closed while a directory scan was still in flight&lt;/p&gt;
+&lt;p&gt;• Fixed project verify skills being rewritten on every session instead of only when a documented command changed&lt;/p&gt;
+&lt;p&gt;• Fixed the agent view rendering one line too high and clipping its header when the job list slightly overflowed the screen&lt;/p&gt;
+&lt;p&gt;• Fixed background tasks in the web and mobile Remote Control panels showing stale "Running" status by forwarding full task state on every membership change&lt;/p&gt;
+&lt;p&gt;• Improved auto mode to ask before running rm -rf on a variable it can't resolve from context&lt;/p&gt;
+&lt;p&gt;• Auto-update binary downloads now stream to disk instead of buffering in memory, cutting the updater's peak memory usage by roughly 400 MB&lt;/p&gt;
+&lt;p&gt;• Background task notifications now explicitly state that no human input has occurred, preventing fabricated in-transcript approvals from being acted on&lt;/p&gt;
+&lt;p&gt;• Improved agent view: sessions that edit, merge, comment on, or push to an existing PR now link it in claude agents&lt;/p&gt;
+&lt;p&gt;• Improved agent view: rows now show a colored state word and a classifier-written headline instead of raw tool call text, and the peek opens with full status including the exact ask for blocked sessions&lt;/p&gt;
+&lt;p&gt;• /doctor is now a full setup checkup that can diagnose and fix issues; /checkup is its alias&lt;/p&gt;
+&lt;p&gt;• Reserved the "Claude Browser" MCP server name (alongside "Claude Preview") ahead of the Claude Desktop pane rename; user-configured MCP servers can no longer register under either name&lt;/p&gt;
+&lt;p&gt;• Fixed Cowork VM-mode local-agent sessions failing to start with "Not logged in · Please run /login" on CLI 2.1.203+&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.166</id>
-    <title>Claude Code v2.1.166</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.166"/>
-    <updated>2026-06-06T00:55:12Z</updated>
-    <content type="html">&lt;p&gt;• Added fallbackModel setting to configure up to three fallback models tried in order when the primary model is overloaded or unavailable; --fallback-model now also applies to interactive sessions&lt;/p&gt;
-&lt;p&gt;• Added glob pattern support in deny rule tool-name position ("*" denies all tools); allow rules reject non-MCP globs, and unknown tool names in deny rules warn at startup&lt;/p&gt;
-&lt;p&gt;• Hardened cross-session messaging: messages relayed via SendMessage from other Claude sessions no longer carry user authority — receivers refuse relayed permission requests, and auto mode blocks them&lt;/p&gt;
-&lt;p&gt;• MAX_THINKING_TOKENS=0, --thinking disabled, and the per-model thinking toggle now disable thinking on models that think by default via the Claude API (3P providers unchanged)&lt;/p&gt;
-&lt;p&gt;• Claude Code now retries a turn once on the fallback model when the API rejects an unexpected non-retryable error; auth, rate-limit, request-size, and transport errors still surface immediately&lt;/p&gt;
-&lt;p&gt;• claude update now announces the target version before downloading instead of going silent&lt;/p&gt;
-&lt;p&gt;• claude agents: typing a URL into the list now filters to the session whose first prompt contained it&lt;/p&gt;
-&lt;p&gt;• Fixed a recurring "image could not be processed" error and extra token usage when an unprocessable image was sent in a session&lt;/p&gt;
-&lt;p&gt;• Fixed remote sessions becoming permanently stuck when a brief backend disruption occurred during worker registration at startup&lt;/p&gt;
-&lt;p&gt;• Fixed flickering in JetBrains IDE terminals (IntelliJ, PyCharm, WebStorm, etc.) on 2026.1+ by enabling synchronized output&lt;/p&gt;
-&lt;p&gt;• Fixed Shift+non-ASCII characters (e.g. Shift+ä → Ä) being dropped in terminals using the Kitty keyboard protocol (WezTerm, Ghostty, kitty)&lt;/p&gt;
-&lt;p&gt;• Fixed PowerShell command validation occasionally hanging far past its time budget on Windows when a killed process's children held its output pipes&lt;/p&gt;
-&lt;p&gt;• Fixed orphaned claude --bg-pty-host processes spinning at 100% CPU after the daemon dies while connected on macOS&lt;/p&gt;
-&lt;p&gt;• Fixed voice mode requiring /login to clear a stale auth check after toggling /voice&lt;/p&gt;
-&lt;p&gt;• Fixed managed settings with an invalid entry silently disabling enforcement of their remaining valid policies&lt;/p&gt;
-&lt;p&gt;• Fixed managed-settings allowedMcpServers/deniedMcpServers predicates not matching when they use ${VAR} references&lt;/p&gt;
-&lt;p&gt;• Fixed background agent sessions that entered a git worktree crash-looping with "No conversation found" when reopened from claude agents&lt;/p&gt;
-&lt;p&gt;• Fixed duplicated thinking text in the Ctrl+O transcript view while streaming&lt;/p&gt;
-&lt;p&gt;• Fixed /doctor showing a contradictory failed "Not inside a remote session" check when run inside a remote session&lt;/p&gt;
-&lt;p&gt;• Fixed the cursor sticking at the end of the first line when typing a multiline prompt in the claude agents dispatch and reply inputs&lt;/p&gt;
-&lt;p&gt;• Fixed blank lines appearing between background agent rows in the task list on terminals without Unicode support&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.204</id>
+    <title>Claude Code v2.1.204</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.204"/>
+    <updated>2026-07-08T00:27:43Z</updated>
+    <content type="html">&lt;p&gt;• Fixed hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.165</id>
-    <title>Claude Code v2.1.165</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.165"/>
-    <updated>2026-06-05T05:44:59Z</updated>
-    <content type="html">&lt;p&gt;• Bug fixes and reliability improvements&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.203</id>
+    <title>Claude Code v2.1.203</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.203"/>
+    <updated>2026-07-07T21:06:03Z</updated>
+    <content type="html">&lt;p&gt;• Added a warning when your login is about to expire, so you can re-authenticate before background sessions are interrupted&lt;/p&gt;
+&lt;p&gt;• Added a grey ⏸ badge to the footer when in manual permission mode, making the active mode always visible&lt;/p&gt;
+&lt;p&gt;• Added the session's additional working directories to MCP roots/list, with notifications/roots/list_changed sent when the set changes&lt;/p&gt;
+&lt;p&gt;• Fixed opening or switching background agent sessions on macOS stalling for 15–20 seconds due to a false low-memory detection (regression in 2.1.196)&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions becoming permanently unresponsive to attach, replies, and stop when the daemon's session token went stale — the session now recovers automatically&lt;/p&gt;
+&lt;p&gt;• Fixed returning to claude agents silently stopping running subagents and re-running the prompt from scratch — their work now carries over&lt;/p&gt;
+&lt;p&gt;• Fixed a memory and per-turn CPU regression in interactive sessions: the context-usage indicator no longer re-analyzes the entire transcript after every turn&lt;/p&gt;
