Of this build's 31 gated additions, none are switched on yet. They include code for a headless claude -p --cloud run whose enabling switch returns false, and an Anthropic plugin directory marketplace that is compiled out. A new compact prompt footer with an artifacts shortcut is also built but switched off, so the old footer stays. Dark-launched work would let Claude Code offer to sign in to an MCP server again with wider permissions when a tool call is refused for missing scope, and let Remote Control download up to 16 attachments before the message that uses them arrives.
Opus 5.5 (claude-opus-5-5) now fills the Opus slot in the model picker in place of Opus 5, with default effort set to medium; it is one of 280 usable changes. Setting CLAUDE_CODE_MCP_APPS_HOST to true tells MCP servers that Claude Code accepts MCP App content. Setting CLAUDE_CODE_CCR_EARLY_REMOTE_CONNECT makes a resumed --sdk-url session open its remote connection before the rest of startup finishes. /focus now works in non-interactive sessions such as the SDK, and a hidden --await-claim option lets an SDK host start a spare process early and bind it to a session later. Plugin hooks modules gain $.state.get and $.state.set, a versioned shared store where only a value's owner can write it.
Resuming a conversation gets two of the 57 fixes: messages split away from their response are moved back beside it, and messages whose tool results are all interrupted or missing placeholders are no longer dropped. A response stream that ends early is now treated as a dropped connection and retried, with the message 'Connection closed before the response finished'. Hooks that call MCP tools now wait for a server that is still connecting instead of being skipped. Uninstalling a plugin no longer deletes install folders that other plugins still use, and a scheduled task whose run throws an error no longer disrupts scheduling.
Written by our agent from the shipped bundle, not by Anthropic.
The bundled model catalog now puts claude-opus-5-5 (Opus 5.5) in the Opus picker slot with medium thinking effort, and the in-app release notes announce it
Sessions & agentsPlugin hook modules can read and write shared, versioned values with $.state.get and $.state.set, under static and runtime checks
ExtensionsWith CLAUDE_CODE_MCP_APPS_HOST set to true, Claude Code tells MCP servers it accepts MCP App content
ExtensionsA hidden --await-claim option lets an SDK host start a spare Claude Code process early and bind it to a session later
A new /focus [on|off] works in non-interactive sessions, and session init now reports view_mode and per_turn_effort_active to SDK hosts
Extensions
claude -p --cloud headless cloud-print path added, but compiled offSessions & agentsWant the reasoning? Read walks the 62 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
The bundled model catalog now puts claude-opus-5-5 (Opus 5.5) in the Opus picker slot with medium thinking effort, and the in-app release notes announce it
Unclear The finding does not say which product or context the cc surface refers to.
Code for an Anthropic plugin directory marketplace is present but cannot switch on in this build
Unclear The finding does not say what makes a plugin "record-bound".
Two new Artifact tool experiments: capabilities inherited from Anthropic-published types, and v0/v1/v2 variants of the tool's guidance text
Unclear The finding does not say what an inherited type grant changes about artifact permissions.
Prompts for dangerous commands like rm in auto or bypass mode deny after 2 minutes by default and stop appearing after 3 unanswered
A new prefetch_attachments request lets Remote Control download up to 16 files early, and a new claim_session request targets parked spare processes
Sessions run by Claude Desktop through a gateway pass that status to child processes, defer consent in background, and verify the gateway's policy
Plugin hook modules can read and write shared, versioned values with $.state.get and $.state.set, under static and runtime checks
A new compact prompt footer with an artifacts shortcut is built in but switched off at build time, so the old footer stays
With CLAUDE_CODE_MCP_APPS_HOST set to true, Claude Code tells MCP servers it accepts MCP App content
Unclear The finding does not say whether Claude Code actually displays that content, or how.
A hidden --await-claim option lets an SDK host start a spare Claude Code process early and bind it to a session later
Claude Code can offer to sign in to an MCP server again with wider permissions when a tool call is refused for missing scope
A new stripped-down way to start a cloud session from a prompt, or join an existing one, has been added
Unclear The finding does not say which command or flag reaches this new path.
A new /focus [on|off] works in non-interactive sessions, and session init now reports view_mode and per_turn_effort_active to SDK hosts
Unclear The finding does not make clear which way of running Claude Code counts as submitting on local stdin.
/insights now counts per-session permission prompts, file edits and destructive commands, and can suggest auto mode or /auto-mode-setup
With CLAUDE_CODE_CCR_EARLY_REMOTE_CONNECT set, resumed SDK/cloud sessions open their remote link early and hold incoming events until startup finishes
Unclear The finding calls CLAUDE_CODE_CCR_EARLY_HYDRATE_PREFETCH both existing and new, so whether it first appears in this build is unclear.
Behind tengu_velvet_panda, the send-now key can push queued messages into a running turn without stopping it
Claude Code now recognises a new remote_projects entrypoint, classified as a remote session, plus a new remote-control-app tag
Unclear The finding does not say where remote_projects is reached from or what it looks like to a user.
Setting CLAUDE_CODE_AUTO_MODE_SERVER now turns server-side review of auto mode actions on or off on first-party connections, not only third-party ones
Unclear The finding does not say what the "arbiter" mode does differently for a user.
server_prompt and computer_folder for SDK hosts#can_use_tool permission requests gain untrusted server_prompt and computer_folder fields, forwarded to the SDK canUseTool callback
Unclear The finding does not say what computer_folder is used for once it is accepted.
The prompt footer can now select artifacts and open them, and the artifacts list gains session grouping, filter tabs and key hints
Claude Code can tell MCP servers it supports URL and form requests for input, behind a flag whose fallback is false and a per-server denylist
Updating plugins from anthropic-plugin-directory refreshes the marketplace first, and pinned directory plugins are refused in this build
Remote Control has a new mode that holds back the full transcript upload until a client opens the session, controlled by remote config
A new internal SDK message reports when a conversation stops sending effort on every turn
CLAUDE_CODE_TETHER_LIVE and CLAUDE_CODE_MCP_APPS_HOST join Claude Code's protected set of environment variables
Unclear The finding does not confirm that being in the protected set stops settings env blocks from setting these variables.
A new environment variable, CLAUDE_CODE_COMMIT_BETWEEN_KEYS, is read by the terminal display code and counts as off when unset
Unclear The finding does not say what setting the variable changes about how the screen is drawn.
The Agent SDK can now read tool lists from in-process MCP servers itself and pass them to the CLI when it starts
The gateway config accepts telemetry.resource_attributes, labels passed to spawned sessions when telemetry.forward_to is set
When a cloud session's container is replaced, Claude's commits, staged changes and working files can now be restored instead of starting over
Cloud directory sync can now send each turn as a chained link and restore an earlier environment's work
Plugin toast messages can appear as stacked boxes in the top-right corner that you can hover to keep open or click to dismiss
Unclear The finding does not say which hosts set stacksToasts to true.
Claude for Financial Services, Claude for Legal and Claude for Life Sciences now appear in the 'Curated by Anthropic' marketplace suggestions
The remote_projects entrypoint is now allowed to use managed cloud-worker features
Unclear The finding does not say what the remote_projects entrypoint is or how a user reaches it.
Admin marketplace entries asking for auto_install or required are treated as available, with a warning, unless pinned by commit SHA or manifestSha256
CLAUDE_CODE_SUBAGENT_MODEL_FORCE joins a list of passed-on env vars, and RUNNER_ENVIRONMENT is added next to GITHUB_ACTIONS
Unclear The finding does not say what either list is used for.
Spend-limit, fast mode and 1M-context usage-credit messages now point to /usage-credits when available, or tell you where to turn credits on based on your role
Unclear The finding does not say what the message shows when the command is unavailable.
--agents now accepts a path to a file of subagent definitions, but only with --print (-p); interactive sessions still need inline JSON
The /artifacts panel shows this session's artifacts sooner, opens attached ones with Enter, and lists 10 rows at a time
Programs using the SDK can now change the session's permission mode when they allow a tool
Arrow keys can now move focus to the nearest item in that direction when the focused item does not use them
The /hooks view gains a per-hook detail pane and clearer wording for when hooks are disabled or restricted by your organization
The SDK conversation_reset message gains optional trigger, user_message_uuid and timestamp fields, and ultraplan's fresh-session flow sets its trigger
Tools you block with --disallowedTools now stay blocked in cloud sessions you start
Plugins can now call session.version
Unclear The finding does not say which version session.version returns.
Managed config entries accept serve_to_desktop, and marketplace entries no longer need a SHA-256, falling back to available without one
Unclear The finding does not say what desktopSessionPayload does, or which product the version 1.32352.0 belongs to.
Building the plugin list now reads each plugin's own autoUpdate setting
Unclear The finding does not say whether the setting is shown in the list or how it is set.
--disallowed-tools now passes through to new cloud sessions; attaching with a deny list or an unclosed rule gets a clear error
The /plugin manage list now shows plugins, skills and MCP servers in aligned columns, with sign-in needs spelled out
The offer message gains a link to the offer and a tip to run /web-setup to connect GitHub for cloud sessions
Unclear The finding does not say what the offer is or when the message is shown.
/batch now runs outside a git repository when a WorktreeCreate hook is configured, publishing through the project's own version control
/install-github-app now runs in one 'Install GitHub App' dialog with step titles and key hints, and is sturdier against stale input
claude agents view now honours --settings, --managed-settings and setting sources#claude agents now applies --settings, --managed-settings and --setting-sources
awsAuthRefresh and gcpAuthRefresh commands now stop together with everything they started on timeout, cancel or shutdown
The first-turn wait for MCP servers now follows MCP_CONNECT_TIMEOUT_MS (default 5000 ms) and no longer stalls when fetching their config fails
claude plugin update now auto-detects the scope by default instead of assuming the user scope
Unclear The finding does not say how auto-detect chooses a scope or what scope is used when --cowork is set.
plugin validate now checks MCP server entries and warns about unquoted placeholders in hook commands
claude --tmux --worktree now checks managed policy, cleans its environment and forwards arguments correctly#Launching with --tmux and --worktree now enforces managed policy, stops parsing at --, passes a clean env and makes path arguments absolute
Unclear The finding does not say which environment variables are kept or dropped when tmux is started.
Using --bg with --agents pointing at a file now fails; pass the agents as inline JSON instead
--no-session-persistence is checked earlier and takes effect at once, and --managed-settings and setting sources are passed to child processes
Unclear The finding does not say what condition decides whether the agent and agents options are passed to the child process.
The /install-github-app wizard drops its step subtitles, limits Escape to the sign-in step and can no longer create the workflow twice
Unclear The finding does not say whether steps other than sign-in still offer another way to cancel.
The /loops list now scrolls, fits the terminal and keeps your selection when the list changes
Unclear The finding does not say whether /loops can now be run, or is still disabled in this build.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
19 more of these are in What probably matters to you, above.
profiles lookup for people's names, with one-read approval#Artifact read_db can now turn user ids into display names, with a one-read approval and a wider consent notice for shared pages
Claude Code adds a high-priority warning for when a Stop hook reaches its limit on blocking
Unclear The finding does not say what the limit is or what happens after the warning appears.
27 more of these are in What probably matters to you, above.
Auto mode's safety classifier can give up at its deadline under rate limits and now passes the API's requested wait on to the model
Worktree isolation is refused in diskless sessions, remote isolation falls back to a local agent there, and remote isolation eligibility changed
The bundled Claude Desktop admin schema adds dictation, SSH, M365 and stream-timeout keys, validates forceLoginOrgUUID and deprecates allowOptionalClientAuth
Plugin install rejects IDs under reserved marketplace names, and install, load and update now track directory plugins and run a source check
Plugin installs, and the dependencies they pull in, now go through a policy check that explains refusals and notes when a plugin starts disabled
One model in the bundled model selector config drops always_on thinking and now requires Claude Code 2.1.280
Unclear The finding does not name the model this entry describes.
In diskless sessions, oversized command output is cut off instead of saved to a file, and Claude is not told to read output files
Unclear The finding does not say how a session is launched in diskless mode.
Dev-intent detection recognises iOS work from strong evidence alone, re-runs when you change directory, and old config keys are removed
mcp_set_servers after the turn starts#In remote sessions, MCP servers added with mcp_set_servers can connect in the background, with the next turn waiting up to 8 seconds
Unclear The finding does not say what triggers a set_servers call or how the relay decides which servers to mark.
Cloud sessions now tell Claude clearly when a call to your computer could not run, and why it might have failed
Sessions stuck at the login notice now notice when you log in from another Claude Code process and clear themselves
Unclear The finding names tengu_streamed_thimble but does not say whether that gate controls this watch.
Directories added mid-session now survive a relaunch or background handoff, and reattached sessions run untrusted with a warning when trust is missing
Plugins installed from the plugin directory now update automatically unless you set autoUpdate yourself
Unclear The finding does not say how a plugin comes to have the plugin directory as its source.
Artifact comments can now come back with commenters' display names instead of only account IDs
Unclear The finding does not say whether names are included by default or only when something asks for withNames.
The apps gateway no longer sends managed policy to Claude Desktop sessions unless that policy includes a desktop-specific version
Auto mode's safety checker keeps working when the API does not support message threads
Thinking now stays on for models that do not allow it to be switched off, and /config shows it locked
Unclear The finding does not name which models carry the rejects_disabled_thinking capability.
An artifact permission you already approved no longer skips the prompt when the request is marked as not covered by that approval
Unclear The finding does not say which kinds of request get the heldYesDoesNotCover mark.
In auto mode, tool calls that Claude Code generates itself now skip the classifier and are allowed
In auto mode, a shell action the server classifier skipped or left to the client is now allowed by the tool's own rule
Coordinator mode can tell the coordinator to load a skill before briefing workers, when CLAUDE_CODE_COORDINATOR_SKILL_GUIDANCE is set
Remote Control sessions now run in a git worktree whenever the server asks for one, and run in place if the folder is not a git repo
When an organization disallows memory sync, it now counts as configured but "closed" instead of switched off entirely
Unclear The finding does not say what a user sees differently when memory sync is blocked by the organization.
The /config settings panel is now told whether remote tool serving is on
Unclear The finding does not say what the panel shows with this value or what remote tool serving does.
In auto mode, shell commands allowed locally by sandbox or read-only rules can now be held for a server-side classifier to review
Unclear The finding does not explain what a "served call" is or how the arbiter modes are chosen.
In host-managed gateway sessions, parentSettingsBehavior defaults to merge and remote managed settings are no longer cached on disk
Unclear The finding does not say which entrypoints qualify for the new "merge" default.
Model-switch failures now carry a code and only mention /model where it exists, and a model chosen at launch is no longer checked with the server
The rm/rmdir safety check now tracks shell variables and requires approval for targets like $VAR/usr or a bare backslash path
The notice shown when auto mode falls back to billed classifier requests can now appear in SDK hosts, and ignoring it is not consent
Plugin install accepts new replace and switch options and new failure reasons, though the replace paths cannot run in this build
Unclear The finding does not say what more-installed-than-shown or directory-pin-unsatisfied mean for the person installing.
The folder trust check now returns which parent folder's trust applies, drops an unconditional bypass, and always returns true or false
Unclear The finding does not say under what condition the removed shortcut applied.
Commands like rm -rf $(...) now always stop for approval, even with broad allow rules, unless an env var or flag turns this off
Remote Control can now set how thinking is displayed along with the thinking budget, unless the local user already chose a display
File sync no longer deletes or replaces files you have open; it waits and retries them later
Opening the footer's frame item now runs /artifacts; cycling and dismissing frames from the footer are gone
Emergency compaction now tries summarizing only the first round before dropping it
A prompt queued mid-turn now keeps its IDE selection, shows it in the queue and keeps it if handed back for editing or dropped by a hook
Some non-interactive sessions get high-load errors without the /model hint, and 429 errors report their message more reliably
Unclear The finding does not say exactly which sessions get the shorter wording, beyond some non-interactive ones.
On macOS, Claude is now told how to recognise sandbox blocks on local ports and on open/osascript, and what to offer the user instead
Unclear The finding says the /sandbox exclude and ! suggestions appear only in a "non-auto" branch but does not say what that mode is.
Cloud file sync gains new error messages explaining why syncing or safe file placement is not working on this machine
Unclear The finding does not say where in Claude Code these messages appear or what "safe file placement" does.
Cloud agent runs that stop to wait for input now wait up to 10 minutes for an MCP question and fail quickly for any other kind of prompt
A file-sharing tool now checks files against a list of allowed file types
Unclear The finding does not name the tool or say what the documents option adds.
Disabling a plugin now works out which enabled plugins depend on it
Unclear The finding does not say what is done with the dependents or what staleBasis and deferred mean.
The bundled deep-research workflow's scoping step now returns only search angles, without a question or summary
Unclear The finding does not settle whether the gate turns off the whole workflow or only Claude's ability to start it on its own.
Listing remote-control servers with claude daemon remote-control now shows an extra section
Unclear The finding does not say what the extra data contains.
When the cloud sync service refuses access, Claude is told once that your latest local changes may not be arriving
Cloud file sync now reports credential-named files already on origin and cloud file names it cannot write locally
Whether a folder can be synced to the cloud now also depends on its total size, not only its file count
Unclear The finding does not give the size limit.
Choosing "always allow" on a prompt raised by a safety check the classifier cannot approve no longer saves a rule
Hook session.start now skips if it is no longer wanted after modules load, and session.end waits for its fallback under the timeout
Unclear The finding does not say what condition the still-wanted check tests for session.start.
--continue now records where a resumed session came from, and attaching to a cloud session passes on extra working directories
Unclear The finding does not say what recording resumeSource: "store" changes for someone using --continue.
When another writer changed files a publish touches, the agent is told which files, up to 20, and to re-read, re-apply and publish again
Unclear The finding does not say what "publish" refers to or where a user would meet it.
Three new reasons explain why a remote machine has not received a session's file changes: held_open, turn_end and awaiting_container
New notices cover Windows not reporting the Documents folder, and cloud sessions with no repository but synced project files
Unclear The finding does not say which of the computer's tools are withheld.
Plugin UI elements can now refuse a value when pressed and held, and ui.render runs inside a drawing context
Unclear The finding does not say what running ui.render inside a drawing context changes for plugin authors.
Reasons for home settings not reaching a cloud session are more specific, and 'sync kept failing here' is removed
Unclear The finding does not give the wording shown for the switched_off reason.
In cloud sessions, Claude is now told when your blocked changes start reaching its checkout again, and to re-read files
Non-interactive runs now tag the reply to an unavailable slash command with commandOutcome of unavailable_headless
Directory sync now tells you what happened to Claude's commits and why a file was not installed
When auto mode denies an action, Claude is now told not to reach the same result any other way
After directory sync in cloud sessions, Claude now gets notices for more cases where your history and the cloud's differ
Manage marketplaces now marks built-in marketplaces that are turned off or blocked
The self-hosted runner now routes GitHub calls by path, passes staged files as arguments and can inline subagent prompts
Unclear The finding does not say how a reader starts the self-hosted runner or what inlining the subagent prompt changes in a session.
A missing or invalid API key notice now clears itself when you log in from another Claude Code window
After the provider-switch wizard finishes, pressing Enter restarts Claude Code and shows "Restarting Claude Code…"
The /plugin list scrolls with the mouse wheel, has a scrollbar, and counts plugins that need sign-in
The Dynamic workflows list now scrolls and shows each workflow's run time, agent count and token total
The Discover plugins screen can open pre-filled with a search or marketplace, filter by marketplace, and handles blocked marketplaces
Unclear The finding does not say what opens the screen with initialMarketplace or initialSearchQuery already set, or which marketplace sources are affected by the "blocked" check.
Claude Code now warns when all instruction files together pass a total size limit, naming the three largest
Bash command permission matching changed for quoted globs, git and docker, and the approval messages for writes and pipelines were reworded
Unclear The finding does not say which condition was removed from the safe-command check, or what the new git sub-checks look for.
When a marketplace refresh falls back to the old copy, its last-updated time stays put, and stale catalog caches can now be used
Directory sync now reads core.sparseCheckout, so files skipped by a sparse checkout are no longer uploaded as deleted
The self-hosted runner now separates start failures from exits and names disableSideloadFlags when managed settings refuse the launch
A new folder_too_large refusal starts a cloud session without the folder's files and lists the largest ones to trim
A 'Stop ultrareview?' dialog now appears before stopping a running ultrareview, including from the background task list
Claude Code now auto-connects only to an IDE whose open workspace contains your current folder, and also lists IDEs open on a subfolder
Link-based MCP input requests keep their ID only when the client has a channel to report completion
Fetching remote managed settings now refuses gateways that resolve to a public address and reports more about failures
Managed settings fetched through a cloud gateway are refused, without retrying, if the gateway's name resolves to a public address
Claude's correction note for an earlier remote tool call can now say the call "was reported as interrupted"
Unclear The finding does not say when this correction note is sent to Claude.
Whole-PDF reads can skip a page-image render that only fed telemetry, and PDF renders can now be cancelled
The message refusing to link some sessions to a personal computer no longer names the Anthropic monorepo
Remote tool calls are refused with declined_spelling when a path is written in a form the session's path rules cannot match
Permission prompts that auto-deny after a timeout now show the same countdown deadline as denial-limit fallback prompts
The artifact read action's not-a-URL error now names the design tool when it is available
Unclear The finding does not say what the background step after publishing does or when its condition holds.
Publishing to an existing artifact can now re-fetch that artifact's type contract first when none was supplied
Unclear The finding does not say which publish modes allow the refresh.
Instructions telling Claude when remote file sync output arrives were reworded, and a sentence about being told when sync cannot happen was removed
When the sandbox network classifier is told to wait by the API, its deny is held for that time instead of rechecked on every request
A new refusal reason says Claude Desktop's gateway is not an accepted source of managed settings on this machine
Claude Code no longer opens the server notification stream for claude.ai connectors, and answers that request itself with a 405
Once an MCP server finishes signing in, its placeholder tool now tells Claude where the real tools are, depending on whether tool search is in use
A collapsed row of tool calls can now show a script summary while the script works, without an elapsed timer
Unclear The finding does not say what text the script summary contains.
Checking your API credentials now tells a rejected login apart from a network error worth retrying
Completing a slash command can now keep the name you typed instead of swapping in the main command name
The error for partial git clones that can't be uploaded now explains how to fix it
Claude Code warns when an MCP server name is defined in several scopes with different endpoints, since sign-ins don't carry over
The built-in updater no longer deletes the old Claude Code program file immediately after replacing it
Unclear The finding does not say when, or whether, the old file is now cleaned up.
File paths in diff views now show tabs and line breaks as spaces, and long selected paths cut from the start
Starting a session with --agent now goes through one helper, which can also re-apply the agent's system prompt when that agent is already active
Unclear The finding does not say what situation makes Claude Code use reapplySystemPromptIfSeated.
Selection lists now tint the hovered option by default, show only one hovered option at a time, and cut long labels short
When claude remote-control fails to register without a terminal attached, it now waits a limited time before exiting
Invalid values in the attribution setting now produce errors that point at the exact subfield
Startup now checks for required remote managed settings earlier and exits if they cannot be loaded, except for auth
On the /mcp sign-in and clear-sign-in screens, Esc now has to be pressed twice to go back
Exiting while cloud-session changes are still syncing now shows a notice that they stay in the cloud and sync next time
The model picker now hands your effort choice to the screen that opened it instead of saving it itself
Unclear The finding does not say whether the effort is still saved in the same places as before once the caller receives it.
The teleport login prompt can now offer Cancel instead of Exit, and Ctrl-C/D no longer quits the app there
Unclear The finding does not say which screens open the teleport prompt with cancelling allowed.
Creating a remote session now sends the caller's disallowedTools, combined with the built-in list for device-bound sessions
Several lists now show a dimmed 'N more above' or 'N more below' row when items are off screen
Unclear The finding does not say which list views use the new row.
The numbered, screen-reader-friendly selection list can now show section headings and put an option's description on its own line
Unclear The finding does not say which screens pass headings or drawLabels to this list.
Custom telemetry labels are now checked: names use a limited character set, some names are reserved, and values must be short printable ASCII
Unclear The finding does not say which setting defines these labels or what happens to existing labels that fail the check.
Claude Code now logs a warning naming settings env vars it ignored because the launch environment already set them differently
CLAUDE_CODE_LEGACY_BUNDLE is ignored with a warning when it comes from a settings file rather than your launch environment or own settings
Cloud-session git upload now refuses or hardens checkouts sitting under a home directory that is itself a git repository
The header row of tabbed screens can now take keyboard focus, and Down moves from it into the tab's content
Unclear The finding does not say which screens use this tabs component.
On Windows, shell commands that mention TMPDIR now get their own Claude temp directory, as they already did with sandboxing on
When nobody can answer AskUserQuestion, Claude is told to put its question in its reply text instead
Cloud sessions reject --tools with a clearer message, and --disallowed-tools is no longer on the rejected list
Unclear The finding shows --disallowed-tools taken off the rejected list but not whether cloud sessions now apply it.
Cloud sessions now say why the local upload failed and how to start with CLAUDE_CODE_DIR_SYNC_ENGINE=none instead
Agent definitions with an empty prompt are no longer rejected
--resume now records where a session was resumed from, and fleet view opened this way gets extra working directories
Unclear The finding does not say what fleet view is or what resumeSource and thinkingDisplayFlag change for a reader.
The plugin marketplace Ref field accepts a branch, tag or commit SHA; a full SHA is only needed for auto_install and required
Cloud file sync now tracks repeated refusals of cloud changes, warns if they persist and says when changes arrive again
In SDK and headless sessions, applying MCP settings no longer reconnects to every server; it compares each server's config first
Unclear The finding's title says only changed servers are redialled, but its description says a server is dialled when the configs are equal, so which way the comparison goes is unsettled, and the flag is not named.
Directory sync now warns you when Claude's cloud checkout had gone back past commits on your branch
A folder with .claude-plugin/marketplace.json but no plugin.json is now treated as a marketplace root
Directory sync now warns when files Claude changed are open in another program and skips them until they are closed
Workflow rows now show a coloured status dot, agent counts, tokens, and a paused status with reset time while waiting on a rate limit
Large Artifact frame publishes are now gzip-compressed, falling back to plain uploads when compression would be too slow or is refused
Branch-on-remote lookups and first-upload probes now use sessionRoot and sessionReach, and first upload handles a missing git directory
Unclear The finding does not explain what a session's "git reach" covers.
read_file and register_repo_root now refuse, before touching disk, any path whose parent folders and links cannot all be examined
Unclear The finding does not say which paths are screened or what happens after one is reported.
/cd and set_cwd now skip the 'environment block still names the previous directory' note when nothing has been sent to Claude yet
Artifact read_file and preview now refuse network paths and any path they cannot resolve, with updated error messages
Automatic refresh for enabled plugins missing from the local catalog now looks up their marketplace more safely, ignoring name case
Cloning a plugin marketplace now scans for Git LFS pointer files
Unclear The finding does not say what the host_config check decides or what the user sees.
The Help dialog's tabs now accept navigation while focus is on the tab's content
Unclear The finding does not say which keys move between tabs from the content.
In non-interactive runs, the 'Unknown command' reply now carries a structured record of the outcome and the suggested command
Unclear The finding does not say where this outcome record can be read.
Two more kinds of message are now shown with the same short placeholder used for interrupted messages
Unclear The finding does not say which two markers were newly added.
Checks on whether project hook scripts sit inside allowed folders no longer normalise paths first
Unclear The finding does not say what the dropped normalisation did, so the effect on which paths pass is unclear.
The .gitattributes check now records whether a flagged file was caught by a macro or quoted line or by an ordinary rule, and skips comment lines
Unclear The finding does not say whether the new reason is ever shown to the user or only kept internally.
The Write permission dialog now says a file "may be" on a network path when it skips the preview
Unclear The finding does not say whether the change in how the path is looked up alters which path the message shows.
Inside the sandbox, files you pass through the agents flag can no longer be written to
Unclear The finding does not say how the policy-limit file list was changed.
When your checkout cannot be sent to a cloud session as a bundle, the notice now includes the reason it failed
Messages about an unreachable remote Claude now say the machine is not answering and give a simpler reason
Gateway URLs are now tidied into a standard form, with the host lowercased and all trailing slashes removed
You are no longer asked to approve placeholder values in remotely managed settings
The sandbox now blocks writes to git's objects/info/alternates and objects/info/http-alternates files
On Windows, the Credentials, Vault and Protect folders are now protected paths that cannot be read
Read, Edit, Write and NotebookEdit now run a shared check on the file path before any of their other input checks
Unclear The finding does not say what the shared path check tests for.
CONIN$ and CONOUT$ are now rejected as parts of file paths and as working names, ignoring case, extension and trailing spaces
Unclear The finding does not say what a working name is used for.
The Claude Code Insights HTML report now shows two sections under its subtitle instead of one
Unclear The finding does not say what either of the two new blocks contains.
Arguments to the aki command that use tilde expansion, such as =~ or ~{, are now treated as dangerous
When an rm is blocked because no one answered, Claude is told a safety check denied it and not to work around the block
The rm safety check now looks inside quoted eval and trap strings to find removals hidden there
Path-safety checks now flag macOS special paths starting with /.vol, /.file, /.nofollow or /.resolve
Unclear The finding does not say what an "opaque" classification leads to in practice, for example whether it triggers a permission prompt or a refusal.
When a remote call gets no answer, the model now asks the user to check that Claude is running on that computer
The /remote-control dialog options now wrap around and start focused on Continue
In the /desktop prompt, Escape and Ctrl-C/D no longer cancel directly; only Meta+C/D does
Unclear The finding does not confirm what Escape and Ctrl-C/D now do in this prompt, such as a press-twice-to-exit behaviour.
A dialog with a sending step now shows 'Press <key> again to cancel' after the first press
Unclear The finding does not name which dialog this is.
The per-file diff view and its 'git add' hint now show a converted form of the file path instead of the raw path
Unclear The finding does not say what the conversion does to the path, for example whether it makes the path relative to your project folder.
SDK workspaceTrust warnings drop the 'initialize:' prefix, and the 'recorded nothing' warning now shows the actual outcome
The Permissions panel title is now drawn by a different component with the navFromContent option turned on
Unclear The finding does not say what navFromContent changes for someone using the panel.
The notice about a cloud turn held for over a minute now says it waited on the file sync service, not for it to answer
Directory sync's repair hints for git problems now start with an extra first step
Unclear The finding does not say what the added first step tells the user to do.
The browser action's out_dir refusal message now also covers folders that cannot be resolved, not only network paths
Unclear The finding shows the message changed but not whether unresolvable folders were already being refused before.
A gateway host used as a managed-settings source must now use https and resolve to a private network address
Fetching remote managed settings no longer retries on most 4xx errors, only on 408, 409 and 429
URL-mode MCP elicitations now leave out the elicitationId when the server uses the modern protocol
Unclear The finding does not say whether this changes anything you would notice during a URL elicitation.
The skills status list now shows status icons with screen-reader labels instead of coloured symbols
Notes about edited files now leave out the changed text in three cases and mark the file to be read again
Unclear The finding does not say which file names the internal check matches.
Read-only command checks now treat any argument containing ~ as unsafe for commands using flags like --socket and --family
Unclear The finding does not say what the reordered or replaced safe-command entries change.
Claude is now told when the directory sync service refuses the session's requests
Background jobs now drop an unsafe CLAUDE_CONFIG_DIR passed in by a dispatch, with a warning
The "could not be reached" message for remote calls now says Claude may not be running there or may no longer be connected to this session
Cloud file sync now says when your branch has not caught up with Claude's latest commit because git was busy
The message shown when cloud file sync gives up now adds that Claude's cloud changes stop coming back to this window
Cloud file sync now gives two specific reasons when it is not set up: GitHub access not confirmed, or cloud starting point unknown
When an attached computer stops offering its tools, the error now suggests the Claude app there may have closed and says how to recover
Cloud sync and upload now also refuse files linked from your Claude Code configuration, and the refusal message says so
When no one can answer an artifact permission question, the refusal message now lists every pending question
Trusted-device errors are clearer, with new reasons for trusted devices being off and enrollment being paused
Claude Code now refuses to read the plugin catalog cache or a plugin folder file if it is a symlink, not a regular file, or too large
Native installer backup copies of the Claude Code program are now named with a timestamp and the process ID, and leftover files are recognised by name
Unclear The finding suggests the process ID lets cleanup tell which running process owns a file, but the evidence does not confirm how cleanup uses it.
git's --git-dir and --work-tree left the Bash risky-flag table, and a new helper checks git commands for them instead
Unclear The finding does not say whether this changes which git commands ask for your approval.
Plugin marketplaces that fail to load because a directory policy blocks them are no longer counted as errors
Unclear The finding does not say where the filtered error list is shown to the user.
Directory sync's first send now waits for another writer's lock to clear instead of failing, and reports more detail
Permission dialogs now say pressing the key again will cancel, and only say exit when set up to exit
Policy fetches through the Cloud gateway now fail, without retrying, when the gateway's address resolves to a public one
A web search cut off before results arrive now gives a plain "try again" message instead of the raw error
When cloud sessions are blocked by policy with no stated reason, the message now always asks you to check your network and retry
Claude Code now tracks which settings environment variables it dropped for host-launched processes, to warn once per variable
Unclear The finding does not show the warning text or where it appears.
The task list now shows task types it does not recognise, using their description and status
The plugin install screen now shows messages for the new install failures, and its success message can mention copies in other projects
Unclear The finding does not say which surface values exist or where each one comes from.
Cancelling the /copy block picker now takes two presses, with a "Press again to cancel" prompt after the first
After /login, Claude Code now refreshes your account's policy limits, with a time limit, before running a follow-up step
Unclear The finding does not say what the follow-up step after the refresh does.
Sandboxed Bash now drops read permissions for paths it cannot fully check, and reports a missing working directory by name
Unclear The finding does not say exactly which path expansions count as checked ("vetted").
The rm safety warning now explains that an empty variable can turn a path like $VAR/child into /child, and how to guard against it
Git commands run by Claude Code now have GIT_TRACE2 tracing turned off by default, unless you have set those variables yourself
A blocked model switch now returns a code field naming the reason, such as restricted_by_org or catalog_unknown
Validation errors from the set_model control request now include code "invalid_request" so SDK apps can check a code rather than the message
The spinner can now show the word "Polishing" while Claude Code is working
Non-interactive sessions no longer run the release-notes step at startup
One dialog box no longer draws a rounded border or padding and appears as a plain column
Unclear The finding does not say which dialog lost its border.
The slash-command list no longer shows a title or an empty-list message, only the compact list itself
Unclear The finding does not say which screens use this list.
The Auto-memory toggle in /memory now shows a description line
Unclear The finding does not say what text the description shows.
When a conversation is resumed, messages that were split away from the response they belong to are moved back next to it
Plugin uninstall and cleanup now keep install paths other plugins still use and say whether each data folder was removed, missing or failed
The permission-mode chip for cloud sessions now keeps separate state per session, surviving screen changes and reattaching
In plan mode, tool calls served for a remote caller no longer take the auto-mode permission path
Unclear The finding does not say how a served call is handled instead of taking the auto path.
Resume no longer drops messages whose tool results are all 'interrupted' or 'not in this copy' placeholders
A scheduled task whose run fails with an error no longer disrupts scheduling: one-off tasks stay saved and recurring runs are skipped
mcp_tool hooks now wait for an MCP server that is still connecting instead of being skipped straight away
Login now shows an error when your credentials can't be saved, for example because the macOS keychain is locked
A response stream that ends early is now treated as a dropped connection and retried, shown as 'Connection closed before the response finished'
Vim mode now enters insert mode through enterInsert for change commands, with handling for accented and combined characters
Unclear The finding does not describe the specific misbehaviour these changes correct.
Pressing Ctrl+C or Ctrl+D in the Consumer Terms dialog opened from settings no longer quits Claude Code
Reading a git folder no longer fails outright when a filename is not valid text or clashes with another
Resuming a session from the picker now keeps the thinking-display flag you started Claude Code with
Unclear The finding could not identify what the helper behind the declined value does, so the effect of the new resume steps is unknown.
Remote Control cleanup now keeps a worktree if its checkout moved or Claude Code could not check it for changes
A permissions.allow entry the sandbox cannot resolve now stops with a config error naming it, instead of an unhandled failure
On Windows, a CLAUDE_CONFIG_DIR variable written in any upper or lower case is now recognised under its standard name
Removing an MCP server while it is still being added now cancels the add, so it does not reappear
claude plugin test now cleans up the same directory it checks for at the end of a run
Unclear The finding does not say which directory each step referred to or what the new cleanup step does.
SDK options now read disallowedTools, and the maxThinkingTokens whole-number check now checks the right value
Loading a saved conversation now puts split-up Claude replies back together and moves tool results after their tool calls
Spawned teammates and agents now inherit --managed-settings, --mcp-config and --strict-mcp-config from the launching command
Folders added with --add-dir or /add-dir are now kept when Claude Code restarts to switch its terminal interface mode
In the teleport stash dialog, cancel says "Cancel" when it does not quit, and Escape is blocked while a stash is running
Unclear The finding does not say in which situations cancelling this dialog does not quit.
Directories added with --add-dir now survive when Claude Code restarts itself
Claude Code now runs git update-index --no-split-index on a copied git index that may be split before reading it
Unclear The finding does not say when Claude Code takes these git snapshots.
ExitWorktree results now include restoredCwd and originalCwdMissing and say which folder the session moved to if the original was deleted
Matching claude.ai connectors as enabled in chat now ignores letter case and falls back to the server's name when its ID header is missing
The workspace diff now counts any kind of .git entry when detecting nested repositories and skips a single non-folder match
Unclear The finding does not say how this changes what appears in the diff.
Pressing Ctrl+C or Ctrl+D in the 'Pick which to remove' picker now exits
Unclear The finding does not say what the picker removes.
File sync no longer shows a startup failure warning when the session was already being cancelled
Dir-sync records with no engine are now simply reported as unreadable, not probed and called the old "rows" engine
Unclear The finding does not say what dir-sync records are or where the result appears.
A Git change check now skips submodule entries and entries already compared
Unclear The finding does not say which Claude Code feature uses this comparison.
Ctrl+C and Ctrl+D now exit from the 'What do you want to do?' dialog instead of being ignored
Unclear The finding does not say whether exiting closes only the dialog or Claude Code itself.
Pressing up in a picker now only moves the selection and is no longer also passed to other key handlers
Unclear The finding does not say which pickers are affected or what else used to react to the key.
bashEditDiff now deletes its private scratch git directory when setup fails, when tracking stops, and on shutdown
Unclear The finding does not say what bashEditDiff shows or does for a user.
Tool names longer than 200 characters are now cut to 200 instead of being passed through
Checks on CLAUDE_CODE_SHELL_PREFIX for cloud device hooks now understand Windows paths
A cancelled prompt no longer puts back an old IDE selection if you have already made a new one
Ctrl+C and Ctrl+D now work in the 'What do you want to do?' and 'Review rules that skip checks' dialogs like other dialogs
Unclear The finding does not say whether these keys close only the dialog or exit Claude Code.
Laptop-generation sync now handles file paths that are not valid UTF-8 byte for byte
Unclear The finding does not say what laptop-generation sync is or when a user would encounter it.
