Claude Code 2.1.178: Tool Parameter Permissions Let Operators Block Specific Subagent Model Tiers

Claude Code 2.1.178, released June 15, ships three changes that matter directly to operators managing claude code 2.1.178 Tool parameter permission subagent deployments at scale: a new Tool(param:value) permission grammar that can target specific model tiers, nested .claude/ directory scoping with deterministic collision resolution, and a pre-flight classifier gate that screens every subagent spawn in auto mode before it executes.

What Changed in 2.1.178

Tool(param:value) — permission rules that target model tiers

The biggest governance addition is a new permission rule syntax: Tool(param:value). Where before you could only allow or deny an entire tool class (Agent, Bash, Edit), you can now match on the tool's input parameters using key-value pairs and * wildcards.

The flagship use case Anthropic calls out is Agent(model:opus) — a deny rule that blocks any subagent from spawning with Opus. For teams routing to Claude through TheRouter or a shared gateway, this is meaningful cost governance: a developer's task that accidentally spawns a multi-turn Opus subagent is exactly the kind of runaway spend that per-model allowlists are designed to stop.

The syntax works in allowedTools, disallowedTools, and in managed settings files, so fleet-wide policies are enforceable without requiring individual users to opt in:

{
  "disallowedTools": ["Agent(model:opus)", "Agent(model:claude-fable*)"]
}

A * wildcard on the value side matches any suffix, which means you can also write Bash(command:rm*) to block destructive shell prefixes — though the Anthropic changelog focuses on the model-tier use case.

Nested .claude/ directory scoping

Claude Code now loads skills from nested .claude/skills/ directories when you are working inside a subdirectory. On a name collision between a nested skill and a project-root skill, the nested skill appears as <dir>:<name> in the listing so both remain callable.

The same scoping logic extends to agents, workflows, and output-style configs: the definition closest to the current working directory wins on name collision. Project-scope workflow saves now target the closest existing .claude/workflows/ rather than always writing to the project root.

This matters for monorepo teams where different packages have different skill or workflow sets. Previously, a shared project root controlled all definitions; now individual subdirectories can own their own configs without clobbering siblings.

Auto-mode subagent pre-flight classifier

In auto mode, Claude Code now runs the safety classifier against a subagent spawn request before the subagent starts. Previously, a subagent could request a blocked action and be caught only during execution — after tokens had already been spent. The pre-flight gate surfaces the block at spawn time.

For operators with strict disallowedTools or availableModels policies, this closes a gap where subagent intent could escape review. The classifier uses the same auto-mode model-selection logic introduced in prior releases.

Bug Fixes Operators Should Know About

Two fixes in 2.1.178 are particularly relevant for teams running Claude Code against custom API gateways:

ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN daemon auth. Workers launched via claude agents were returning 401 Invalid bearer token when the daemon was started from a shell that had a custom ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN set. The daemon was not inheriting the credentials correctly. This is fixed.

Compaction fallback model chain. Compaction (automatic context-window compression) was not honoring --fallback-model. When a compaction attempt hit an overload or model-availability error, it would fail rather than retry on the configured fallback chain. Now it does.

Both fixes compound with the enforceAvailableModels governance introduced in 2.1.175: you can now combine strict model allowlists, fallback chains, and custom gateway credentials without hitting silent auth gaps.

What This Means for Routing Teams

Tool(param:value) moves Claude Code permission rules from "which tool category" to "which model, command prefix, or parameter value". For teams that route to multiple providers through a shared gateway:

• You can now deny Opus-tier subagents at the harness level without disabling the Agent tool entirely. This means swarm architectures can still use subagents, but only on approved model tiers.
• Combined with enforceAvailableModels, a managed settings file can lock the entire session — both direct model picks and subagent spawns — to the tiers your billing plan covers.
• The auto-mode pre-flight classifier means that policy violations surface before compute is burned, not after.

The daemon credential fix also matters if you operate a proxy that requires custom base URLs. Daemon-based background sessions now correctly inherit gateway credentials set in the parent shell.

What to Watch

Anthropic has not yet extended Tool(param:value) to allow wildcard on both the key and value side simultaneously (e.g., Agent(*:fable*) is not documented as supported). Watch the Claude Code changelog for extensions to the grammar.

The nested .claude/ scoping is new behavior — if your CI pipeline or scripts assume all .claude/ definitions live at the project root, audit them before upgrading. Skills with directory-qualified names like api:lint now behave differently from unqualified lint.

Try It

Update Claude Code and check your permission rules with /permissions. Any existing disallowedTools entries continue to work unchanged; the Tool(param:value) syntax is additive.

To explore how TheRouter's model catalog maps to your permission rules — and which model IDs are valid targets for Agent(model:...) entries — see the models directory.

For broader governance configuration in enterprise deployments, the docs hub covers managed settings, OTEL integration, and multi-provider fallback chain setup.