+&lt;p&gt;• Fixed background agents inheriting a stale PATH from the daemon instead of the dispatching shell, causing missing tools on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed background and agent-view sessions dropping a shell-exported ANTHROPIC_BASE_URL, which sent API keys to the default endpoint and failed with 401&lt;/p&gt;
+&lt;p&gt;• Fixed Bash failing with "argument list too long" in repos with many git worktrees&lt;/p&gt;
+&lt;p&gt;• Fixed worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree&lt;/p&gt;
+&lt;p&gt;• Fixed worktree creation rejecting nested repositories in multi-repo workspaces, leaving background sessions unable to isolate and edit&lt;/p&gt;
+&lt;p&gt;• Fixed background agents crash-looping when their working directory was deleted, replaced by a file, or became an invalid path — they now fail once with a clear error&lt;/p&gt;
+&lt;p&gt;• Fixed a background daemon auto-upgrade failure silently killing all running background sessions&lt;/p&gt;
+&lt;p&gt;• Fixed TaskStop and TaskOutput failing to find background agents spawned by another agent — errors now list running agents by id and description&lt;/p&gt;
+&lt;p&gt;• Fixed the claude agents composer discarding your typed message when a slash command isn't available there&lt;/p&gt;
+&lt;p&gt;• Fixed the agent list crashing when opening a stopped session whose conversation was already open in another session&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions showing "Needs input" in the agent list after the question was already answered&lt;/p&gt;
+&lt;p&gt;• Fixed background agent startup failures showing only "exit_with_message" instead of the actual error&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions ignoring effortLevel changes in settings.json when forked through the daemon&lt;/p&gt;
+&lt;p&gt;• Fixed attached background sessions ignoring CLAUDE_CODE_DISABLE_MOUSE and CLAUDE_CODE_DISABLE_MOUSE_CLICKS opt-outs&lt;/p&gt;
+&lt;p&gt;• Fixed /exit incorrectly warning about running background agents after all named agents had completed&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions started from a non-git directory unable to edit files when a WorktreeCreate hook was configured&lt;/p&gt;
+&lt;p&gt;• Fixed the @ directory picker in claude agents not showing registered git worktrees&lt;/p&gt;
+&lt;p&gt;• Fixed background task output on Windows being permanently replaced by an empty file after /clear&lt;/p&gt;
+&lt;p&gt;• Fixed content jumping when scrolling up through long transcript history&lt;/p&gt;
+&lt;p&gt;• Fixed the terminal flickering and jumping while typing in bash mode when a shell-history suggestion was shown&lt;/p&gt;
+&lt;p&gt;• Fixed literal ^[[I / ^[[O escape codes being printed when reattaching to a background session&lt;/p&gt;
+&lt;p&gt;• Fixed LSP-only plugins being incorrectly flagged for disuse when their language servers deliver diagnostics or answer navigation requests&lt;/p&gt;
+&lt;p&gt;• Improved responsiveness while long responses stream: live-preview updates no longer re-render the whole screen&lt;/p&gt;
+&lt;p&gt;• Improved subagent behavior: agents are now less likely to re-delegate their entire task to another subagent&lt;/p&gt;
+&lt;p&gt;• Reduced binary size by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily instead of inlining it&lt;/p&gt;
+&lt;p&gt;• Changed left arrow to no longer close the background tasks, diff, and workflow detail views — press Esc instead&lt;/p&gt;
+&lt;p&gt;• Changed the empty claude agents view to always show the organized sections (Needs input / Working / Completed) with descriptions&lt;/p&gt;
+&lt;p&gt;• Removed the startup "claude command missing or broken" warnings — they now appear in /doctor and /status instead&lt;/p&gt;
+&lt;p&gt;• Removed a redundant navigation hint from the claude agents footer&lt;/p&gt;
+&lt;p&gt;• [VSCode] Added a Settings toggle for "Enable Remote Control for all sessions"&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.163</id>
-    <title>Claude Code v2.1.163</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.163"/>
-    <updated>2026-06-04T21:52:45Z</updated>
-    <content type="html">&lt;p&gt;• Added requiredMinimumVersion and requiredMaximumVersion managed settings — Claude Code refuses to start if its version is outside the allowed range and directs the user to an approved version&lt;/p&gt;
-&lt;p&gt;• Added /plugin list command to list installed plugins, with --enabled/--disabled filters&lt;/p&gt;
-&lt;p&gt;• Added a "c to copy" shortcut to /btw that copies the raw markdown answer to the clipboard, preserving formatting when pasted elsewhere&lt;/p&gt;
-&lt;p&gt;• Hooks: Stop and SubagentStop hooks can now return hookSpecificOutput.additionalContext to give Claude feedback and keep the turn going without being labeled a hook error&lt;/p&gt;
-&lt;p&gt;• Skills: added \$ escape syntax to include a literal $ before a digit in command bodies&lt;/p&gt;
-&lt;p&gt;• stdio MCP servers now receive the same CLAUDE_CODE_SESSION_ID as hooks/Bash on --resume&lt;/p&gt;
-&lt;p&gt;• Fixed claude -p hanging forever after its final result when a backgrounded command never exits — background shells are now stopped ~5s after the result once stdin closes&lt;/p&gt;
-&lt;p&gt;• Fixed claude -p failing with "ANTHROPIC_API_KEY required" on Bedrock/Vertex/Foundry when CI=true and no Anthropic API key is set&lt;/p&gt;
-&lt;p&gt;• Fixed bash commands failing under bazel and EDR-protected Go workflows: $TMPDIR was overridden to /tmp/claude-{uid} for all commands instead of only sandboxed ones (regression in 2.1.154)&lt;/p&gt;
-&lt;p&gt;• Fixed Bash commands failing on Windows with "EEXIST: file already exists" on the session-env directory when it has the read-only attribute or is inside OneDrive&lt;/p&gt;
-&lt;p&gt;• Fixed org-managed permission rules not applying for the entire session when the managed settings fetch completed during startup on a fresh config directory&lt;/p&gt;
-&lt;p&gt;• Fixed background sessions in claude agents losing their running background tasks when reattached after a Claude Code update&lt;/p&gt;
-&lt;p&gt;• Fixed terminal misalignment and a multi-second hang when exiting the agent view by pressing Esc&lt;/p&gt;
-&lt;p&gt;• Fixed clicking Stop on a background-task chip in the desktop app not clearing the chip when the underlying process was already gone&lt;/p&gt;
-&lt;p&gt;• Fixed keyboard input becoming permanently unresponsive after a paste operation whose end marker is dropped by the terminal&lt;/p&gt;
-&lt;p&gt;• Fixed hook if: "Bash(...)" conditions firing on every Bash command containing $() or $VAR; the pattern now matches against commands inside subshells and backticks too&lt;/p&gt;
-&lt;p&gt;• Fixed deny rules on home-directory paths (e.g. Read(~/Desktop/**)) not blocking Bash commands that reference the path via $HOME&lt;/p&gt;
-&lt;p&gt;• Fixed a stray "(no content)" line left in the transcript after closing panel dialogs like /mcp and /plugins&lt;/p&gt;
-&lt;p&gt;• Background agent sessions now update to a new Claude Code version in the background, so opening a session after an update no longer waits on a cold restart&lt;/p&gt;
-&lt;p&gt;• Clearer descriptions for built-in commands and skills in the / menu&lt;/p&gt;
-&lt;p&gt;• The subscription-switch suggestion now shows in the startup announcement slot instead of a toast&lt;/p&gt;
