Claude Code 2.1.293-294: hooks that didn't always block what they promised

Claude Code's 2.1.293, released October 7, 2026, and 2.1.294, released the next day, make an odd pair. The first has several dozen entries, mostly one-off fixes to specific surfaces: Remote Control, vim mode, mods, Claude Tag in Slack. The second has exactly two lines, and both are about the same thing: natural-language hooks, which judge a situation instead of running a deterministic check. One could let through exactly what it was supposed to block, the other made Claude stop too early. Alongside that, a bug in how claude agents carries bypass permissions into background sessions closes another permissions gap, and Claude Haiku 5.5 lands as the new default Haiku model.

Hooks that judge, and judged wrong

A regular Claude Code hook runs a shell command and reads a clean, binary exit code back. But the hooks documentation is explicit: "Claude Code supports prompt-based hooks (type: "prompt") that use an LLM to evaluate whether to allow or block an action, and agent hooks (type: "agent") that spawn an agentic verifier with tool access." In other words, a hook that says "block commands that touch production" isn't running a deterministic filter at all: it sends the situation to a model, which answers with JSON like {"ok": true/false, "reason": "..."}, and Claude Code acts on whatever comes back. That's useful for rules too fuzzy for a shell if, but it means the block's reliability rests on that model call's judgment, not on a test that comes out the same way every time.

2.1.294 fixes exactly the case where that judgment went wrong: a prompt or agent hook written as an instruction, the changelog's own example is "Block commands that...", could let through the action it was supposed to block. The same release also covers prompt hooks on Stop and SubagentStop: a hook written as "Carry on if the build is broken" judges, turn by turn, whether Claude should keep going or stop, and 2.1.294 improves the judgment so Claude is less likely to stop too early. Agent hooks are still labeled experimental either way, the docs don't soften it: "Agent hooks are experimental. Behavior and configuration may change in future releases. For production workflows, prefer command hooks." And when a block genuinely has to hold, the permissions docs are clear that deny rules have the final say, not a hook: "PreToolUse hook decisions don't bypass permission rules. Claude Code evaluates deny and ask rules regardless of what a PreToolUse hook returns." A natural-language hook is a useful editorial backstop, not a wall.

Bypass permissions dropped silently for sessions launched from claude agents

claude agents --dangerously-skip-permissions lets you dispatch several background sessions straight into bypassPermissions mode (--allow-dangerously-skip-permissions only makes it available in their Shift+Tab cycle), a mode that skips confirmation prompts except for the actions no mode auto-approves. Before granting it, Claude Code requires an explicit, one-time acceptance: as the agent view docs put it, "Claude Code refuses claude --bg --permission-mode bypassPermissions until you've accepted the bypass disclaimer by running claude --dangerously-skip-permissions once interactively, since that mode lets a session you aren't watching act without approval."

2.1.293 fixes a case where that check misfired: when your acceptance was recorded only in .claude/settings.local.json or a file passed with --settings, background sessions ignored it. claude agents offered you the bypass, but the session that actually started didn't necessarily get it, with nothing telling you so. That lines up with a rule already documented for defaultMode: a value set in project or local settings isn't enough to elevate a session's rights, only managed settings, a --settings file, or ~/.claude/settings.json count for auto and bypassPermissions. As of 2.1.293, Claude Code asks for consent upfront before launching the session, and if a session still ends up without bypass, a short notice stays on screen to say so, instead of letting you assume the mode applied.

Claude Haiku 5.5 becomes the default Haiku model

2.1.293 adds Claude Haiku 5.5 (claude-haiku-5-5), now the default Haiku model on the Anthropic API. It has the 1M-token context window shared across the current lineup, and its pricing stays in the "fast and cheap" territory the Haiku line is built for: the changelog puts it at $0.10 / $0.50 per million input / output tokens, and $0.50 / $2.50 for prompts over 100K tokens. The models page positions it for high-volume, latency-sensitive work like classification, extraction, and routing.

Everything else

• Context compaction: Claude sometimes treated its own last actions before a compaction as done after it, and retracted or redid finished work unnecessarily. Fixed in 2.1.293.
• MCP memory leak: an HTTP MCP connection kept every request it had sent in memory until the connection closed.
• ← and a pending message: moving a session to the background with ← could lose a message you sent while Claude was working; if a queued message can't move, ← now stays put and tells you instead.
• Project rules silently skipped: path-scoped rules and nested CLAUDE.md files didn't load when Claude viewed a single file with cat, head, tail, sed -n, or grep in the Bash tool instead of the Read tool. If your project rules ever seemed to get ignored for no reason, this is a plausible explanation.
• Surprise sign-outs: claude logs, stop, kill, rm, as well as claude daemon status, stop, uninstall, could sign you out when your login had expired or was about to.
• Windows, wrong process killed: stopping a status line, a hook, or a shell command could terminate an unrelated process that had since been handed the same process ID.
• Two reverts: 2.1.293 reverts the auto mode denial message change introduced in 2.1.281, and also reverts the 2.1.290 fix that kept a cloud session from staying asleep after a container restart lost a pending /loop wakeup or scheduled task. That specific bug is back in effect: Claude is no longer told, and the session stays asleep. If you run long-lived cloud sessions, it's worth remembering.
• Artifacts: libraries loaded into an artifact are now pinned to exact versions at least two weeks old.
• Claude in Chrome: fewer page actions get refused when the browser is slow to report its tabs.

What to take from this

If you rely on prompt or agent hooks to enforce a rule that absolutely has to hold, these two releases are a reminder of a real limit: these hooks judge, they don't run a filter, and judgment calls sometimes go wrong. For a hard block, a deny rule is still the only mechanism no hook can get around. If you dispatch background sessions with claude agents --dangerously-skip-permissions, watch for the notice that now flags a session running without bypass, especially if your acceptance of the mode lives in a local settings file. And if you run long cloud sessions with scheduled tasks, know that a container restart can once again leave them asleep with no wake-up: a bug 2.1.290 had fixed and that 2.1.293 brought back by reverting that fix. Otherwise, Claude Haiku 5.5 becomes the default Haiku model, at the Haiku line's usual entry-level price.