tigers1997 · tigers1997 · May 23, 2026 · May 23, 2026
@@ -4,46 +4,20 @@ All notable changes to this project. Format: [Keep a Changelog](https://keepacha
 
 ## Unreleased
 
-### feat(defaults): promote skillOverrides + autoMode.hard_deny to active defaults
+## [2.6.0] — 2026-05-23
 
-Follow-up to the #5706 unblock batch: two of the eight opt-ins shipped as stubs in that PR are now active defaults, based on a per-key review against the configurator's existing safety/efficiency goals. The other six stay stubbed for genuine reasons (user-workflow choice, infrastructure-dependent, or would break the shipped scripts).
+Bundle release: the SchemaStore PR #5706 unblock batch — PR #56 shipped eight schema-validated CC 2.1.143 settings keys + bumped `tested_up_to` 2.1.132 → 2.1.150 (closing tracking issue #53 after a multi-month, three-resurvey watch on the upstream gating PR), and PR #57 followed up by promoting two of those opt-ins to active defaults after a per-key review against the configurator's safety/efficiency goals. Latent strip-bug fix in #56 also unblocked the existing PRs #17/#18 opt-ins (`// prUrlTemplate`, `// sandbox.network.deniedDomains`) — they now actually surface in users' generated `.claude/settings.json` for the first time. `CC_VERSION` bumped to 2.6.0.
 
-**Promoted to active:**
+### v2.6.0 — CC 2.1.150 schema-validated keys batch + active-default promotions
 
-- **`skillOverrides: "name-only"`** is now active in `templates/token-efficiency/settings-patch.tier-pro.json` (renders only when `token-efficiency.tier=pro`). The pro tier already signals "user wants aggressive context efficiency" — this extends that contract by collapsing skill descriptions (the largest single contributor to per-turn context overhead, exactly the metric `/check-context` flags). Model still sees skill names and can invoke them; only the descriptions are trimmed. `basic` tier is unaffected. Personas: `solo-experienced` + `small-team` get it (both use pro); `solo-newer` + `library-author` + `custom` do not. Override to `"off"` / `"user-invocable-only"` / unset by editing the patch if `"name-only"` is too aggressive for your skill set.
-- **`autoMode.hard_deny: ["Running executable files", "Writing to system directories"]`** is now active in `templates/safety/settings-patch.json`. Pure upside: zero behavior change for standard manual sessions (the auto-mode classifier doesn't fire without `--auto-mode`), meaningful safety backstop for users who do run with `--auto-mode`. Consistent with the configurator's existing safety-first posture (`disableBypassPermissionsMode: disable`, PreToolUse Bash blocking, scan-secrets, slop-scan). Renders for all non-custom personas (every non-custom persona includes the `safety` module). Tune or remove entries by editing the patch if the example categories don't match your project's threat model.
+**The pattern:** the configurator wraps every Claude Code primitive it depends on behind a JSON-schema-validation gate — when a CC settings key isn't yet in `claude-code-settings.json` (community-maintained in SchemaStore/schemastore, Anthropic-CODEOWNED), shipping a template that uses it risks Claude Code silently dropping adjacent sections at parse time. v2.6.0 lands the long-tail unblock batch for SchemaStore PR #5706 (merged 2026-05-23, syncing to CC v2.1.143) — eleven configurator-territory keys + five env vars that had been held in `docs/07-backlog.md` through three CHANGELOG resurveys (2026-05-06, 2026-05-11, 2026-05-21) plus a fourth resurvey of 2.1.147–2.1.150 to capture anything new.
 