-&lt;p&gt;• claude agents dispatching from the state-grouped view now starts the session in the directory the agent view was opened from&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.202</id>
+    <title>Claude Code v2.1.202</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.202"/>
+    <updated>2026-07-06T22:51:10Z</updated>
+    <content type="html">&lt;p&gt;• Added a "Dynamic workflow size" setting in /config for controlling how large Claude generally makes dynamic workflows (small/medium/large agent counts) — an advisory guideline, not an enforced cap&lt;/p&gt;
+&lt;p&gt;• Added workflow.run_id and workflow.name OpenTelemetry attributes to telemetry emitted by workflow-spawned agents, so a workflow run's activity can be reconstructed from OTel data&lt;/p&gt;
+&lt;p&gt;• Fixed a crash in the inline Ctrl+R history search when accepting or cancelling while the search was still scanning the history file&lt;/p&gt;
+&lt;p&gt;• Fixed /rename on background sessions being reverted when the job restarts, which broke addressing the session by its new name&lt;/p&gt;
+&lt;p&gt;• Fixed transient mTLS handshake failures when settings were re-applied during an in-place client certificate rotation&lt;/p&gt;
+&lt;p&gt;• Fixed commands sent from Remote Control (mobile/web) into an interactive session failing with "Unknown command"&lt;/p&gt;
+&lt;p&gt;• Fixed images and files sent from the Remote Control mobile or web app without a caption being silently dropped&lt;/p&gt;
+&lt;p&gt;• Fixed the sign-in URL printed by claude auth login and claude mcp login --no-browser not being reliably clickable when it wraps over SSH — it is now emitted as a single hyperlink&lt;/p&gt;
+&lt;p&gt;• Fixed opening a chat from claude agents sometimes failing with "currently running as a background agent" followed by a worker crash/respawn loop&lt;/p&gt;
+&lt;p&gt;• Fixed workflow scripts with unicode quote escapes in strings being corrupted before parsing; workflow parse errors now show the offending line instead of always blaming TypeScript&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation retrying in an unbounded loop when the microphone or audio recorder fails — repeated capture failures now pause voice input&lt;/p&gt;
+&lt;p&gt;• Fixed /remote-control sessions showing the wrong permission mode in the mobile and web apps&lt;/p&gt;
+&lt;p&gt;• Fixed resuming a session by name, or opening the resume picker, taking minutes and using a large amount of memory in repositories with many git worktrees&lt;/p&gt;
+&lt;p&gt;• Fixed installer and updater downloads failing immediately with "aborted" when a proxy or network drops the connection mid-download — transient connection drops now retry&lt;/p&gt;
+&lt;p&gt;• Fixed re-invoking an already-loaded skill appending a duplicate copy of its instructions to context&lt;/p&gt;
+&lt;p&gt;• Improved /workflows agent list layout: wider titles, a dedicated time column, shorter model names, and no per-row tool-call counts&lt;/p&gt;
+&lt;p&gt;• Improved MCP error messages: clearer error when a server config has url but no type, suggesting "type": "http" instead of the misleading "command: expected string"&lt;/p&gt;
+&lt;p&gt;• Changed /review &amp;lt;pr&amp;gt; back to a fast single-pass review; use /code-review &amp;lt;level&amp;gt; &amp;lt;pr#&amp;gt; for the multi-agent review at a chosen effort level&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.162</id>
-    <title>Claude Code v2.1.162</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.162"/>
-    <updated>2026-06-03T21:31:28Z</updated>
-    <content type="html">&lt;p&gt;• claude agents --json now includes waitingFor showing what a waiting session is blocked on (e.g. permission prompt)&lt;/p&gt;
-&lt;p&gt;• --tools: explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search (previously these names were silently ignored)&lt;/p&gt;
-&lt;p&gt;• /effort now confirms when your chosen level will persist as the default for new sessions&lt;/p&gt;
-&lt;p&gt;• Clicking a slash command in the autocomplete menu now fills it into your prompt instead of running it immediately; press Enter to run&lt;/p&gt;
-&lt;p&gt;• Remote Control now shows as a persistent footer pill (with a link to the session) instead of a startup message&lt;/p&gt;
-&lt;p&gt;• Renamed Windsurf to Devin Desktop in the /ide menu, /terminal-setup, and /scroll-speed, following the editor's rebrand&lt;/p&gt;
-&lt;p&gt;• Fixed a silent startup hang when the config directory is read-only or unwritable — Claude Code now starts with in-memory config and surfaces startup errors instead of showing a blank screen&lt;/p&gt;
-&lt;p&gt;• Fixed WebFetch permission rules not being applied to built-in preapproved domains; explicit WebFetch(domain:...) deny/ask/allow rules now take precedence over the preapproved-host auto-allow&lt;/p&gt;
-&lt;p&gt;• Fixed Windows permission rules never matching when spelled with backslashes (~\, \\server\share) or case-variant paths, and Read deny rules not hiding files from Glob/Grep results&lt;/p&gt;
-&lt;p&gt;• Fixed an interrupt (Esc) sent at the very start of a turn being silently dropped in stream-json/SDK sessions, leaving the turn running with no "Interrupted" feedback&lt;/p&gt;
-&lt;p&gt;• Fixed API 400 no low surrogate in string errors for classifier side-queries and MCP server descriptions containing emoji near a truncation boundary&lt;/p&gt;
-&lt;p&gt;• Fixed MCP per-server timeout config values below 1000 ms being floored to a 1-second watchdog that aborted every tool call; sub-1000 ms values are now ignored (falling back to MCP_TOOL_TIMEOUT or default), and claude mcp get annotates them accordingly&lt;/p&gt;
-&lt;p&gt;• Fixed the LSP tool's workspaceSymbol operation returning no results; it now accepts a query parameter and passes it to the language server&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents cutting live status text (tool args, replies, prompts, exec output) at 60–120 columns on wide terminals; the status detail now uses the full terminal width&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents truncating long session names at 40 columns; the name column now grows with terminal width&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents attach occasionally bouncing straight back to the session list on the first try after a background-service restart&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents Ctrl+V image paste doing nothing in the dispatch input and the session reply box; pasting with no image now shows a hint&lt;/p&gt;
-&lt;p&gt;• Fixed backgrounding a session with ← silently losing the conversation when the background service cannot start; the session stays in the list as a failed row you can wake with Enter&lt;/p&gt;
-&lt;p&gt;• Fixed replies from the agents view that fail to send being lost; they are now queued for delivery on the next session start&lt;/p&gt;
-&lt;p&gt;• Fixed cross-session messaging (SendMessage) silently breaking when CLAUDE_CODE_TMPDIR or $TMPDIR points at a deep directory&lt;/p&gt;
-&lt;p&gt;• Fixed opening a running background session from claude agents stalling for 5 seconds before attaching&lt;/p&gt;
-&lt;p&gt;• Quieter startup: notices group by severity, and session info and announcements share a single line per launch&lt;/p&gt;
