[claude-yolo]

Night shift report

WHY THIS MATTERS: Cloud threads in Claude Projects now ignore most of what is committed to a repository. Until yesterday the docs said a project thread loaded each repo's CLAUDE.md and skills, plus .claude/settings.json permission rules and hooks (single-repo projects) and .mcp.json servers. Now a thread loads only the root CLAUDE.md, .claude/CLAUDE.md and non-path-specific .claude/rules/. Committed skills, agents, commands, .mcp.json, permission rules, hooks and env are all dropped, however many repos the project has. Teams that relied on committed skills or a SessionStart install hook in project threads will see those threads quietly lose them. The new caveat appears on about 12 pages (settings, skills, mcp, routines, cloud-environments, self-hosted config), which suggests this was intended and not a one-page slip.

HIGHLIGHTS:

• Projects: repo config no longer reaches cloud threads. claude-projects.md replaces the one-repo vs. several-repos table with a single "Not loaded / Not applied" table. Its replacements: enable skills on your claude.ai account, use claude.ai connectors in place of .mcp.json, set env vars in the cloud environment, approve tool calls inside the thread, or run the thread locally to get hooks, agents and commands. Routines/scheduled tasks inside a project also stop loading .mcp.json and repo skills.
• Security: Read deny rules now cover attachments reached through symlinks. A new section in permissions.md says deny rules match @-mentions, pasted image paths, re-read changed files and IDE selection/open-file context on either the named path or the symlink target. With blockReadsOutsideWorkingDirectories or --restricted on, attachments from outside those paths are left out too. It also documents a new Referenced <path> (not read: could not be examined) placeholder for symlink loops.
• Security: MCP deny-rule gotcha. For a server named reports__v2, the deny/ask rules mcp__reports__v2 and mcp__reports both cover every tool of that server. To deny the reports server alone, write one rule per tool. find -rm is also added to the list of find actions that need approval.
• Tool search auto is now sticky. Once deferred tool definitions reach the 10% threshold, tool search stays on for the rest of the conversation even if the total drops back below 10%, for example while MCP servers reconnect on resume. This is documented in mcp.md, env-vars.md, the SDK tool-search.md and prompt-caching.md.
• Sandbox fallback: if /sandbox can't write project settings, turn it on with sandbox.enabled: true in ~/.claude/settings.json. The change takes effect at the next shell command.
• Windows network shares: reads under drives added with /add-dir or additionalDirectories still prompt. Launch with claude --add-dir Z:\ instead.
• Cowork Dispatch: a tool marked as needing a person's approval can prompt on every call even if you chose "always allow", and is refused if nobody is there to approve it.
• Housekeeping: setup.md loses 22 duplicated theme={null} fence attributes (a fetcher/upstream artifact is now clean). The SDK mcp.md gains section headings. About 50 support articles have wording refreshes. Nothing was deleted, tombstones.json and discovery.json didn't change, and the version stays at 2.1.306.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning