[Bug] v2.1.88 yanked release caused wasted session + significant token loss
Description
I updated Claude Code from v2.1.87 to v2.1.88 following the standard update procedure (npm install -g @anthropic-ai/claude-code@latest). The release turned out to be severely broken and was later yanked by Anthropic due to an accidental source code leak (59.8MB source map included in the package).
Problems encountered with v2.1.88
- Skills completely broken — slash commands were not discovered or executed
- MCP servers invisible — configured MCP servers (Supabase, Context7) were not detected
- Commands not discovered — custom commands from
.claude/commands/were not found - Overall instability — the entire session was unusable
Token loss estimate
1. Direct loss from v2.1.88 broken session
- Full work session wasted trying to use a non-functional release: estimated 50,000–80,000 tokens (input+output) on a session that produced zero useful work
- Recovery session: downgrade + full audit + integrity verification: estimated 30,000–50,000 additional tokens
- Subtotal: ~80,000–130,000 tokens wasted due to the broken release
2. Systemic loss from double/triple memory injection (weeks of sessions)
During the post-downgrade audit, I discovered that the hook documentation examples led to a silent token waste bug that had been active for weeks:
- Claude Code's auto-memory system already loads memory into context automatically
- Following hook documentation examples, I had SessionStart and PostCompact hooks also injecting the same memory via stdout
- Result: memory content loaded up to 3x per compaction cycle (auto-memory + SessionStart + PostCompact)
- Memory payload: ~252 tokens × 3 injections × 2-3 compactions/session = ~1,500 extra tokens/session
- Over ~30 days of heavy usage (3-5 sessions/day): ~135,000–225,000 tokens wasted silently
Total estimated token waste: ~215,000–355,000 tokens
Account identification (for Anthropic internal lookup)
- GitHub account: amicicixp
- Session IDs from incident date (2026-03-31):
1e30a636-9bae-4bf6-83d6-58ba89937d33(audit/recovery session — Downloads project)7da9a9fb-15f2-440c-9c5f-fd2eedfa31d0729ca726-dd48-4f62-a45b-9765aadcdd0dbc7a5355-f39a-40da-8334-d42f95f0e6085edb8908-04e1-4cc8-9df5-ac295a5fbcd8- Claude Code version: 2.1.87 (downgraded from 2.1.88)
- OS: macOS 15.4 (Darwin 25.4.0) — Apple Silicon
Request
I am requesting a manual token/credit reset for the tokens wasted due to:
- The broken v2.1.88 release (entirely Anthropic's fault — should not have been published)
- The misleading hook documentation that caused silent double/triple memory injection for weeks
The update was performed following official instructions. No productive work was possible with v2.1.88. The memory injection bug was caused by documentation that does not warn users that hook stdout = token consumption, and that auto-memory already handles loading.
Suggestions for Anthropic
- Hook documentation should explicitly warn that stdout from hooks consumes tokens
- Auto-memory deduplication — if the same content is injected multiple times, deduplicate it
- Release testing — v2.1.88 had fundamental features broken (skills, MCP, commands) that should have been caught in basic QA
Environment
- OS: macOS 15.4 (Darwin 25.4.0)
- Platform: Apple Silicon (arm64)
- Broken version: 2.1.88 (yanked)
- Current version: 2.1.87 (stable, downgraded)
- Node: v22.x
- Package manager: npm 11.12.1
Related
- This appears related to the broader token consumption issues reported in #41662 and #41663
- The v2.1.88 source code leak was discussed in multiple community threads
14 Comments
Additional: Double/Triple memory injection bug (token waste across ALL sessions)
During the post-downgrade audit, I also discovered a systemic token waste bug that had been affecting every single session for weeks:
The bug
Claude Code's auto-memory system automatically loads
~/.claude/projects/.../memory/MEMORY.mdinto the conversation context. However, the official hook documentation examples led me to implement:Result: The same memory content was loaded up to 3 times per compaction cycle:
Token impact estimate
Root cause
The documentation does not clearly state that:
Users following hook examples naturally end up duplicating what the system already does, with no warning or deduplication.
Fix applied (user-side)
Suggestion
The documentation should explicitly warn that hook stdout consumes tokens and that memory content should NOT be injected via hooks since the auto-memory system handles it. Ideally, Claude Code should deduplicate identical content injected via multiple hooks.
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
Related — v2.1.88 was installed Mar 31 on my machine, and the rate limit issues started around the same time. v2.1.89 auto-updated Apr 1, problem persists.
Max 20, 100% usage in ~70 min after reset.
Full report: #41788
Related: #38335, #38239, #40790, #6457, #40895, #41055, #38345, #41174, #41550, #41617, #41663, #41779, #41802
News Today?
I've been experiencing the same issue on Max 20 ($200/mo) — rate limit 100% exhausted in ~70 minutes.
After setting up a monitoring proxy using the official
ANTHROPIC_BASE_URLenv var, I identified two cache bugs as the root cause (#40524, #34629) and measured the impact: cache read ratio dropped to 4.3%, meaning ~20x token inflation per turn. After applying workarounds it stabilized at 89-99%.Full analysis with per-request measured data, safe workarounds, and community references (including cc-cache-fix): https://github.com/ArkNill/claude-code-cache-analysis
Update (April 2): v2.1.90 resolves the cache regression that was present in v2.1.89.
