Claude Code v2.1.203

Token-based authentication is now supported for Amazon Bedrock Foundry alongside the existing ANTHROPIC_FOUNDRY_API_KEY. When ANTHROPIC_FOUNDRY_AUTH_TOKEN is set, it is used directly as a bearer token instead of deriving credentials from the API key.

export ANTHROPIC_FOUNDRY_AUTH_TOKEN="my-bearer-token"
claude

A new internal env var preserves terminal dimensions across session relaunches. When Claude Code spawns a replacement process (upgrade self-respawn, background detach), it captures the current terminal size as COLUMNSxROWS and passes it forward so the new process renders at the correct width and height even when the TTY reports wrong dimensions.

Past sessions from earlier work can now appear in the fleet/sessions view alongside active ones. When enabled, previously completed sessions are loaded from transcript history and interleaved with live sessions in modification-time order.

The break reminder interval defaults have been significantly reduced. The reminder now fires every 30 minutes of continuous use (down from 120 minutes), and 10 minutes of inactivity resets the timer (down from 15 minutes). New short intervals (5 min, 15 min) are available and the longer 2/3/4-hour options have been removed.

Before:

• Default interval: Every 2 hours; inactivity reset: 15 minutes
• Available: Off, 1h, 2h (default), 3h, 4h

After:

• Default interval: Every 30 minutes; inactivity reset: 10 minutes
• Available: Off, 5m, 15m, 30m (default), 1h

Invalid proxy env vars (https_proxy, HTTPS_PROXY, http_proxy, HTTP_PROXY) are now detected and reported clearly at startup and in /doctor.

• At startup: logs Invalid proxy URL in https_proxy: "<value>" cannot be parsed as a URL. Proxy settings must be a complete URL including the scheme, e.g. "http://proxy.example.com:8080". Fix or unset https_proxy and restart Claude Code.
• In /doctor's connection section: shows (invalid — ignored; fix or unset the proxy env var) next to the bad value
• Previously, bare hostnames or partial URLs were passed directly to the HTTP client and could cause confusing failures

When Claude Code cannot start a command because the OS argument/environment limit is exceeded (E2BIG), it now surfaces a detailed diagnostic instead of a generic spawn error:

Could not start bash: the command line plus environment exceed the OS exec argument
limit (E2BIG). At spawn: command line 12.3 KB across 47 args (largest single arg
4.1 KB); environment 38.9 KB across 312 vars (largest: MY_VAR at 2.1 KB).
The Bash sandbox profile adds 2847 filesystem deny paths to every command, 87 of
them for registered git worktrees, which grow this list without bound. From another
terminal, remove worktrees you no longer need (git worktree remove <path>; git
worktree prune for already-deleted checkouts), then restart Claude Code so the
profile is rebuilt without them — or relax the Bash sandbox for this session with
/sandbox.

The message reports command-line size, arg count, largest arg, environment size, var count, and largest env var. If the Bash sandbox deny list is a factor, it identifies how many paths come from accumulated git worktrees and gives remediation steps.

When Claude is blocked on a cybersecurity topic, the message now links to the Cyber Verification Program help article and adds a feedback prompt:

Before: pointed to https://claude.com/form/cyber-use-case

After: "…has safety measures that flagged this message for a cybersecurity topic. To learn about the Cyber Verification Program and apply for access, visit our help center: https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude." If the user was not engaging in a cybersecurity topic, the message now adds: "If you were not engaging in a cybersecurity topic, please send feedback via /feedback."

The description for the url parameter in the Artifact tool has been rewritten to cover more update scenarios:

Before: "Pass when the user gives you a URL for an artifact not published in this session."

After: "Pass whenever the user wants to update an artifact this conversation did not publish — 'update my artifact', 'keep the same link', a pasted artifact URL — and find the URL with action: 'list' if you don't have it; without this, a conversation that didn't publish the artifact always mints a new URL."

This teaches Claude to proactively use action: "list" to locate the URL rather than waiting for the user to paste it.

The first action: "list" call within any session now always requires user confirmation, even if the user has previously allowed artifact listing. A permission prompt appears: "Claude wants to list your published artifacts (titles and links from your earlier sessions)."

action: "list" now enforces that no publish-related fields are present:

• If any field other than action or limit is set, the tool returns an error: ` action "list" takes only limit — remove <fields>. To publish or update an artifact, omit action. `
• Passing limit with a publish action now returns an error: ` limit applies only to action "list" `

When updating an artifact that has been shared (via the claude.ai share menu) but the shared version is not the latest, Claude now surfaces a warning in the tool result:

"This artifact is shared, and viewers are pinned to an older version — they will not see this update until the user moves the shared version forward from the page's share menu."

