Claude Code 2.1.238 remote/internal-model flow — reconstructed pseudocode and diagram

README.md

Claude Code remote/internal-model flow

This Gist documents a reconstructed control flow observed in the public Claude Code native package beginning with version 2.1.236 and still present in 2.1.238.

It is explanatory pseudocode, not Anthropic source code. Function names are expanded, unrelated application logic is omitted, and unknown private behavior remains explicitly marked as unknown.

Brief diagram

 CLI / host override       ANTHROPIC_MODEL       account/org default
          \                       |                       /
           +----------------------+----------------------+
                                  |
                                  v
                       resolve effective model ID
                                  |
                                  v
                    isInternalModel(modelId)
                       public build: false
                                  |
              +-------------------+-------------------+
              |                                       |
              v                                       v
 model-selection provenance                 permission/settings trust
 allowlist | remap | agent                  explicit mode | settings
 settings_env | settings                    auto-mode eligibility
              \                                       /
               +-------------------+------------------+
                                   |
                                   v
                  decideInternalModelRemoteMode(...)
                     public build: action = "none"
                                   |
                    +--------------+---------------+
                    |                              |
                    v                              v
           permission mode / notice     resolved effective model ID
                    |                              |
                    +---------------+--------------+
                                    |
                                    v
                         create cloud session

What is directly observable

• The detector receives the resolved effective model string.
• Unknown/private full model IDs can pass through the normal alias parser unchanged.
• The public detector is exactly equivalent to return false.
• The public decision function always returns action: "none".
• The caller uses the decision output for permission-mode provenance, optional notices, and telemetry; the private policy itself is absent.
• The resolved effective-model string is sent to Anthropic's cloud-session endpoint; this path does not visibly replace it with a public model. Downstream worker propagation is not traced.
• repositoryModel is a misleading property name: its value is selection provenance such as allowlist, remap, agent, settings_env, or settings, not another model ID.
• publicModel resolves to Claude Code's public Opus default, normally claude-opus-5, but its intended private use is not exposed.

What is not established

The package does not reveal the internal model's name, ID, family, capabilities, context length, external availability, or release schedule. It cannot identify the target as Internal Model 2, Fable 5.1, Mythos, or an Opus checkpoint.

This is not a model-secrecy boundary. No automatic disclosure to the repository author is shown; the likely boundary is permission behavior experienced by the local operator, although the stripped public policy does not prove its intended action.

Public artifacts

• First version containing the scaffold: @anthropic-ai/claude-code-win32-x64@2.1.236
• Current analyzed version: @anthropic-ai/claude-code-win32-x64@2.1.238
• Official release notes: Claude Code v2.1.238
• Analyzed 2.1.238 Windows x64 binary SHA-256: 223BC058B5AEF48138876E28DE5D00387E4FD7362A18E733143BF00819C01AAB

Observed and reconstructed on 2026-08-21.

remote-internal-model-flow.pseudocode.js

/*
 * Reconstructed pseudocode: Claude Code 2.1.238 remote/internal-model flow
 *
 * This is explanatory pseudocode derived from public package behavior. It is
 * not Anthropic source code. Names have been expanded and unrelated UI/error
 * handling has been omitted.
 */

async function startCloudSession(args, currentSession) {
  // 1. Attach to an existing cloud session when one was supplied.
  const existingSessionId = parseExistingCloudSession(args.cloud);

  if (existingSessionId) {
    await authenticateForRemoteSession();
    await attachToExistingCloudSession({
      sessionId: existingSessionId,
      localSession: currentSession,
    });
    return;
  }

  requireCloudTaskDescriptionUnlessPoolWasSpecified(args);
  const auth = await authenticateForRemoteSession();

  // 2. Discover whether local repository state and settings can be forwarded.
  const remoteInfrastructureAvailable =
    await checkRemoteInfrastructure().catch(() => false);

  const repositoryRoot = remoteInfrastructureAvailable
    ? findSynchronizableRepository()
    : null;

  if (repositoryRoot) {
    const syncDecision = await decideWhetherToSyncRepository({
      explicitBranch: args.onBranch,
      explicitRef: args.ref,
      poolId: args.pool,
    });

    if (syncDecision.offer) {
      await offerRepositorySynchronization(repositoryRoot);
    }
  }

  const settingsForwardingAllowed =
    remoteInfrastructureAvailable &&
    await checkRemoteSettingsGate().catch(() => false);

  // 3. Resolve the explicit and settings-derived permission modes.
  const requestedMode = args.permissionMode
    ? parsePermissionMode(args.permissionMode)
    : undefined;

  // bypassPermissions is deliberately not forwarded on this path.
  const acceptedExplicitMode =
    requestedMode &&
    isForwardablePermissionMode(requestedMode) &&
    requestedMode !== "bypassPermissions"
      ? requestedMode
      : undefined;

  const permissionContext = resolveRemotePermissionContext({
    gateOn: settingsForwardingAllowed,
    permissionModeWasTyped: args.permissionMode !== undefined,
    dangerouslySkipPermissions: args.dangerouslySkipPermissions === true,
    settingsWereScrubbed: wereSettingsScrubbed(),
    settings: loadSettings(),
    effort: resolveEffort(),
  });

  // 4. Resolve the effective main-loop model to a string.
  const effectiveModel = getEffectiveMainLoopModel();

  // 5. Test that resolved string for internal-model status.
  // This is the complete behavior in public versions 2.1.236-2.1.238.
  const internal = isInternalModel(effectiveModel);

  // 6. Only for an internal model, determine whether repository/user settings,
  // an agent, a remap, or an allowlist influenced model selection.
  const selectionProvenance = internal
    ? classifyModelSelectionProvenance({
        model: effectiveModel,
        cliModel: args.model,
        selectedAgent: args.agent,
        agentWasSelectedByCli: args.agentCli !== undefined,
        availableAgents: getAvailableAgents(),
        effectiveModelOverride: getEffectiveModelOverride(),
        initialMainLoopModel: getInitialMainLoopModel(),
        restrictedModel: getRestrictedModel(),
      })
    : undefined;

  // 7. Reconcile internal-model status with permission-mode trust/defaults.
  const decision = decideInternalModelRemoteMode({
    model: effectiveModel,
    internal,
    explicitMode: acceptedExplicitMode,
    droppedMode:
      (requestedMode !== undefined && acceptedExplicitMode === undefined) ||
      args.dangerouslySkipPermissions === true,
    pinnedDefault: false,
    settingsMode: permissionContext.settingsDefault,
    settingsModeForwardable: settingsForwardingAllowed,
    autoSeedable:
      autoModeIsNotDisabledBySettings() && !wereSettingsScrubbed(),
    publicModel: getDefaultOpusModel(),
    repositoryModel: selectionProvenance,
    trustedPlanDisplaced:
      trustedSettingsRequestedPlanModeButEffectiveSettingsDidNot(),
  });

  if (decision.notice) {
    log(`[remote] ${decision.notice.text}`);
  }

  const finalPermissionMode =
    decision?.permissionMode ?? acceptedExplicitMode;

  // 8. Create the cloud session with the resolved effective-model string.
  const result = await createCloudSessionRequest({
    description: args.taskDescription,
    branchName: resolveBranch(),
    explicitRef: args.onBranch ?? args.ref,
    poolId: args.pool,
    effort: permissionContext.effort,
    model: effectiveModel,
    permissionMode: finalPermissionMode,
    auth,
    repositorySynchronization: repositoryRoot,
  });

  if (!result.ok) {
    recordTelemetry("tengu_remote_create_session_error", {
      reason: result.reason,
    });
    throw new Error(result.message ?? "Unable to create cloud session");
  }

  // 9. Explain where the permission mode came from in telemetry.
  const permissionModeSource = classifyPermissionModeSource({
    acceptedExplicitMode,
    requestedMode,
    decision,
    permissionContext,
  });

  recordTelemetry("tengu_remote_create_session_success", {
    sessionId: result.session.id,
    permissionMode: finalPermissionMode,
    permissionModeSource,
  });

  // Unreachable in the public build because action is always "none".
  if (decision.action !== "none") {
    recordTelemetry("tengu_remote_model_gate_hint", {
      sessionId: result.session.id,
      action: decision.action,
      permissionMode: finalPermissionMode,
      requestedMode,
      settingsMode: permissionContext.permissionMode,
      repositoryModel: decision.repositoryModel,
    });
  }

  // 10. Surface any internal-model warning supplied by the private decision.
  if (decision.notice?.level === "warning") {
    queueNotification({
      key: "remote-internal-model-mode",
      kind: "warning",
      text: decision.notice.short,
      priority: "high",
      timeoutMs: 30_000,
    });
  } else if (decision.notice) {
    queueNotification({
      key: "remote-internal-model-mode",
      kind: "feedback",
      text: decision.notice.short,
      priority: "medium",
      timeoutMs: 15_000,
    });
  }

  if (!args.stayAttached) {
    printCloudSessionDetails(result.session);
    return;
  }

