Claude Code v2.1.218

New safeguards automatically disconnect MCP servers that produce excessive non-protocol data, preventing unbounded memory growth:

• HttpBodyOverflowError: An HTTP SSE transport disconnects when a response body exceeds the size limit without an SSE event boundary. The server is likely returning logs or non-protocol data in the response stream.
• StdoutOverflowError: A stdio transport disconnects when the server writes too much to stdout without a JSON-RPC message boundary. This catches servers writing debug logs to stdout instead of stderr.

Both errors produce a clear diagnostic message including the size at which disconnection occurred.

"Org memory" is renamed to "Synced project memory" throughout the CLI interface. The /config panel now shows:

• "Synced project memory (this directory; applies next session)"
• "Synced project memory writes (enable reads first)"
• "Synced project memory writes (this directory; applies next session)"

File-write warning messages, notes in edited files, and error messages related to memory stores have all been updated to use the new name. Behavior is unchanged.

Two new optional fields appear in per-model usage/pricing records:

• canonicalModel: The canonical model ID used for the pricing lookup (e.g., claude-opus-4-7). May differ from the raw model string when provider-specific IDs or aliases are in use.
• provider: The API provider that served the model: 'firstParty', 'bedrock', 'vertex', 'foundry', 'anthropicAws', 'anthropicGoogleCloud', 'mantle', 'gateway'.

These fields are useful for hooks and third-party cost tracking tools that need to normalize model identifiers across providers.

When a conversation is backgrounded, the terminal now shows more actionable messages:

• Backgrounded by the system: "Your conversation moved to the background — enter opens it · esc returns to it · ctrl+c twice quits"
• Backgrounded and detached from terminal: "Your conversation was backgrounded — resume it with: claude --resume <sessionId>"

These replace the less informative prior messages.

When auto-mode is active and a classifier call completes after the permission mode changes, Claude now falls back gracefully to manual approval with a clear message: "Permission mode changed while the auto-mode classifier call was queued — falling back to manual approval under the current mode".

Previously this edge case could lead to unexpected behavior.

The internal list of "Claude-aware" environment variables has been expanded from a small set to over 80 named variables. This list is used by the hooks system to determine which env vars hooks may set or modify.

A new secondary set (Lvh) covers privacy-sensitive variables (DISABLE_TELEMETRY, DO_NOT_TRACK, DISABLE_ERROR_REPORTING, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC) that hooks may only write when the caller has elevated trust.

This does not change how users configure Claude Code; it tightens the security boundary around which env vars hooks can inject.

Observer activity digests now include two additional event types:

• <guidance-loaded path="...">...</guidance-loaded>: emitted when Claude reads CLAUDE.md or similar guidance files
• <skills-discovered dir="..." names="..." />: emitted when skills are discovered in a directory

These give observer agents fuller context about what the observed agent has loaded, improving the quality of observer reports.

When a session resumes and picks up a forked-skill agent, the resumption path now validates:

1. The scoping record file (.forked-skill.json) must be present and parseable
2. The record must name the same skill as the agent's task record
3. For cold restarts, a provenance-marker witness (.forked-skill.marker.json) must also be present and corroborate the fork identity

If any check fails, the agent refuses to resume and logs a clear error rather than running without its intended permission scoping. This prevents forked-skill agents from running with wrong or missing permission boundaries after a restart.

New infrastructure for MCP servers that require enterprise cross-account OAuth authentication. The flow:

1. Performs Protected Resource Metadata (PRM) discovery against the MCP server URL
2. Exchanges an identity provider ID token for an intermediate JWT Authorization Grant (ID-JAG)
3. Exchanges the ID-JAG for an access token at the authorization server via the urn:ietf:params:oauth:grant-type:jwt-bearer grant type

ID tokens are cached in user config keyed by normalized IdP URL. This is infrastructure for enterprise MCP authentication scenarios; end users will see this flow when their MCP server requires cross-account auth.

Extremely deeply nested React/Ink component trees no longer cause a stack overflow crash. Instead, Claude Code now logs a warning at MAX_TREE_DEPTH and continues rendering the subtree as empty rather than recursing further.

The hook timer description changed from "Stamp each assistant message with its arrival time" to "Stamp each message with its arrival time", reflecting that the stamp now applies to both user and assistant messages in the hook payload.

When /ultrareview is launched with a note (e.g., /ultrareview focus on the auth changes), the note is now recorded at launch time and included in the review results presentation:

> "This review was launched with a note, recorded at launch time: "...". The cloud review did not see the note — it ran a standard review of the diff. When presenting these findings, prioritize and relate them to that note."

Previously the note was not tracked and findings were presented without relation to the user's original intent.

• Observer arm/retire lifecycle fixed: the system now correctly stops observer tasks that are tied to worker subagents when the main agent loop closes, preventing orphaned background observers (search for "agent_observer_stop")
• API key verification no longer forces thinkingConfig: { type: "disabled" }, fixing verification failures on accounts configured with always-on extended thinking
• org-memory discovery mount-name collision handling improved: when a derived mount name conflicts with an existing entry pointing to a different path, the existing entry is renamed aside with _discovered suffix rather than silently skipped (search for "discovered config squatting the derived mount name")
• MCP elicitation pending-count tracking corrected: pendingElicitations counter and lastElicitationClosedAt timestamp are now maintained consistently through all elicitation paths including hook-resolved responses
• Windows path handling in WSL: when running under WSL without USERPROFILE set, IDE config paths are now correctly converted from Windows C:\... form to /mnt/c/... WSL paths (search for "Nzr" function handling Windows-to-WSL path conversion)