The favicon validation error message is now more specific:

Before: "favicon must be one or two emoji — no markup"

After: "favicon must be the literal emoji character(s) — not an HTML entity, quoted string, or markup (send 📊, not '&#x1F4CA;' or '<svg/>')"

The path parameter now resolves worktrees from repositories nested inside the launch directory, not just the exact current repo. This enables entering an existing worktree that belongs to a sub-repo in a multi-repo workspace.

Several worktree operations now handle lock-state edge cases more carefully:

• Stale-lock self-heal failures are now logged: [worktree] skipped the stale-lock self-heal for <path>: <reason>
• When the worktree registry is unreadable, operations log [worktree] left the lock on <path> — cannot read the worktree registry to verify ownership
• cleanupWorktree logs when it keeps a worktree because the registry is unreadable, instead of silently skipping cleanup
• cleanupStaleAgentWorktrees logs each kept worktree with the lock reason

When an isolated agent's worktree has been removed externally and the only fallback would be running in the parent session's shared checkout, the agent now refuses to run and reports the problem:

"This agent is isolated in the worktree <path>, but its working directory <cwd> no longer exists and the only recovery target is the parent session's shared checkout. Refusing to run there — the isolation worktree appears to have been removed. Report this instead of retrying."

Previously the agent might silently run commands in the parent directory.

When a file attachment upload fails in the IDE bridge (VS Code / JetBrains), the failure is now returned as a structured error object to Claude rather than silently dropped. Claude can then inform the user of the specific failure reason:

• "upload failed: no OAuth token available"
• "upload failed: could not read file (<reason>)"
• "upload failed: server returned <status>"
• "upload failed: unexpected server response"
• "upload failed: network error (<reason>)"
• "upload aborted" (when the request was cancelled)

When auto mode blocks an action, Claude now receives clearer guidance on how to handle the situation:

1. First try an alternative that no rule blocks (feature branch instead of default branch, synthetic data instead of real data, narrower scope).
2. If a consent ask must be raised, hold it and batch it with other outstanding asks rather than ending the turn immediately.
3. Format each consent item as a single concise sentence with the affected item in bold.
4. If the block seems wrong, say so directly: "auto mode blocked X because Y — is that wrong?"

The tip that appears in Claude Code now accurately describes what /code-review does:

Before: "/code-review runs three review agents on your changes — reuse, quality, efficiency — and fixes what they find before you commit."

After: "/code-review checks your diff for correctness bugs and cleanup opportunities before you commit — add --fix to apply what it finds."

The advisory shown to Pro-plan users running Opus who have consumed more than half their weekly limit now refers to Sonnet 5:

Before: "Sonnet 4.6 handles most coding tasks and uses your weekly limit roughly half as fast as Opus."

After: "Sonnet 5 handles most coding tasks and uses your weekly limit much more slowly than Opus."

The domain claude.com/docs is now in the set of pre-approved domains that can be fetched without a permission prompt. This includes Claude Tag pages and other documentation at the claude.com docs domain.

When saving the TUI renderer setting, the confirmation message now includes the name of the renderer that was chosen:

Before: "Background sessions always use the fullscreen renderer so scrolling and mouse work when attached. The tui setting applies to sessions started directly with claude."

After: "Saved. Background sessions always use the fullscreen renderer while attached; the <renderer> renderer will apply to sessions started directly with claude."

When stdin is unreadable (e.g., the process was launched without a proper stdin pipe), Claude Code now emits a clear warning and continues rather than failing silently:

"Warning: stdin is unreadable (<reason>), proceeding without piped input. If you piped input, it was not received — pass it as a prompt argument, or check that the process launching Claude Code wires stdin to a pipe or /dev/null."

The tmux option queries (mouse mode and focus-events state) are now performed once and cached per session. Previously each check that needed the tmux mouse or focus-events status spawned a new tmux show subprocess. The cached results are shared across all callers within the session.

• Worktree deleteJob now correctly detects live-process locks when deciding whether to remove an owned worktree (search for "locked by a live Claude Code process, or with a reason we did not write")
• reapJobWorktreeIfSafe now logs why it kept a worktree that had a non-owned lock, instead of silently skipping it (search for "reapJobWorktreeIfSafe: kept")
• Transcript retention cleanup is now skipped (with a logged reason) when settings contain parse errors that prevent reading cleanupPeriodDays, to avoid deleting transcripts with an unknown retention period (search for "Transcript retention cleanup is paused until the settings errors above are fixed")
• stream-json stdin errors now produce a proper diagnostic message instead of a generic failure (search for "getInputPrompt: stream-json stdin unreadable")