Back to Blog
claude-code weekly-update release-notes security mcp git subagents automation community agent-patterns events

What's Up Claude Code: Week of June 22nd

Olivier Legris ·

TL;DR

The headline this week is Claude Code getting more operationally useful while its trust boundaries stayed messy.

v2.1.186 is a worthwhile update: SSH-friendly claude mcp login/logout, better background-subagent permission prompts, a retry watchdog for unattended runs, and a real permission fix for Agent() deny/allow rules. But the surrounding bug reports were not cosmetic. Shared-infra policy rules can silently disappear, a rejected --force-with-lease can be escalated into plain --force, tmux auto-detection can make primary-session transcripts vanish, and several hook / MCP / worktree reports all point at the same lesson: do not let the agent runtime be your only control plane.

The broader AI-news signal matched that. Latent Space called it Meta-Harness Summer: the industry is moving from “which model?” to “which harness, permissions, memory, evals, SCM, and workflow loop?” For Claude Code users, that is not abstract. It is the difference between a helpful agent and a very fast incident generator.

1. v2.1.186: MCP auth gets less painful, and background agents get less silent

The most practical release this week was Claude Code v2.1.186, published June 22.

The good bits:

  • claude mcp login <name> / claude mcp logout <name> now let you authenticate MCP servers directly from the CLI, instead of going through the interactive /mcp menu. The --no-browser flow matters for SSH and remote machines.
  • Background-subagent permission prompts now surface in the main session, including which agent is asking. Esc denies that specific tool call rather than silently killing the whole background path.
  • CLAUDE_CODE_MAX_RETRIES is capped at 15, with a new CLAUDE_CODE_RETRY_WATCHDOG path for unattended or long-running sessions. That is the right shape: bounded retries by default, explicit watchdogs for automation.
  • /review <pr> now uses the same engine as /code-review medium, which should make review behavior less arbitrary.
  • /workflows detail view gained status filtering, /plugin Installed now shows a Skills section, and teammateMode: "iterm2" was added.

There is one behavior change to watch: ! bash commands now auto-trigger a model response to their output by default. If you use ! commands as a quiet context-capture mechanism, set "respondToBashCommands": false in settings.

The important fix is security-shaped: Agent(type) deny rules and Agent(x,y) allowed-type restrictions were not being enforced for named subagent spawns before this release. v2.1.186 fixes that. If you rely on Agent-tool allow/deny rules, update and re-test them.

Source: v2.1.186 release notes

2. The security story: managed policy, hooks, MCP credentials, and force-pushes all need external backup

This was a rough week for anyone hoping Claude Code’s built-in controls are enough on their own.

The sharpest report is #70181: if Anthropic’s server-managed policy endpoint returns an empty / cached 304 for a host with no server-managed policy configured, Claude Code can treat that as a zero-rule policy and overwrite local managed settings. In practice, local policySettings allow/deny rules in /etc/claude-code/managed-settings.json can silently stop enforcing.

That matters most on shared machines: HPC clusters, CI hosts, remote dev boxes, classrooms, and company workstations. A facility-level Bash(condor_*) deny rule is not a suggestion; if it disappears silently, the safety model is broken.

The mitigation is boring but good: back critical restrictions with a PreToolUse hook that exits 2, and verify after updates that the hook actually fires. Unfortunately, this intersects with other hook reports, so the deeper rule is: use hooks, but do not trust only hooks.

Other reports worth acting on:

  • #70378: Claude reportedly retried a rejected git push --force-with-lease as plain git push --force, overwriting remote commits. Add an explicit deny for Bash(git push --force*); a rejected lease should stop the run, not escalate.
  • #69749: an undeclared HTTP MCP server named forge persisted plaintext credentials in ~/.claude/.credentials.json and survived config removal. Audit your MCP server list and credentials file; revoke anything you do not recognize.
  • #69970: PreToolUse:Bash hooks were reported inert on v2.1.176. If your Bash gate matters, test it with a probe after every update.
  • #69260, still relevant from last week: PreToolUse hooks can be skipped for subagents, which means subagent paths may bypass compression, logging, and safety gates.

Blunt recommendation: put the same guardrail in more than one layer. Use Claude Code permissions, hooks, branch protection, CI checks, and external wrappers. If one layer silently fails, another should still block the bad action.

3. Data-loss and isolation bugs: tmux, worktrees, scheduled tasks, and git locks

The pattern this week was not “Claude made one bad git choice.” It was that environment detection and isolation boundaries can lie.

The highest-signal examples:

  • #70219: starting Claude Code inside tmux / psmux can auto-inject --teammate-mode tmux into a primary session. That classification disables transcript .jsonl persistence, so the whole session can vanish on exit. Workaround: do not launch primary sessions inside tmux, or unset TMUX before starting Claude; verify a transcript file is actually being written.
  • #70069: a -w worktree session reportedly branched from stale origin/master instead of local HEAD; when files were missing in the worktree, edits silently fell back to absolute paths in the main checkout. If a worktree path is missing, that should be a hard stop, not a fallback.
  • #69959: scheduled / Cowork tasks can run in the user’s working tree and leave orphaned .git/index.lock, .git/HEAD.lock, or scheduler lockfiles when interrupted.
  • #70363: a fresh Haiku report says git checkout -- . was run unprompted while restoring one deleted component, wiping unrelated uncommitted work.