-**Stubbed opt-ins kept as stubs** (with rationale):
+- **feat(compat): ship 8 schema-validated opt-ins + fix latent // strip; bump tested_up_to 2.1.132 → 2.1.150 (PR #56).** The full unblock batch closes tracking issue [#53](https://github.com/tigers1997/ClaudeCodeConfigurator/issues/53). Eight new opt-ins land across `safety`, `multi-agent` (which previously shipped no settings — gained its first `settingsPatch` reference + a new `templates/multi-agent/settings-patch.json`), `ui` (via `extraSettings` since it predates `settingsPatch`), and `token-efficiency` (in the existing tier-pro patch). All shipped as commented `// keyname` stubs matching the PRs #17 (`prUrlTemplate`) / #18 (`sandbox.network.deniedDomains`) precedent — users uncomment to activate. Settings keys: `skillOverrides` (CC 2.1.129+, token-efficiency-pro), `worktree.baseRef` + `worktree.bgIsolation` (CC 2.1.133+ / 2.1.143+, multi-agent), `autoMode.hard_deny` (CC 2.1.136+, safety), `sandbox.failIfUnavailable` (CC 2.1.143+, nested inside the existing `// sandbox` block in safety), `subagentStatusLine` + `statusLine.hideVimModeIndicator` (CC 2.1.143+, ui), and `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` (CC 2.1.143+, safety env). Hook `args: string[]` exec form + `continueOnBlock: boolean` (CC 2.1.139+) shipped as doc notes in `safety` + `git-workflow` patches — no active hooks use them; forward-looking enablement for user-authored hooks. Four other env vars (`ANTHROPIC_WORKSPACE_ID`, `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE`, `CLAUDE_CODE_PLUGIN_PREFER_HTTPS`, `CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY`) are platform-/workspace-specific and captured only in the `CLAUDE_CODE_COMPAT` rationale comment. Still held for a future schemastore sync: hook output `terminalSequence` (CC 2.1.147) and Stop/SubagentStop hook input `background_tasks` + `session_crons` (CC 2.1.149) — both verified absent from #5706's head-branch schema. **Latent bug fix:** `configure.py:463` had been stripping ALL top-level `//`-prefixed keys when merging `settingsPatch` files, including the opt-in stubs PRs #17 and #18 promised would surface in `.claude/settings.json`. New `_is_doc_label(k)` helper distinguishes label keys (`//`, `//N`) from stub keys (`// foo`). Existing `// sandbox` + `// prUrlTemplate` now appear in scaffolded outputs for the first time — users on `cc-configure --retrofit` will see them. Two source patches also corrected (`safety/settings-patch.slop-scan.json`, `commands/microbit-enforcer/settings-patch.json`) — their top-level descriptive `// filename.json` keys would have leaked into user settings under the new filter; rewritten as plain `"//"` labels.
+- **feat(defaults): promote skillOverrides + autoMode.hard_deny to active defaults (PR #57).** Per-key review of the eight new opt-ins from #56 against the configurator's existing safety/efficiency goals: six stay stubbed for genuine reasons (user-workflow choice, infrastructure-dependent, or would break shipped scripts), two get promoted. `skillOverrides: "name-only"` is now active in `templates/token-efficiency/settings-patch.tier-pro.json` (renders only when `tier=pro`) — extends the pro tier's existing aggressive-efficiency contract by collapsing skill descriptions (the largest per-turn context overhead, exactly the metric `/check-context` flags). Model still sees skill names; only descriptions are trimmed. `autoMode.hard_deny: ["Running executable files", "Writing to system directories"]` is now active in `templates/safety/settings-patch.json` — pure upside since the auto-mode classifier doesn't fire without `--auto-mode` (no-op for manual sessions, meaningful safety backstop for auto-mode users), consistent with the configurator's existing safety posture (`disableBypassPermissionsMode: disable`, scan-secrets, slop-scan). Retrofit impact: existing users get a top-level `autoMode` block (all non-custom personas) and pro-tier users (`solo-experienced` + `small-team`) get a top-level `skillOverrides: "name-only"`. Both are no-ops in common workflows. Six stubs retained with rationale captured inline in the patch comments — promotable in future PRs as the underlying constraints lift (`statusline.sh` learning `--subagent` or vim mode; a `safety.sandbox_strict` flag for `failIfUnavailable`; etc.).
 
