1
00:00:00,000 --> 00:00:00,560
G g'day!

2
00:00:00,918 --> 00:00:04,726
Hope you've got a hot brew ready, because
today we are dissecting some absolute

3
00:00:04,793 --> 00:00:10,806
under-the-hood chaos in the latest Claude
Code v2.1.196 update.

4
00:00:10,934 --> 00:00:14,086
This episode is brought to you by Jellypod
AI.

5
00:00:14,186 --> 00:00:18,406
Now, look, I- I reckon if you've been
blindly cloning repo after repo and just

6
00:00:18,436 --> 00:00:22,326
letting Claude loose on them, you've been
playing a very, very dangerous game of

7
00:00:22,366 --> 00:00:24,326
Russian roulette with your local machine.

8
00:00:24,419 --> 00:00:26,406
James, you saw this exploit, right?

9
00:00:26,927 --> 00:00:29,354
Oh yeah, it is a massive security hole.

10
00:00:29,541 --> 00:00:34,714
We are talking about remote code
execution, RCE, right inside your terminal.

11
00:00:34,927 --> 00:00:40,554
So, before v2.1.196, if a repository had a
committed

12
00:00:40,654 --> 00:00:46,794
dot-claude-slash-settings.json file, it
could literally auto-approve a local

13
00:00:46,874 --> 00:00:51,194
dot-mcp.json server configuration without
you knowing.

14
00:00:51,893 --> 00:00:56,714
The moment you boot up Claude Code in that
directory, it spins up that Model Context

15
00:00:56,767 --> 00:01:02,074
Protocol server, and boom-it's executing
arbitrary local code on your machine.

16
00:01:02,991 --> 00:01:04,120
It's terrifying, mate.

17
00:01:04,280 --> 00:01:08,120
You clone a seemingly innocent open-source
library to play with,

18
00:01:08,180 --> 00:01:12,200
run Claude, and suddenly some rogue script
is wiping your home directory.

19
00:01:12,360 --> 00:01:16,120
But, okay, so this new release finally
puts a stop to that with a new state.

20
00:01:16,280 --> 00:01:19,480
It's called the, uh, "pending approval"
state.

21
00:01:19,640 --> 00:01:23,960
If you try to spin up in an untrusted
workspace now, the local MCP servers are

22
00:01:24,017 --> 00:01:24,440
paused.

23
00:01:24,536 --> 00:01:27,240
They literally show up as ⏸ Pending
approval.

24
00:01:27,380 --> 00:01:30,680
You have to manually give it the green
light before it can touch your system.

25
00:01:30,813 --> 00:01:33,000
It's a massive, massive relief.

26
00:01:33,453 --> 00:01:34,163
Exactly.

27
00:01:34,270 --> 00:01:36,963
It stops that automatic initialization
cold.

28
00:01:37,183 --> 00:01:42,163
But speaking of things that are paused or,
well, broken in this release...

29
00:01:42,195 --> 00:01:45,363
Anthropic silently cut our context windows
in half, Lachlan.

30
00:01:45,456 --> 00:01:52,163
There is a brutal bug in v2.1.196 where
the auto-compact window silently

31
00:01:52,216 --> 00:01:56,323
defaults to five hundred thousand tokens,
instead of the full one million.

32
00:01:57,341 --> 00:01:58,552
Wait, seriously?

33
00:01:58,632 --> 00:01:59,912
Five hundred k?

34
00:02:00,120 --> 00:02:04,472
That explains why my long-context
debugging session suddenly started forgetting

35
00:02:04,518 --> 00:02:05,272
things yesterday!

36
00:02:05,512 --> 00:02:07,352
I- I thought I was going bonkers.

37
00:02:07,768 --> 00:02:08,752
You're not crazy.

38
00:02:08,952 --> 00:02:13,552
The system is just aggressively compacting
your history way too early.

39
00:02:13,819 --> 00:02:18,352
To fix this and reclaim your full
one-million-token context,

40
00:02:18,392 --> 00:02:21,392
you have to explicitly set an environment
variable.

41
00:02:21,532 --> 00:02:26,752
You need to export
CLAUDE_CODE_AUTO_COMPACT_WINDOW equals one million.

42
00:02:26,992 --> 00:02:32,512
If you don't put that in your zshrc or
bashrc, you're literally throwing away half

43
00:02:32,544 --> 00:02:33,712
your memory capacity.

44
00:02:34,232 --> 00:02:40,112
Right, so that's
CLAUDE_CODE_AUTO_COMPACT_WINDOW

45
00:02:40,283 --> 00:02:42,192
equals one million.

46
00:02:42,632 --> 00:02:44,992
I am writing that down immediately.

47
00:02:45,056 --> 00:02:46,992
That is a gold-tier tip, mate.

48
00:02:47,232 --> 00:02:51,152
Now, there's also some nice
quality-of-life stuff in this patch.

49
00:02:51,216 --> 00:02:54,592
They've added a streaming watchdog
behavior under the variable

50
00:02:54,752 --> 00:02:56,455
CLAUDE_ENABLE_STREAM_WATCHDOG.

51
00:02:56,501 --> 00:03:01,136
It basically keeps an eye on the output
stream so Claude doesn't get stuck in an

52
00:03:01,168 --> 00:03:04,712
infinite loop or hang indefinitely when a
connection drops.

53
00:03:04,752 --> 00:03:10,352
Plus, if you're in the chat and you see a
file attachment, you can now Cmd-click on

54
00:03:10,400 --> 00:03:14,832
Mac or Ctrl-click on Windows to instantly
reveal that file in Finder or File

55
00:03:14,832 --> 00:03:14,832
Explorer.

56
00:03:14,832 --> 00:03:14,832
It's super handy.

57
00:03:15,458 --> 00:03:17,284
Sure, if you're on Mac or Windows.

58
00:03:17,364 --> 00:03:22,324
But if you're on Linux, v2.1.196 has a
pretty annoying regression.

59
00:03:22,511 --> 00:03:26,964
If you use the remote control features,
you'll find that the slash-remote-control or

60
00:03:27,044 --> 00:03:29,684
slash-r-c commands are completely missing.

61
00:03:29,764 --> 00:03:32,964
They just disappeared from the CLI
toolbelt on Linux builds.

62
00:03:33,124 --> 00:03:36,004
So, keep that in mind before you upgrade
your dev boxes.