Benchmark confirms v2.1.90 achieves 95-99% cache read in stable sessions (both npm and standalone). If you haven't already, update and pin:
Details: https://github.com/ArkNill/claude-code-cache-analysis
Update: v2.1.90 installed — verifying fixes
I've updated to v2.1.90 and I'm currently verifying the fixes in my environment. Here's what I've confirmed so far:
ifcompound commands: now working correctly, restored proper pattern matching insettings.jsonWhat we're still waiting on
While v2.1.90 technically resolves the symptoms, the core issue remains: v2.1.88 was a broken release that auto-updated silently, causing significant token waste and degraded sessions for paying users before we could even notice.
For affected Max plan subscribers who lost substantial token budget during the v2.1.88/89 window, it would be fair for Anthropic to consider resetting or crediting the accounts that were impacted by the broken auto-update. We didn't opt into a buggy release — it was pushed to us automatically, and the token drain was invisible until we investigated manually.
This isn't just about the technical fix. It's about trust in the auto-update pipeline and accountability when a bad release ships to paying customers.
Suggestion for Anthropic
DISABLE_AUTOUPDATERworkaroundsLooking forward to Anthropic's response on this.
April 3 update: The cache regression (Bugs 1-2) is fixed in v2.1.91. However, systematic proxy testing revealed additional unfixed mechanisms — a 200K tool result budget cap, a client-side false rate limiter (151 synthetic entries found), and silent microcompact clearing (327 events). Anthropic responded on X (Lydia Hallie) acknowledging peak-hour tightening but stating "none were over-charging you" — our measured data shows mechanisms their statement does not cover. Full analysis: claude-code-cache-analysis
Related — we hit the same cost spike ($364.87 extra in a single day on a $200/mo Max plan) and traced part of it to a resume context loading regression in v2.1.91.
Source code analysis (v2.1.88 leaked TypeScript vs v2.1.91 minified cli.js) revealed three changes:
walkChainBeforeParseremoved — the fork pruning function exists 2× in v2.1.88 source, 0× in v2.1.91. Large JSONL files (>5 MB) now load all fork branches unpruned.ExYtimestamp fallback —tengu_chain_timestamp_fallback(0× in v2.1.88, 1× in v2.1.91) bridges unrelated messages across fork boundaries via a 5-second temporal window.leafUuidscheck ingetLastSessionLog(line 3900) — picks mid-chain synthetic messages instead of actual conversation leaves.Result:
/resumeloads 644 tokens (0.1%) from a 20 MB session (5,027 lines, 444 user messages). Each failed resume corrupts the JSONL further by forking theparentUuidDAG.Full analysis with exact file:line references, suggested fixes, and Claude Code prompts: #43044
We also built a Go tool to recover session context directly from JSONL files (bypassing the broken resume): https://github.com/kolkov/ccdiag
@ArkNill your proxy-based cache analysis is excellent work — the silent microcompact (327 events) and false rate limiter (151 entries) findings are particularly valuable. Our data confirms the same pattern from a different angle (session JSONL forensics vs API traffic analysis).
Good morning everyone, has anyone received a Recette refund on their account following the issues we’ve had over the past few days? Or, even if it wasn’t labeled as a refund, did they credit your account anyway in our favor, considering the problem originated on their side?
@amicicixp Short answer: no. After searching across the major rate limit / token drain threads (#38335, #16157, #38350, #41930, #21601, #5088, etc.), there are zero confirmed cases of Anthropic issuing a voluntary refund or credit for the token consumption bugs.
The only confirmed refunds were automatic refunds tied to account suspensions/disablements — not compensation for service issues. For example:
Users who actively requested refunds through support have been either auto-rejected (#21601 — $440 request rejected, 22 emails with zero human response) or simply ignored (#29108 — 19 days, no human reply). At least two users have filed formal chargebacks through their credit card companies.
Meanwhile, there has been zero official Anthropic response on any GitHub issue regarding refunds, credits, or compensation for the token drain bugs affecting users since March 23. The situation is effectively being left unaddressed.
Important finding for everyone affected by token drain bugs:
Claude Max individual subscribers fall under Consumer Terms, NOT Commercial Terms. The difference is critical:
| | Consumer Terms (Max subscribers) | Commercial Terms (API/business) |
|---|---|---|
| Arbitration clause | NONE | Mandatory JAMS |
| Class action waiver | NONE | Yes |
| Governing law | Irish law | California |
| Courts | EEA consumers can use local courts | San Francisco only |
This means:
What we know about refund attempts
Per @ArkNill's research above: zero voluntary refunds, $440 request auto-rejected with no human response (#21601), 19 days no reply (#29108), at least 2 chargebacks filed.
Recommended steps
Our data point: $364 extra in a single day on a $200/month plan, caused by resume cache invalidation (#42338), quadratic transcript writes (fixed in v2.1.90 after 20+ versions), and watchdog retry loops (#39755). Rate: $10,920/month.
The token drain bugs are well-documented: resume cache miss lived for 20+ versions (v2.1.69→v2.1.90), cch=00000 Bun attestation bug (#38335) causes 10-20x token inflation, and Anthropic publicly acknowledged that "users hitting usage limits way faster than expected."
Closing for now — inactive for too long. Please open a new issue if this is still relevant.
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.