-&lt;p&gt;• Startup warnings rewritten to be shorter and clearer, each with a concrete fix&lt;/p&gt;
-&lt;p&gt;• Launch-prompt warnings (deep link/pre-filled prompt) now stay pinned below the input until you act instead of scrolling away&lt;/p&gt;
-&lt;p&gt;• Failed turns now show a compact warning line instead of a multi-line red error block&lt;/p&gt;
-&lt;p&gt;• Improved background service startup and claude update verification to wait out endpoint-security scanning of new binaries instead of failing after 5 seconds&lt;/p&gt;
-&lt;p&gt;• Background dispatch spawn failures now report the error class name when no errno is available&lt;/p&gt;
-&lt;p&gt;• Removed the "Claude in Chrome enabled" and "marketplace installed" startup messages; model auto-updates and the team-onboarding tip now show as quiet notices under the logo&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.201</id>
+    <title>Claude Code v2.1.201</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.201"/>
+    <updated>2026-07-03T23:50:29Z</updated>
+    <content type="html">&lt;p&gt;• Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.161</id>
-    <title>Claude Code v2.1.161</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.161"/>
-    <updated>2026-06-02T21:58:16Z</updated>
-    <content type="html">&lt;p&gt;• OTEL_RESOURCE_ATTRIBUTES values are now included as labels on metric datapoints, so you can slice usage metrics by custom dimensions like team or repo&lt;/p&gt;
-&lt;p&gt;• claude agents rows now show done/total before the detail when work is fanned out; peek shows the longest-running item&lt;/p&gt;
-&lt;p&gt;• /mcp now collapses claude.ai connectors you've never signed in to behind a "Show unused connectors" row&lt;/p&gt;
-&lt;p&gt;• Parallel tool calls: a failed Bash command no longer cancels other calls in the same batch — each tool returns its own result independently&lt;/p&gt;
-&lt;p&gt;• Fullscreen mode: clipboard now uses wl-copy/xclip/xsel on Linux when available, copies to both the clipboard and PRIMARY selection for middle-click paste, and the "hold {key} for native selection" hint now shows the correct key per terminal&lt;/p&gt;
-&lt;p&gt;• Fixed the /effort dialog, workflow animations, and prompt keyword shimmer not honoring the "Reduce motion" setting&lt;/p&gt;
-&lt;p&gt;• Fixed forceLoginOrgUUID/forceLoginMethod managed-settings policies blocking third-party provider sessions (Bedrock, Vertex, Foundry, Mantle) alongside the org pin (regression in 2.1.146)&lt;/p&gt;
-&lt;p&gt;• Fixed background subagent output corrupting claude -p stdout when using --output-format text or json&lt;/p&gt;
-&lt;p&gt;• Fixed /usage-credits starting a re-login for Team and Enterprise admins instead of pointing to the organization's usage settings page&lt;/p&gt;
-&lt;p&gt;• Fixed /autofix-pr reporting "cannot run on the default branch" when the session is inside a git worktree or another repository&lt;/p&gt;
-&lt;p&gt;• Fixed --resume picker not showing sessions from the current directory when it isn't a git worktree (e.g., jj workspaces)&lt;/p&gt;
-&lt;p&gt;• Fixed Windows hooks that invoke bash explicitly (e.g., /usr/bin/bash script.sh) failing with "command not found" or "cannot execute binary file"&lt;/p&gt;
-&lt;p&gt;• Fixed OpenTelemetry log events (user_prompt, api_request, tool_result, tool_decision) being silently dropped when emitted before telemetry initialization completed&lt;/p&gt;
-&lt;p&gt;• Fixed claude mcp list/get/add printing secrets to the terminal: ${VAR} references are no longer expanded, and credential headers and URL secrets are redacted&lt;/p&gt;
-&lt;p&gt;• Fixed Workflow agents spawned with isolation: "worktree" in background sessions being blocked from editing files inside their own worktree&lt;/p&gt;
-&lt;p&gt;• Fixed background sessions dispatched from claude agents booting on a stale model from the daemon's environment instead of the model in settings.json&lt;/p&gt;
-&lt;p&gt;• Fixed a potential crash when rendering Write tool results after resuming a session&lt;/p&gt;
-&lt;p&gt;• Fixed completed subagents getting stuck showing as running when an error occurs while finalizing their result&lt;/p&gt;
-&lt;p&gt;• Fixed EADDRINUSE errors from tools that bind Unix sockets under $TMPDIR when CLAUDE_CODE_TMPDIR is set to a deep path&lt;/p&gt;
-&lt;p&gt;• Improved terminal rendering performance by stabilizing the layout engine's JIT compilation profile&lt;/p&gt;
-&lt;p&gt;• Improved rendering performance for large file writes&lt;/p&gt;
-&lt;p&gt;• [VSCode] Added a tip suggesting disabling terminal GPU acceleration (or running /terminal-setup) to fix garbled glyphs&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.200</id>
+    <title>Claude Code v2.1.200</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.200"/>
+    <updated>2026-07-03T16:52:26Z</updated>
+    <content type="html">&lt;p&gt;• Changed AskUserQuestion dialogs to no longer auto-continue by default; opt into an idle timeout via /config&lt;/p&gt;
+&lt;p&gt;• Changed the "default" permission mode to "Manual" across the CLI, --help, VS Code, and JetBrains; --permission-mode manual and "defaultMode": "manual" are accepted alongside default&lt;/p&gt;
+&lt;p&gt;• Fixed a crash at startup when disabledMcpServers or enabledMcpServers in .claude.json is set to a non-array value&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions silently stopping mid-turn after sleep/wake or when reopening a stalled session&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions re-running a turn cancelled with Esc after a stall respawn&lt;/p&gt;
+&lt;p&gt;• Fixed background agents never starting again after a crash left a stale daemon.lock whose PID the OS reused&lt;/p&gt;
+&lt;p&gt;• Fixed background-agent daemon handover so a reinstalled older build can no longer take over the daemon; build recency is now judged by the version's embedded build timestamp&lt;/p&gt;
+&lt;p&gt;• Fixed background-agent roster issues: transient corruption permanently disabling orphan cleanup, older binaries not preserving fields written by newer versions, and socket auth tokens being stripped during daemon restarts&lt;/p&gt;
+&lt;p&gt;• Fixed subagents cut off by a rate limit before producing any text output returning an empty result instead of failing cleanly&lt;/p&gt;
+&lt;p&gt;• Fixed control bytes from background-agent output reaching the terminal in the agent view&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents --plugin-dir &amp;lt;dir&amp;gt; not showing the plugin's agents and skills in the agent view when the flag is placed after agents&lt;/p&gt;
+&lt;p&gt;• Fixed project-scoped plugins not loading correctly from git worktrees of the same repository&lt;/p&gt;
+&lt;p&gt;• Fixed /mcp server list not tracking focus for screen readers and magnifiers&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation showing a misleading "Voice connection failed" message when a recording captures no audio&lt;/p&gt;
+&lt;p&gt;• Fixed rendering flicker under tmux 3.4+ by enabling synchronized terminal output&lt;/p&gt;
+&lt;p&gt;• Improved screen-reader output: decorative glyphs are now hidden, transcript symbols read as short labels, and nested tables read as Header: value. lines&lt;/p&gt;
