Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / claude-code

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-claude-code-the-server-side-classifier-reaches-every-direct-api-session-type-read-only-and-sandboxed

The server-side classifier reaches every direct-API session type; read-only and sandboxed commands now wait for it. The no-charge server-side check now covers direct Anthropic API sessions of every kind from 2.1.281 and telemetry-off sessions by default from 2.1.282, and the environment variable the docs described in September as not read on a direct connection now opts direct sessions in or out. Where the server reviews, read-only and sandboxed shell commands that used to run on the client’s say-so now wait for its verdict and are blocked when it flags them, and a missing verdict is a deny. The client classifier refuses a Sonnet 5.5 or Opus 5.5 pin and runs Sonnet 5 (2.1.288). One profile sentence did not hold even when written: a gateway that strips the review fields does not stall a -p run; the billing page said on 2026-09-21, and says now, that -p prints the notice to stderr and continues in auto mode on billed local checks.

Channel: tagged-release (2.1.280 to 2.1.282 on stable; 2.1.288 latest only). Half: both. Date: 2026-09-22 (2.1.280), 2026-09-23 (2.1.281), 2026-09-24 (2.1.282), 2026-10-02 (2.1.288).

Operator consequence: For CI on the direct API, Anthropic’s server is the default judge as its rollout reaches the session; telemetry-off direct sessions default to it from 2.1.282; the /status “Auto mode server” row and the stream-json system warning remain the only per-session readout, so put them in run records. A headless gateway session that falls back does not hang, it silently starts paying for local checks: alert on the stderr notice, not on a timeout. Expect more denials of read-only and sandboxed commands where the server reviews, and denials when a proxy truncates responses. The control is still labeled temporary, so get behavior from a gateway that passes safeguards and safeguard_results through rather than from the variable.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-claude-code-the-server-side-classifier-reaches-every-direct-api-session-type-read-only-and-sandboxed

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Claude Code
    tagged commit file2026-10-13-claude-code-the-server-side-classifier-reaches-every-direct-api-session-type-read-only-and-sandboxedanthropics/claude-code / CHANGELOG.md#L1474official docs2026-10-13-claude-code-the-server-side-classifier-reaches-every-direct-api-session-type-read-only-and-sandboxedcode.claude.com/docs/en/permission-modes#server-side-classifier-reviewofficial docs2026-10-13-claude-code-the-server-side-classifier-reaches-every-direct-api-session-type-read-only-and-sandboxedweb.archive.org/web/20260921092459/https://code.claude.com/docs/en/auto-mode-classifier-billing

Versioned source: run artifact