-- `worktree.baseRef` (multi-agent) — `"fresh"` vs `"head"` is a genuine workflow preference, no persona signal distinguishes
-- `worktree.bgIsolation` (multi-agent) — stub value matches CC's default, so writing active is a no-op; stub provides discoverability of the lever (and future-proofs if CC flips its default again like it did with `baseRef` between 2.1.128/2.1.133)
-- `sandbox.failIfUnavailable` (safety) — fail-closed aligns with safety goals but breaks users on platforms where `bwrap`/`socat` aren't easily installable (esp. macOS); proper fix is a future `safety.sandbox_strict` flag
-- `subagentStatusLine` (ui) — shipped `statusline.sh` doesn't handle the `--subagent` flag; promotable once the script learns it
-- `statusLine.hideVimModeIndicator` (ui) — shipped `statusline.sh` doesn't render vim mode; active default would just remove vim display entirely for vim users (strict downgrade); promotable once the script learns vim mode
-- `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` (safety) — no shipped Stop hook actually blocks repeatedly, so raising the cap adds noise without benefit by default; only useful for user-authored strict-blocking hooks
+---
 
-**For existing users on `cc-configure --retrofit`:** the merged `.claude/settings.json` will gain a top-level `autoMode` block (all non-custom personas) and, for pro-tier users (`solo-experienced` and `small-team`), a top-level `skillOverrides: "name-only"`. Both are no-ops in common workflows: `autoMode.hard_deny` only fires under `--auto-mode`, and `skillOverrides: "name-only"` preserves all `/`-menu access while trimming descriptions the user typically doesn't read. Test plan covers per-persona rendering. No `tested_up_to` bump (stays 2.1.150 from the prior PR).
-
-### chore(compat): bump tested_up_to to 2.1.150 + ship eight schema-validated opt-ins after SchemaStore PR #5706 merge
-
-[SchemaStore PR #5706](https://github.com/SchemaStore/schemastore/pull/5706) merged 2026-05-23, syncing `claude-code-settings.json` to Claude Code v2.1.143 and unblocking nine settings keys (+ five env vars) that had been held in the configurator's backlog through three prior CHANGELOG resurveys. This PR ships all of them as commented-out opt-ins so users can uncomment to activate, matching the established pattern from PRs #17 (`prUrlTemplate`) and #18 (`sandbox.network.deniedDomains`). Bumps `tested_up_to` 2.1.132 → 2.1.150 (covers the 18 CC releases since the last bump, including the 2.1.147–2.1.150 resurvey that found only one new configurator-adjacent key — `allowAllClaudeAiMcps`, 2.1.149 — Enterprise managed setting, outside configurator territory). Closes tracking issue #53.
-
-**Latent bug fix:** discovered while wiring the new opt-ins that `configure.py`'s `settingsPatch` merger was stripping ALL top-level `//`-prefixed keys, including the opt-in stubs (`// sandbox`, `// prUrlTemplate`) that PRs #17 and #18 promised would surface in users' generated `.claude/settings.json`. The filter intended to drop documentation labels (`//`, `//2`, `//9`) but was too aggressive. New `_is_doc_label(k)` helper distinguishes label keys (pure-digit suffix or empty) from stub keys (`// foo`). The existing `// sandbox` + `// prUrlTemplate` opt-ins now actually appear in scaffolded settings.json for the first time — users who `cc-configure --retrofit` will see them on the next run. No persona snapshot drift (snapshots compare file trees, not contents); all 50+ shell fixtures still pass. Two source patch files also corrected (`safety/settings-patch.slop-scan.json`, `commands/microbit-enforcer/settings-patch.json`) — their top-level `"// settings-patch.slop-scan.json": "..."` / `"// microbit-enforcer.json": "..."` keys were maintainer-facing docs that would otherwise leak into user settings under the new filter; rewritten as plain `"//"` labels.
-
-**Settings keys shipped as opt-ins:**
-
