Hot reload of agents and slash commands

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/4384
2. https://github.com/anthropics/claude-code/issues/3541
3. https://github.com/anthropics/claude-code/issues/3095

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

It is - but it needs attention then :-) - Close it as a dupe

https://github.com/anthropics/claude-code/issues/10348 - This is still a problem as of today.

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

This is still a problem.

From what I understand this is a security risk, as it would allow a prompt injection attack to write a new command / overwrite an existing command and then execute it immediately. This is not official info, but I have seen official info saying the same thing about hooks, so I think it's logical.

IMO that horse has left the barn. They should at least give us a /reload slash command.

If someone has access to modify the slash commands on your system, and the risk is that you execute the command and that's the attack vector, then it's too late: they already have file modification access. Calling this a security risk is just silly, in my humble opinion.

There are so many other security holes in Claude Code (if someone is able to modify files) that auto-reload for active sessions is no reason to argue a security concern for things like prompts.

If they're really paranoid, then they can just make sure that none of the backtick content has changed (in which case /reload should work), but textual content is absolutely safe.

I have a user input hook, so if I run :restart, it kills $PPID, and runs a claude -r <uuid>, with the session number that came from the hook after changing to the working directory. (xdotool types it in since there is no pty in the hook context.) This is the nuclear option that works for me, but it seems like they should be able to support this:

claude-hooks]$ cd /home/u/src/claude-hooks && claude --permission-mode default -r 59d375b8-5e69-42be-a954-a3fdfdd195db

Adding to this discussion with a specific proposal for explicit, user-triggered reload (complementary to automatic hot-reload):

Proposed command: /plugin reload [plugin-name] or /plugin reload --all

This provides:

• Manual control over when reloads happen (addresses security concerns about automatic behavior)
• Selective reload of specific plugins vs all
• Follows existing Claude Code command patterns

The automatic hot-reload discussed here and manual reload command could coexist - auto for development convenience, manual for production control.

Submitted feedback ID: 98715579-0eb6-40a4-b00e-777f39d806fb

This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.

This issue was closed incorrectly despite recent human comments. This behavior of the bot is reported at https://github.com/anthropics/claude-code/issues/16497. Please upvote that issue, so maybe it gets noticed.

Hi, I filed a similar feature request in #23608 and the bot redirected me here as a duplicate — so I thought I'd share a workaround I've been using that fully bypasses the agent reload limitation within a live session.

The Workaround: Read Agent Files → Execute as Subagent Prompt

Instead of relying on the agent discovery mechanism (which only loads at session start), I have the main session use the Read tool to directly read the .md file content from .claude/agents/, then pass that content as a prompt to Task() running as a general-purpose subagent.

Since Read always fetches the latest file content from disk, any modifications to the agent file are picked up immediately — no session restart needed.

Known limitation: This approach cannot inherit YAML frontmatter settings (allowed_tools, model, permission_mode). The subagent runs with general-purpose defaults, so only the system prompt content is applied. For agents that primarily rely on prompt engineering rather than tool restrictions, this is sufficient.

My Use Case: Autonomous Agent Self-Evolution Loop

I've been using this workaround to build an iterative self-improvement loop where Claude Code modifies its own agent definitions mid-session. Here's the full workflow:

Phase 1: Initialization (human-in-the-loop)

1. Ask Claude Code to create an initial Worker Agent (.claude/agents/worker.md) based on the task requirements.
2. Ask Claude Code to create an initial Validator Agent (.claude/agents/validator.md) whose job is to verify the Worker's output and report issues.

Phase 2: First Run & Permission Audit (human-in-the-loop)

1. Instruct the main session to read the Worker Agent file content using the Read tool.
2. Instruct the main session to launch a subagent with the read content as the prompt to execute the task.
3. Similarly, read the Validator Agent file and run it as a subagent to validate the Worker's output.
4. Manually review all permission requests during this round to ensure no dangerous operations (e.g., deleting files, scanning from disk root).

Phase 3: Switch to Autonomous Mode (semi-automated)

1. Once safety is confirmed, restart Claude Code with --dangerously-skip-permissions and instruct the main session to run the following iteration loop:

Phase 4: Iteration Loop (fully automated)

1. Main session reads the latest Worker Agent content → executes as subagent.
2. Main session reads the latest Validator Agent content → executes as subagent to validate Worker's output.
3. Main session analyzes the Validator's report and determines root cause:

• Is it an actual defect in the Worker?
• Or a false positive from the Validator?

1. Main session decides how to improve the Worker and/or Validator, then writes the updates to their respective agent files.
2. Main session logs the iteration's improvements to Claude Code Project Memory for future evaluation.
3. Main session reverts or cleans up the Worker's changes from this iteration.
4. Return to step 8.

Phase 5: Convergence & Handoff (auto-detected → human review)

1. After each iteration, the main session evaluates the improvement log from Project Memory.
2. Termination condition: When three consecutive iterations find no issues or improvements needed, the agent workflow is considered to have reached a steady state — iteration stops.
3. Human steps in for final review and course correction.

---

This workflow effectively turns the hot-reload limitation into a non-issue for my use case. Hope this helps others who need to iterate on agent definitions within a live session.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.