Claude Report — 2026-10-06

🚀 Anthropic Official

Claude Code v2.1.289 → v2.1.291 (Oct 3–6)

Three releases land in four days. v2.1.289 (Oct 3) fixes a deny/ask rule on compound shell commands not holding over mod approvals on managed machines, plus Read deny rules not applying to IDE-selected files through a symlink. v2.1.290 (Oct 5) is the big one: adds /claude-api managed-agents-onboard <url|quickstart> for scaffolding Managed Agents patterns, fixes WebFetch silently truncating pages past 100K characters (now reports unread length and takes an offset), fixes resumed subagents losing thinking/prompt cache, fixes scheduled /loop tasks not resuming after conversation compaction, and ships 100+ other fixes across cloud sessions, VS Code, Slack's Claude Tag, and the apps gateway. v2.1.291 (Oct 6) is a same-day two-bug hotfix: cloud sessions were dropping answers to permission prompts, and a regression since v2.1.288 could lose a session's last messages on quit.

claude-agent-sdk-typescript v0.3.289 → v0.3.291 (Oct 3–6)

Tracks Claude Code parity release-for-release and adds its own fixes: v0.3.290 (Oct 5) adds an offset field to the WebFetch tool input for paging through long reads, fixes Claude-in-Chrome tool calls dropping the result's _meta, and fixes deny/ask rules missing toolAliases under wildcard patterns.

anthropics/skills — Managed Agents quickstarts (Oct 5)

Ships 9 new Managed Agents quickstart templates (deep-researcher, incident-commander, support-agent, and others) in the claude-api skill, backing the managed-agents-onboard CLI command shipped the same day in Claude Code 2.1.290.

anthropics/sandbox-runtime — Linux hardening continues (Oct 4–5)

Lands further Linux-specific fixes on top of the Oct 3–4 glob/path-handling stack reported yesterday: reads the CLI version through a static import so compiled binaries start, fixes a race where one wrap/working-directory could be claimed by two installs, ensures a command only starts once both relays are listening, and moves CI's Docker legs to Node 22.

🔌 Claude Code Plugins

Plugin install-count cache still unavailable this run — top-10-by-installs tracking is skipped per instructions. The only plugin-folder commit found in anthropics/claude-plugins-official this window is a security-guidance version bump (2.0.9 → 2.0.10, Oct 5) fixing the mod to leave nothing behind when git is killed; the Oct 2 AWS-plugin bumps were already reported yesterday.

🛠️ Skills

anthropics/skills (Oct 5)

Updates the claude-api skill with 9 new Managed Agents quickstart templates, matching the new CLI onboarding command (see above).

kharmanskyi/open-steps v0.4.8 (Oct 5)

Ships v0.4.8, following the v0.4.7 release reported yesterday.

Unchanged in window: addyosmani/agent-skills (last commit Oct 3, already reported), K-Dense-AI/scientific-agent-skills (latest release still v2.72.0 from Oct 1), cloudflare/security-audit-skill (last commit Sep 14).

🤖 Agents & Subagents

nicobailon/pi-subagents v0.76.1 (Oct 6)

Fixes a reliability issue where a subagent result waking an idle parent would drop that parent's full prompt (subagent list, MCP servers, other extensions); the parent now keeps its tools instead of losing them mid-session.

wshobson/agents (Oct 4)

Lands five merged PRs: fixes skill conversion to use local processing with safer setup examples, fixes the Codex publish step to ship only native packages with source skills, documents the marketplace across supported harnesses, refreshes plugin-setup docs, and bumps PyJWT to 2.15.1.

davila7/claude-code-templates (Oct 3–5)

Redesigns the prompt-cache-control indicator as a shrinking green/yellow/red bar following Claude Code's account-based TTL rules, removes the beta/early-access label from Mods now that they've shipped, and enhances both the api-architect and error-detective subagents.

VoltAgent/awesome-claude-code-subagents (Oct 5)

Adds an "Official MCP Servers" badge to the README, its first commit since a two-week gap.

Unchanged in window: anthropics/commerce-agents (dormant since Aug 31).

🔗 MCPs & Integrations

upstash/context7 (Oct 5–6)

Documents the reviewed-owner title/description field (CTX7-2724) and the Docs7 cookie-consent banner (CTX7-3023), fixes the CLI to accept trailing commas in OpenCode JSONC, and ships a version-packages release.

oraios/serena (Oct 5–6)

Stops the MemoryLogHandler worker on close, fixes solidlsp to keep same-named callers in referencing-symbols results, and marks the REPL and onboarding tools as edit-capable.

Unchanged in window: DeusData/codebase-memory-mcp (no new commits since the Oct 4 merges already reported), ChromeDevTools/chrome-devtools-mcp (only a Dependabot yargs bump on Oct 5), graygnatconsole/mcp-audit-tool (last commit Sep 26).

💡 Community — Workflows & Ideas

Piebald-AI/claude-code-system-prompts (Oct 3, Oct 5)

Tracks Claude Code's internal system prompts diff-by-diff for every release; logs v2.1.290's prompt as +12,809 tokens over v2.1.289 (which itself added just 2 tokens) — a concrete, sourced data point on the system-prompt growth developers have been complaining about all year.

📰 Quick Mentions

• dev.classmethod.jp — Claude Code v2.1.290–291 roundup — third-party breakdown of the WebSearch quota refill change and enhanced Bash permission checks (Oct 6).