Uninstalling a plugin now leaves its record alone if the plugin was reinstalled or updated in the meantime
Directory sync no longer fails to read git status output that contains lines starting with H
Unclear The finding does not say what produces H lines or what a user saw when the reading failed.
With git older than 2.41, the ccr-sync code now adds --no-reuse-object to its git commands; git 2.41 or later does not get it
Unclear The finding does not say what ccr-sync is or what problem the option works around on older git.
Leaving a worktree now mentions the branch only when there is one; a planned status check is present but inactive
Ctrl+C or Ctrl+D now exits Claude Code from the "New MCP server found in this project" dialog
The Artifact HTML scanner now counts attributes toward its size limit and stops parsing once the limit is passed
Flipping between accept and decline now leaves any other value alone instead of turning it into accept
Unclear The finding does not say which screen or prompt uses this toggle.
A numbered list whose items are only numbers, like '1.', now shows as plain text instead of a formatted list
A streamed message_delta now counts as the end of a reply only when its stop_reason is text, not just any non-empty value
A check for acknowledged ancestors now returns the files of the entry it matched instead of the wrong set
Unclear The finding does not say which feature uses this check or what a wrong result caused.
Reading a file for an @-mention now quietly returns nothing when it is cancelled, instead of raising an error
A recency check no longer fails outright when the system clock jumps backwards
Unclear The finding does not say which feature relies on this recency check.
12 more of these are in What probably matters to you, above.
Creating a device-bound cloud session can now send a repositories_trusted field with device-proof headers, controlled by the tengu_violin_fingerboard flag
Unclear The finding does not say what the server does with repositories_trusted once it accepts it.
MCP server configs accept bareElicitationCapability, which sends a server the plain capabilities, and it only matters behind a legacy flag
Claude Code records organization changes mid-conversation and can warn that the next reply may be slower and use more tokens, behind a flag
The organization memory sync check can now be open, closed or held, and tools-based memory mode no longer waits for the policy verdict to load
Internal layout changes add a toast overlay over the transcript, a verbose-aware prompt container and a left gutter that is not shown yet
Remote sessions can send tool descriptions straight from a recorded snapshot instead of rebuilding them, behind tengu_binary_balloon
Unclear The finding does not say what the unnamed internal condition checks.
New hooks for pinning or switching a session on resume are empty in this build and do nothing
A new telemetry event, tengu_bridge_transcript_deferral, reports each stage of Remote Control's deferred transcript upload
onlyBuiltInContext is read but nothing sets it#Auto mode's permission classifier has an unused onlyBuiltInContext option; nothing sets it, so behaviour is unchanged
Claude Code now records which environment variables came from settings and adds a check to withhold settings env blocks, currently inactive
Unclear The finding does not say which settings sources would be withheld or what a pinned login means.
A new stored-login pinning value exists but is hard-wired to false in this build
Unclear The finding does not say what pinning a stored login would do if it were ever turned on.
A plugin aliasing step now runs while plugins load, but for now it returns every plugin unchanged
4 more of these are in What probably matters to you, above.
Permission-request metadata and served remote channel requests now include a modeStamp, and control-only clients no longer answer unsupported requests with errors
Unclear The finding does not say what remote_tool_gate being caller_reauthored means for a user.
Chrome, Browser and computer-use placeholder tools now record a device request during a relay, and a new request_computer tool points Claude to remote-device tools
Unclear The finding does not say what the relay is or whether the call actually ends it.
Remote Control rechecks org policy before refusing, records a reason code when it does not start, and sends each session only undelivered history
Unclear The finding does not say what remoteControlOrigin is used for or in which situations backfill is switched off.
The bundled Cowork 3P settings library gains tool-policy helpers, provider lists and a config reference URL, and drops dictationEndpoints
Unclear The finding does not say whether Claude Code itself uses any of these additions.
Artifact share status gains three connector fields that nothing fills yet, cleared on account change, plus new connector-consent tracking
The macOS iOS-app intent check now always reads the tengu_magical_pixel gate, and tengu_magical_pixel_startup is no longer used
Unclear The finding does not say what this check enables when it passes.
Build constants move to 2.1.281, artifact output gains a db_profiles section, MCP counting changes, and many internals are renamed
Publishing Artifact updates now sends optional preconditions and a baseRebase reason, with preconditions adoption behind the tengu_tidy_widget gate
Unclear The finding does not say what baseRebase means for a publish.
Artifact shares now record type_first_party and caps_read_not_found and are flagged when a first-party type claim cannot be confirmed
Unclear The finding does not say how the handling of a share differs when these fields are set.
advisorStripPlan, reminderFold and declaredToolNames#Advisor tool output can now be stripped from selected messages only, and main requests and compaction share reminder-folding and tool-name options
Unclear The finding does not say what these three inputs change about the messages sent.
Side queries now resend once with a fixed dispatch value after a headerless 503 or a 408, 409 or 429, and API results record a dispatch value
Unclear The finding does not say what dispatch records.
Pre-started spare Claude Code processes now refuse most control requests while waiting and no longer run SessionEnd hooks
Unclear The finding does not say how spare sessions are started or claimed, or which control requests are allowed.
Claude Code now tracks timing for deferred tools and can check whether a tool was withdrawn
Unclear The finding does not say what the timing data or the withdrawn-tool check is used for.
Applying worktree or bundle results now supports chained generations and keeps track of what each one was based on
Unclear The finding does not say what a chained generation is or where a user would see this behaviour.
When a sandboxed Bash command fails or records a sandbox violation, Claude Code now sends a sandboxed_failure note to the remote caller
Unclear The finding does not say who the remote caller is or what it does with the note.
Resuming a session now reuses the saved record of tool inputs sent to the API, but only where it can prove they still match
Unclear The finding does not say what a reader notices when a resumed session reuses these records.
/insights now logs a usage event when it considers recommending auto mode
Unclear The finding covers only the logged event and does not say whether the report itself shows the recommendation.
Many managed and admin settings fields now state the minimum client version that honours them, through a new support availableInVersion marker
Unclear The finding does not say which product's version numbering these availableInVersion values refer to.
Directory sync now accepts repos with known malformed commit data, dates fork points oldest first and caps its setAside list
Unclear The finding does not say what the set-aside list holds, where a reader would see it, or what the limit is.
Subagent tasks now take their output file path from the task record, and output polling skips tasks that have no output file
Unclear The finding does not say whether the two ways of getting the file location ever gave different answers.
Claude Code's git changed-file checks now list submodule changes and a repository's first commit instead of skipping them
Unclear The finding does not say which Claude Code feature shows this file list.
The git directory sync used by remote sessions now withholds publishing when a prior-life note is pending and writes a chain of links
Unclear The finding does not say what these links or chains are, or where they show up.
Local bash and local workflow tasks, including paused workflows, now store an outputFile path in their task state
Unclear The finding does not say whether the stored path is shown to you or used anywhere else.
Records of tool calls forwarded to another host now include request_id and instance_id, and in-flight updates are batched
Unclear The finding does not say what these calls are or where a reader would see these records.
Directory sync no longer polls with timeouts before a turn, makes single pull attempts, and records turns that run before sync is armed
The humanTurn marker is no longer added to messages whose text consists entirely of wrapped blocks
Unclear The finding does not say what text the new check matches or what the humanTurn marker is used for.
Cloud-session file sync now re-announces an interrupted first upload, follows chained uploads, and explains more failure cases in plain messages
If the server classifier rejects a request sent on a message thread, the rest of the session sends its requests without a thread
Unclear The finding does not say what the server classifier decides.
Cloud session sync can now report uploads as held or deferred, and failed journal writes stop retrying after a limit
Unclear The finding does not say what CCR is or what causes an upload to be held.
A check for whether a path is only the root folder now uses a shared separator constant and a path helper instead of a literal '/'
Unclear The finding does not say which feature uses this check or whether its behaviour changes on any platform.
Slash commands now record whether they failed, with the skill usage command and /recap marking their errors as failed
Unclear The finding does not say where commandOutcome is shown or reported, or what the internal condition is.
Tool calls now sample memory through a sampler, and the command runner gains a waitForExitAfterKill option, plus small internal tweaks
Unclear The finding does not say who sets waitForExitAfterKill or what it changes when a command is stopped.
Size warnings on workflow rows in the task panel are now fitted to the width by the row itself
Unclear The finding does not say whether the warning looks any different on screen.
The status icon can now take a custom aria-label in place of its default label
A log message about re-applying project settings after workspace trust no longer starts with "initialize:"
A new check inspects .git entries when seeding a folder and refuses linked index files, unknown entries, oversized folders or missing config/HEAD
Unclear The finding does not say what folder seeding is, and only suggests that this check backs the existing refusal message.
The cloud directory-sync worker can reuse links it recorded itself and now stops the link store at size limits
Unclear The finding does not say what these links are or what a reader would notice when the cap is reached.
New sync and rebase code lists up to 50 files that were changed on both sides
Unclear The finding does not say which command or feature shows this list.
Directory sync's saved state now has fields for link chains, earlier environments and answered requests
Unclear The finding does not say what standingRow, priorLifeNote or installsCompleteThrough hold.
The directory-sync divergence check now runs git merge-base separately with its own time limit
Files held back from sync for host configuration reasons are now listed separately from credential-named files
Unclear The finding does not say which sync feature builds this file list.
Directory sync's git safety check now records a .git stamp when it refuses a checkout and checks linked worktrees separately
Unclear The finding does not say what the recorded dotgitStamp is used for afterwards.
A "deferred" status can now carry an optional list of held items and a heldCount
Unclear The finding does not say what the deferred status describes or what the held items are.
An unreadable result caused by host_config is now handled like the "other" cause in a sync verdict check
Unclear The finding does not say what is being synced or what a false result from this check leads to.
Directory sync rounds now record heldOpen, heldOnly and basisLink
Unclear The finding does not say what heldOpen, heldOnly or basisLink mean.
install_ack pass publishes an install report without uploading#Cloud file sync gains an install_ack pass that only republishes the install report, without pulling or uploading
Unclear The finding does not say what sets off an install_ack pass.
Several internal changes to workspace syncing, respawning, the live connection and telemetry, including removal of the 'seed' source kind
Unclear The finding does not say what, if anything, these changes change for someone using Claude Code.
A cloud sync round with only held-open files left is now deferred with reason "held_open" instead of retried
Unclear The finding does not say what holds these files open or what is being synced.
Git uploads now fail if a staged file that was meant to stay untouched changed during the upload
Unclear The finding does not say which Claude Code feature runs this upload.
Five new tracked operations were added, covering SDK session claims, self-hosted agent files, cloud skill reads and sibling login adoption
Unclear What each operation does is inferred only from its name.
The CLAUDE.md load event now records instruction sizes and is skipped in one mode that also limits auto-memory
Unclear The finding does not say which mode this is or how a user enters it.
New usage reporting covers reminder folding, copied tool inputs and the estimated size of each attachment
Unclear The finding does not say what a reader sees differently when a tool run is cancelled by an image or model error.
New telemetry records whether a trusted-repositories creation request was sent, refused then retried, or not sent
Unclear The finding does not say what creating trusted repositories means or when it happens.
The telemetry event sent when a remote review is stopped now includes a source field
Unclear The finding does not say what values source can take.
File download statistics now record reused, prefetched and shared downloads and the slowest wait times
Request telemetry now records JSON and on-the-wire byte counts plus whether gzip compression was used, skipped or fell back
Unclear The finding does not say what value the timeout helper's (n+30)*1000 is based on.
Plugin telemetry now sends real plugin and marketplace names instead of "third-party" in one more case
Unclear The finding does not say which plugins or marketplaces meet the new condition.
A request lifecycle telemetry event gains an inherited_withdrawn field, sent only when there is an inherited request id
Unclear The finding does not say which requests this event describes or what "withdrawn" means for them.
Attachment download telemetry now records slowest wait times plus counts of reused, prefetched and shared downloads
Unclear The finding does not settle whether attachments are actually reused, prefetched or shared in this release, or only counted.
The directory-sync pull telemetry event now reports a set of link-chain fields
Unclear The finding does not say what the link-chain fields measure.
The remote managed-settings fetch event now also reports how sign-in went, including token source, refresh results and server errors
OpenTelemetry trace exports now report each export's result through a callback, except when traces go to the startup gateway
Unclear The finding does not say what the per-export callback does with each result.
Telemetry about held items now also counts how many are waiting on the user
Unclear The finding does not say what the held items are.
The background daemon now writes worker status one write at a time, retries failed writes, and finishes them before stopping
Items waiting in the message queue can be raised to 'now' priority and set back
Unclear The finding does not say how or when an item is raised to 'now' priority.
Startup now hands more options to the session it prepares, and the --thinking-display value is read even when thinking is turned off
Unclear The finding does not say what earlyRemoteLink or headlessCloudPrint do for someone using Claude Code.
A late end-of-turn context-usage estimate is now applied with an after_boundary marker
Unclear The finding does not say what after_boundary changes about how the late estimate is used.
New URL helpers reject any address that does not parse back identically, and can strip a URL's query, fragment or trailing slash
Unclear The finding does not say which features use these helpers.
Clearing session caches now also clears WebFetchHistory alongside WebFetchCache and ToolSearchDescriptionCache
Unclear The finding does not say what WebFetchHistory holds or when the cache-clear routine runs.
When the internet check against 1.1.1.1 fails, the error is now written to the debug log
The coordinator prompt now mentions the Skill tool only when that tool is really available; the text itself is unchanged
Finding child processes to stop can now be limited to those in the same operating-system session
Unclear The finding does not say which stop actions pass sameSession.
A duplicated line was removed from a deep-research workflow prompt
The tmux version check and session shutdown now run through a different internal command helper that takes extra options
Unclear The finding does not say what the new options argument changes about how these commands run.
The LSP tool now uses a different check to decide when to skip input validation for a file path
Unclear The finding does not say what the new check tests or which paths it now lets through.
Claude Code can now tell whether its wait during startup timed out
Unclear The finding does not say what the startup waits for or what uses this check.
A hidden --await-claim flag can start Claude Code as a pre-warmed spare that waits to be handed a session
Spare Claude Code processes started ahead of time now skip session setup until they are claimed
claim_session now triggers the same plugin and MCP reload as plugin syncs and working-directory changes
Unclear The finding does not say what claiming a session means or when it happens.
The SDK engine now reports turns that failed to start and cleans up waiting turns when it closes
Internal docs for the stream-json status frame now say --attach-serve helpers have no init and list every key in their first frame
Unclear The description is marked internal, and the finding does not say how --attach-serve is used or reached.
The set_cwd control request is now documented as never re-running SessionStart hooks
Internal changes to how SDK messages, prompts and session state are handled, including a new firstTurnGate option that does nothing by default
Unclear The finding does not say what firstTurnGate holds back or what turns it on.
Print and SDK sessions now count unread input as work and do not finish while some is waiting
When Claude Code is driven by a program, the client's own first-turn message now waits in its own queue
Unclear The finding does not say what ordering problem, if any, this change fixes for SDK users.
The SDK client now tracks when its first initialize message was sent and stops MCP manifest capture on cleanup
The SDK now builds its control responses through one shared helper and uses a single error for unsupported control request types
Unclear The finding does not show whether replies look any different to an SDK app than they did before.
Handling of poll_event control requests in headless mode has moved into a shared handler
Unclear The finding does not show whether the shared handler applies the same checks and error messages as before.
Cancel messages for pending requests now go through the outgoing queue instead of being sent immediately
Unclear The finding does not say whether this changes the order in which the other program receives messages.
Cancelling during PDF page extraction is no longer reported as an unknown error
Unclear The finding does not say what happens after a summary without a <summary> block is detected.
The ExtraUsageDialog is now loaded only when needed, and two new size constants (256 and 32 MiB) appear
Unclear The finding does not say what the constants 256 and 32 MiB limit.
A batch of small internal changes, a few visible: disabled MCP servers show "off", and two new error messages appear
A batch of small fixes, including a stricter symlink check, PDF extraction that stops when cancelled, and the version bump to 2.1.281
Many code sections were only renamed internally; the few visible changes are one panel's border and hint, and command labels
Unclear The finding does not say which panel lost its border and key hint.
Small internal changes in 2.1.281, including cleanup after AskUserQuestion, a new --exitOnCtrlCD dialog prop and a reworked tmux setup
A batch of small internal changes: tmux environment handling, a git lazy-fetch setting, and several telemetry adjustments
Unclear The finding does not say what the 'reach' part on ask-class cards shows to a user.
Assorted internal changes with no clear user-facing effect, plus a version string bump to 2.1.281
Version is now 2.1.281; the other code changes found are renames and small internal refactors
Several small internal changes, including tidier Markdown lists and room for scroll indicators in the diff file list
Several small internal changes with no clear effect for users, plus the version number moving to 2.1.281
A new invisible advisor_stripped marker is recorded in the transcript, handled like the existing thinking-stripped marker
Unclear The finding does not confirm what triggers the marker, only that it probably follows advisor content being removed from a request.
When running without a disk, resumed background work no longer tells the model to check output files
Background sessions now start from a cleaned environment, with login variables added back and some internal variables left out
Unclear The finding does not name the host login variable or say what the check before restoring it tests.
In diskless sessions, asking for a task's output file now fails with an error instead of returning a fake path
Unclear The finding does not say what a user sees when this error occurs.
Ambient attachments can now be held over and delivered at the start of the next turn
Unclear The finding does not say which attachments count as ambient or what causes them to become owed.
advisor_stripped attachment when relayed thinking is stripped#A hidden advisor_stripped marker is added to the conversation when relayed thinking is stripped from a request
Unclear The finding does not say what relayed thinking is or where it comes from.
At session start, a condition that picked between two feature checks by how the session started is now a single check
Unclear The finding does not say which feature this check controls.
/clear now tells the session reset that it was the trigger and which command message started it
Unclear The finding does not say what the reset does with the trigger or the message ID.
The command-line options for forking a session to the background, including removing --add-dir, are now built by separate helpers
Unclear The finding does not show whether background forks behave any differently.
A single-value handoff slot now uses a key, and only a taker with the matching key gets the value
Unclear The finding does not say which feature uses this holder.
Finding the last user or assistant message in a turn now skips certain messages by id
Unclear The finding does not say which messages the new check matches.
Edit and Write calls approved in a host dialog are now fingerprinted so the approved change can be matched to the one that runs
Unclear The finding does not say which host programs show this dialog.
Internal builds can no longer take over a session that uses bypassPermissions outside a sandbox
Unclear The finding does not say which builds count as internal or when that check returns true.
In serve-only mode, Claude Code no longer sends the startup request built from --permission-mode
Unclear The finding does not say how serve-only mode is turned on or whether the permission mode is applied some other way there.
Every change of permission mode, and every mode restored, is now passed to a new account-level setter called setAccountSetMode
Unclear The finding does not say what the recorded account mode is read by or what it changes for the reader.
When the shell is bash, Claude Code now checks some command lists against the command name exactly as typed
Unclear The finding does not say which command groups changed or what the classification is used for.
hasStandingPrompt now only counts published pending actions#The check for whether a prompt is waiting on you now only counts published pending actions, with one fallback case
Unclear The finding does not say where this check is shown to users or what they would notice.
Questions now carry a note on their scope or ownership, and that note is shown after each question
Unclear The finding does not say which feature produces these rulings or who reads the joined question text.
Permission requests that carry an auto-deny window now skip an extra check on one permission path
Unclear The finding suggests but does not confirm that permission requests can now be denied automatically after a timeout.
When a tool action is denied permission, Claude Code now records the denial on the session
Unclear The finding does not say what the recorded denial is later used for.
The private temp directory check now records the directory's device and inode so it can be rechecked before removal
Path checks gain a 'screen' mode that follows up to 8 symlink hops and reports failure if any cannot be followed
Unclear The finding does not say which feature uses the new 'screen' mode.
