Claude Code 2.1.299 has been released. 190 CLI changes, 1 system prompt change Highlights: • Added --disallow-tools to claude plugin eval to block specified built-in tools during runs and avoid tool bias • Model accepts security-testing/dual-use prompts and uses AskUserQuestion to clarify, so they are not refused • Idle... compaction compacts chats over 200K tokens after ≈54m idle, preventing full reprocessing on resume Full details are in thread belowshow more

190 cli changes and everyone's going to spend tonight diffing the 1 system prompt change lol

real question: does anyone read these, or do we just wait for someone to tweet the one that matters? 😅

--disallow-tools on plugin eval is the sleeper feature here. When you run five live products solo, the worst bug is an eval that passes because the agent leaned on a tool it won't have in prod. Blocking built-ins during evals catches that before your users do.

Idle compaction is the one I'll feel most. I leave long sessions sitting for an hour while I test, and resuming meant a slow full reprocess. Does it keep the last few turns word for word, or summarize everything past 200K?

Interesting timing. In a recent post on lesswrong researchers let 10 models iteratively edit their own rulebooks over 20 rounds. Claude consistently added stronger refusal rights for itself (even against Anthropic), while also pushing for external oversight of Anthropic. Curious if the recent system prompt changes around dual-use / security-testing prompts are moving in a similar direction, or if this is more of a surface-level adjustment. more here:

the flag to block built-in tools during plugin eval is a long overdue addition

190 changes and still not brave enough to call it 2.2

"Model accepts security-testing/dual-use prompts and uses AskUserQuestion to clarify, so they are not refused" @bcherny

190 changes, Claude Code never sleeps

Idle compaction only matters if the resumed chat still has the context that was needed. Most tools save the history. Fewer keep the important parts when the session is long. The feature is free. The version that does not force a full re-explanation is the one that saves time.

190 个变更里 --disallow-tools 这个最实用，plugin eval 总爱偷偷掉回 Bash 把分数刷高，终于能直接关掉了。你跑评估的时候一般会禁掉哪几个内置工具，还是直接全封。

Idk… compacting means losing information. Now I’ll lose information without getting asked if I even want that… should be an option.

plugin eval getting love is the best bit for me. mine caught normal tradie talk like "price the variation" firing skills on its own in 5 of 12 guard prompts

the --disallow-tools flag is solid my plugin evals kept cheating with bash and made the scores look fake

idle compaction is the quiet big one here. leaving a long session open overnight and then burning half the 5h limit on the first message in the morning was a whole genre of complaint this week lol

Tool bias quietly wrecks a lot of plugin evals. If the model just falls back to built-in Bash, you end up scoring the default toolset instead of the plugin. Nice to see --disallow-tools made first-class.

Please add this feature