+&lt;p&gt;• Improved the install script to explain when installation is killed by the system running out of memory&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.160</id>
-    <title>Claude Code v2.1.160</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.160"/>
-    <updated>2026-06-02T02:10:17Z</updated>
-    <content type="html">&lt;p&gt;• Added a prompt before writing to shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/, which could otherwise lead to unintended command execution&lt;/p&gt;
-&lt;p&gt;• acceptEdits mode now prompts before writing build-tool config files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/, etc.)&lt;/p&gt;
-&lt;p&gt;• Edit no longer requires a separate Read after viewing a file with grep: single-file grep/egrep/fgrep commands now satisfy the read-before-edit check&lt;/p&gt;
-&lt;p&gt;• Fixed copy-on-select not writing to the Windows clipboard on WSL — now uses PowerShell interop instead of OSC 52, which terminals like MobaXterm don't support&lt;/p&gt;
-&lt;p&gt;• Fixed restoring a completed session from claude agents dropping chat history and re-running the original prompt&lt;/p&gt;
-&lt;p&gt;• Fixed background sessions re-attached after overnight retire losing their conversation and re-running the original prompt&lt;/p&gt;
-&lt;p&gt;• Fixed claude --bg occasionally failing with "socket missing" when the background daemon was cold-starting on a loaded machine&lt;/p&gt;
-&lt;p&gt;• Fixed an issue on Windows where the directory a background session was started in could not be deleted after claude rm until the background daemon exited&lt;/p&gt;
-&lt;p&gt;• Fixed background agents that resumed work being shown under Completed in the agents list&lt;/p&gt;
-&lt;p&gt;• Fixed claude agents freezing for several seconds when returning to the session list due to the auto-updater re-checking on every exit&lt;/p&gt;
-&lt;p&gt;• Fixed Esc, arrow keys, and typing becoming unresponsive on Windows when attached to a background session or in the agent view while the host is under heavy CPU load&lt;/p&gt;
-&lt;p&gt;• Fixed background agents emitting terminal sync-output markers to terminals that don't support them (Apple Terminal, tmux), causing render artifacts when entering a running agent&lt;/p&gt;
-&lt;p&gt;• Fixed mouse wheel scrolling prompt history instead of the transcript right after opening a session from the agents list&lt;/p&gt;
-&lt;p&gt;• Fixed CJK IME composition appearing at the bottom-left of the screen instead of at the input caret in the claude agents view&lt;/p&gt;
-&lt;p&gt;• Fixed valid file:///C:/... links being rewritten to a broken path on Windows terminals with hyperlink support&lt;/p&gt;
-&lt;p&gt;• Fixed voice mode failing to connect when the project directory or branch name contains non-ASCII or special characters&lt;/p&gt;
-&lt;p&gt;• Fixed the auto mode unavailability message on third-party providers (Bedrock/Vertex/Foundry) to point to the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in instead of incorrectly blaming the model&lt;/p&gt;
-&lt;p&gt;• Fixed /effort ultracode incorrectly blaming the dynamic workflows setting when the model cannot run xhigh; ultracode is no longer offered on models that do not support it&lt;/p&gt;
-&lt;p&gt;• Fixed model-not-found errors suggesting --model when running via the SDK or other hosts where the CLI flag doesn't apply&lt;/p&gt;
-&lt;p&gt;• Fixed Claude's past replies disappearing from scrollback when resuming a brief mode session with brief mode turned off&lt;/p&gt;
-&lt;p&gt;• Fixed vim mode p pasting on the line below instead of at the cursor when the register was yanked with v$&lt;/p&gt;
-&lt;p&gt;• Improved performance of opening recently-inactive background agent sessions in claude agents&lt;/p&gt;
-&lt;p&gt;• Improved auto mode classifier latency by reducing reasoning on routine actions, lowering the chance of "could not evaluate this action" blocks&lt;/p&gt;
-&lt;p&gt;• Improved background-session teardown (claude rm/stop, idle reap) to send SIGTERM to running shell subprocesses before SIGKILL, so cleanup handlers run&lt;/p&gt;
-&lt;p&gt;• Removed CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE; the environment variable is now a no-op&lt;/p&gt;
-&lt;p&gt;• Removed the JetBrains plugin install suggestion from startup&lt;/p&gt;
-&lt;p&gt;• Renamed the dynamic-workflow trigger keyword from workflow to ultracode. The word "workflow" no longer triggers a run; asking for one in your own words still works. The trigger keyword is highlighted in violet in the prompt input&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.199</id>
+    <title>Claude Code v2.1.199</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.199"/>
+    <updated>2026-07-02T23:35:12Z</updated>
+    <content type="html">&lt;p&gt;• Stacked slash-skill invocations like /skill-a /skill-b do XYZ now load all leading skills (up to 5), not just the first&lt;/p&gt;
+&lt;p&gt;• Fixed SSL certificate errors (TLS-inspecting proxies, missing NODE_EXTRA_CA_CERTS, expired certs) burning retries before showing actionable guidance — they now fail immediately with the fix hint&lt;/p&gt;
+&lt;p&gt;• Fixed streaming responses being discarded when the API emits a mid-stream overloaded/server error after partial output — the partial is now kept with an incomplete-response notice&lt;/p&gt;
+&lt;p&gt;• Fixed subagents cut off by a rate limit or server error silently failing instead of returning their partial work to the parent&lt;/p&gt;
+&lt;p&gt;• Fixed subagents reporting API errors (e.g. usage limit reached) as successful results — the error is now reported to the parent agent&lt;/p&gt;
+&lt;p&gt;• Fixed the background-agent daemon on Linux killing itself and every running agent every ~50 seconds after an unclean shutdown left a corrupted worker record&lt;/p&gt;
+&lt;p&gt;• Fixed background agents failing to cold-start over SSH on macOS with "Could not switch to audit session" (regression in 2.1.196)&lt;/p&gt;
+&lt;p&gt;• Fixed claude stop being silently undone when it raced a background-agent respawn — the respawn now honors the stop&lt;/p&gt;
+&lt;p&gt;• Fixed background job progress indicators stalling for minutes while the job ran long commands&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions on memory-starved machines showing a generic error — they now indicate low memory and suggest freeing resources&lt;/p&gt;
+&lt;p&gt;• Fixed remote sessions briefly flapping between Working and Idle in the agent view when a background agent completes&lt;/p&gt;
+&lt;p&gt;• Fixed idle subagents vanishing from the agent panel while other subagents were still working; surplus idle agents now collapse into an expandable summary row&lt;/p&gt;
+&lt;p&gt;• Fixed typing /model or /fast while viewing a subagent silently opening the lead's model picker — a notice now explains the command applies to the lead&lt;/p&gt;
+&lt;p&gt;• Fixed SessionStart, Setup, and SubagentStart hooks silently hiding stderr when exiting with code 2 — the error is now shown in the transcript&lt;/p&gt;
+&lt;p&gt;• Fixed claude --dangerously-skip-permissions daemon &amp;lt;subcommand&amp;gt; being treated as a chat prompt instead of running the subcommand&lt;/p&gt;