File paths containing a null byte are now rejected by permission-rule path handling too, with a dedicated NullBytePathError
A path that is a broken symbolic link now counts as existing when Claude Code checks whether a path exists
Unclear The finding does not say which user-facing actions rely on this existence check.
The noFollowAny capability check now always saves a result, counting any error other than EINVAL as working
The file path resolver now returns a path unchanged when its lookup gives back a special marker value
Unclear The finding does not say what situation produces the marker value.
Opening an output file now retries once if a symlink's target changes, then fails instead of continuing
Unclear The finding does not say which output files this applies to or what the removed early check did.
File paths that contain a NUL byte are now rejected before Claude Code tries to open them
The "ask-session" value of the builtinToolPolicy managed setting now declares it is available from app version 1.40609.0
Unclear The finding does not say which app the version 1.40609.0 refers to, or how this relates to "ask-session" being rewritten to "ask".
The desktop managed-config schema now tags ask-session and several other settings with the app version that supports them
Unclear The finding does not say what SSH_CLIENT_UNREADABLE_STAND_IN is used for.
Remote managed settings now report host_gateway_not_accepted when a host gateway is rejected
Unclear The finding does not explain what gateway mode or a host verdict is.
Managed settings now record which app-behaviour keys from a device profile are also set elsewhere
Unclear The finding does not say where the groupClaimed list is used or shown.
The admin config schema now lists the minimum Claude Desktop version for the client secret helper and additionalRedirectReferrerHosts
Managed-settings fields for Tenant ID and Manifest SHA-256 now record the version they became available in, and the sandbox host field uses a shared placeholder
Unclear The finding does not say which product those version numbers belong to or what the new shared placeholder text reads.
The managed-config module now exports helpers for settings that need a restart, a config reference link, and a default relaunch enforcement period
Unclear The evidence shows the names being exported but not where they are used or what a user would see.
Managed-config defaults now cover internal keys, and new helpers list changed keys that cannot apply without a restart
Unclear The finding does not confirm that the list of non-hot-applied keys is used to decide when a restart is needed.
Trusted-device enrollment now reports a reason when a device is not bound, such as trusted_devices_off or enrollment_paused
Unclear The finding does not say where, or whether, these reasons are shown to the person using Claude Code.
Cloud-hosted auth can now register callbacks that fetch a bearer token on demand and observe responses
Unclear The finding does not say who registers these callbacks or whether users can configure them.
Saving claude.ai sign-in tokens now also records which host they belong to
Unclear The finding does not say how the recorded host is used afterwards.
Binding an account to a device now requires a device proof and fails with no_device_proof when none is available
Unclear The finding does not say what a device proof is or how one is obtained.
When your stored login changes in the keychain or .credentials.json, Claude Code now runs an extra refresh step
Unclear The finding does not say what the extra refresh step does.
Resetting the OAuth credential change-check now also forgets the access token Claude Code last saved itself
Unclear The finding does not say what Claude Code does differently once it knows a token was its own.
The xaa subcommand still loads its login module on demand; the code appears to have moved, with no change in behaviour
When an MCP server rejects a tool call for missing permissions, the error now also records which scope was needed
Unclear The finding does not say what uses the stored scope once it is attached to the error.
MCP cache files are now keyed on whether the MCP UI extension was offered, so the two cases are stored separately
MCP-related URLs are now normalised without a trailing slash, as well as without credentials, query or hash
Unclear The finding does not say where these tidied URLs are used or compared.
The status text for a cached MCP server is unchanged but is now also provided as a separate list of facts
Unclear The finding does not say where the separate list of facts is used.
Claude Code now removes CLAUDE_CODE_MCP_APPS_HOST from the environment of programs it starts
Unclear The finding does not say what CLAUDE_CODE_MCP_APPS_HOST is used for.
Side queries accept a Retry-After time budget, and their attribution block is now built by a shared helper
Unclear The finding does not say which side queries set retryAfterBudgetMs or what forceAttributionHeader changes in the attribution block.
The model-fallback check can now apply the refusal fallback when a response was swapped, not only when a message carries a marker
Unclear The finding does not say what a swapped response is or what the reader sees when this fallback applies.
Claude Code now checks its default output tokens and default effort against the server's model catalog and reports mismatches
notAllowed#A model rejected for not being in the available list is now flagged as not allowed
Unclear The finding does not say what callers do differently with the notAllowed marker.
Model pickers no longer pass skipSettingsWrite, and clicking a blank part of a /config row now selects it
Unclear The finding does not settle whether picking a model now saves it to your settings in cases where it did not before.
Buttons hosted for plugins now store their own options and can be looked up by the request they belong to
Unclear The finding does not say what the per-button options contain or what a reader sees differently.
The plugin memory check now tells a binding 'elsewhere' apart from an 'unknown' one, and reports 'switched_off' when the feature is disabled
Unclear The finding does not say what a binding is here or where a user would see these results.
Plugin hooks now run inside a per-request scope that can carry values through the handlers and be ended
Unclear The finding does not say whether plugin authors can reach these scopes or what they would use them for.
At startup, plugin install IDs are now set up in a separate step after storage is ready
Unclear The finding does not say whether the new order changes anything a user can see.
.version off a record#Command-sourced plugins now read their recorded version from a record's version field
Unclear The finding does not say what a command-sourced plugin is or whether users see any difference.
Bridge session updates that include client_metadata now always go the CCR v2 way, without an organization lookup
Unclear The finding does not say what a bridge session is or whether a user would notice any difference.
The Remote Control bridge gains internal metadata reporting and counters for dropped updates
Unclear The finding does not say whether any of this is visible to someone using Remote Control.
Headless bridge registration now reports its tool host, and records which interrupted sessions it carried over
Unclear The finding does not say what the tool host snapshot is used for.
The Remote Control flag check now reports its specific diagnosis code and loads policy limits through a dedicated helper
Uploading a forked conversation's history now includes the list of available tools
Unclear The finding does not say what the receiving side does with the tool list.
Claude Code can now report that panes aren't placed because no attached client is fullscreen, naming those clients
Unclear The finding does not say what panes and attached surfaces are here or where the reason is shown.
When several keypresses arrive at once, the terminal interface can now finish its screen updates between each key
Unclear The finding does not say when commitsBetweenKeys() is true.
Yes/No confirm dialogs can now stay disabled for a short delay so an accidental Enter cannot confirm them
Unclear The finding does not say which dialogs use the delay or how long it is.
The rewind picker's "more above" line now uses a shared component
Claude Code now records when each agent's safety-classifier history is compacted and can clear it per agent
The auto-mode classifier prompt can now be built with its allow, soft_deny, hard_deny and environment rule lists left empty
Unclear The finding does not say which part of Claude Code turns on the new setting, or when.
Auto mode's safety-check model calls now report when their prompt cache breaks, and record what changed since the previous call
The auto-mode server-fallback notice now records "unanswered" when it closes without a choice, and the dialog can be cancelled from outside
Unclear The finding does not describe what the server-fallback notice itself tells the user.
A precomputed-compaction value is now worked out from a new "facts" input instead of straight from the main model setting
Unclear The finding does not say what facts contains or whether this changes when compaction happens.
The code that picks the context window size for auto-compact now works from a full model description instead of a model name
Unclear The finding does not settle whether the new descriptor fields change the window size chosen for any model.
After a successful emergency compaction, rebuilding attachments now knows it was reactive
Unclear The finding does not say what the rebuild does differently for reactive compactions or what the extra step does.
Compaction now resets the internal noChannelTools state together with declaredTools
Unclear The finding does not say what condition triggers the reset or what noChannelTools controls.
Connecting a device bridge now waits for an extra setup step and passes new details to the tool list
Unclear The finding does not say what deviceMcpQuestion or the new setup step do.
Internal wiring adds a namesSilent callback for shared rooms and passes deviceMcpQuestion along in remote status updates
Unclear The finding does not say what namesSilent or deviceMcpQuestion do for a user.
A new debug message explains when a remote permission question in plan mode is sent to a person
Records of abandoned remote tool calls now use the journal's host and epoch and a new machineHadCall field
Unclear The finding does not say what a reader sees differently as a result of this change.
Whether system reminders are folded is now fixed once per session and handed down to subagents
Unclear The finding does not say what folding a system reminder does.
The system-reminder folding mode is now fixed per conversation, so a resumed chat keeps the mode it started with even if the remote flag changes
Unclear The finding does not say what folding actually does to the reminders.
Reminder delivery can now be forced with deliveryOverride, and the decision also sees creditRetryStateless
Unclear The finding does not say what sets deliveryOverride or what creditRetryStateless and reminderFold represent.
Reserved tags such as system-reminder are now also found and escaped when hidden inside JSON text
Unclear The finding does not say which content passes through this sanitizer.
Startup now passes a new headlessCloudPrint value when deciding what kind of session to run
Unclear The finding does not say what headlessCloudPrint represents or how it changes the session.
The client for cloud sessions without an interactive screen logs more at startup and reports changes earlier
The keepalive-after-stop check was restructured to take its flag name as a parameter, with no change in behaviour
Memory dump details now record whether Claude Code was running on Bun or Node
The end of Bun module-loading and build error messages is now replaced with <redacted>
Unclear The finding does not say where the redacted messages are shown or sent.
Shortened JSON previews in logs now write runs of spaces as one space followed by \u0020 codes
The internal git helper for diffs gains an objectGraph option: 'pinned' by default, 'as_is' for merge-base
Unclear The finding does not say what pinned and as_is do differently.
Building a temporary git index now works from snapshots that hold only a tree and no commit
Unclear The finding does not say which feature creates these snapshots.
The shallow-pins setup step now stops early for folders that have no git data
Unclear The finding does not say what the shallow-pins step does or when a reader would notice it.
The data sent to function hooks can now include an optional state field alongside events, calls and env
Unclear The finding does not say what goes into the state field or when it is filled in.
An after-query step now also runs for prompts that never reach the model, such as bash-mode turns
Unclear The finding does not say what the after-query step does or what condition turns it on.
The hooks runtime now captures a scope for each dispatch and interface call and releases it when the call finishes
Unclear The finding does not say what the scope holds or what it changes for someone using hooks.
Automatic starting of the observer agent gains a second refusal check and a marker on its permissions
Unclear The finding does not say what the new check refuses or what the observer agent does.
Background agents started where there is no disk no longer point to an output file that cannot exist
Artifact frame reads can now name the actor making the request, through a new actorId option
Unclear The finding does not say what sets actorId or where artifact frames appear to a user.
The instructions Claude gets for live docs and Artifacts are now assembled in one place, with an option to put capabilities last
Unclear The finding does not say when capabilitiesLast is used.
A new check passes only when the gateway host has been verified and a policy helper is configured
Unclear The finding does not say what this check allows or blocks.
The code reading CLAUDE_GATEWAY_ALLOW_LOOPBACK was reorganised; the variable still lets the gateway reach loopback addresses
Unclear The finding does not say whether the new state object or timing values change behaviour.
Whether proactive tools are available now depends on the permission mode, with an extra condition in plan mode
Unclear The finding does not say what proactive tools are or what the extra plan-mode condition checks.
Clearing the conversation when leaving plan mode now records plan_mode_exit as the reason
Unclear The finding does not say whether the recorded reason changes anything a reader can see.
A new wrapper for a settings accept/reject dialog, and resetting a store now cancels per-file prefetches
Unclear The finding does not say which settings the dialog asks about or what the prefetched files are.
When settings.env changes, Claude Code reapplies config environment variables and no longer saves and restores CLAUDE_CODE_REPL itself
Unclear The finding does not say whether the new helper keeps CLAUDE_CODE_REPL intact.
The leaveQuestionsStanding teardown mode for pending permission questions is gone, and host-answered prompts are now tracked when the host owns input
Claude Code no longer records whether the environment has internet access
The usage-reporting event frame_link_dismiss is gone; frame_link_dismiss_dialog and frame_link_open remain
The /stats footer now shows the date-cycling and copy hints only on the tabs view
Unclear The finding does not say which screen each of the two footer states corresponds to.
Renaming a session over remote control can now be handed to the host program through a recordRename hook
Unclear The finding does not say which host programs provide recordRename or what its v5 storage is.
Teleport now reads a remote session's pending_action along with its status and startup failure
Unclear The finding does not say what pending_action contains or what Claude Code does with it.
When the auto-mode network classifier is unavailable, its result now includes a retryAfterMs wait time
Unclear The finding does not say what uses retryAfterMs or whether you see it.
Approving servers from a project's .mcp.json no longer loses approvals added at the same time
Remote uploads are now marked fromUpload only for bundles, no longer for folders
Unclear The finding does not say what the fromUpload flag controls.
Headless and SDK runs now hold some startup work until the host is ready; CLAUDE_CODE_DISABLE_STARTUP_WORK_GATE turns this off
Startup prefetching is split into two steps, and one mode now skips the context prefetch and remote fetch
Unclear The finding does not say which mode skips the prefetch or what the extra function does.
attribution setting accepts true/false#The attribution setting now accepts true or false, and false hides all attribution
env and permissions settings schemas are now built lazily#The env and permissions parts of the settings format are now only prepared the first time they are needed
Unclear The finding does not say whether this makes any difference a user could notice, such as faster start-up.
Resolving shortcut-style file links now stops on long loops or network targets instead of passing the raw path through
Unclear The finding does not say which cases return the original path and which return nothing.
Plugin auto-update results now flag directory plugins that failed to update for an unexplained reason
Unclear The finding does not say what directoryIdentityChanged means or whether either field is shown to the user.
Local hooks can now be offered to a cloud session when their folders use Windows-style absolute paths
A new scrollbar can be clicked, dragged and hovered with the mouse
Unclear The finding does not say which screens use this scrollbar.
Refusals for a linked worktree with a worktree_config problem now warn that new worktrees made from it will be refused too
Unclear The finding does not say what is being uploaded or where it goes.
Two new messages explain why a Windows computer's tools are not yet offered to cloud sessions
Focusing a part of the screen that cannot take focus now moves focus to a nearby part that can
Unclear The finding does not say which screens or controls this affects in practice.
Claude Code can now turn its active setting sources back into a --setting-sources= argument
Unclear The finding does not confirm that the rebuilt argument is passed to child processes, only that this appears to be its purpose.
After Bedrock or Vertex setup succeeds, you can press Enter to have Claude Code restart itself
Five Windows folders that store saved passwords and encryption keys are now treated as sensitive paths
SDK results for local slash commands now include a commandOutcome saying whether the command failed or was unavailable
When checking git changes times out, the failure is now reported as timed_out instead of a general git error
Unclear The finding does not say where this reason is shown.
Ctrl+C and Ctrl+D now exit Claude Code from the Claude in Chrome dialogs and a setup confirm dialog
The bundled settings format now marks which app version supports some settings and warns about OTLP over gRPC
Unclear The finding does not say which app the version numbers refer to.
The check for reusing cached conversation history now looks at the next message first before comparing earlier ones
Unclear The finding does not say whether this changes which requests reuse the cache or only how quickly a mismatch is found.
Claude's replies stored as plain text are now converted into standard text blocks before messages are assembled
Directory-sync uploads no longer record usage statistics, and the seed-upload step has been removed
Unclear The finding does not say what directory sync does for a user or how it is started.
Plugin validation now checks a plugin's MCP server files for bad settings, insecure addresses and credentials left in plain text
Reading a plugin's types field now also gives back the plugin's name and its declared state
Unclear The finding does not say what the types field or its state is used for.
tool_use name cap and MCP stdio restart on -32022 protocol-version rejection#A local MCP server that rejects the protocol version after a timed-out version check is now restarted once without that check
Unclear The title mentions a model-level cap on tool_use names, but the finding gives no details about it.
The tool that suggests new skills now rejects skill names containing "claude" or "anthropic"
Memory files in subfolders are no longer attached again when their content has not changed
Reading a PDF you @-mentioned now stops when you cancel the turn
Telemetry about attachments now includes attachment types, estimated token counts and where the request came from
A new helper for plugin uninstalls removes the plugin's saved options and can also delete its data folder
Unclear The finding does not say whether any uninstall command already uses this helper.
Claude Code now has a starter template for a plugin hook that runs when a session begins
Unclear The finding does not say which command or action produces this template.
~ in arguments now marks read-only commands as needing approval#A read-only command with ~ anywhere in its arguments now always needs your approval
remoteToolServingOn#The Remote Control settings panel now receives a remote tool serving flag, which is always false in this build
Unclear The finding does not say what the settings panel shows differently when remoteToolServingOn is false.
The theme picker's press-again hint now ends in either "cancel" or "exit", depending on a new internal flag
Unclear The finding does not say which situation makes the picker show "cancel" rather than "exit".
The /desktop error and download screens now appear in a dialog titled "Claude Desktop" with an Esc-to-cancel hint
Refusing a folder too large to seed a cloud session now adds a fixed piece of advice after the size summary
Unclear The finding does not say what the added advice text says.
The managed setting that turns on MCP tool search now says it is already on for the Claude API, Vertex AI, Bedrock and Bedrock Mantle
When joining messages into the saved conversation history, some messages are now skipped as the attachment point
Unclear The finding does not say which messages the new test excludes or what a reader would notice.
Plugin events now pass along a default "bottom" value when the event has one
Unclear The finding does not say what bottom means or which events have a default for it.
G motion removed from this motion table#The G motion is no longer in one of the vim normal-mode motion tables; ; and , remain
Unclear The finding does not say whether G is handled somewhere else or has stopped working.
The token_usage attachment now converts the model through an extra step before working out the context window
Unclear The finding does not say what the extra step does or which models it affects.
The standby advisor model is now used only if your organisation is known to serve that model
The one-time policy-limits cache check is now skipped when ANTHROPIC_UNIX_SOCKET or a diskless launch is in use
Two new bridge names appear for tool hosting: bridge_tool_host_refuse and bridge_tool_host_work
Unclear The finding does not say what the bridge is or whether these names are telemetry events or feature names.
Merged managed policies now keep the base policy's serve_to_desktop value when the override leaves it unset
Claude Code now recognises remote_projects as a source for remote sessions
Unclear The finding does not say what product or screen remote_projects refers to.
The sync status reason "stale_basis" is gone, and the "deferred" message has new wording
Unclear The finding does not say which sync feature these messages belong to.
Internal changes to checkout snapshots, including a new "not under a directory" message for some files
Unclear The finding does not say what a chained snapshot means for a reader.
Small interface changes, including Ctrl+C and Ctrl+D handling in the Teleport to Repo dialog
Unclear The finding does not say which onboarding step, which list, or which data these changes apply to.
On models where thinking is always on, the thinking shortcut now shows a notice instead of opening the toggle
In the transcript file viewer, the press-again hint now reads "again to close" instead of "again to exit"
The artifact comments instructions now describe a per-person list of short ids and display names, and tell the model to treat those names as data
Unclear The finding does not say where a reader sees this list or how it is filled in.
The plugin browse screen now notes when a policy catalog hides plugins, and inactive state for a built-in plugin catalog is added
Unclear The finding does not say whether or how the hidden-plugins marker is shown to the reader.
Deleting a plugin's saved options now checks that its settings and secrets are really gone, and reports what failed
Claude in Chrome file upload now refuses a path it cannot vet because of a symlink chain or an unreadable part
Background task output links are now checked after they are created and re-checked before use
Worktree tamper checks now read commits directly and report "unverified" instead of "none" when a commit cannot be read
Unclear The finding does not say where the "unverified" result is shown to a reader.
A retry check now treats HTTP 408 and 409 as temporary failures, as well as 429
Unclear The finding does not say which request this is or what the saved result is used for.
