feat(v11.19.0): sync with Claude Code v2.1.165

CHANGELOG.md

@@ -6,6 +6,28 @@ All notable changes to cc-settings are documented here.
 
 ## [Unreleased]
 
+## [11.19.0] — 2026-06-05
+
+Upstream sync to Claude Code 2.1.165. Two of the three releases (2.1.164, 2.1.165) are bug-fixes-only; the one surface-area change is in 2.1.163. Manifest bumped `2.1.162` → `2.1.165`; version bumped minor for the new settings keys.
+
+### Added
+
+- **`requiredMinimumVersion` + `requiredMaximumVersion` managed settings (2.1.163).** Claude Code refuses to start if its version falls outside the allowed range. New keys, distinct from the older `minimumVersion` (which they pair with conceptually but do not replace). Both `string`, enterprise/managed scope. Added to `src/schemas/settings.ts` (ENTERPRISE/MANAGED block), `upstream/claude-code-manifest.json` `knownSettingsKeys`, and the `docs/settings-reference.md` table. The schema is `passthrough`, so live configs carrying these keys already parsed — enumerating keeps the manifest honest and documents the surface.
+
+### Changed
+
+- **Upstream sync to Claude Code 2.1.165.** Triaged all of 2.1.163 (2.1.164/2.1.165 are "Bug fixes and reliability improvements" with no detail). Beyond the two settings keys above, only one bullet touches a surface cc-settings ships: `Stop` and `SubagentStop` hooks may now return `hookSpecificOutput.additionalContext` to feed Claude context and keep the turn going without being labeled a hook error. This is a runtime-output capability, not a config field, so there's no zod change — documented as a one-line note in `docs/hooks-reference.md` (cc-settings already ships `stop-summary.ts` + SubagentStop logging). Everything else skipped: `/plugin list` and `/btw` "c to copy" (native UI/commands), the Skills `\$` literal-`$`-before-digit escape (no skill emits `$N`), stdio MCP receiving `CLAUDE_CODE_SESSION_ID` on `--resume` (env var already tracked), and ~17 bug fixes. One bug fix is a quiet win with no action on our side: `if: "Bash(...)"` hook conditions were firing on every command containing `$()`/`$VAR` (and `$HOME` deny-rule paths weren't blocking) — 2.1.163 fixes both upstream, making our existing `if:`-conditioned hooks and home-dir deny rules more correct for free.
+
+### Files changed
+
+- `src/schemas/settings.ts`
+- `schemas/settings.schema.json` (regenerated via `bun run schemas:emit`)
+- `upstream/claude-code-manifest.json`
+- `docs/settings-reference.md`
+- `docs/hooks-reference.md`
+- `src/setup.ts`
+- `CHANGELOG.md`
+
 ## [11.18.0] — 2026-06-04
 
 Fixes the review-queue statusline nag (`⚠ N review`) staying red forever in PR / fast-forward-merge workflows. The `awaiting` counter incremented per writeable agent spawn but **only drained on a local `git commit` that Claude itself ran** (`isGitCommit` + `commitSucceeded` in `src/hooks/review-queue-nudge.ts`). Work that landed any other way — pushing a branch for a PR, a fast-forward `git pull`, a pulled-down PR merge, or a commit made in another terminal — never reset it, so it accumulated permanent false "review debt". The drain now recognizes how work actually advances.

docs/hooks-reference.md

@@ -382,6 +382,8 @@ Logs are used by `bun ~/.claude/src/scripts/claude-audit.ts` to analyze command
 |--------|---------|-------|
 | `stop-summary.ts` | End-of-turn summary; if >5 files were changed, reminds to store learnings | No |
 
+> **v2.1.163:** `Stop` and `SubagentStop` hooks may return `hookSpecificOutput.additionalContext` to feed text back to Claude and keep the turn going — it surfaces as context rather than being treated as a hook error.
+
 ### StopFailure
 