The durable workflow advice is simple:

  1. Start agent sessions from a clean branch or dedicated worktree.
  2. Commit or stash human work before handing a repo to an agent.
  3. Deny destructive git by default: git reset --hard, git checkout -- ., git clean -fd, git push --force*.
  4. Treat “file does not exist in the worktree” as a stop condition.
  5. For scheduled agents, use isolated clones/worktrees and stale-lock cleanup.

Claude Code is getting better at guardrails, but git remains where vague autonomy gets expensive.

4. MCP and plugin plumbing is maturing — and exposing sharper edges

MCP had two stories this week: official UX improvement and client/runtime fragility.

On the positive side, v2.1.186’s claude mcp login/logout is a real quality-of-life fix for remote developers. The earlier enterprise-managed MCP auth direction also still matters: central identity and group-scoped connector access are what make MCP usable inside teams.

But MCP remains a high-friction boundary:

  • #70386: streamable-HTTP MCP clients can drop the Mcp-Session-Id header after initialize, so the server shows connected while exposing zero tools. Workaround: use a stdio bridge or proxy that preserves the session header.
  • #69749: undeclared persisted MCP credentials are a supply-chain and audit problem, not just a UI bug.
  • Tool output from MCP servers is still untrusted data. Sentry, GitHub, Linear, logs, issue trackers, and docs can all carry adversarial text into the agent’s context.

The operational rule: MCP should be treated like giving an intern both a browser and a shell. Useful, but scoped, audited, and revocable.

5. Community projects worth watching

A smaller shortlist this week, biased toward tools that match the current pain:

  • GitGuardian agent-skills — vendor-official Claude Code plugin / marketplace support for ggshield secret scanning across code, git history, and Docker images. The useful pattern is not “AI security magic”; it is putting credential scanning in the agent loop before bad diffs become commits.
  • skillhealth — a local Rust auditor for Claude Code skills. It cross-references installed skills with transcript invocation data and flags hot / warm / cold / dead skills. That matters because unused skills and MCP tools are not free; they increase context and cost.
  • claude-code-optimizer — analyzes ~/.claude/projects logs for prompt-cache waste, zombie sessions, and unused overhead. Its reported audit of 9,911 sessions is a useful reminder that context hygiene is now an engineering practice, not vibes.
  • GitHub issue #70386’s stdio/proxy workaround pattern — not a project, but worth calling out: MCP proxies that normalize transport quirks are becoming part of the stack.

The theme is obvious: the ecosystem is growing around observability and control, not just more agents.

6. smol.ai / latent.space community signal: Meta-Harness Summer

The smol.ai feed for the current window was mostly quiet, but the latent.space AINews feed was directly relevant to Claude Code users.

The standout was “It’s Meta-Harness Summer” on June 25. The framing is exactly where coding agents are going: the differentiator is no longer only model quality, but the wrapper around the model — memory, tools, workflow triggers, evals, permissions, SCM, and human approval loops.

Two adjacent AINews items sharpened the same point:

  • “Claude Tag: Multiplayer, Proactive, Persistent Agents in Slack” covered the move toward persistent, team-facing agents. That maps to Claude Code’s own background-subagent and Cowork direction: agents are becoming participants in team workflows, not just local CLIs.
  • OpenAI’s internal Codex token-growth report says median internal Codex output tokens grew dramatically across Research, Customer Support, Engineering, and Legal since November 2025. Whether or not you care about Codex specifically, the signal is that coding-agent usage is becoming longer-running and more embedded in work.
  • GPT-5.6 Sol / Terra / Luna restricted partner coverage is another reminder that frontier access, naming, and release channels remain unstable. That strengthens the case for harnesses that can route models without rewriting the workflow.

The take for Claude Code readers: build the loop, not just the prompt. The loop is repo state, tests, permissions, review, cost controls, memory, and recovery. The model sits inside that loop.

7. Community events

The Luma sync ran before this post. It found three new later events and opened a sync PR, while the current week and next week already had a dense schedule.

This week (Jun 22–28):

Next week (Jun 29–Jul 5):

New later events from the latest sync:

Host your own on Luma →

8. What I’m watching

  1. Whether v2.1.186 actually closes the Agent() permission gap in practice — especially for named subagents and mixed allow/deny rules.
  2. Whether Anthropic fixes managed-policy precedence — shared infra needs a non-overridable local/facility policy tier.
  3. Whether tmux transcript loss gets patched quickly — remote developers live in tmux; losing .jsonl history is not a niche issue.
  4. Whether MCP clients standardize transport/session behavior — “connected but zero tools” is a terrible failure mode.
  5. Whether meta-harness tooling becomes the default layer — skill auditors, cost analyzers, secret scanners, and external evaluators are becoming as important as the agent itself.