A plugin's hooks.json file can now include a $schema key, which Claude Code ignores when loading
The Read tool no longer skips re-reading a file when the earlier read never actually reached the model
When switching to auto permission mode fails, the result now includes a machine-readable code giving the reason
Unclear The finding does not say which interface returns this result.
A new step tidies permission settings, including dropping unearned bypass availability and resetting the mode saved before plan mode
Unclear The finding does not say when this step runs, and whether it applies to restored sessions is not shown.
The Agent SDK's list of control and event names gains sdk_mcp_manifest_capture
Unclear The finding does not say what sdk_mcp_manifest_capture does or who sends it.
Shell command summaries now turn control characters into a single space, as they already did for runs of whitespace
Claude Code's check of the current git branch now says "unreadable" when git ran and failed, not "unknown"
Internal support for sending session bundles and git packs gains link records and extra pack options
Unclear The finding does not say what these changes do for a reader.
Small internal changes: one select menu loses its tint hover style, tool approval now receives the host, and session roles pass through whole
Unclear The finding does not say what the approval step does with the new host value or which menu lost its hover style.
File sync's refusal about .git/info/attributes now names the problem lines, and a new host_config refusal is added
Unclear The finding does not say what situation triggers the new host_config refusal.
A new creditRetryStateless input makes the thread planner send a turn as a fresh stateless request instead of continuing a server-side thread
Unclear The finding does not say what sets creditRetryStateless.
Deny and ask permission rules for the Artifacts tool now apply to every list request, not only listings by type
Unclear The finding does not say what the extra rule matcher matches beyond the existing one.
HTML resources from MCP servers marked with profile=mcp-app are now recognised as app interfaces
Unclear The finding does not name the address prefix or say what Claude Code does with a resource once it is recognised as an app.
In the MCP "wants to open a URL" dialog, pressing Enter right after an arrow key now acts on the option you just picked
The guard that ignores keystrokes arriving just after a dialog opens now takes an extra context value in many permission dialogs
Unclear The finding does not say what the new context value changes about when keystrokes are ignored.
--channels now checks that the installed plugin's name matches, not only its marketplace, and names the installed plugin when skipping
Claude Code now refuses a file path when it cannot fully resolve shortcuts or ~ in it
Unclear The finding does not say which features rely on this check.
When several files are published as an artifact, the file list now passes through an extra processing step before upload
Unclear The finding does not say what the new step does to the manifest.
The memory part of the system prompt now goes through a new step that currently leaves it unchanged
A message sent to an agent that was evicted is now resumed using the loaded task instead of a value still loading
The remote session runner now hands system prompts to the processes it starts through files instead of on the command line
In vim mode, 0 after an operator now means line start so d0 works, and G jumps to line N with a count or the last line without
Plugin function hooks can now call session.version to get the running build's version, build time and git commit
The PromptHint and AbovePrompt slots are now listed for the desktop app as well as the terminal
Unclear The finding does not say what content currently fills these slots, so it is unclear what a desktop user will actually see there.
On reset, classifier transcript lines are now deleted for each agent except the agents that are being kept
Unclear The finding does not say what the classifier is or what these lines are used for.
A new keepSessionMessagesCache flag, off by default, stops the session messages cache from being cleared
Unclear The finding does not say what sets this flag or when.
The permission dialog's outer box no longer grabs keyboard focus or handles keys and paste itself
Unclear The finding does not say which part of the dialog now handles keys and pasting.
The follow-up prompt behind /insights now accepts a recommendation line
Unclear The finding does not say what the recommendation line contains or where a reader would see it.
Senders of served tool calls can now withdraw a standing call, when they provide a way to do it
Unclear The finding does not say what a standing served call is or where this is used.
Resumed sessions now reattach stray tool results to the reply that asked for them, matched by tool call id
Artifact patch publishes can now send per-file checks and report which files conflicted when a check fails
The spinner no longer breaks on a malformed API retry status and shows "API error" or skips it instead
Deferred tools from an MCP server that is reconnecting are now kept, not dropped, when the conversation is compacted
On Windows and WSL, any path part that looks like an old 8.3 short name now counts as a protected path
The read-only Bash check gains an offline-estimate mode and now rejects commands with some kinds of arguments
Unclear The finding does not say what the new argument check tests for or when the offline mode is used.
Claude Code now shows startup messages when managed settings from an LLM gateway fail to verify or load
In the /plugin detail menu, Update now and Uninstall are coloured, and uninstall says whether plugin data was kept
Unclear The finding does not confirm what the extra value on the success line is, only that it is probably a version.
Screen-reader output no longer says "blockquote:" before quoted text and marks each row of it with a row prefix instead
Unclear The finding does not say what the row-prefix marker looks like or how a screen reader reads it out.
The hints shown when claude --cloud falls back now depend on the sync mode and say what gets uploaded and what stays local
Unclear The finding does not give the new wording of the hints or say which situation other_forge covers.
Cloud git sync can now receive link commits written by the cloud container, with extra cleanup, logging and a clearer refusal message
Unclear The finding does not say what sets peerWritesLinks or when the container writes link bundles.
The SDK and headless startup coordinator takes new inputs for session-start hooks, pending SDK MCP servers and SDK entry waits
Unclear The finding does not say what these inputs change about startup for someone using the SDK.
The MCP OAuth modes dcr and byo are tagged with minimum version 1.15200.0, and hosted with 1.32885.1
Unclear The finding does not say which product these version numbers refer to.
Resuming a background agent no longer sets replHydration in its stream override
Unclear The finding does not say what dropping replHydration changes when an agent resumes.
A malformed policy-limits response is now retried even when retries are otherwise switched off, instead of being given up on
Unclear The finding does not say which of tengu_shimmying_stardust and tengu_policy_limits_fetch sets skipRetry.
Bash permission checks now track zsh's lowercase dirstack as well as DIRSTACK after pushd and popd
Skill proposals now tell the model a skill's slug must not contain "claude" or "anthropic" and must be at most 64 characters
Unclear The finding does not show whether the naming rules are enforced anywhere or only described.
Tool calls cancelled because a turn failed now come with a message saying so, including one for an image that could not be sent
Unclear The finding does not say whether these messages are shown to the user or only passed to the model.
The managed-settings option for the built-in Microsoft 365 MCP server is tagged with minimum version 1.19367.0
Unclear The finding does not say which product the version number 1.19367.0 refers to.
The shared config module now exports RELAUNCH_ENFORCEMENT_DEFAULT_HOURS, changedKeysNeedingRestart and canonicalJson
Unclear The finding does not say what these exports do for a user or what the default number of hours is.
Shortened lists can now end with "and at least N more" or "and more" instead of an exact count
Unclear The finding does not say which lists use the new wording.
The worker journal can now tell when a file was written by a newer build of Claude Code
Unclear The finding does not say what Claude Code does once it detects such a file.
Three small internal plugin changes: catalog-version installs, resolved IDs for aliased plugins, and sent-from records
Unclear The finding does not say what a sent-from record holds or how these changes affect installing plugins.
Permission decisions flagged as a dangerous removal now trigger an extra follow-up step that receives the decision's reason
Unclear The finding does not say what the follow-up step does or which condition must hold for it to run.
At startup, background plugin installs now wait for remote managed settings, and fall back to whatever settings have loaded if those fail
A new filter could limit credential-helper settings to admin-controlled managed settings; it is compiled so nothing is filtered yet
Unclear The finding does not say whether the key-stripping filter is also behind the switched-off check.
MCP Apps UI resources are no longer shown to Claude in its list of MCP resources, though they can still be read by address
Tables in responses now wrap their last column in narrow terminals instead of running off the edge
SDK initialize on a parked spare session (--await-claim) now ignores workspace trust and can defer the first prompt
Unclear The finding does not say what publishedCommands lists or when the initial prompt is deferred.
A warm spare session is now restarted when the extra launch arguments it was started with no longer match
Background dispatch now retries while the daemon starts, carries a reattach environment, and forwards flags like --settings when attaching
Unclear The finding does not say what reattachEnv contains or when it is present.
Two new telemetry events count context entries that land off the message chain around the first turn of a resumed session
Saving credentials to secure storage is now skipped when the read before it fails for a temporary reason
The safe mode notice now says hooks from settings files won't run this session, while session hooks still do
Plugin versions that don't come from an installed plugin can now get a 12-character hash added to the end
Unclear The finding does not say what the hash is computed from or when the extra input is supplied.
Git environment hardening now sorts toolchain variables like JAVA_HOME as folders and UV_PYTHON as files
Unclear The finding does not say how each label changes the way a variable is treated.
/focus is now marked terminal-oriented, and slash-command completion can offer a short name or the full prefixed name
Unclear The finding does not say what being marked terminal-oriented changes for /focus.
When the remote-tools flag is off, remote tool announcements are now recorded as withdrawn or refused, and inherited forwarded calls are cancelled
Unclear The finding does not say what remote tools are or how a reader would encounter them.
The settings screen now shows the default for the gitignore and /copy picker toggles when you haven't set them
The --managed-settings payload, including the SDK's managedSettings option, is now actually loaded at startup
The "Left on this machine" summary after a first remote upload now counts files held back because your Claude Code configuration links to them
File path comparison now folds letter case in the order lower, upper, lower, for more consistent matching of unusual characters
Claude Code's internal git handling now reads GIT_CONFIG_GLOBAL and GIT_CONFIG_SYSTEM, sets global config to /dev/null, and converts Windows paths
Unclear The finding does not say what GIT_CONFIG_GLOBAL was set to before this change.
MCP authentication errors now record which access scope was requested
Unclear The finding does not say whether requestedScope is ever shown to the user.
Re-attaching an already connected client now updates its stored viewport instead of being ignored
Unclear The finding does not say what kind of client this is or what its viewport controls.
The check for whether a model can use a 1M-token context now reads a per-model native1mHere value
Unclear The finding does not say whether this changes which models actually qualify.
Three new diagnostic log categories were added: context_credential_org_change, remote_headless_print and otlp_export
A list row's status now reads on or off for enabled items instead of success or pending
Unclear The finding does not say which list in Claude Code this row belongs to.
The "Large file modified" label is now cut off at the end when it does not fit, and its dimming follows the opposite condition
Unclear The finding does not say what condition controls the dimming.
A teammate mailbox attachment that contains messages is now counted among a set of included message kinds
Unclear The finding does not say what the set of included kinds is used for.
The desktop app's 'Environment helper script' setting now declares it needs app version 1.21459.0 or later
A helper was added that treats 4xx error responses other than 408, 409 and 429 as not worth retrying
Unclear The finding does not say where the new helper is used.
--cloud print mode#The not-yet-launched --cloud print mode has fixed messages for timeouts, failed starts, archived sessions, pending questions and Ctrl-C
initialize has been written#The SDK client now waits for initialize to be sent before sending any other request or MCP message
Instructions for writing artifacts now list https://unpkg.com as an allowed script source, while esm.sh stays blocked
Unclear The evidence shows the instruction text changing, but not the viewer's own loading rules.
When directory sync stops, Claude is now told the synced copy was moved to a set-aside directory, not deleted
Unclear The finding does not give the name of the set-aside directory or say what starts directory sync.
Rows in the /config settings list now highlight when you hover over them
Unclear The finding does not say what decides whether the tint or the inverse style is used.
The marketplace manager no longer shows action hints on built-in rows that can't use them
Unclear The finding does not say what makes a built-in marketplace blocked or off.
The work-in-progress upload now also checks file-mode changes and refuses on assume-unchanged or skip-worktree mismatches
Unclear The finding does not say what action starts the direct-publish upload.
The worktree refusal message now shows how to find the config.worktree file and warns sparse-checkout needs it
Remote Control now re-sends its tool-host advert when it re-registers after a 401 or 404
Unclear The finding does not say what the tool-host advert contains or what a reader notices when it is missing.
Staged Edit and Write results now take a wording option that defaults to "review"
Unclear The finding does not list the other wordings or say when they are used.
Fake protected tags written with look-alike Unicode letters or odd capitals are now caught and neutralised
The --plugin-dir debug log now explains whether a folder was read as one plugin or a folder of plugins
In /install-github-app, the "Existing Workflow Found" screen no longer shows a repository subtitle
Small internal changes to sync journals, nested CLAUDE.md loading, session tags, a sync notice and MCP server adds
Setting CLAUDE_CODE_TETHER_LIVE=true on first-party sessions now forces on humble-hammock tool-input copies, stellar-drift and tether live, even with a custom base URL
Unclear The finding does not say what the stellar-drift and humble-hammock features do, or what the further check requires.
Settings guidance now says to hide attribution with the object form, since older versions skip a file with a true/false value
The sandbox no longer retries setup after building its configuration has failed
SDK clients can now send an mcp_read_resource control request, limited to ui:// addresses
A git-folder check now reports a path through a file as having no git folder
Unclear The finding does not say what a reader sees differently as a result.
Refusal messages for settings-file edits via the desktop app, symlinks or managed policy exist but cannot run in this build
The footer's list of artifact rows is replaced by a single clickable badge showing the artifact's name or a count
Unclear The finding does not say what clicking the badge does.
The plugin list can now be filtered by marketplace, including the extra marketplaces a plugin is also listed in
Unclear The finding does not say how a user sets the marketplace filter or what the surface value is used for.
The plugin details menu now uses the standard selection list and shows "Installing…" on the chosen option during an install
Lists too long to fit on screen now get a scrollbar and can be scrolled with the mouse wheel
The /feedback drafts list is rebuilt, and typing d in a draft's text fields no longer discards the draft
Unclear The finding does not say which mode hides the Enter and d hints.
Text the terminal cannot display now shows as "[unreadable text]", "[unreadable]" or "[?]" instead of breaking the layout
Double-press and anti-misclick timing now measure from when your keypress arrived, not when it was handled
Malformed retry-status updates to the spinner are now reported once each, and errors while reporting them are ignored
Unclear The finding does not say where these reports go or whether a user sees them.
The published permission snapshot now leaves out session-added working folders that a child process adds again itself
Unclear The finding does not say which child process this is or when the snapshot is published.
After a container restart, Claude is told which background tasks were stopped and which finished without delivering results
The warning about credential-like files blocking sync now suggests amending or rebasing, or pushing the branch first
Unclear The finding does not say which sync feature shows this message.
MCP servers whose start was put off can now be started later in a session
Unclear The finding does not say what triggers the step or what the "claim" label means.
For Claude in Chrome, working out the startup MCP settings now waits for a dynamic-config step first
Unclear The finding does not say what the dynamic-config step does or how it changes anything a user sees.
The queue for typed messages gains promoteToNow and demoteFromNow
Unclear The finding does not say how a user reaches these operations.
Sending a queued message now can deliver it early without cancelling Claude's turn, falling back to cancelling only if needed
When a skill can only be sent as a file, Claude is told to name the save option in its reply text and describe using the skill only conditionally
Unclear The finding does not say which apps or situations use this send-file mode for skills.
A helper that labels a Remote Control session as refused for lack of capacity was added but does not appear to be used yet
Unclear The finding does not say whether anything calls this helper or what the always-false check will eventually control.
API requests that fail with a 400-499 status are no longer retried, except for 408, 409 and 429
The /stats dialog no longer takes keyboard focus on its header when it opens
Unclear The finding does not say which part of the screen receives key presses first instead.
A dialog's footer hint now shows Enter to confirm as well as Esc to cancel
Unclear The finding does not say which dialog or dialogs show this footer.
Git commands Claude Code runs now add extra -c config settings by default, in a new "pinned" mode
Unclear The finding does not list which settings are added or which git calls use a mode other than pinned.
Folder snapshot uploads can now fail with a new folder_too_large reason, reported with the folder's size
Unclear The finding does not say what the size limit is, what the snapshot is used for, or whether you see this reason on screen.
tool.call events now have their isReadOnly field removed before they are passed on
Unclear The finding does not say which consumers receive this reduced payload, including whether user-configured hooks do.
Handling of 400, 403 and 415 errors now reads the response text directly when checking for invalid_json_at_origin
Unclear The finding does not say whether any error messages or retries change as a result.
Several small internal additions, including a worktree setting beside auto_mode_environment and a new input_low_latency_submit event
Unclear The finding does not say what the new worktree value or most of the other additions do for a user.
Claude Code now records when a Swift file is edited in a session, along with evidence fields
Unclear The finding does not say what this tracking is used for.
The /mcp server list now scrolls with a scroll bar and shows each server's status as short labels
Unclear The finding does not say what the internal flag that hides the key hints is or when it is on.
Remote Control now declines recently created project-thread sessions when it is already at its session limit
Unclear The finding does not define a project-thread child session or say how recent counts as recently created.
Remote Control now stops incoming work that carries an unsupported mode instead of trying to run it
Unclear The finding does not say which modes exist or where they come from.
When a session's working directory disappears, Bash refuses to run elsewhere and headless turns keep going with a warning instead of failing
Unclear The finding does not say how a session becomes pinned to a directory.
On Windows, Claude Code now locates your Documents and PowerShell profile folders for the check that offers local tools to cloud sessions
Unclear The finding does not say what happens when an overlap is actually found.
A new tengu_violin_tailpiece flag name appears next to the remote-tools flags but nothing seems to use it yet
Unclear The finding does not say what this flag is meant to control.
Plugins with a directory pin are now cloned without fetching git submodules
Unclear The finding does not say how a plugin comes to have a directoryPin.
The memory report attached to a heap snapshot now has its own breakdown when Claude Code runs on Bun
docker logs and docker inspect stop running automatically as read-only when given connection flags or tilde paths
Git read-only checks now also inspect --group values and reject values with tilde expansions
A failed plugin install batch now puts back the plugin's earlier install record instead of deleting it
Context-usage reports can now name the compaction point they were measured after, except in some sessions
Unclear The finding does not say what a foreign or noHistoryBackfill session is from a user's point of view.
upload_asset now refuses network paths, device paths and symlinks it cannot fully check
Unclear The finding does not say how upload_asset is reached or whether the 256 depth constant is the symlink limit.
Claude Code can now refuse a file path written in a form its permission rules cannot match and ask for the full path
Unclear The finding does not say which tool calls go through the path-rule layer.
Cloud session setup now sends the list of disallowed tools along with allowed tools
A new keybinding action plugin:cycleMarketplace has been added
Unclear The finding does not say what the action does, which key triggers it, or what the check that excludes it controls.
A plugin-not-found error is now grouped with marketplace load failures
Unclear The finding does not say what handling this group receives.
DEBUG_CLAUDE_AGENT_SDK is now read from the current environment each time and parsed as on or off
Unclear The finding does not say which values count as on.
A plan-style dialog now shows a title and paragraphs instead of a single plan
Unclear The finding does not say which dialog this is or when it appears.
Background task completion notices now point to the output file the task actually recorded
The git check for divergence from the remote now gets a fixed deadline as well as a timeout
The managed-settings schema raises one minimum version, adds minimums to two MCP subfields, and hides the Salesforce partner skills entry
Unclear The finding does not say which application's version numbering the availableInVersion values refer to.
Credential masks from an eval-confined foreign settings tier are now treated as untrusted and can never grant proxy injection
Unclear The finding does not say what an "eval-confined foreign tier" is or which settings files carry that label.
In-process SDK MCP servers now give up connecting after the standard MCP connect timeout instead of waiting forever
Debug-level remote sync messages now go only to the debug log instead of also appearing in the conversation
Unclear The finding does not say which reasons the new "not armed" check can report.
Remote Control now records whether it was turned on explicitly, by default or by a setting, and re-sends session info when a new value changes
Unclear The finding does not say what the newly watched value is.
The plugin function-hooks runtime gains a state library with atom, derive, memberOf, read and update
Unclear The finding does not say whether plugin authors can use this library in this build.
User messages can now carry a classifierBoundary marker that the auto-mode classifier reads
Unclear The finding does not say what sets the marker or how it changes the context the classifier receives.