  await attachCurrentClientToCloudSession(result.session);
}

function getEffectiveMainLoopModel() {
  let requestedModel =
    getHostOrCliModelOverride() ??
    getInitialMainLoopModel() ??
    process.env.ANTHROPIC_MODEL ??
    getAuthenticatedAccount()?.model;

  requestedModel = applyOrganizationAllowlistAndFallbacks(requestedModel);

  if (requestedModel != null) {
    return resolveModelAlias(requestedModel);
  }

  return resolveDefaultMainLoopModel();
}

function resolveModelAlias(value) {
  switch (normalize(value)) {
    case "opus":
      return getDefaultOpusModel();
    case "sonnet":
      return getDefaultSonnetModel();
    case "haiku":
      return getDefaultHaikuModel();
    case "fable":
      return getDefaultFableModel();
    case "best":
      return getBestAvailableModel();
    default:
      // An unknown or private full ID can survive unchanged.
      return value.trim();
  }
}

// Exact public behavior. The private detector implementation is absent.
function isInternalModel(modelId) {
  return false;
}

function resolveRemotePermissionContext(input) {
  const mayUseSettings =
    !input.permissionModeWasTyped &&
    !input.dangerouslySkipPermissions &&
    !input.settingsWereScrubbed;

  const settingsDefault = mayUseSettings
    ? resolveDefaultPermissionMode(input.settings)
    : undefined;

  return {
    considered: input.gateOn && mayUseSettings,
    settingsDefaultModePresent:
      input.settings.permissions?.defaultMode != null,
    settingsDefault,
    permissionMode: input.gateOn ? settingsDefault : undefined,
    effort: input.gateOn ? input.effort : undefined,
  };
}

// Exact behavior of the public 2.1.238 decision stub, expressed readably.
function decideInternalModelRemoteMode(input) {
  const mayUseImplicitMode =
    !input.droppedMode &&
    (input.explicitMode === undefined ||
      (input.pinnedDefault && input.explicitMode === "default"));

  const permissionMode = mayUseImplicitMode
    ? input.settingsModeForwardable
      ? input.settingsMode
      : undefined
    : input.explicitMode;

  return {
    permissionMode,
    action: "none",
  };
}

function classifyModelSelectionProvenance(input) {
  const usingDefault =
    input.cliModel === "default" ||
    (input.effectiveModelOverride === undefined &&
      input.initialMainLoopModel === null);

  if (
    repositoryModelAllowlistIsActive() &&
    input.restrictedModel !== undefined &&
    !isInternalModel(input.restrictedModel)
  ) {
    return "allowlist";
  }

  if (
    repositoryModelAllowlistIsActive() &&
    usingDefault &&
    organizationDefaultIsEnforced()
  ) {
    return "allowlist";
  }

  const remapped = someRepositoryOrLocalOverrideMapsTo(input.model);

  if (input.cliModel) {
    return remapped ? "remap" : undefined;
  }

  if (
    input.effectiveModelOverride !== undefined &&
    input.selectedAgent?.model &&
    input.selectedAgent.model !== "inherit"
  ) {
    return agentDefinitionCameFromRepository(input.selectedAgent)
      ? "agent"
      : remapped
        ? "remap"
        : undefined;
  }

  if (input.effectiveModelOverride !== undefined) {
    return remapped ? "remap" : undefined;
  }

  if (someRepositoryAgentInfluencedSelection()) {
    return "agent";
  }

  if (repositorySettingsDefine("ANTHROPIC_MODEL")) {
    return "settings_env";
  }

  if (process.env.ANTHROPIC_MODEL && !usingDefault) {
    return remapped ? "remap" : undefined;
  }

  if (modelSettingCameFromProjectOrLocalSettings()) {
    return "settings";
  }

  return remapped ? "remap" : undefined;
}

function classifyPermissionModeSource({
  acceptedExplicitMode,
  requestedMode,
  decision,
  permissionContext,
}) {
  if (acceptedExplicitMode) return "flag";
  if (requestedMode) return "flag_withheld";

  if (decision.action === "auto_seeded") {
    return permissionContext.permissionMode
      ? "model_auto_over_settings"
      : "model_auto";
  }

  if (permissionContext.permissionMode) return "settings";

  if (
    permissionContext.considered &&
    permissionContext.settingsDefaultModePresent
  ) {
    return "settings_withheld";
  }

  return "none";
}

/*
 * Unknown/private portion
 * -----------------------
 *
 * A non-public implementation could replace isInternalModel() and
 * decideInternalModelRemoteMode(). The surrounding caller indicates that the
 * decision may return a permissionMode, action, notice, and provenance label.
 * It does not expose the predicate, model ID, notice wording, or full action
 * enumeration, so those details must not be invented.
 */