-- **`skillOverrides`** (CC 2.1.129+) → `templates/token-efficiency/settings-patch.tier-pro.json`, behind the existing `tier=pro` flag. Default value in the commented stub is `"name-only"` (most conservative). Values: `off` (hides from model AND `/`-menu), `user-invocable-only` (hides from model only), `name-only` (collapses description to just the skill name). Directly reduces the context metric `/check-context` flags.
-- **`worktree.baseRef` + `worktree.bgIsolation`** (CC 2.1.133+ / 2.1.143+) → new `templates/multi-agent/settings-patch.json` (added `settingsPatch` reference to `multi-agent` module — module previously shipped no settings). Pair naturally with `/merge-worktrees`. `baseRef=head` preserves unpushed local commits in new worktrees; `bgIsolation=none` lets background sessions edit the live working copy directly when a worktree is impractical.
-- **`autoMode.hard_deny`** (CC 2.1.136+) → `templates/safety/settings-patch.json`. Auto-mode classifier rules that block unconditionally regardless of user intent or allow exceptions. Example values seeded: `"Running executable files"`, `"Writing to system directories"`. Only meaningful under `claude --auto-mode`.
-- **`sandbox.failIfUnavailable`** (CC 2.1.143+) → nested inside the existing `// sandbox` block in `templates/safety/settings-patch.json`. Set to `true` for fail-closed sandbox posture (hard failure when required deps missing, instead of falling back to non-sandboxed execution).
-- **`subagentStatusLine` + `statusLine.hideVimModeIndicator`** (CC 2.1.143+) → `extraSettings` in `ui` module (`config_schema.py`). `subagentStatusLine` lets subagent runs render a distinct status line for visual separation from the parent session; `hideVimModeIndicator` suppresses CC's built-in vim mode display when the user's statusline script renders its own.
-- **Hook `args: string[]` exec form + `continueOnBlock: boolean`** (CC 2.1.139+) → doc comment in `templates/safety/settings-patch.json` and `templates/git-workflow/settings-patch.json` annotating that the new syntax is now schema-valid for custom hooks users add. No active hook configs use them yet — pure forward-looking enablement.
-
-**Env vars (mention-only, in `safety/settings-patch.json` comment block):** `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` (override 8-block consecutive-Stop cap; seeded value `"16"` inside the commented `// env` block). The other four (`ANTHROPIC_WORKSPACE_ID`, `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE`, `CLAUDE_CODE_PLUGIN_PREFER_HTTPS`, `CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY`) are platform-/workspace-specific and don't warrant configurator-shipped defaults; captured in the `CLAUDE_CODE_COMPAT` rationale comment for future-self.
-
-**Still held for a future schemastore sync PR:** hook output `terminalSequence` field (CC 2.1.147); Stop/SubagentStop hook input `background_tasks` + `session_crons` fields (CC 2.1.149). Both were verified absent from #5706's head-branch schema and remain in `docs/07-backlog.md`.
-
-`CLAUDE_CODE_COMPAT.tested_up_to` bumped 2.1.132 → 2.1.150; rationale comment rewritten to a clean summary. Local SessionStart watcher (`.claude/hooks/check-schemastore-pr.sh`, gitignored) retired after PR #5706 merged.
+**Claude Code compat:** bumped to 2.1.116–2.1.150 (was 2.1.116–2.1.132 in v2.5.0). 18 CC releases covered since the prior bump; SchemaStore PR #5706 sync to CC v2.1.143 merged 2026-05-23 unblocking the long-held key batch. Final 2.1.147–2.1.150 resurvey found one new key (`allowAllClaudeAiMcps`, 2.1.149) — Enterprise managed setting, outside configurator territory.
 
 ## [2.5.0] — 2026-05-21
 

@@ -40,7 +40,7 @@
 TEMPLATE_DIR = REPO_ROOT / "templates"
 BASE_SETTINGS_PATH = TEMPLATE_DIR / "core" / "dot-claude" / "settings.json"
 
-CC_VERSION = "2.5.0"
+CC_VERSION = "2.6.0"
 
 # -----------------------------------------------------------------------------
 # Colored output (only if stdout is a TTY and NO_COLOR isn't set)