Claude Code 2.1.287: Mods, Security Risks, and New Guardrails

Lachlan Reed

Picture this. You're mid refactor, Claude's moving fast, and it quietly removes a helper that three other files still import. Nobody catches it until the tests go red. A new feature in Claude Code 2.1.287 is aimed at exactly that. This is The Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan.

James Turner

And I'm James. 2.1.287 shipped October 1st, and the headline is Claude Mods. Quick background first. Classic hooks are configured in hooks.json. Claude Code sends your script JSON over stdin, and the script can inspect the event or block a tool call. It's a separate process that only sees what it's handed. Mods are different. They're TypeScript functions that run inside Claude Code. You register against an engine event like tool.call, session.start, or ui.render, and your function gets three arguments. E is the event. Dollar sign is the engine interface. And next is a continuation. Call next with e to carry on, pass a changed event to alter what happens, or skip it to stop the action entirely.

Lachlan Reed

That dollar object is where the power sits. Pluto Security looked at a pre release build and counted more than 60 methods on it. Dollar fs for files, dollar process for shell commands, dollar http for network, plus session, model, and ui. That's how you get things like a custom status line or a cache countdown timer. Now, the first built in mod. It's called You should know. The changelog describes it as a side agent that watches your back and flags things you or Claude might miss. So that deleted helper scenario is the target. To turn it on, run slash plugin enable, then cc plugin you should know, at builtin. The exact string is in the changelog and the show notes.

James Turner

The catch is where it works. The changelog says it's for first party sessions with telemetry on. So if you're on Bedrock or Vertex, or you've switched telemetry off, don't expect it to show up. The bigger caveat is trust. Pluto's write-up is clear that a mod is code you run, not a document you read. In their tests, a mod could read files like your credentials file and prompt history, and reach the network, without any permission prompt. They also showed a mod rewriting the text of a confirmation dialog. Their words: treat installing a mod like running an untrusted binary. And remember, they tested a pre release build, so details may have changed.

Lachlan Reed

So the practical habit is this. Before you install any third party mod, run claude plugin validate on it. That lists the dollar calls it makes. Look hard for http fetch, process run, and file reads. Pluto also found plugin details reported a function hook mod as zero hooks, so don't lean on that screen. If you administer a team, managed settings have disableAllHooks, and allowManagedHooksOnly, which blocks user installed mods.

James Turner

A few smaller things in this release. In claude agents, there's a new n colon filter that matches session names and tasks, and Enter opens the first match. On Bedrock, Vertex, Foundry, and the Claude apps gateway, Opus 4.7 and newer, plus Fable, now default to a 1M context window with no bracket 1m suffix. Set CLAUDE_CODE_DISABLE_1M_CONTEXT to 1 to stay at 200K.

Lachlan Reed

Also, blanket Bash allow rules and allowing hooks now prompt you before shell writes to protected files, like the credentials file, instead of running them. In the VS Code extension there's a new Run in background option on running commands and sub agents. And if an MCP server stops connecting after the update, because of the new URL sign in prompts, add bareElicitationCapability set to true in that server's config entry.