# CC 2.1.129/132 Adoption — Group C: OAuth + permission breaking-changes

Four upstream behavior changes documented as `### subsections` under the `## CC 2.1.129 Settings` / `## CC 2.1.132 Settings` headers introduced by Group D (#1686). Two OAuth fixes (server-managed-settings scope, wake-from-sleep refresh race), one plan-mode permission fix, one MCP connector status fix. Doc-only — the 2.1.132 floor in `engines.claudeCode` already guarantees the runtime behavior; what was missing was the human-readable prose.

## Issues closed 7 (5 effective with dupes)

Issue(s) | Feature | CC | Category | Skill ref
--- | --- | --- | --- | ---
#1645 + #1664 | server_settings_oauth_scope_fix dupe pair | 2.1.129 | breaking | configure
#1646 + #1665 | oauth_refresh_race_wake dupe pair | 2.1.129 | breaking | configure, doctor
#1650 + #1669 | permission_mode_resume_fix dupe pair | 2.1.132 | breaking | configure, checkpoint-resume, chain-patterns
#1651 | mcp_unauth_connector_status_fix | 2.1.132 | breaking | configure, mcp-visual-output

## Files touched 6 src/ files

File | Section added
--- | ---
src/skills/configure/references/cc-version-settings.md | 2 subsections under 2.1.129; new `## CC 2.1.132 Settings` with 2 subsections
src/skills/configure/references/mcp-config.md | new `## CC 2.1.132 changes` covering `needs auth` + `connected · tools fetch failed`
src/skills/mcp-visual-output/references/upstream-mcp.md | "Auth status visibility (CC 2.1.132+)" appended after the SYNCED block
src/skills/doctor/references/remediation-guide.md | "Logged out after laptop wake" entry → CC ≥ 2.1.129 + `claude /login`
src/skills/checkpoint-resume/SKILL.md | 1-line note: plan mode preserved across `--resume`
src/skills/chain-patterns/references/checkpoint-resume.md | 1-line note + section header for the same

## Before / after — `--permission-mode` on plan-mode resume

### Before (CC ≤ 2.1.131)

    $ claude --resume  \
        --permission-mode plan
    # flag silently dropped
    # session continues without plan-mode
    # constraints — security-relevant leak
    $ # ExitPlanMode also failed to
    $ # re-apply plan mode for the rest
    $ # of the session

### At our floor (CC ≥ 2.1.132)

    $ claude --resume  \
        --permission-mode plan
    # plan mode honored on resume
    $ # ExitPlanMode re-applies plan
    $ # mode for the rest of the session
    $ # — no permission-bypass surface

## Before / after — `/mcp` status text

### Before (CC ≤ 2.1.131)

    $ claude  /mcp
      github     connected · 12 tools
      notion     failed
      flakysvr   connected · 0 tools
    # notion needs auth but reports
    # the same as a broken server
    # flakysvr's tools/list crashed
    # silently — no retry, no signal

### At our floor (CC ≥ 2.1.132)

    $ claude  /mcp
      github     connected · 12 tools
      notion     needs auth
      flakysvr   connected · tools fetch failed
    # Three concrete states; doctor +
    # mcp-visual-output can branch on
    # them. Headless -p stops retrying
    # non-transient 4xx auth failures.

## Before / after — wake-from-sleep OAuth

### Before (CC ≤ 2.1.128)

    laptop sleeps...
    laptop wakes...
    session A: refresh attempt
    session B: refresh attempt (race)
    session C: refresh attempt (race)
    → active token invalidated
    → all sessions logged out
    → checkpoint-resume chain dies

### At our floor (CC ≥ 2.1.129)

    laptop sleeps...
    laptop wakes...
    sessions A/B/C serialize the
    wake-time refresh.
    → token stays valid
    → no phantom logout
    → long /ork:implement chain
       survives the sleep cycle

## Group plan

- A · Foundation — 4 doc additions (#1672) merged
- B · MCP hygiene — 5 features + manifest restructure (#1674) merged
- D · Config / permission — 3 features, parent headers introduced (#1686) merged
- C · Security-adjacent (this PR) — 4 features, OAuth + permission breaking-changes in-flight
- E · New surface — channels, gateway opt-in, init plugin_errors pending

## Verification

- `npm run build` — plugins/ regenerated, no count drift (107 / 37 / 188)
- `npm run test:skills` — frontmatter + structure unchanged
- `npm run test:agents` — all 37 valid
- `npm run test:manifests` — schema valid, 0 orphaned skills
- `npm run test:security` — 14/14 pass
- `npm run typecheck` — clean