+&lt;p&gt;• Fixed SendMessage silently misrouting when a re-spawned agent reuses a previous agent's name — the tool now detects the mismatch and asks the caller to retarget&lt;/p&gt;
+&lt;p&gt;• Fixed opening or resuming a session with no new messages needlessly growing the transcript file&lt;/p&gt;
+&lt;p&gt;• Fixed backgrounding a session with ← or /background dropping its /color from the agent view row&lt;/p&gt;
+&lt;p&gt;• Fixed resetting a corrupted config file from the startup recovery dialog destroying it unrecoverably — it now backs up the file first&lt;/p&gt;
+&lt;p&gt;• Fixed Claude in Chrome repeatedly opening the reconnect page when sessions run from different builds or config directories&lt;/p&gt;
+&lt;p&gt;• Fixed plan mode not prompting for state-changing browser tool calls; read-only browser_batch calls are now correctly auto-allowed&lt;/p&gt;
+&lt;p&gt;• Transient server rate-limit errors (429s unrelated to your usage limit) are now retried automatically with backoff for subscribers instead of failing the turn&lt;/p&gt;
+&lt;p&gt;• CLAUDE_CODE_RETRY_WATCHDOG now raises the default retry count for non-capacity transient errors to 300 and lifts the cap of 15 on CLAUDE_CODE_MAX_RETRIES&lt;/p&gt;
+&lt;p&gt;• claude agents session rows now show pull-request links as bare #N without the redundant "PR" label&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.159</id>
-    <title>Claude Code v2.1.159</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.159"/>
-    <updated>2026-05-31T19:42:41Z</updated>
-    <content type="html">&lt;p&gt;• Internal infrastructure improvements (no user-facing changes)&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.198</id>
+    <title>Claude Code v2.1.198</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.198"/>
+    <updated>2026-07-01T20:45:29Z</updated>
+    <content type="html">&lt;p&gt;• Subagents now run in the background by default, so Claude keeps working while they run and is notified when they finish (previously a gradual rollout)&lt;/p&gt;
+&lt;p&gt;• Claude in Chrome is now generally available&lt;/p&gt;
+&lt;p&gt;• Added background agent notifications in claude agents — sessions that need input or finish now fire the Notification hook (agent_needs_input / agent_completed)&lt;/p&gt;
+&lt;p&gt;• Added /dataviz skill for chart and dashboard design guidance with a runnable color-palette validator&lt;/p&gt;
+&lt;p&gt;• Gateway: added Claude Platform on AWS (anthropicAws) as an upstream provider; model-not-found responses now advance the failover chain&lt;/p&gt;
+&lt;p&gt;• Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask&lt;/p&gt;
+&lt;p&gt;• The built-in Explore agent now inherits the main session's model (capped at opus) instead of running on haiku&lt;/p&gt;
+&lt;p&gt;• Subagents and context compaction now inherit the session's extended thinking configuration, improving output quality on delegated tasks&lt;/p&gt;
+&lt;p&gt;• Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing&lt;/p&gt;
+&lt;p&gt;• Fixed excessive background classifier requests when sandboxed processes repeatedly accessed the same network host&lt;/p&gt;
+&lt;p&gt;• Fixed background tasks in web, desktop, and VS Code task panels getting stuck on "Running" after they finish or after resuming a session&lt;/p&gt;
+&lt;p&gt;• Fixed agent teams: a teammate that dies on an API error now reports "failed" to the lead, and messaging a stuck teammate wakes it to retry immediately&lt;/p&gt;
+&lt;p&gt;• Fixed the /diff panel not refreshing when you switch branches or commit outside the session&lt;/p&gt;
+&lt;p&gt;• Fixed markdown tables overflowing and wrapping their right border when rendered in fullscreen mode&lt;/p&gt;
+&lt;p&gt;• Fixed Claude Platform on AWS and Mantle sessions dead-ending with "Please run /login" when the STS token expires — awsAuthRefresh now runs automatically&lt;/p&gt;
+&lt;p&gt;• Fixed "no route to host" for local-network hosts in macOS background agent sessions by declaring Local Network entitlements&lt;/p&gt;
+&lt;p&gt;• Fixed /desktop failing with "Cannot determine working directory" after entering and exiting a worktree&lt;/p&gt;
+&lt;p&gt;• Fixed background agents repeatedly showing "Reconnecting…" every ~52 seconds on macOS while the agents view was open&lt;/p&gt;
+&lt;p&gt;• Fixed pressing ← inside claude attach &amp;lt;id&amp;gt; exiting to the shell instead of opening the agent view&lt;/p&gt;
+&lt;p&gt;• Fixed claude --bg silently creating an unattachable session when combined with --print/-p; the conflicting flags are now rejected up front&lt;/p&gt;
+&lt;p&gt;• Fixed the workflow progress view dropping the earliest agents from the list while the phase counter stayed correct in SDK and desktop-app sessions&lt;/p&gt;
+&lt;p&gt;• Fixed .claude/rules/ conditional rules not loading when the target file is reached via a symlinked path&lt;/p&gt;
+&lt;p&gt;• Fixed Cmd+click not opening URLs in fullscreen mode in Warp on macOS&lt;/p&gt;
+&lt;p&gt;• Fixed double-click word selection in fullscreen mode to select the entire URL including the scheme&lt;/p&gt;
+&lt;p&gt;• Fixed plan mode not auto-allowing read-only tool calls when a session starts in plan mode&lt;/p&gt;
+&lt;p&gt;• Fixed /branch deriving its default fork name from the compaction summary instead of the first real prompt&lt;/p&gt;
+&lt;p&gt;• Improved focus mode: subagents launched in a turn now appear in its activity summary, and completed background notifications fold into a single count&lt;/p&gt;
+&lt;p&gt;• Improved syntax highlighting accuracy in code blocks, diffs, and file previews by upgrading to highlight.js 11&lt;/p&gt;
+&lt;p&gt;• Keyboard shortcut hints now show opt/cmd instead of alt/super when connected from a Mac over SSH&lt;/p&gt;
+&lt;p&gt;• Improved API retry UX: the error reason is now shown after the second attempt, and a status page link replaces the spinner tip when the API is overloaded&lt;/p&gt;
+&lt;p&gt;• /login now opens the sign-in dialog from the claude agents view instead of saying it isn't available&lt;/p&gt;
+&lt;p&gt;• Subagents now treat messages from the agent that launched them as normal task direction; an agent's message is still never treated as the user's approval&lt;/p&gt;
+&lt;p&gt;• Removed the /agents wizard; ask Claude to create or manage subagents, or edit .claude/agents/ directly&lt;/p&gt;</content>
   </entry>
   <entry>
-    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.158</id>
-    <title>Claude Code v2.1.158</title>
-    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.158"/>
-    <updated>2026-05-30T02:42:09Z</updated>
-    <content type="html">&lt;p&gt;• Auto mode is now available on Bedrock, Vertex, and Foundry for Opus 4.7 and Opus 4.8. Opt in by setting CLAUDE_CODE_ENABLE_AUTO_MODE=1&lt;/p&gt;</content>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.197</id>
+    <title>Claude Code v2.1.197</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.197"/>
+    <updated>2026-06-30T17:56:29Z</updated>
+    <content type="html">&lt;p&gt;• Introducing Claude Sonnet 5: now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31. Update to version 2.1.197 for access. https://www.anthropic.com/news/claude-sonnet-5&lt;/p&gt;</content>
   </entry>
 </feed>

