Project releases

Open Claude Code 2.1.3 lets hooks veto tool calls and limits what subagents inherit

Open Claude Code 2.1.3 makes hook vetoes stick, runs nothing for invalid matchers, rejects malformed UTF-8 before edits and bounds subagent tools, turns and delegation.

GitHub activity: · Published:

A hook can say no

A veto now stops the call. Subagents get the parent's tools, checks and hooks, never more.

Explanatory diagram · not live telemetry
Explanatory connectionsA model's tool call passes through a PreToolUse hook. If the hook allows it, the tool runs. A veto, through exit code 2, continue false or a structured deny, blocks the call and returns an error result the model can read. A subagent inherits the parent's tool set, permission checks and hooks, within bounded turns and depth.Explanatory connectionsA model's tool call passes through a PreToolUse hook. If the hook allows it, the tool runs. A veto, through exit code 2, continue false or a structured deny, blocks the call and returns an error result the model can read. A subagent inherits the parent's tool set, permission checks and hooks, within bounded turns and depth.

Model tool call

Requested by the agent loop

PreToolUse hook

Command or HTTP hook

Tool runs

Only if the hook allows it

Veto

Blocked, error result returned

Subagent

Parent's tools, checks, hooks

What changed

Open Claude Code is an open-source rebuild of the Claude Code command-line agent. Version 2.1.3, released on October 11, tightens how hooks, file edits and subagents behave. It follows behaviour described in the public Claude Code changelog.

  • Hook vetoes hold. Command and HTTP hooks honour onFailure: block. Exit code 2, continue: false or a structured deny blocks the call, and the model receives an error result and can continue. MCP hook output replacement works.
  • Invalid matchers run nothing. A hook whose matcher is not a valid pattern no longer executes. HTTP hook responses are capped at 1 MiB.
  • Large reads are explicit. Read with allow_large skips the default 2,000-line limit but still honours offset and limit, under hard ceilings of 16 MiB and 100,000 lines.
  • Edits refuse malformed UTF-8. Edit, MultiEdit and NotebookEdit reject invalid UTF-8 before changing any bytes, and keep BOMs, CRLF line endings and trailing newlines.
  • Subagents inherit, never widen. A child gets the intersection of its requested tools and the parent's tools, plus the parent's permission checks and hooks. An empty child tool list grants no tools. Worktree isolation requests are rejected because isolation is not implemented.
  • Turns are bounded. maxTurns limits model requests, including tool continuations. Subagents default to at most 10 model calls, a delegation depth of 2 (hard maximum 3) and at most 4 background agents.

What the published package contains

npm lists @ruvnet/open-claude-code 2.1.3, published at 2026-10-11T22:05:37Z and tagged latest. The tarball attached to the GitHub release is byte-identical to the registry tarball, and its SHA-512 matches the registry's integrity value. The release's publication-verified.json reports the same integrity. Another attached receipt (receipt.json) returned a GitHub server error when we tried to read it, so we did not use it.

The registry tarball's source contains the maxTurns guard in the agent loop, the rejection of subagent isolation requests, the parent-bounded child turn limit, and the invalid-matcher handling in the hook engine.

Get started

Use Node 20 or later in a disposable directory. The documented first command prints the installed version and should report 2.1.3. Claude Code users can instead add the project's marketplace and install its plugin with the documented slash commands.

Documentation-verified only. We compared the published package files with the release but did not install the package, run these commands or execute any agent session.

npx @ruvnet/open-claude-code@2.1.3 --version
/plugin marketplace add ruvnet/open-claude-code
/plugin install occ@ruvnet-occ
claude plugin update occ@ruvnet-occ

Use it today

Input: a project with a PreToolUse hook that blocks writes outside a folder. Workflow: ask the agent to edit a file outside that folder. Output: the call is blocked, the model receives an error result, and the session continues. For delegation, give a subagent an empty tool list and confirm it can call nothing.

Experimental commentary — acceptance test

These rules make Open Claude Code a reasonable place to prototype hook policies before using them elsewhere. Acceptance: a policy hook that exits 2 blocks the same call in both the parent and a subagent. Limitation: prompt and agent hook evaluators and asynchronous hooks are not implemented, so policies that depend on them cannot be tested here.

Limits and verification

  • The maintainers report 1,008 CLI tests and 124 script regressions passing, zero npm audit findings and packed-artifact end-to-end checks. Those results are theirs. The newsroom did not run them.
  • Still outstanding, according to the release: full provider parity, prompt and agent hook evaluators, asynchronous hooks, the complete session and checkpoint lifecycle, and actual worktree isolation. Lifecycle issue #17 remains open. Capability proposals are advisory.
  • These changes tighten specific behaviours. They are not a general safety guarantee, and full parity with Claude Code has not been established.
  • This is a separate release from the September 2.0.0 nightly, which keeps its own story.

Read the original on Open Claude Code v2.1.3 release

v2.1.3 / PR #30

Open Claude Code repository

Back to the newsroom