 | Script | Purpose | Async |

docs/settings-reference.md

@@ -535,6 +535,8 @@ All ~104 documented top-level keys. Class column: **G** = General, **E** = Enter
 | `prUrlTemplate` | string | G | Custom PR badge URL template; substitutes `{host}`, `{owner}`, `{repo}`, `{number}`, `{url}` (v2.1.119) |
 | `preferredNotifChannel` | enum | U | Preferred desktop/terminal notification channel (`auto`, `terminal_bell`, `iterm2`, …) |
 | `prefersReducedMotion` | boolean | U | Suppress animations in the TUI |
+| `requiredMaximumVersion` | string | E | Managed: refuse to start if the Claude Code version is above this (v2.1.163) |
+| `requiredMinimumVersion` | string | E | Managed: refuse to start if the Claude Code version is below this; pairs with `requiredMaximumVersion` to define an allowed range (v2.1.163) |
 | `respectGitignore` | boolean | G | Honour .gitignore when listing files |
 | `sandbox` | object | G | Sandbox configuration for secure command execution (v2.1.98–2.1.108) |
 | `showClearContextOnPlanAccept` | boolean | U | Offer context-clear prompt after accepting a plan |

schemas/settings.schema.json

@@ -977,6 +977,12 @@
       "properties": {},
       "additionalProperties": {}
     },
+    "requiredMaximumVersion": {
+      "type": "string"
+    },
+    "requiredMinimumVersion": {
+      "type": "string"
+    },
     "strictKnownMarketplaces": {
       "type": "array",
       "items": {

src/schemas/settings.ts

@@ -184,6 +184,8 @@ export const Settings = z
     minimumVersion: z.string().optional(), // minimum Claude Code version required; older clients are blocked
     pluginTrustMessage: z.string().optional(), // custom trust-confirmation message shown when installing plugins
     policyHelper: z.object({}).passthrough().optional(), // policy-helper configuration object (enterprise)
+    requiredMaximumVersion: z.string().optional(), // 2.1.163 — managed: refuse to start if the version is above this
+    requiredMinimumVersion: z.string().optional(), // 2.1.163 — managed: refuse to start if the version is below this; pairs with requiredMaximumVersion to define an allowed range
     strictKnownMarketplaces: z.array(z.string()).optional(), // allowlist of marketplace IDs considered trusted
     strictPluginOnlyCustomization: z
       .union([z.boolean(), z.array(z.enum(["skills", "agents", "hooks", "mcp"]))])

src/setup.ts

@@ -50,7 +50,7 @@ import type { StatusData } from "./lib/status-types.ts";
 import { buildVersionDelta, readInstalledVersion } from "./lib/version-delta.ts";
 import { Settings } from "./schemas/settings.ts";
 
-const VERSION = "11.18.0"; // review-queue drains on push/HEAD-advance, not just local commit
+const VERSION = "11.19.0"; // sync to Claude Code 2.1.165: requiredMin/MaxVersion settings keys
 const CLAUDE_DIR = join(homedir(), ".claude");
 
 // --- Arg parsing ---------------------------------------------------------

upstream/claude-code-manifest.json

@@ -1,6 +1,6 @@
 {
-  "lastScan": "2026-06-04T00:00:00.000Z",
-  "claudeCodeVersion": "2.1.162",
+  "lastScan": "2026-06-05T00:00:00.000Z",
+  "claudeCodeVersion": "2.1.165",
   "knownSettingsKeys": [
     "$schema",
     "agent",
@@ -72,6 +72,8 @@
     "prUrlTemplate",
     "preferredNotifChannel",
     "prefersReducedMotion",
+    "requiredMaximumVersion",
+    "requiredMinimumVersion",
     "respectGitignore",
     "sandbox",
     "showClearContextOnPlanAccept",
@@ -215,6 +217,7 @@
     "knownBuiltinTools is used by the zod schemas when validating permission rules by shape (e.g., `Tool(pattern)`). Updated when upstream adds tools.",
     "knownHookTypes includes `mcp_tool` (added 2.1.118) for hooks that invoke MCP tools directly.",
     "v2.1.139 added two hook fields (not enumerated here, see src/schemas/hooks.ts): `args: string[]` on command hooks (exec form, no shell) and `continueOnBlock: boolean` on PostToolUse hooks.",
-    "v2.1.143 added `worktree.bgIsolation: \"none\"` to disable background-session worktree isolation — see src/schemas/settings.ts."
+    "v2.1.143 added `worktree.bgIsolation: \"none\"` to disable background-session worktree isolation — see src/schemas/settings.ts.",
+    "v2.1.163 added two managed settings keys: requiredMinimumVersion/requiredMaximumVersion (version-range gate, distinct from the older minimumVersion). It also let Stop/SubagentStop hooks return hookSpecificOutput.additionalContext (runtime output, not a config field — see docs/hooks-reference.md)."
   ]
 }