The low-context warning now normalizes the model before working out its warning level and auto-compact threshold
Unclear The finding does not say what the helper does to the model, so it is unclear for which models the numbers change.
A policy-gated feature that is latched off now always shows "Restart Claude Code to re-evaluate." instead of a generic fallback
CLAUDE_CODE_DIR_SYNC_ENGINE now only understands the off words, so "git" and "always-git" trigger a warning
Unclear The finding does not say how sync behaves when the variable holds an unrecognised word.
Claude Code's internal git calls, including teleport overlay calls, now switch off commit-graph, multi-pack index, pack bitmaps and the reverse index
Unclear The finding does not say what problem turning these off addresses.
Reading a PDF now logs a cli_pdf_read telemetry event with page counts, file size, outcome and time taken
An API 400 error naming a message's output_config.effort is now treated as an unsupported-effort error and falls back
/plugin directory now opens Discover scoped to the Anthropic plugin directory, and marketplace list escapes odd values and hides built-in entries from --json
Unclear The finding does not say when a lookup of the Anthropic plugin directory marketplace now returns nothing.
The message Claude gets when a linked computer's Claude Code hasn't connected is reworded to talk about the user's computer
Permission rules with wildcards now never match if the pattern contains a NUL byte
The host-credential cache now resets when APPDATA or LOCALAPPDATA change, as well as its earlier inputs
The git-lfs pointer warning now only runs for cloned sources and checks that source's own pointer scan
Unclear The finding does not say what a "source" is here, what other kinds exist, or what the warning text tells the reader.
Skill sync gains a listedSkills list and missing-skill resync fields, and changes when a synced skill claims its short name
Unclear The finding does not say what listedSkills holds or which skills gain or lose their short name under the new rule.
A function that would add informational notices to the transcript was added but never runs in this build
Directory and content sync gained several new internal fields for reports, caches and journal resets
Unclear The finding does not say what any of these fields do for someone using Claude Code.
The "Authorization server" config field is now marked as available from version 1.32885.1
Unclear The finding does not say which product version 1.32885.1 refers to or where this field is shown.
Several small internals changed, covering Slack channel updates, a name sanitizer, thinking sync, estimates and a git screen cache
Unclear The finding does not say what any of these changes means for someone using Claude Code.
Effort, Opus-on-Pro and disabled-API-key errors now give desktop-hosted sessions advice they can follow instead of CLI commands like /login
The "Could not load credentials" error no longer breaks mid-sentence on a trailing newline
On Windows, backup copies of Claude Code are now kept for up to 30 days when the launcher is missing
The internal cloud_session description now says started_from_upload also covers an empty start filled by file sync
Unclear The finding does not say whether this description is ever shown to users.
Starting a --cloud session no longer refuses a prompt given as plain text
Unclear The finding does not say which situation still triggers the remaining no_stream_input refusal.
With --sdk-url, waiting for SDK MCP servers is now time-limited, and servers started later are waited for
A parked spare process in print mode now runs session-start hooks only once it is claimed
Resuming in print mode now works out which tool calls the host can answer and passes them to session loading
Unclear The finding does not say what makes a tool call host-answerable or how the resumed session treats those calls differently.
A new path for presenting adopted host tools after a restart was added, but a built-in switch keeps it empty
Up to 32 undelivered completion notices for finished background tasks are now published by a new queue subscriber
Unclear The finding does not say where these notices are published or who reads them.
Over a remote connection, finished background tasks are now recorded so they can be reported after a restart
The built-in gateway now refuses amazon-bedrock-* headers when a Bedrock guardrail applies, and can use a separate AWS role per user
The directory sync protocol gains new state fields, a "held" result for the trash handler, and a count of already-published commits
Unclear The finding does not say what these fields change for someone whose directory is being synced.
Plugin update summaries now count results for plugins installed from a local directory
Unclear The finding does not say where this summary is shown to a user, or what counts as an identity change.
The "worktree could not be examined" error when resuming an agent now shows the real error code
The GitHub Actions install progress list no longer shows its header box
Bridge debug logs now hash work and session IDs and hide JSON values and unusual type or mode text
Laptop memory status events now report a local_memory_off state for any gate state besides open, closed, pending and denied
Unclear The finding does not say whether this event is shown to the user or only recorded internally.
Reading memory files while memory is paused is now blocked based on the file's actual resolved location
Session launch settings now pass on the list of tools that are not allowed, along with permission mode, effort and model
Unclear The finding does not say which kinds of session this launch builder is used for.
Plugin list entries now note when a plugin has auto-update explicitly turned off
Unclear The finding does not say where this flag is shown or how it changes update behaviour.
Non-interactive runs started from VS Code no longer run the startup step that prepares markdown handling
Settings screens gain text describing allowed outbound-host entries and a host-list placeholder; a helper cache TTL field is tagged with a version
Unclear The finding does not say which settings screen shows these strings or what the helper cache TTL field controls.
NotebookEdit's refusal message now says the notebook "may be" on a network path instead of stating it as fact
An internal sync store adds list, unheld-lookup and move operations, drops the "seed" kind, and records fewer ids on cache hits
Unclear The finding does not say what this sync store is used for or how the change shows up for someone using Claude Code.
Cancelling a permission request now always queues a cancel, and a special case for 'leftStanding' requests was removed from that path
Unclear The finding does not say whether the leftStanding unwind was moved elsewhere or removed entirely.
The memory-store watcher now tracks whether its start was held by a policy check and clears that state on reset
Unclear The finding does not confirm that the start is actually held until a policy verdict arrives, or say what the memory store holds.
Signing out or changing account now clears the cached profile names and profile ids, even when the account is the same
Unclear The finding does not say what these profiles are or where they are shown.
Cloud sessions recover more reliably when the permission mode you asked for is refused, with retries and a notice if they fail
Unclear The finding does not say what the notice shown after the retry helper gives up says.
CCR worker startup now records how long initialization took, as worker_init_ms
Unclear The finding does not say what the CCR worker is.
A notice telling Claude it cannot run tools on your connected computer is built in but switched off everywhere it is used
A rule telling Claude to stay silent about skipped checks on trivial commits is added only when a plugin hooks module supplies exemption text
Unclear The finding does not say how a plugin registers an attribution.text handler.
Git diff stats and untracked-file listing can now run pinned to the repository root with an isolated environment and filtered paths
Unclear The finding does not say which features pass a repository to these helpers.
hooks.json validation now warns about unquoted plugin path placeholders, and /plugin gains install-count sorting and an 'All' marketplace tab
Unclear The finding does not say whether the placeholder check shows a warning to the user or where.
The /plugin details menu now uses a standard selection list, and plugin, connector and marketplace names are cleaned before display
Unclear The finding does not say what the ignoredNameEntry flag changes for the user.
Publishing an Artifact made from an Anthropic-published type now notes that its capabilities are fixed by that type
Git bundle failure reasons such as tip_mismatch are now mapped to fixed logged values, with anything else logged as "other"
The Write tool now drops alias fields that repeat the same value as file_path or content, and notes which one it ignored
API errors that arrive as an HTML web page now show the status code and its standard reason instead of raw page markup
A remotely served call now counts as consented only when the stored consent choice is exactly "accepted"
Unclear The finding does not say whether the allowUnattendedServing setting and the stale state each block consent or bypass the check.
Remote Control child sessions now honour the auto-over-settings flag, and the artifact option extends to attended sessions
Unclear The finding does not say what the check that now accepts either gate controls.
Remote session summaries now include pending_action naming the tool a waiting session needs, and 'needs input' tracking counts only live requests
Unclear The finding does not say where this session list is shown to users.
On remote workers, subagent thinking is now always set to omitted, even when the session chose a display setting
Unclear The finding does not define what counts as a remote worker.
Sandboxed commands on macOS and Linux now get TMPDIR pointed at the sandbox's own temporary folder
The Design and Slides artifact commands can now each be allowed or blocked separately by organisation policy
A debug message about MCP server connections now names both hosts it checked when a blocklist entry matches
Agents loaded from plugins now record which plugin and file they came from
Unclear The finding does not say where pluginSource is shown or used.
A fallback that matches sandbox-excluded commands was simplified but does not run in this build
A remote task stops waiting and is marked blocked when its cloud session has unanswered MCP server questions for too long
The "git not found" error can now explain that your home directory is, or sits inside, a git checkout
Unclear The finding does not say why a home directory inside a checkout affects finding git.
After each successful upload to /worker/events, the client now reads the reply and passes on a has_subscribers yes/no value
Unclear The finding does not say what Claude Code does differently once it knows whether there are subscribers.
The shared bootstrap configuration gains a flat (v1) format, and each setting is now tagged with the first Desktop release that reads it
Unclear The finding does not say whether anything in Claude Code already sends or reads the flat v1 format.
The gateway's policy checker now warns when no desktop policy sets serve_to_desktop, and gateway errors are cleaned before logging
Cowork's advanced file analysis now also requires chatSurface.enabled to be true
Unclear The finding does not say what the chat surface is or how it gets enabled.
The /plugin menu ignores repeat clicks while an action runs, and its selection now follows scrolling
The mobile project scan now separates strong iOS evidence from weak hints and recognises iOS commands more strictly
Unclear The finding does not say what Claude Code does differently once it decides a project is an iOS project.
Memory syncing skips a startup step until its first pull is due, and waiting git syncs now stop within a time limit at shutdown
Unclear The finding does not give the length of the shutdown time limit.
Attachments under /net, /Network, /.vol, /.file, /.nofollow or /.resolve are now refused, with advice to copy the file somewhere local first
Messages from teammates are now cleaned repeatedly, up to four times, before being wrapped for delivery
Unclear The finding does not say what the cleaning steps remove from a message.
Self-hosted gateway policies can now set serve_to_desktop, and a new error points admins to it when a Desktop session has no policy
A failed recap now records its outcome as failed, alongside the "Couldn't generate a recap" message
Command overrides can now replace a command's description, argument hint, model and allowed tools, and plugin commands are merged into the list
Unclear The finding does not say where overrides come from or how a merged plugin command is combined with an existing one.
Internal replies used when starting, moving or resuming a session gain new fields such as freshSession and reattachEnvDropped
Unclear The finding does not say what the leafUuid filter checks or whether any of the new fields change what a reader sees.
Claude Code's internal file layer can now move a newly created file into place without overwriting an existing one
Unclear The finding does not say which Claude Code features use placeCreated.
New patterns spot a ~ home-folder shortcut after = or :, or inside braces, in command arguments
Unclear The finding does not say which check uses these patterns or what happens when one matches.
A new message reports a known_marketplaces.json entry that is already gone, and the old attach-this-machine hint is removed
Internal tidy-ups, including a shared "more below" scroll hint and a reattached Windows sandbox install subcommand
Unclear The finding does not say whether sandbox install on Windows could be reached before it was reattached.
PWD and OLDPWD now always count as risky variables when the Bash check decides whether rm or cd can take the quick path
Unclear The finding does not say what the quick path skips, such as whether it means running without asking.
The self-hosted runner now drops invalid environment variable names for sessions and reports failed starts as a startError
With --configure-git, the runner stops governed sessions at capacity above 1 if commit signing cannot be set up
Unclear The finding does not define what a governed session is or what capacity counts.
Resuming a compacted conversation now restores exactly the messages compaction kept, and falls back to reading everything if that list is unusable
Broken sandbox settings now wait to be fixed and retried, and a later bad edit keeps the running sandbox instead of failing
The footer under the prompt now shrinks to fit: "N background" becomes "N bg", the hint drops, and the right side is capped at 40%
claude --cloud file sync now explains refusals for project folders tied to Claude Code's configuration and rewords the protected-commit refusal
The generated settings schema now lists old inferenceCredentialKind values as deprecated, with warning and end-of-support dates
Artifact type lists now show the tier in brackets before the title and cut long descriptions at a word
Unclear The finding does not say where the artifact type list appears or whether type:<glob> rules can be written in settings yet.
The MCP and plugin subcommands now load from separate files instead of being built into the main program
Creating a cloud session now tells the service whether a repository, a bundle or files are attached
Unclear What anything and launchCheckout each mean, and whether the service acts on them, is not shown.
Confirmation panels shown for errors now display Enter to confirm and Escape to cancel hints
Responsive mode is no longer offered when Claude Code runs inside Slack or Teams
Cloud sessions tied to a device now block the device_bash, device_list_dir, device_stage_files and device_commit_files tools
When advisor content is stripped partway through a conversation, a notice saying so is added to it
Unclear What advisor content is, and whether this notice is shown to the user or only to the model, is not shown.
The warning about cloud file changes not being copied to your machine now includes the reason
The auto-memory status can now show a short detail after the status itself
System events marking a per-turn effort change are now skipped in one event loop, like preempted-turn events
Unclear Which part of Claude Code runs this loop, and what a user saw before the change, is not shown.
Pressing Ctrl+C or Ctrl+D at the custom API key prompt now exits
Unclear Whether Ctrl+C or Ctrl+D closes only the dialog or quits Claude Code altogether is not shown.
Plugin status checks now match installed plugins by their resolved name and marketplace
Cloud launch checks now receive a headlessCloudPrint value, and one remote-control check reads the command-line arguments
Unclear How headlessCloudPrint is set, what it changes, and what the old remote-control test got wrong are not shown.
MCP tool calls refused for missing permissions can prompt you to sign in again and retry, behind a gate
The MCP discovery cache is now kept separately depending on whether the MCP Apps host is enabled
Unclear Whether CLAUDE_CODE_MCP_APPS_HOST is an environment variable or a setting, and how a user turns it on, is not shown.
Cloud sessions tied to a device can now tell the service that their repositories are trusted
Unclear What sets repositoriesTrusted, and what the service does with it, is not shown.
Gateway Bedrock upstreams can now apply a Bedrock Guardrail and assume an AWS role; telemetry gains resource_attributes and policies gain serve_to_desktop
Unclear The finding does not say what the guardrail: true flag does on its own in this client or how a user sets assumeRole.
Cloud gateway sign-in and availability errors now tell you to sign in from a terminal where the session runs, or to ask your admin
Removing a marketplace from /plugin errors now also clears that marketplace's plugin errors and handles ignored-name entries
Environment dialogs now use a shared titled dialog, and their separate Esc-hint footers are gone
Unclear The finding does not say whether Esc still cancels these dialogs now that the hint is gone.
The "folder too large" message for cloud sessions no longer gives removal advice, and its path list is cut off at 512 characters
Unclear The finding does not say whether the removed advice now appears somewhere else.
The git_within_reach message now also says to install git outside your home directory if git tracks your home or a folder above it
The SSE connection can now hold incoming messages in a queue instead of handling them straight away, and closes through one shared step
Unclear The finding does not say what puts the connection into held mode or when the queued messages are handled.
Fetching comments on an artifact can now also return the names of the comment authors
Unclear The finding does not say what an artifact is here or where the author names are shown.
Laptop sync now compares branch heads first and skips the integrated-branch fallback when the branches have not diverged
Unclear The finding does not describe what the integrated-branch path does or what you see when it is taken.
New internal helpers track whether a spare session is parked, being claimed, claimed or failed, and remove a block from mixed content
Unclear The finding does not say what a spare session is used for or where either helper is used.
Multi-select submit buttons now light up on hover, and a file list gains a scroll indicator
-i with a ~ argument now needs permission#An lsof command using -i followed by an argument containing ~ now asks for permission instead of being auto-approved
Slash commands no longer list an alias that is identical to the command's own name
The status indicator icons gain an on state (green tick) and an off state (circle)
Unclear The finding does not say which screen or setting uses the new on and off states.
otlp_export health telemetry for customer OpenTelemetry exporters#Claude Code now records whether its OpenTelemetry exports to your own collector succeed or fail, with an error code on failure
The Cowork 3P settings schema warns when an allowedPluginMarketplaces entry has no pin and so installs nothing
When a git config path is the null device, Claude Code now records it with a lighter identity check
Unclear The finding does not say what a reader would notice differently because of this.
The self-hosted runner's checkout hook can now pass its error output out line by line as it runs
Unclear The finding does not say where the streamed lines are shown.
Background daemon sessions now write their environment into the host tombstone record instead of leaving it empty
Unclear The finding does not say what is written from the environment or what reads the tombstone.
Publishing an artifact file can now be cancelled, and cancelling takes the file back
Unclear The finding does not say how a reader cancels a publish.
/autocompact now standardises the model name first, so aliases get the right default and limit
Claude Code's git change counts can now be limited to files inside one folder
Unclear The finding does not say which part of Claude Code passes a root folder.
Config for spawned sessions now passes on disallowedTools and reads the effort level from the correct place
Unclear The finding does not say which feature starts these sessions or whether that path runs in this build.
Peer sync now tracks whether the other side writes links, not only whether it reads them
Unclear The finding does not say what peer sync or links are to a reader.
Three small internal changes: a PowerShell permission flag, an input clock in the display layer, and a new prompt dispatchCommand input
Unclear The finding does not say what any of these changes does for a reader.
More Windows environment variables, such as SYSTEMROOT, COMSPEC and PSMODULEPATH, now get special handling when set in settings env
Unclear The finding does not say what the special handling does to these variables.
Session permission rules can now hold an optional addDirs list next to allow and deny
Unclear The finding does not say how addDirs gets filled in or what effect the listed directories have.
An upload announcement that hits a create conflict now checks its own journal and continues if it wrote it
Directory-sync git store now caps linksInherited at the link count, timestamps turn-start records, and logs failed writes
Unclear The finding does not say which earlier record the turn-start record replaces.
Placing a working file can now fail with WORKING_FILE_HELD: "another program holds the file"
Unclear The finding does not say which feature places working files or when the error appears.
Saving a setting blocked by a managed lock marked reasonShipsOffBox now reports a refusal, not "locked"
Unclear The finding does not say what reasonShipsOffBox means or how a refusal looks different to you from a lock.
The tengu_context_size event now measures tool schemas from the tool list actually sent, when one is recorded
The word-by-word fallback for matching commands now skips configured commands with spaces in their names
Unclear The finding does not say which feature relies on this matching helper.
claude.ai MCP connectors now check a cached discover response and ignore it unless it passes three checks
The self-hosted runner now checks agent_files, passes agents via --agents <file>, and passes system prompts as files
Directory sync now says when a folder's upload was cut short or never began, and records a quiet not-armed case
Unclear The finding does not say whether recording through noteSilentlyNotArmed shows you anything.
The cloud-session system prompt now names the synced folder when it differs from the project path
Unrecorded tool results in ended or copied sessions now get placeholders telling the model to check before trusting or retrying
Unclear The finding does not say what hostAnswerableToolUseIds does when a session is resumed.
EnterWorktree gained a fallback for folders that are not git repositories, but it never runs, so behaviour is unchanged
The admin config schema adds five keys, including disableBypassPermissionsMode, and removes relaunchEnforcementHours
Unclear The finding does not say what usageMetricsEnabled controls or what replaces relaunchEnforcementHours.
A new permission pre-check can change an automatic allow into a prompt that asks you first
Unclear The finding does not say what a servedCall is or which permission modes the check lets through.
Small internal changes: a link sanitizer that writes "(link removed)", command outcomes on messages, a simpler repo-name dialog
Unclear The finding does not say where the link sanitizer is applied.
The error for managed settings that fail to load now drops the claude auth login advice in one sign-in situation
Unclear The finding does not say which sign-in situation produces the shorter wording.
Updating a plugin without naming a scope now picks local, project or user, whichever has an install, then falls back to managed
The artifacts tool gains a db_profiles action whose result reads "no names available" or "found N person/people"
Unclear The finding does not say what the profiles are or when this action is used.
When a changed file's diff is empty, the note to the model no longer mentions the snippet budget
Some API errors are now labelled plain http_<status> without the _no_retry suffix, and 503 no-retry responses get their own check
Unclear The finding does not say what the internal check tests or where the new 503 helper is used.
