Tools reference changedtools-reference
Nearest release: v2.1.321, published an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 9 Nov 2026 21:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Nov 2026 21:07 UTC.
Upstream edited
Recorded here
Lines+14added
Lines−3removed
From line
386
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits87to this page, all time
#### Bash rules that deny or prompt for WebSocket watches
The whole hunk
from line 386, old and new numbered
/
from line 386
386386
387387When Monitor runs a command, it uses the same [permission rules as Bash](https://code.claude.com/docs/en/permissions.md#tool-specific-permission-rules), so `allow` and `deny` patterns you have set for Bash apply here too. While [auto mode](https://code.claude.com/docs/en/permission-modes.md#eliminate-prompts-with-auto-mode) is active, Claude Code sets aside allow rules that name `Monitor` itself, along with the other [broad allow rules it drops](https://code.claude.com/docs/en/permission-modes.md#how-the-classifier-evaluates-actions), so the classifier reviews Monitor commands the same way it reviews Bash commands.
388388
389The [WebSocket source](#websocket-source) has its own approval prompt, which the classifier also decides in auto mode.
390
391389Monitor needs a minimum version or Git Bash in these cases:
392390
393391* **Minimum version**: on Amazon Bedrock, Claude Platform on AWS, Google Cloud's Agent Platform, or Microsoft Foundry, or with `DISABLE_TELEMETRY` or `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` set, Monitor requires Claude Code v2.1.310 or later. The requirement applies when [feature-flag fetching](https://code.claude.com/docs/en/env-vars.md#features-that-need-feature-flag-fetching) is off
from line 411
413411
414412The `timeout_ms` deadline applies to a WebSocket watch too: the watch ends at the deadline, and `TaskStop` cancels it early.
415413
416Opening a WebSocket prompts for approval; in [auto mode](https://code.claude.com/docs/en/permission-modes.md#eliminate-prompts-with-auto-mode) the classifier decides instead. The prompt doesn't offer an option to skip future prompts for the same host.
414Without a `Monitor` allow rule, you're prompted before Claude opens a WebSocket; in [auto mode](https://code.claude.com/docs/en/permission-modes.md#eliminate-prompts-with-auto-mode) the classifier decides instead, unless an [ask rule](#bash-rules-that-deny-or-prompt-for-websocket-watches) applies. The prompt doesn't offer an option to skip future prompts for the same host.
417415
418416Claude Code denies URLs that point at a private, link-local, or cloud-metadata address, including hostnames that resolve to one. It also denies hosts in `sandbox.network.deniedDomains`, and when [`allowManagedDomainsOnly`](https://code.claude.com/docs/en/settings-reference#sandbox-network-allowmanageddomainsonly) is set in managed settings, any host outside the managed allowlist.
419417
418#### Bash rules that deny or prompt for WebSocket watches
419
420If Claude Code refuses a `Monitor` call that opens a WebSocket, look for a [deny or ask rule](https://code.claude.com/docs/en/permissions.md#manage-permissions) written `Bash` or `Bash(*)`. Do the same if it prompts for that call despite your `Monitor` allow rule. A rule on every Bash command also covers these WebSocket watches:
421
422* **Deny rule**: if the rule is in place when the session starts, Claude doesn't have the Monitor tool, so it can't start the watch. If you add the rule during a session, Claude's next `Monitor` call is refused. The refusal reads `Permission to use Monitor has been denied: it runs code as Bash does, and a rule denies Bash.`
423* **Ask rule**: you're asked to approve the watch. You can't have an allow rule, a `PreToolUse` hook, `bypassPermissions` mode, or the auto mode classifier approve it for you. You can approve it from a [`PermissionRequest` hook](https://code.claude.com/docs/en/hooks#permissionrequest). Where nobody can answer, such as in `dontAsk` mode, Claude Code denies the watch.
424
425To let these watches run, narrow the rule to the commands you mean, such as `Bash(rm *)`.
426
427The ask rule, and a deny rule you add during a session, cover these watches in Claude Code v2.1.319 or later.
428
420429## NotebookEdit tool behavior
421430
422431NotebookEdit modifies a Jupyter notebook one cell at a time, targeting cells by their `cell_id`. It doesn't perform string replacement across the notebook the way [Edit](#edit-tool-behavior) does on plain files.
from line 599
590599* Non-interactive `-p` runs and [Agent SDK](https://code.claude.com/docs/en/agent-sdk/overview.md) sessions, which have no screen to review the queue on
591600* [Cloud sessions](https://code.claude.com/docs/en/claude-code-on-the-web.md), which can't write to the queue on your machine
592601* Sessions on [Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock.md), [Claude Platform on AWS](https://code.claude.com/docs/en/claude-platform-on-aws.md), [Google Cloud's Agent Platform](https://code.claude.com/docs/en/google-vertex-ai.md), or [Microsoft Foundry](https://code.claude.com/docs/en/microsoft-foundry.md)
602* Sessions that reach Claude through an [LLM gateway](https://code.claude.com/docs/en/llm-gateway) with the gateway's own key or token
593603* Sessions where you set [`CLAUDE_CODE_SEND_FEEDBACK=0`](https://code.claude.com/docs/en/env-vars) or [`DISABLE_FEEDBACK_COMMAND=1`](https://code.claude.com/docs/en/env-vars), set `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` to any non-empty value, or turned off [feature-flag fetching](https://code.claude.com/docs/en/env-vars.md#features-that-need-feature-flag-fetching)
594604* Organizations that have turned off product feedback, [organizations with Zero Data Retention](https://code.claude.com/docs/en/zero-data-retention.md#features-disabled-under-zdr), and organizations with the [HIPAA configuration](https://code.claude.com/docs/en/hipaa-setup.md) applied
605* Sessions where Claude Code has [stopped offering feedback after a refused report](https://code.claude.com/docs/en/errors.md#feedback-is-disabled-by-your-organizations-policy)
595606
596607## Task tool availability
597608
No line in this hunk matches that.