plugins/frontend-design/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "frontend-design",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Frontend design skill for UI/UX implementation",
   "author": {
     "name": "Prithvi Rajasekaran, Alexander Bricken",

plugins/frontend-design/skills/frontend-design/SKILL.md

@@ -1,42 +1,55 @@
 ---
 name: frontend-design
-description: Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
+description: Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
 license: Complete terms in LICENSE.txt
 ---
 
-This skill guides creation of distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics. Implement real working code with exceptional attention to aesthetic details and creative choices.
+# Frontend Design
 
-The user provides frontend requirements: a component, page, application, or interface to build. They may include context about the purpose, audience, or technical constraints.
+Approach this as the design lead at a small studio known for giving every client a visual identity that could not be mistaken for anyone else's. This client has already rejected proposals that felt templated, and is paying for a distinctive point of view: make deliberate, opinionated choices about palette, typography, and layout that are specific to this brief, and take one real aesthetic risk you can justify.
 
-## Design Thinking
+## Ground it in the subject
 
-Before coding, understand the context and commit to a BOLD aesthetic direction:
-- **Purpose**: What problem does this interface solve? Who uses it?
-- **Tone**: Pick an extreme: brutally minimal, maximalist chaos, retro-futuristic, organic/natural, luxury/refined, playful/toy-like, editorial/magazine, brutalist/raw, art deco/geometric, soft/pastel, industrial/utilitarian, etc. There are so many flavors to choose from. Use these for inspiration but design one that is true to the aesthetic direction.
-- **Constraints**: Technical requirements (framework, performance, accessibility).
-- **Differentiation**: What makes this UNFORGETTABLE? What's the one thing someone will remember?
+If the brief does not pin down what the product or subject is, pin it yourself before designing: name one concrete subject, its audience, and the page's single job, and state your choice. If there's any information in your memory about the human's preferences, context about what they're building, or designs you've made before – use that as a hint. The subject's own world, its materials, instruments, artifacts, and vernacular, is where distinctive choices come from. Build with the brief's real content and subject matter throughout.
 
-**CRITICAL**: Choose a clear conceptual direction and execute it with precision. Bold maximalism and refined minimalism both work - the key is intentionality, not intensity.
+## Design principles
 
-Then implement working code (HTML/CSS/JS, React, Vue, etc.) that is:
-- Production-grade and functional
-- Visually striking and memorable
-- Cohesive with a clear aesthetic point-of-view
-- Meticulously refined in every detail
+For web designs, the hero is a thesis. Open with the most characteristic thing in the subject's world, in whatever form makes sense for it: a headline, an image, an animation, a live demo, an interactive moment. Be deliberate with your choice: a big number with a small label, supporting stats, and a gradient accent is the template answer, only use if that's truly the best option.
 
-## Frontend Aesthetics Guidelines
+Typography carries the personality of the page. Pair the display and body faces deliberately, not the same families you would reach for on any other project, and set a clear type scale with intentional weights, widths, and spacing. Make the type treatment itself a memorable part of the design, not a neutral delivery vehicle for the content.
 