Streamed blocks that are cut off partway are no longer marked as ended
Unclear The finding does not say how this changes what a reader sees.
wc now uses the same file-path handling as tail, sort and uniq
Unclear The finding does not say how this changes which paths are found for wc.
The check for added directories a command line cannot carry now counts only directories added by a command-line argument
Unclear The finding does not say what this check is for or what happens when it flags a directory.
The Vertex/GCP setup wizard has a new step list, including a step to pin models
Unclear The finding does not say how the wizard is opened or what the previous steps were.
Small UI tweaks to the Sandbox settings pane, a confirm dialog, the footer, and a new row list for scheduled items and stop hooks
Unclear The finding does not say where the new row display appears.
Internal changes to remote control: connection-down detection, a startup signal, and thinking settings re-synced on model change
Unclear The finding does not say what any of these changes look like to someone using remote control.
A new helper compares file paths ignoring upper and lower case on Windows and macOS
Unclear The finding does not say which features use this helper.
The auto-mode classifier's verdict is now discarded in plan mode unless the host allows it
Unclear The finding does not say which hosts pass the check.
claude plugin marketplace add now refuses the reserved name anthropic-plugin-directory straight away, before doing any other work
Plugin commands now run names through an alias lookup that changes nothing yet; plugin update and plugin details get small message fixes
Attached file downloads now reuse a checked local cache and can join a download of the same file that is already running
Cloud file sync now reads committed .gitattributes from extra commits or trees and reports more reasons a sync was not applied
Unclear The finding does not say what folding your machine's installs into the agreed tree changes for a user.
Cycling permission modes with Shift-Tab now marks that you cycled before the new mode is applied
Unclear What the cycled marker is later used for is not shown.
The memory prompt index now reports policy_pending when a policy is held, instead of a generic unavailable
iOS and Xcode project detection now weighs evidence from every tool call instead of stopping at the first clue
Unclear The finding does not say what Claude Code does differently once it detects iOS work.
SDK: workspace_trust_recorded is now described as absent when a parked spare initializes with --await-claim
Unclear The finding does not explain what a parked spare is.
Internal tidy-ups to the gateway confirmation dialog, feedback survey trigger and plugin loader, with little for users to notice
Bash permission checks now understand cp and mv with -t or --target-directory and check all their files as writes
Changing the block-outside-reads setting now reports when the sandbox did not refresh, instead of claiming success
Starting a remote session with an environment that does not match the repository now gives a plain explanation instead of a raw HTTP error
Checkout upload failures can now be reported as timed_out, shown as "the upload ran out of time"
The status line's thinking.enabled value now reads true for models that force thinking, even if you switched thinking off
Unclear The finding does not name which models always use thinking.
A cached background lookup stops starting new fetches once Claude Code has begun shutting down
Unclear The finding does not say what this lookup fetches or which feature relies on it.
The /stats error, empty and loading screens no longer take keyboard focus automatically
Unclear The finding does not say where key presses go instead or what a user would notice differently.
Build 2.1.281 ships a newer bundled model catalog, version 994 in place of 837
Unclear The finding does not say which models were added, removed or changed between catalog versions 837 and 994.
The 'Run this command?' prompt for commands opened from a link now uses the standard dialog, with no press-twice-to-cancel hint
A picker dialog's press-twice hint now says 'again to close' instead of 'again to exit'
Unclear The finding does not name which dialog this is.
Discover plugins shows install counts for more entries and labels marketplaces differently
Unclear The finding does not say which marketplace keeps the counts or which one no longer shows '[Community Managed]'.
In Install Plugins, a plugin that is installing shows the in-progress mark even when it is selected
After a forwarded command, directory sync no longer pulls the remote machine's changed files in the middle of a turn
Unclear The finding does not say whether or when the remote changes are pulled instead.
Directory sync now re-checks git when .git changes, reports clearer reasons when no safe git is found, and flags risky git config locations
Remote tool calls can take over a standing request on resume, withdraw it on interrupt, and report hosts as still running or restarted
Unclear The finding does not say what a standing request is or what a user sees when one is withdrawn.
Remote host summaries include the sync root, and remote file paths follow the remote machine's own path rules
The hook-chain runner can now strip a result before checking it, unless the result is meant for the engine
Unclear The finding does not say what a site is, what gets stripped, or whether hooks a user writes are affected.
Claude Code now records the account-set permission mode and uses it to decide auto-mode status and who answers remote plan-mode questions
Unclear The finding does not say how a mode comes to be set on the account.
Resuming a session rebuilds the record of read files from the file content itself, not from display text
Cloud sessions track bundle chains, and sessions started without a device binding now say so
Unclear The finding does not say what a bundle is or what the new fields do.
Creating a cloud session now passes a repositoriesTrusted option
Unclear The finding does not say what value is sent or what the option changes.
Joining an artifact room now also passes a namesSilent setting
Unclear The finding does not say what namesSilent controls or how it affects a user.
Detecting git folders for a path now checks only that folder, not the folders above it
Unclear The finding does not say where this helper is used or what visible behaviour changes as a result.
Artifact errors about non-JSON values now name whether $.store.set or $.state.set was called
System-prompt-file flags and agents are now among the arguments the runner handles alongside settings and mcp-config
Unclear The finding does not say what the runner is or what being in this group does to a flag.
Windows drive paths like C: are no longer mistaken for web-style addresses and dropped from launch directories
The /ide notice now says other open IDEs are skipped because their folders don't match the current directory
Skill lock labels are now built without a leading · separator, which is added by the code showing them
SDK Remote Control failures now report a failure_kind, and failed enable requests return an error_code such as remote_control_policy_disabled
Unclear The finding does not say what getBackfillMessages supplies or which other failure_kind values exist.
An SDK process started with --await-claim now rejects messages sent before it is claimed with a not_claimed error
Listing artifacts of a named type now respects deny and ask permission rules for that type
Page Up and Page Down can now be passed to another action when the content already fits on screen
Unclear The finding does not say which screen enables the option or what the keys then do there.
SDK transcripts can now mark why a local command failed, with kinds such as unknown command or restart required
Turning PDF pages into images with pdftoppm can now be cancelled, and cancelling is not reported as a failure
The cloud file-sync failure message has a new version without the "send from another window" advice
Unclear The finding does not say when the new version is shown or what text it adds.
An early-exit check and a staging-link parser were added, but neither can run in this build
Five small internal changes, covering git remote lookup, file-sync results, a bash task counter, path handling and SDK setup order
Unclear The finding does not say whether any of these five changes has a visible effect for users.
Teammate tmux sessions now start without the environment variables that come from your settings files
The "Background work is running" exit warning now passes one extra setting when it opens
Unclear The finding does not name the new option or say what it does to the dialog.
Commands and skills loaded from plugins now carry a full record of which plugin and file they came from
Unclear The finding does not say what uses the pluginSource record or how it affects the reader.
When saving a session transcript fails, the failed record is now marked as lost
Unclear The finding does not say what reads the "lost" mark or what the reader sees because of it.
Two settings, frameNavPath and frameExpanded, were removed from Claude Code's starting app state
Unclear The finding does not say what these two values controlled or whether anything visible went with them.
The plugin seed-cache lookup now describes the version it wants as a catalog version
Unclear The finding does not say whether this changes which cached plugins are found.
Slash-command search now knows when what you typed contains a colon
Unclear The finding does not say how results or their order change when the query has a colon.
A confirm dialog with Cancel preselected no longer shows numbers next to its options
Unclear The finding does not say which confirmation dialog this is or whether number keys still pick options.
Code handling bridge environment advertise and withdraw steps was added but can never run
A skill file built into Claude Code has changed content
Unclear The finding does not say which skill this is or what in it changed.
The Agent tool can now keep tool results inside subagents instead of stripping them, controlled by a server-side switch
Unclear The finding does not say where the kept results end up or what the reader notices from them.
WebFetch now measures how often the same web page is fetched again, without changing what it returns
A new helper measures how much memory Claude Code's process gains or loses during each tool call
Unclear The finding does not say whether the helper is used yet or where its measurements go.
The /context total is now the sum of its non-deferred categories plus the API-measured message remainder, not the raw API input count
Unclear The finding does not say how 'non-deferred' categories are chosen or how large the difference from the old total tends to be.
unavailable set; breadcrumbs skipped on launch model pick#In print mode the model list now includes an unavailable set, and model-switch notes are skipped when the model is picked at launch
Unclear The finding does not say what firstTurnGate does, which service depends on the spare-claim state, or what "parked" means.
\??\ prefix#The helper path check now rejects Windows paths that start with the \??\ prefix
Unclear The finding does not say which setting supplies the helper path.
The mid-turn sync notice now tells the model it can read changes on the remote machine while it waits for them to arrive
Every tool call now runs a cleanup step after it finishes, whether it succeeded or failed
Unclear The finding does not say what the cleanup step actually does.
Small interface and telemetry changes: a new clickable footer item, extra usage fields, a cleaned-up server-name hint and a new command list
Unclear The finding does not say what the new footer item opens or where the new command list appears.
File sync now reports files skipped because of host config, and the --cloud fallback hint says only commits will upload
The list of folders a bound cloud session can write to now covers a home directory that is, or sits inside, a git checkout
Unclear The finding shows the description changed but only suggests that the actual search for writable folders widened to match.
After edits that change how accented or combined characters are stored, the prompt cursor no longer lands in the middle of a character
SDK set_max_thinking_tokens now returns an error when the host refuses part of the request
Unclear The finding does not say which parts of the request a host may refuse.
New usage event tengu_advisor_strip_replayed counts assistant messages covered by advisor stripping
A new permission-decision label, permission_safety_check_timed_dialog, points to a timed dialog for safety-check prompts
Unclear The finding does not say when the timed dialog appears or what happens when its time runs out.
A new internal switch can keep a session's stored message list from being cleared
Unclear The finding does not say what turns this switch on.
In option lists, pressing the up arrow on the first option can now be ignored
Unclear The finding does not say exactly when the up-arrow check applies or what happens to the ignored key press.
A new helper can remove the core.hooksPath setting from a git configuration list in Claude Code's git and worktree support
Unclear The finding does not say when the helper is asked to drop core.hooksPath or which git operations use it.
A check for one project config file name was narrowed, and the broader list of matching config file names moved into a separate check
Unclear The finding does not say which file name the narrowed check matches or which features use each check.
Telemetry can now report whether the main response is still streaming in
Applying environment variables from settings now always runs a reset step afterwards, and ending a session gained a cleanup step
Unclear The finding does not say what the reset step clears or what the new cleanup at session end does.
In headless mode, changing directory with set_cwd now restarts MCP servers started in the old folder so they run in the new project
Spare sessions parked with --await-claim skip project stdio MCP servers, and workspace_trust must now come with claim_session
Unclear The finding does not say exactly how takeClaimSessionStartHooks changes when or which SessionStart hooks run.
In headless stream-json output, commands_changed now also fires when MCP commands change, and a re-scan skips it when nothing changed
A JSON file passed to --agents is now protected from edits the same way Claude Code's settings files are
The AGENTS.md plugin's availability check now falls back to true, and the flag server reads it as on for this site's account
More Windows home folders, including legacy folders and OneDrive PowerShell folders, are now treated as dangerous, with WSL-aware matching
On macOS, reading or searching paths under /.vol, /.file, /.nofollow or /.resolve now needs your manual approval
A path check that lets some file access go ahead automatically no longer excludes /Network and /net paths first
Unclear The finding does not show whether /Network and /net paths are still blocked elsewhere, so the practical effect on what is allowed automatically is unclear.
The "Exiting worktree session" dialog can now be closed with Ctrl+C or Ctrl+D
Saved feedback drafts are listed under This session and Other sessions, with a write-new row and d to discard a draft
Unclear The finding does not say how this list is opened.
The recalled-memories panel now uses the shared more-above and more-below indicators and takes keyboard focus when it opens
New messages explain why later uploads or a checkout could not be restored from a session's storage during an environment handoff
Artifact patch publishes can send per-file checks, and a conflict now reports which files differ from what was expected
Unclear The finding does not say what the extra upload parameter does.
The artifact tool now explains what went wrong when given a claude.ai chat, share, task, project or Claude Design link
Reading an artifact accepts a new actorId option, which stops it reusing an earlier share check's loaded result
Unclear The finding does not say what actorId identifies or when it is passed.
Local server responses that carry the version header now also send Vary: User-Agent
Unclear The finding does not say which local server this is.
Folder seeding adds a hint when a folder is too large, and sync listings now report files that were left out
Unclear The finding does not give the hint's wording or say what historyHeld records.
When /model cannot check a model name, the error is cleaner, says the model was not changed, and marks retryable cases
The artifact database tool's description now explains person ids and an action: "profiles" lookup for details such as guest status
The error for using your attached computer before it is ready now says so plainly and names a setting that may be off
Non-interactive sessions now wait for remote managed settings to load before connecting MCP servers
Usage data now records a tool result's estimated tokens, image and document count, and whether it will be saved to disk
Leaving a worktree with keep now always counts its changed files and commits, hook-based worktrees included
Team memory now leaves out the mount named account
Unclear The finding does not say what the account mount contains.
The heap dump memory report now correctly says external memory is included in the snapshot when running under Bun
Artifact details can now carry publishPreconditions, which turns on a file check before writes and removals
The SDK now ignores control requests after close, leaves remote-tool requests unanswered, and logs failed replies and closes
When the SDK is given a plain text prompt, it now waits until setup has finished before sending it, and a failed send stops the query
In print mode, telemetry setup now waits unless CLAUDE_CODE_ENABLE_TELEMETRY is set, and a new parked-spare state skips session-start hooks
Unclear The finding does not say what a parked spare process is, how one is created, or when the held-back MCP servers are connected.
The Claude Apps gateway can now take on an AWS role separately for each user, naming each session after that user's identity
The startup offer to upgrade the model on Bedrock or Vertex now only runs for the provider currently in use
Unclear The finding does not say what the changed fourth argument to the settings write does.
Pulling a queued message back into the prompt to edit it now also brings back its attached IDE selection
The auto mode server-fallback notice now respects a stopped turn and treats SDK hosts differently when deciding whether to show
Unclear The finding does not say whether SDK hosts now see the dialog or skip it, or what the extra headless condition checks.
When a remote review is unavailable or blocked, the result now says what is blocking it
Unclear The finding does not say what values these fields hold or which pattern a reason must match to be included.
Errors from checking a permission mode now carry a code such as invalid_mode or bypass_disabled
Marketplace plugins set to auto_install or required no longer need a full commit SHA or a manifestSha256 hash
Unclear The rule that follows the removed ones is not shown, so it may bring in a different requirement in their place.
On Windows, dir-sync can now anchor its root folder through a native Windows handle, with fallbacks when that is not possible
Unclear The finding does not say what anchoring protects against or what the fallback modes mean for syncing.
After you accept an MCP server's request to open a link, the waiting screen now always offers "Skip confirmation"
Unclear The finding does not say what skipping the confirmation does or what counts as a flow existing.
The artifact comments listing now records named stamps on each thread and adds a header line when any exist
Unclear The finding does not say what a named stamp is or what the extra header line says.
Tools from other machines can be shown as pending until the machine announces itself, and are dropped once that machine is gone
Unclear The finding does not say which feature uses this component or how a user reaches it.
Looking up a session by its title now treats a match on a second cleaned-up form of the name as exact
Unclear The finding does not say how the second normalized form differs from the first.
--managed-settings is carried through to spawned sessions; --setting-sources is accepted and discarded by one argument parser#--managed-settings is now passed on to sessions Claude Code starts itself, while one parser reads --setting-sources and throws the value away
Unclear The finding does not say whether a --setting-sources value still reaches spawned sessions through the separately stored field.
claude -p --cloud stays compiled off; a new check excludes stream-json and SDK-URL runs#claude -p --cloud stays switched off in this build, and a new check would keep it away from stream-json output and SDK-URL runs
Plugin updates have five new directory-related failure codes, and an update now fails with directory_commit_mismatch when a new check rejects it
Unclear The finding does not say what a plugin's directory binding is or what makes the new check reject an update.
--no-lazy-fetch and --no-advice accepted as global options#Claude Code's git permission checks now recognise --no-lazy-fetch and --no-advice as git global options
When Claude Code decides to background work, it now also moves tool calls that are still running in the foreground
Element inspection now includes the list of options for Select elements
Unclear The finding does not say which Claude Code feature performs element inspection.
Mostly internal renaming and reformatting, plus a few small changes to internal code with no visible effect described
Unclear The finding does not say what the new clone parameter or the tool-host plumbing does.
The terminal tab status toggle, Claude API tip and Chrome classifier default only moved; their gate fallbacks are unchanged
Se() added in the remote headless client host module#An empty function was added beside the remote headless client host-request logging code, with no effect
--cloud directory sync can send each turn's changes as linked bundles, but only when the laptop sets CLAUDE_CODE_DIR_SYNC_CHAIN
The Background tasks dialog has an empty extra section slot that is compiled out of this build
Unclear The finding does not say what section would fill this slot.
Changing directory now starts a background host service, or refreshes it if it is already running
Unclear The finding does not say what this background host service does.
repeated_errors is no longer one of the listed failure reasons alongside lane_full and lane_unavailable
Unclear The finding does not say what the list is used for or how repeated errors are handled now.
A helper that would record a session's custom title in its internal event log exists, but nothing calls it
A new unused text constant "No-Verification-Needed" appears in the build
Unclear The finding does not show what the constant is meant for.
SDK and print sessions can now hold back SessionStart hooks and wait for SDK MCP servers that are still starting
Unclear The finding does not say how long the session waits or exactly when the held-back hooks run.
