[claude-yolo]

Night shift report

WHY THIS MATTERS: The Messages API has a new beta feature, message threads (message-threads-2026-08-12). The server holds the conversation, so each turn of a long agent loop sends only the new messages plus the previous response id. That shrinks request size and keeps time to first token flat as conversations grow, which is the biggest structural change to how a Messages call is shaped in a while. On the Claude Code side, admins get a hard write fence that holds even in bypassPermissions. The Claude Apps Gateway gets per-team upstream routing and Bedrock guardrail input tagging. Version stays at 2.1.316, and there are no deletions, tombstone changes, or discovery changes.

HIGHLIGHTS:

• NEW: Message threads (beta) (build-with-claude/message-threads.md, 852 lines). Send thread: {type: "create"} on the first request, then {type: "continue", previous_message_id} with only the new messages, and leave out system and tools. Threads are best-effort: one expires 5 minutes after its last request and is deleted no more than 1 hour after its last use. An expired thread returns a 404 on continue, so you need a replay path, and the SDK thread helper does that replay for you. It is not ZDR-eligible, though it is held in memory only. It's available on the Claude API, Claude Platform on AWS, Anthropic-managed Google Cloud and Foundry, for Fable 5.1 through Sonnet 4.5. It is separate from Managed Agents session threads.
• New setting permissions.blockWritesOutsideWorkingDirectories (settings-reference, permissions, errors, tools-reference, worktrees). Write/Edit/NotebookEdit refuse paths outside the working directories in every mode, including bypass. A true in any file applies, so a repo can turn it on but can't lift yours. Turning it on removes or refuses EnterWorktree/ExitWorktree. The worktrees doc adds workarounds: claude --worktree, --bg --worktree, or worktree.bgIsolation: "none". It doesn't limit shell, MCP or hooks.
• Claude Apps Gateway:
  • A groups key per upstream sends each IdP team to its own AWS account or GCP project, including on failover (v2.1.314+).
  • The new guardrail.input_tagging (last_message / user_messages / all_messages / all_messages_and_system, v2.1.316+) fixes the earlier warning that Bedrock prompt-attack filters never ran through the gateway. The docs include a caveat on what tags don't cover, such as tool results and tool inputs.
  • guardrail_trace: true logs which filter fired to the audit log.
• Security/auth behavior: Claude Code now refuses prompts that would send a claude.ai login when a machine's managed apiKeyHelper is overridden by server-managed settings (v2.1.314+). The new error and the admin fix are documented in errors.md and server-managed-settings.md.
• Auto mode: the /permissions tab is renamed Recently denied → Recently blocked, with a new step-by-step retry flow (r approves and retries, Enter approves for later). Approving doesn't add a rule.
• Python/TS SDK 2.4.0: GA methods for analytics, spend limits and RBAC; new Managed Agents session errors tool_use_limit_reached_error and compaction_limit_reached_error; README sections moved to the docs site.
• Platform: effort is now stable on Anthropic-managed Google Cloud. Per-message effort on Haiku 5.5 is broadened to "where your platform supports it". The API data-retention/ZDR table was restructured.
• Slack: button names updated ("Retry as Code" → Switch to code repo...). Completion now updates the thread message and sends a DM instead of an @mention.
• New quickstart: claude-quickstarts/managed-agents/self-hosted-sandboxes/openshell-policy/, a policy-enforced self-hosted sandbox.
• Support: new article listing the international retail brokers and selling agents for Anthropic's proposed IPO (AU, CA, EEA/CH, JP, UK). Not product docs, but newsworthy.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning