Claude Code 2.1.191 Fixes the Background-Agent Zombie Problem

Claude Code 2.1.191 is a patch release, but the lead fix deserves a much louder headline: stopped background agents no longer resurrect. That is the kind of sentence that sounds funny until you remember that background agents are not browser tabs. They are delegated coding sessions with tools, permissions, quota, files, MCP servers, and enough autonomy to do useful damage if lifecycle state is wrong.

The release shipped on June 24 at 21:58:12 UTC with 10 assets and seven GitHub reactions. Anthropic lists 20 changes spanning background agents, hooks, managed settings, permissions, MCP reliability, OAuth, terminal links, scrolling, CPU, and memory. The connective tissue is operational trust. Once an agent leaves the foreground terminal, “UX details” like stop buttons, hook matchers, policy refresh, and network prompts become production controls.

A stopped agent has to stay stopped

The most important fix is blunt: background agents stopped from the tasks panel are now permanent. The release explicitly fixes agents “resurrecting after being stopped.” In a foreground chat, a bad stop action is annoying. In a background-agent system, it is a broken authority boundary. The human issued an operator command. Work should not resume unless the human starts it again.

This is the lifecycle lesson every multi-agent coding tool eventually has to learn. Stop, pause, resume, retry, and delete are not vibes. They are state transitions. If those transitions live only in the UI process, or if a background worker can reconstruct itself from stale state and continue after being stopped, the system has invented a zombie task runner. The fix matters because it makes the tasks panel a control surface instead of a suggestion box.

Teams adopting background agents should test this explicitly. Start a task that can run long enough to observe. Stop it from the management UI. Restart the client. Change network conditions. Confirm it does not reappear and does not continue mutating the workspace. If an agent product cannot prove durable stop semantics, do not put it near unattended work.

Silent hook failure is policy failure

Another small-looking fix is hooks with comma-separated matchers such as "Bash,PowerShell" no longer silently failing to fire. That is not just configuration polish. Hooks are where teams put enforcement: block risky shell calls, log permission requests, run validators, capture audit evidence, or route tool events to security systems. If a matcher syntax silently disables a hook, the operator thinks policy is in force when it is not.

Silent policy failure is worse than a hard error. A hard error interrupts setup and forces a repair. A silent failure produces confidence without enforcement. Claude Code’s hooks documentation exposes lifecycle events such as PreToolUse, PermissionRequest, SubagentStart, TaskCreated, and TaskCompleted. That is powerful surface area, but only if configuration parsing is strict enough that “covered shells” actually means covered shells.

The actionable point is simple: lint hook configuration. Treat unknown matchers, ambiguous lists, and parse failures as blocking errors. If your hook system is part of your safety case, it cannot fail like a theme setting.

Enterprise policy needs freshness semantics

Managed settings get a reliability fix too. forceRemoteSettingsRefresh now takes effect when set through MDM or file policy, and remote policy fetches send Cache-Control: no-cache so stale proxies do not serve old settings. This is exactly the kind of change that never appears in a launch keynote and absolutely determines whether enterprise controls work.

Central policy is only real if it reaches running clients. An admin can update a model allowlist, permission rule, or remote setting, but if clients keep using cached policy until a restart or proxy expiry, the organization has a policy-shaped hope. Agent governance needs freshness semantics: what changed, when the client fetched it, what cache layer was bypassed, and which policy version is active.

The same pattern shows up in the permissions fixes. The /permissions Recently-denied approvals now persist on close instead of being silently discarded. Sandbox network permission dialogs now remember hosts allowed with “Yes” for the rest of the session instead of re-prompting on every connection. That is the right scoped convenience: reduce prompt fatigue without turning a temporary allow into a permanent network grant.

MCP reliability is agent reliability

Claude Code also adds short retry behavior for MCP capability discovery: tools/list, prompts/list, and resources/list retry transient network errors with short backoff. MCP OAuth discovery and token requests retry once after transient network errors. Headless MCP OAuth environments skip the browser popup and go straight to paste-the-URL. HTTP 404 MCP errors now show the URL and point to MCP config.

This is not just nicer setup. Capability discovery is how the agent learns what tools and resources exist. If a transient network burp during tools/list makes the runtime conclude a server has no tools, the user sees a confused agent. If OAuth discovery fails once in a headless session and strands setup, MCP feels brittle even when the server is fine. Short retries and better error messages turn normal distributed-systems grit into recoverable behavior.

The release also reduces streaming response CPU usage by roughly 37% by coalescing text updates to 100ms. That is a reminder that agent clients are long-running applications now. A chat UI that burns CPU during streaming becomes a real cost when developers leave multiple sessions, background agents, and remote-control surfaces open all day.

For practitioners, the checklist from 2.1.191 is useful beyond Claude Code. Make lifecycle actions durable. Fail closed on hook parsing. Refresh managed policy with cache-busting semantics. Persist approval state intentionally. Scope network grants to the session unless explicitly saved. Retry transient MCP discovery and OAuth paths. Give headless auth a first-class flow. And if you implement /clear, think hard about whether /rewind means UI history, model context, or executable state.

Claude Code is maturing in the places that matter after adoption. Not by adding another impressive agent trick, but by making stopped work stay stopped, hooks actually fire, policy actually refresh, and MCP actually survive the network. That is what production agent tooling looks like: fewer zombies, fewer silent failures, more boring guarantees.

Sources: GitHub release — anthropics/claude-code v2.1.191, Claude Code agent view documentation, Claude Code hooks reference, Claude Code permissions documentation, Claude Code MCP documentation