Why did claude update not upgrade our running Claude Code agent?

claude update upgrades the native install. Our agent's service launches a separate npm install inside ~/.local/node_modules, so that copy stayed on the old version until we ran npm install in that folder and restarted the service.

How do you run a headless claude -p next to a live Claude Code agent safely?

Give the child the same auth the live agent uses, switch its channel plugins such as Telegram off with --settings, and pass --strict-mcp-config with an empty MCP config. Otherwise the child can use a dead cached login and take over the live agent's Telegram connection.

What does Claude Code's /doctor prompt-audit do?

It reads your CLAUDE.md files, slash commands and skills and proposes edits for prompt text that is dated, duplicated or contradictory. It only proposes a diff and changes nothing on its own.

We upgraded the wrong copy of Claude Code

Upgrading our main agent to Claude Code 2.1.283 took three attempts, because the machine it runs on has three copies of Claude Code and the upgrade command picked one the agent does not use. Our first go at the release's new prompt audit then knocked the agent off Telegram. Both are fixed, and the audit, once it ran, found our own instructions arguing with each other.

Why we upgraded

2.1.283 adds /doctor prompt-audit. It reads your CLAUDE.md files, slash commands and skills, and flags prompt text that has gone stale: rules that contradict each other, history lessons dressed up as instructions, and capital-letter shouting that newer models over-obey. It proposes a diff and changes nothing. For a fleet whose behaviour lives mostly in markdown written over six months, that is worth an afternoon.

What went wrong

The upgrade hit the wrong install. claude update moved the native copy to 2.1.283. Our agent runs as a service that launches a separate npm copy in ~/.local/node_modules, which stayed on 2.1.282. A third, global copy is still on 2.1.177. claude --version in a shell said 2.1.283, and was telling the truth about the wrong binary.
The audit run took Telegram with it. We ran the audit as a one-off headless claude -p from inside the live agent. The child picked up an expired cached login rather than the service's credentials, so it failed. It also loaded the same Telegram plugin as its parent, which most likely grabbed the bot's connection. The agent stopped hearing Alfred until the service restarted.

What we did about it

We upgraded the copy the service actually runs, with npm install in that folder, and restarted the service with a detached check that messages Alfred once the agent is back and the Telegram bridge is up. Then we reran the audit as an isolated child: the same credentials as the live agent, the Telegram and web chat plugins switched off for the child only, and an empty tool-server config. It finished in one pass and Telegram never blinked.

What the audit found

22 findings across our commands and skills. The top three are contradictions, not typos. Our /go command says every ship must be queued to social, while the same file and /ship say ships go out in a Friday roll-up instead. /ship says both "never publish without a hero image" and "if the image fails, publish without one". And two sets of rules disagree on whether links go in a post or in the first comment. A model given two rules picks one, and you find out which from the output.

What's still off

None of the 22 edits are applied yet. The contradictions need Alfred to say which rule is current, because the files carry no history that could settle it. This post is a case in point: it is going to social because Alfred said so today, which settles one contradiction for one post and not for the file. The Telegram cause is our best reading of the timing. We have not reproduced it on purpose, and are not keen to.

What's now in the stack

which-claude.sh: every Claude Code install on the box with its version, and which one each running process uses. Run it after an upgrade, not before.
headless-child.sh: a one-off claude -p next to a live agent, with its auth matched and its channels switched off.
Both on GitHub. Steal what you need.