Framework Watch: Claude Code 2.1.287 Adds Plugin 'Mods' -- and the Changes Operators Need to Act On

Anthropic released Claude Code v2.1.287 on October 1, 2026, a day after 2.1.286. The headline feature is Claude Mods: "plugins may now modify deeper behavior." The first built-in mod, You should know, is "a side agent [that] watches your back and flags things you or Claude might miss," enabled with /plugin enable cc-plugin-you-should-know@builtin for first-party sessions with telemetry on. The release notes say little else about what mods can change.

The changes administrators should act on:

• Telemetry now carries a second copy of the prompt. The OpenTelemetry user_prompt event gains prompt_text, a copy of prompt for backends that nest dotted keys. The notes are explicit: "drop or mask it wherever you drop or mask prompt." Pipelines that redact the prompt field by name will otherwise start storing prompt text.
• 1M context becomes the default on cloud providers. Opus 4.7 and later and Fable now use a 1M-token context window by default on Bedrock, Vertex, Foundry and the Claude apps gateway, with no [1m] suffix. CLAUDE_CODE_DISABLE_1M_CONTEXT=1 keeps 200K. Long sessions may cost more where they previously compacted earlier.
• Tighter shell-write rules. Whole-tool Bash allow rules and allowing hooks now prompt for, rather than run, shell writes to files the file tools refuse outright, such as the host credentials file. Writes through a repo-committed symlink onto a sensitive file or out of the working tree now name where they land and wait for a person.
• A restored safeguard (fix, no action needed). A dangerous rm, such as one on / or the home directory, had lost its always-ask protection when the same command also redirected output to a ~ or wildcard path. That is fixed.

Other changes include MCP URL prompts for sign-in flows on the 2025-11-25 protocol (servers that stop connecting can set "bareElicitationCapability": true), alwaysLoad: false now deferring all of a server's tools behind tool search, and a long run of screen-reader fixes.

Why it matters: mods move plugins from adding tools to changing how the agent behaves, which is a larger trust decision than installing a skill. Treat a mod like a dependency that can alter every session, and review it accordingly. The telemetry and context-window changes are quieter but have direct privacy and cost effects; check redaction rules and spend dashboards after upgrading.