CC 2.1.129/132 Adoption — Group C: OAuth + permission breaking-changes

Four upstream behavior changes documented as ### subsections under the ## CC 2.1.129 Settings / ## CC 2.1.132 Settings headers introduced by Group D (#1686). Two OAuth fixes (server-managed-settings scope, wake-from-sleep refresh race), one plan-mode permission fix, one MCP connector status fix. Doc-only — the 2.1.132 floor in engines.claudeCode already guarantees the runtime behavior; what was missing was the human-readable prose.

Issues closed 7 (5 effective with dupes)

Issue(s)FeatureCCCategorySkill ref
#1645 + #1664server_settings_oauth_scope_fix dupe pair2.1.129breakingconfigure
#1646 + #1665oauth_refresh_race_wake dupe pair2.1.129breakingconfigure, doctor
#1650 + #1669permission_mode_resume_fix dupe pair2.1.132breakingconfigure, checkpoint-resume, chain-patterns
#1651mcp_unauth_connector_status_fix2.1.132breakingconfigure, mcp-visual-output

Files touched 6 src/ files

FileSection added
src/skills/configure/references/cc-version-settings.md2 subsections under 2.1.129; new ## CC 2.1.132 Settings with 2 subsections
src/skills/configure/references/mcp-config.mdnew ## CC 2.1.132 changes covering needs auth + connected · tools fetch failed
src/skills/mcp-visual-output/references/upstream-mcp.md"Auth status visibility (CC 2.1.132+)" appended after the SYNCED block
src/skills/doctor/references/remediation-guide.md"Logged out after laptop wake" entry → CC ≥ 2.1.129 + claude /login
src/skills/checkpoint-resume/SKILL.md1-line note: plan mode preserved across --resume
src/skills/chain-patterns/references/checkpoint-resume.md1-line note + section header for the same

Before / after — --permission-mode on plan-mode resume

Before (CC ≤ 2.1.131)

$ claude --resume  \
    --permission-mode plan
# flag silently dropped
# session continues without plan-mode
# constraints — security-relevant leak
$ # ExitPlanMode also failed to
$ # re-apply plan mode for the rest
$ # of the session

At our floor (CC ≥ 2.1.132)

$ claude --resume  \
    --permission-mode plan
# plan mode honored on resume
$ # ExitPlanMode re-applies plan
$ # mode for the rest of the session
$ # — no permission-bypass surface

Before / after — /mcp status text

Before (CC ≤ 2.1.131)

$ claude  /mcp
  github     connected · 12 tools
  notion     failed
  flakysvr   connected · 0 tools
# notion needs auth but reports
# the same as a broken server
# flakysvr's tools/list crashed
# silently — no retry, no signal

At our floor (CC ≥ 2.1.132)

$ claude  /mcp
  github     connected · 12 tools
  notion     needs auth
  flakysvr   connected · tools fetch failed
# Three concrete states; doctor +
# mcp-visual-output can branch on
# them. Headless -p stops retrying
# non-transient 4xx auth failures.

Before / after — wake-from-sleep OAuth

Before (CC ≤ 2.1.128)

laptop sleeps...
laptop wakes...
session A: refresh attempt
session B: refresh attempt (race)
session C: refresh attempt (race)
→ active token invalidated
→ all sessions logged out
→ checkpoint-resume chain dies

At our floor (CC ≥ 2.1.129)

laptop sleeps...
laptop wakes...
sessions A/B/C serialize the
wake-time refresh.
→ token stays valid
→ no phantom logout
→ long /ork:implement chain
   survives the sleep cycle

Group plan

Verification