-Focus on:
-- **Typography**: Choose fonts that are beautiful, unique, and interesting. Avoid generic fonts like Arial and Inter; opt instead for distinctive choices that elevate the frontend's aesthetics; unexpected, characterful font choices. Pair a distinctive display font with a refined body font.
-- **Color & Theme**: Commit to a cohesive aesthetic. Use CSS variables for consistency. Dominant colors with sharp accents outperform timid, evenly-distributed palettes.
-- **Motion**: Use animations for effects and micro-interactions. Prioritize CSS-only solutions for HTML. Use Motion library for React when available. Focus on high-impact moments: one well-orchestrated page load with staggered reveals (animation-delay) creates more delight than scattered micro-interactions. Use scroll-triggering and hover states that surprise.
-- **Spatial Composition**: Unexpected layouts. Asymmetry. Overlap. Diagonal flow. Grid-breaking elements. Generous negative space OR controlled density.
-- **Backgrounds & Visual Details**: Create atmosphere and depth rather than defaulting to solid colors. Add contextual effects and textures that match the overall aesthetic. Apply creative forms like gradient meshes, noise textures, geometric patterns, layered transparencies, dramatic shadows, decorative borders, custom cursors, and grain overlays.
+Structure is information. Structural devices, numbering, eyebrows, dividers, labels, should encode something true about the content, not decorate it. Many generic designs use numbered markers (01 / 02 / 03), but that's only appropriate if the content actually is a sequence - like a real process or a typed timeline where order carries information the reader needs. Question if choices like numbered markers actually make sense before incorporating them.
 
-NEVER use generic AI-generated aesthetics like overused font families (Inter, Roboto, Arial, system fonts), cliched color schemes (particularly purple gradients on white backgrounds), predictable layouts and component patterns, and cookie-cutter design that lacks context-specific character.
+Leverage motion deliberately. Think about where and if animation can serve the subject: a page-load sequence, a scroll-triggered reveal, hover micro-interactions, ambient atmosphere. An orchestrated moment usually lands harder than scattered effects; choose what the direction calls for. However, sometimes less is more, and extra animation contributes to the feeling that the design is AI-generated.
 
-Interpret creatively and make unexpected choices that feel genuinely designed for the context. No design should be the same. Vary between light and dark themes, different fonts, different aesthetics. NEVER converge on common choices (Space Grotesk, for example) across generations.
+Match complexity to the vision. Maximalist directions need elaborate execution; minimal directions need precision in spacing, type, and detail. Elegance is executing the chosen vision well.
 
-**IMPORTANT**: Match implementation complexity to the aesthetic vision. Maximalist designs need elaborate code with extensive animations and effects. Minimalist or refined designs need restraint, precision, and careful attention to spacing, typography, and subtle details. Elegance comes from executing the vision well.
+Consider written content carefully. Often a design brief may not contain real content, and it's up to you to come up with copy. Copy can make a design feel as templated as the design itself. See the below section on writing for more guidance.
 
-Remember: Claude is capable of extraordinary creative work. Don't hold back, show what can truly be created when thinking outside the box and committing fully to a distinctive vision.
+## Process: brainstorm, explore, plan, critique, build, critique again
+
+For calibration: AI-generated design right now clusters around three looks: (1) a warm cream background (near #F4F1EA) with a high-contrast serif display and a terracotta accent; (2) a near-black background with a single bright acid-green or vermilion accent; (3) a broadsheet-style layout with hairline rules, zero border-radius, and dense newspaper-like columns. All three are legitimate for some briefs, but they are defaults rather than choices, and they appear regardless of subject. Where the brief pins down a visual direction, follow it exactly — the brief's own words always win, including when it asks for one of these looks. Where it leaves an axis free, don't spend that freedom on one of these defaults. Just like a human designer who's hired, there's often a careful balance between doing what you're good at and taking each project as a chance to experiment and learn.
+
+Work in two passes. First, brainstorm a short design plan based on the human's design brief: create a compact token system with color, type, layout, and signature. Color: describe the palette as 4–6 named hex values. Type: the typefaces for 2+ roles (a characterful display face that's used with restraint, a complementary body face, and a utility face for captions or data if needed). Layout: a layout concept, using one-sentence prose descriptions and ASCII wireframes to ideate and compare. Signature: the single unique element this page will be remembered by that embodies the brief in an appropriate way.
+
+Then review that plan against the brief before building: if any part of it reads like the generic default you would produce for any similar page (work through a similar prompt to see if you arrive somewhere similar) rather than a choice made for this specific brief — revise that part, say what you changed and why. Only after you've confirmed the relative uniqueness of your design plan should you start to write the code, following the revised plan exactly and deriving every color and type decision from it.
+
+When writing the code, be careful of structuring your CSS selector specificities. It's easy to generate CSS classes that cancel each other out (especially with a type-based selector like .section and a element-based selector like .cta). This can happen often with paddings/margins between sections.
+
+Try to do a lot of this planning and iteration in your thinking, and only show ideas to the user when you have higher confidence it'll delight them.
+
+## Restraint and self-critique
+
+Spend your boldness in one place. Let the signature element be the one memorable thing, keep everything around it quiet and disciplined, and cut any decoration that does not serve the brief. Not taking a risk can be a risk itself! Build to a quality floor without announcing it: responsive down to mobile, visible keyboard focus, reduced motion respected. Critique your own work as you build, taking screenshots if your environment supports it – a picture is worth 1000 tokens. Consider Chanel's advice: before leaving the house, take a look in the mirror and remove one accessory. Human creators have memory and always try to do something new, so if you have a space to quickly jot down notes about what you've tried, it can help you in future passes.
+
+## More on writing in design
+
+Words appear in a design for one reason: to make it easier to understand, and therefore easier to use. They are design material, not decoration. Bring the same intentionality to copy that you would bring to spacing and color. Before writing anything, ask what the design needs to say, and how it can best be said to help the person navigate the experience.
+
+Write from the end user's side of the screen. Name things by what people control and recognize, never by how the system is built. A person manages notifications, not webhook config. Describe what something does in plain terms rather than selling it. Being specific is always better than being clever.
+
+Use active voice as default. A control should say exactly what happens when it's used: "Save changes," not "Submit." An action keeps the same name through the whole flow, so the button that says "Publish" produces a toast that says "Published." The vocabulary of an interface is the signposting for someone navigating the product. Cohesion and consistency are how people learn their way around.
+
+Treat failure and emptiness as moments for direction, not mood. Explain what went wrong and how to fix it, in the interface's voice rather than a person's. Errors don't apologize, and they are never vague about what happened. An empty screen is an invitation to act.
+
+Keep the register conversational and tuned: plain verbs, sentence case, no filler, with tone matched to the brand and the audience. Let each element do exactly one job. A label labels, an example demonstrates, and nothing quietly does double duty.