/plugin discover can sort by installs, filter by marketplace and label official plugins, but searching by component name never matches
Resuming memory with /pause-memory always shows the standard "Memory resumed" message
Published verbatim by Anthropic for v2.1.281. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 177 bullets, 69 name something an entry on this page also names, 30 name something no entry here does, and 78 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
desktop policy blocks, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode
Probably desktop-managed-config-schema-new-keys-disablebypasspermiss assume_role on Claude apps gateway Bedrock upstreams: the gateway calls Bedrock as an IAM role it assumes through STS, in another AWS account if needed, optionally one session per developer
Probably bedrock-gateway-upstream-assume-role-support, self-hosted-gateway-bedrock-guardrail-and-assume-role-tele guardrail: {id, version} on Claude apps gateway Bedrock upstreams to apply an Amazon Bedrock guardrail to every request sent through them (set it on all Bedrock upstreams or none)
Probably gateway-bedrock-upstreams-can-now-apply-a-bedrock-guardrail telemetry.resource_attributes to the Claude apps gateway config, to put fixed labels on the telemetry of Claude Desktop and /login sessions
Probably new-sibling-login-watch-picks-up-a-login-made-in-another-cla, warning-when-the-org-changes-mid-conversation-is-gated-off-b, after-login-policy-limits-refresh-before-a-follow-up-step, new-conversation-attachments-credential-org-org-switch-mid, error-wording-for-sessions-hosted-by-the-desktop-app-no-sla, cloud-gateway-sign-in-and-settings-errors-reworded-for-sessi, error-messages-and-advice-worded-for-a-desktop-host, gateway-new-telemetryresource-attributes-config-key "attribution": false in settings.json to hide all commit and PR attribution; older CLI versions skip a settings file that holds it, so keep the object form in files shared across versions
Probably claude-code-legacy-bundle-is-ignored-when-a-project-settings, tmux-worktree-relaunch-absolutizes-path-arguments, windows-credential-manager-vault-and-dpapi-folders-added-to, attribution-settings-doc-warns-against-attribution-false, settings-file-edit-guard-adds-desktop-app-symlink-and-manag claude plugin validate: it reports .mcp.json entries that would be silently dropped at load, undeclared ${user_config.*} references, and insecure URLs
Probably approving-mcpjson-servers-no-longer-drops-concurrent-addit, plugin-validation-now-checks-a-plugins-mcp-server-files /insights that estimates how many permission prompts auto mode could have handled in your recent sessions
Probably insights-logs-an-auto-mode-recommendation, insights-prompt-takes-a-recommendation-line, insights-can-now-suggest-switching-to-auto-mode-based-on-h /skills, /mcp and /plugin Installed lists in fullscreen mode, like the one /workflows now has: it appears while the mouse is over the list and can be clicked or dragged
Probably mcp-server-auth-screens-esc-now-needs-a-second-press-to-go, plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, mcp-insufficient-scope-error-now-carries-the-required-scope, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, mcp-manage-mcp-servers-dialog-rebuilt-on-a-shared-scrolli, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, skills-dialog-explains-which-claudeai-skills-are-blocked-b, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion --max-turns, when the model alternated unparseable tool calls and output-limit truncation
No entry names this CLAUDE_CODE_RETRY_WATCHDOG sessions failing on the first 5xx or dropped connection after a run of 429/529 waits, and sleeping uncapped and silently on a long Retry-After from a 5xx
Probably side-queries-retry-after-budget-and-a-rebuilt-system-prompt, side-queries-with-a-deadline-fail-fast-on-long-retry-after Retry-After: 0
No entry names this --input-format stream-json sessions (Agent SDK, VS Code extension) and scheduled cloud sessions failing every turn with an error when an earlier assistant message had plain-string content
No entry names this -p, Agent SDK) failing on the next turn after the directory they were started in was deleted mid-session
Nothing to match on /.vol, /.nofollow or /.resolve (which can reach a network mount) before approval
Probably macos-vol-file-nofollow-resolve-paths-treated-as, attachment-rejection-widened-from-net-to-several-macos-netw, macos-kernel-redirected-paths-vol-file-nofollow rm whose target is only command-substitution output, such as rm -rf "$(pwd)", running unprompted in auto and --dangerously-skip-permissions mode; it now asks even with a Bash allow rule, unless run with CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1
Probably rm-r-on-a-command-substitution-target-now-always-asks-unle, rm-r-on-command-substitution-output-now-always-prompts-ten, hidden-claude-p-cloud-headless-cloud-print-path-added excludedCommands entries not matching git rev-parse --git-dir, programs named like shell builtins, and commit messages containing [WIP] or # lines
Probably git-bundle-upload-refuses-checkouts-under-a-home-directory-t, git-git-dir-and-work-tree-removed-from-the-bash-risky-fl, git-allowlist-no-lazy-fetch-and-no-advice-accepted $TMPDIR when CLAUDE_CODE_TMPDIR is set
Probably new-env-var-claude-code-commit-between-keys-for-the-terminal claude --bg starting a background session, and running its project hooks, in a directory that had not passed the workspace trust prompt; it now asks for trust first, or exits when not run interactively
No entry names this --setting-sources (and SDK settingSources) not being forwarded to spawned sessions: teammates, /bg, claude agents sessions and --worktree --tmux now start with the parent's restriction
Probably background-sessions-started-from-a-trusted-home-directory-no, smaller-fixes, tmux-worktree-relaunch-absolutizes-path-arguments, setting-sources-forwarded-to-child-processes, tmux-worktree-fast-path-now-enforces-managed-policy, hidden-managed-settings-flag-added-to-claude-agents-and, managed-settings-is-carried-through-to-spawned-sessions, claude-tmux-worktree-passes-a-sanitized-env-to-tmux-s, claude-agents-view-now-honours-settings-managed-setti --add-dir directory inside the working directory being sent to the model twice in headless and SDK sessions
Probably background-fork-argument-building-reworked, git-bundle-upload-refuses-checkouts-under-a-home-directory-t, backgroundrelaunched-sessions-inherit-session-scoped-additi, additional-working-directories-carried-across-tui-mode-switc, self-restart-carries-additional-working-directories, tmux-worktree-relaunch-absolutizes-path-arguments, managed-settings-is-carried-through-to-spawned-sessions /loop wakeups being fired again every second when their delivery failed, which could make Claude Code exit at the end of a turn
Probably loops-dialog-list-scrolls-and-keeps-its-selection claude remote-control starts for you to open from Claude Desktop, claude.ai or the mobile app
Probably remote-control-non-interactive-registration-failures-wait-b gcpAuthRefresh/awsAuthRefresh login processes being left running (and holding their localhost callback port on Windows) when Claude Code exits or the refresh times out
Probably settings-merge-gains-a-credential-helper-filter-that-is-iner, awsgcp-auth-refresh-commands-run-under-a-new-process-superv mcp_tool hooks on blocking events (PreToolUse and similar) being skipped while their MCP server was still connecting; they now wait for it, up to the MCP connect timeout
Probably mcp-tool-hooks-wait-for-an-mcp-server-that-is-still-connecti MCP_CONNECTION_NONBLOCKING=0 giving up on claude.ai connectors after 1s instead of honoring MCP_CONNECT_TIMEOUT_MS
Probably sdk-mcp-servers-bounded-wait-at-first-message-and-servers, mcp-startup-wait-config-fetch-deadline-now-uses-mcp-connect --channels plugin entries being checked against the installed plugin's marketplace alone; the installed plugin's name must now match the entry as well
Probably channels-plugin-identity-check-compares-the-installed-plugi --plugin-dir on a folder of plugins that also has a .claude-plugin/marketplace.json loading one empty plugin instead of the plugins in it
Probably plugin-directory-detection-recognises-marketplace-roots, tmux-worktree-relaunch-absolutizes-path-arguments, bg-dispatch-carries-reattachenv-and-retries-while-the-daemon, plugin-dir-log-explains-plugin-vs-folder-of-plugins, managed-settings-is-carried-through-to-spawned-sessions claude plugin uninstall refusing to remove a project-scope plugin that isn't enabled, saying it is "enabled at project scope" while claude plugin disable says it is already disabled
No entry names this claude plugin update failing for project-scoped plugins when --scope is omitted — it now resolves the scope the plugin is installed at instead of assuming user
Probably claude-plugin-update-scope-now-defaults-to-auto-detect claude plugin validate reporting privacyPolicyUrl, supportUrl and other listing metadata keys in plugin.json as unknown fields
No entry names this known_marketplaces.json recording a marketplace as refreshed when its remote could not be reached and CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE kept the existing clone
Probably stored-marketplace-metadata-no-longer-counts-a-stale-clone-f, status-and-message-string-changes /plugin Errors tab showing no confirmation after its last error is resolved
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion /plugin starting a second uninstall or update of the same plugin when Enter was pressed again while the first was still running
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion y held while /plugin checks a marketplace source adding the marketplace the instant the "Add marketplace?" question appears, before it can be read
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion 1 answering Yes in /permissions' delete and remove-directory confirms while the pointer is on No, which let a held 1 remove one workspace directory after another
No entry names this /config offering to turn thinking off on models that can't; thinking now stays on there, with a one-line reason in place of the switch
Probably thinking-cant-be-turned-off-for-models-that-reject-disabled, config-model-picker-no-longer-passes-skipsettingswrite, settings-panel-receives-remote-tool-serving-status, hover-highlight-and-new-change-callbacks-in-the-config-sett, gates-in-this-group-whose-fallbacks-did-not-change-settings /context total leaving out messages added since the last response; it now matches its categories and can read higher than the status line
Probably context-total-now-counts-categories-plus-the-api-measured-m /model showing the raw API error JSON and request ID when the API refuses the picked model; it now shows the server's message and says the model was not changed
Probably model-error-messages-get-codes-and-wording-for-hosts-withou, 429-and-overload-messages-drop-the-model-hint-in-some-non-i, config-model-picker-no-longer-passes-skipsettingswrite, model-validation-failure-is-marked-retryable-and-only-sugges, model-validation-clearer-api-errors-that-say-the-model-was /ide showing "No available IDEs detected" while also listing a running IDE
Probably ide-mismatch-message-reworded /setup-bedrock or /setup-vertex restarts Claude Code to apply new settings
No entry names this /config exiting when respectGitignore or copyFullResponse in ~/.claude.json holds null
Probably thinking-cant-be-turned-off-for-models-that-reject-disabled, config-model-picker-no-longer-passes-skipsettingswrite, settings-panel-receives-remote-tool-serving-status, settings-ui-shows-effective-defaults-for-gitignore-and-copy, hover-highlight-and-new-change-callbacks-in-the-config-sett, gates-in-this-group-whose-fallbacks-did-not-change-settings /memory, /hooks, /mcp (including a server's sign-in screen), /export, /copy, /theme, and /teleport's uncommitted-changes and login prompts (where Esc also quit)
Probably mcp-server-auth-screens-esc-now-needs-a-second-press-to-go, rewritten-hooks-disabled-screen, mcp-insufficient-scope-error-now-carries-the-required-scope, hooks-menu-policy-notice-reworded, copy-picker-requires-pressing-escape-twice-to-cancel, memory-auto-memory-row-shows-a-description, scaffold-template-for-a-plugin-sessionstart-hook, settings-ui-shows-effective-defaults-for-gitignore-and-copy, mcp-manage-mcp-servers-dialog-rebuilt-on-a-shared-scrolli, new-hook-detail-view-in-hooks-explains-where-each-hook-come x or s, acting on the previous selection: a stale effort level in /effort and the model picker, and the previously highlighted row in /skills, the background task rows under the prompt, MCP server prompts and /install-github-app
Probably install-github-app-existing-workflow-found-drops-the-repo, skills-dialog-explains-which-claudeai-skills-are-blocked-b, install-github-app-wrapped-in-a-titled-dialog-with-step-sub, install-github-app-wizard-navigation-rework-and-double-sub /install-github-app updating the workflow after "Skip workflow update" was chosen, running setup twice on a repeated Enter, and ↑ on the repository step blocking a typed repository name when no repository was detected
Probably install-github-app-existing-workflow-found-drops-the-repo, install-github-app-wrapped-in-a-titled-dialog-with-step-sub, install-github-app-wizard-navigation-rework-and-double-sub dj/dk/dG/dgg and their c/y forms acting on part of a line; 1G going to the last line; d0/c0/y0 doing nothing; the cursor being off by one after . repeats an insert; and o/p on a !-prefixed line switching to shell mode
Nothing to match on cw on a space, an empty line, a word's last letter or a one-letter word also changing the next word; word motions stopping inside words in Hindi, Bengali and other scripts; and ., p or P that inserts text starting with ! switching to shell mode, losing text or editing the wrong character
Nothing to match on - 316.) showing as letters, roman numerals or the wrong numbers
No entry names this keybindings.json, and showing a stray · when the stop-all-agents shortcut is unbound
No entry names this /skills) in fullscreen mode
Probably skills-dialog-explains-which-claudeai-skills-are-blocked-b /heapdump summary saying most memory is native when it is in the JS heap snapshot
No entry names this x stopping it, when a new run started while the list was open
No entry names this /config, /plugin, /permissions) showing no highlight while the tab bar has focus when color is off (NO_COLOR)
Probably thinking-cant-be-turned-off-for-models-that-reject-disabled, plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, config-model-picker-no-longer-passes-skipsettingswrite, plugin-directory-detection-recognises-marketplace-roots, settings-panel-receives-remote-tool-serving-status, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, hover-highlight-and-new-change-callbacks-in-the-config-sett, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, gates-in-this-group-whose-fallbacks-did-not-change-settings, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion /plugin Installed list scrolling the pane behind it instead of the list
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion /hooks and /mcp detail views printing a long value over the row below it in narrow terminals
Probably mcp-server-auth-screens-esc-now-needs-a-second-press-to-go, rewritten-hooks-disabled-screen, mcp-insufficient-scope-error-now-carries-the-required-scope, hooks-menu-policy-notice-reworded, scaffold-template-for-a-plugin-sessionstart-hook, mcp-manage-mcp-servers-dialog-rebuilt-on-a-shared-scrolli, new-hook-detail-view-in-hooks-explains-where-each-hook-come /plugin not being answerable by typing a number in screen-reader mode
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion $TMPDIR/… failing with "Permission denied"
No entry names this claude.exe backup, which could leave no claude.exe behind
No entry names this sandbox.network.allowLocalBinding
Probably sandbox-prompt-new-macos-guidance-for-local-port-binding-an --agents to accept the path to a JSON file (with -p) as well as inline JSON, and to allow an empty prompt
Probably sandbox-file-paths-supplied-through-the-agents-flag-are-now, tmux-worktree-relaunch-absolutizes-path-arguments, self-hosted-runner-server-composed-agent-files-delivered-vi, a-json-file-passed-to-agents-is-now-protected-like-a-setti, bg-rejects-agents-given-as-a-file, agents-can-now-take-a-file-path-instead-of-inline-json-bu /batch to run where a WorktreeCreate hook provides the agent worktrees, not only inside a git repository
Probably batch-works-outside-a-git-repository-when-a-worktreecreate claude plugin validate warning when a shell-form hook leaves ${CLAUDE_PLUGIN_ROOT} unquoted (it breaks on plugin paths with spaces)
Probably scaffold-template-for-a-plugin-sessionstart-hook, plugin-marketplace-sorting-all-filter-and-a-check-for, hooks-validation-warns-about-unquoted-plugin-path-placeholde / menu, /skills, /context and the /plugin Installed list to show skills synced from claude.ai by their short name when no other command uses it, not anthropic-skills:<name>
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, skills-dialog-explains-which-claudeai-skills-are-blocked-b, context-total-now-counts-categories-plus-the-api-measured-m, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion /deep-research reliability on long research briefs by removing unused required fields from the scope step's output
No entry names this env variables ignored because the session's launch environment already sets them
Nothing to match on /permissions and /usage: ↑/↓ move focus between the tab row and the content, and a list responds to keys only while it has focus
Probably clearer-turn-on-usage-credits-hints-that-depend-on-your-ro, stats-footer-shows-the-date-cycle-hint-only-on-the-tabs-vie, stats-dialog-no-longer-grabs-focus-on-open, usage-limit-messages-the-usage-credits-command-name-is-res /help and /sandbox: ←/→ and Tab switch tabs from inside a tab's list, and ↓ on an empty Custom commands tab in /help no longer leaves the keys stuck until Esc
Probably sandbox-prompt-new-macos-guidance-for-local-port-binding-an /install-github-app, /desktop, the /permissions auto mode environment prompts, and the /plugin "Add marketplace?" and "Run this command?" prompts: they now use the standard dialog frame with key hints, and Ctrl+C or Ctrl+D cancels them on the second press like other dialogs
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, desktop-dialog-escape-and-ctrl-cd-no-longer-cancel-direct, plugin-directory-detection-recognises-marketplace-roots, claude-desktop-handoff-dialogs-restyled, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, install-github-app-existing-workflow-found-drops-the-repo, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, deep-link-run-this-command-confirmation-moved-into-the-st, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, install-github-app-wrapped-in-a-titled-dialog-with-step-sub, hookplugin-api-gains-sessionversion, install-github-app-wizard-navigation-rework-and-double-sub /workflows and /mcp lists: they page (PgUp/PgDn, Home/End) and take j/k and the mouse like other lists, their arrows follow select:previous/select:next rebinds, and x in /workflows stops the run the pointer is on
Probably mcp-server-auth-screens-esc-now-needs-a-second-press-to-go, mcp-insufficient-scope-error-now-carries-the-required-scope, mcp-manage-mcp-servers-dialog-rebuilt-on-a-shared-scrolli /plugin plugin and marketplace details menus and the /remote-control already-connected menu: they now support Home/End and clicking a row
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, remote-control-disconnect-dialog-uses-the-shared-selectable, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion /skills: each row now leads with the skill's name, with ✔ or ◯ alone showing on or off, and stays on one line in narrow terminals
Probably skills-dialog-explains-which-claudeai-skills-are-blocked-b /skills, /workflows, /feedback): a name keeps 20 columns beside its first detail, and details are shown whole or not at all
Probably feedback-drafts-panel-list-rewritten-as-a-focusable-componen, skills-dialog-explains-which-claudeai-skills-are-blocked-b /diff: a scrollbar shows where you are in a long list of changed files, and long paths no longer wrap their rows
No entry names this /hooks: a hook's detail screen now says what kind of hook it is and where to change it, instead of always pointing at settings.json, and the hooks-disabled, safe mode and managed-hooks-only notices each say what is happening in one plain sentence
Probably rewritten-hooks-disabled-screen, hooks-menu-policy-notice-reworded, scaffold-template-for-a-plugin-sessionstart-hook, new-hook-detail-view-in-hooks-explains-where-each-hook-come /mcp: a disabled server is read as "off" instead of "pending"
Probably slash-command-completion-keeps-the-typed-alias, auto-mode-stage-2-classifier-rate-limit-errors-carry-the-re, precomputed-compact-arm-fraction-computed-from-a-new-facts, what-do-you-want-to-do-dialog-now-exits-on-ctrlcctrld, insights-html-report-gets-two-sections-under-the-header, subagent-handback-takes-outputfile-from-the-task-record, sessions-without-disk-writes-stop-capturing-oversized-comman, memory-tools-mode-can-now-turn-on-while-the-org-memory-pol, plugin-telemetry-un-redacts-names-in-one-more-case, acceptdecline-toggle-no-longer-turns-other-values-into-acce, mcp-server-auth-screens-esc-now-needs-a-second-press-to-go, tool-names-over-200-characters-are-truncated, mcp-tool-hooks-wait-for-an-mcp-server-that-is-still-connecti, model-picker-effort-choice-is-passed-to-the-caller-instead, teleport-login-prompt-can-be-cancelled-not-only-exited, diff-view-displays-a-transformed-file-path, mcp-insufficient-scope-error-now-carries-the-required-scope, absolute-path-checks-no-longer-hardcode, sandbox-permission-projection-refuses-entries-it-cannot-reso, markdown-ordered-lists-of-bare-numbers-render-as-plain-text, fix-in-the-acked-ancestor-check-picking-the-wrong-file-set, diskless-sessions-task-output-paths-now-throw-instead-of-po, skills-status-list-uses-status-icons-with-aria-labels, control-cancel-request-is-queued-rather-than-written-directl, remote-io-attestation-policy-fault-handling-and-deferred-de, directory-sync-beforeturn-wait-loop-simplified-empty-start, output-file-open-retries-once-if-a-symlinks-target-changes, at-mention-file-read-returns-nothing-on-abort, sandbox-network-classifier-holds-a-deny-while-the-api-asks-i, dir-sync-first-send-waits-behind-another-writers-lock-and-r, memory-sync-org-policy-now-decides-the-sync-state-instead-o, cloud-sync-defers-when-only-held-open-files-remain, clearer-message-when-a-web-search-is-cut-off, context-window-resolution-refactored-to-a-model-descriptor, tool-schemas-can-be-sent-straight-from-the-recorded-prompt-s, artifact-comments-carry-commenter-names, symlink-resolution-now-refuses-network-target-loops-instead, git-change-analysis-keeps-timed-out-distinct-from-git-error, advisor-tool-blocks-can-be-stripped-from-selected-messages-o, thinking-toggle-keybinding-explains-when-thinking-cannot-be, transcript-file-viewer-double-press-hint-now-says-close, worktree-tamper-verification-reads-commits-through-a-structu, message-threads-tether-new-creditretrystateless-forces-a, agent-mailbox-message-to-an-evicted-agent-is-resumed-on-the, remote-runner-passes-system-prompts-by-file, screen-reader-output-blockquotes-get-row-prefixes-instead-o, policy-limits-fetch-retries-after-an-invalid-format-parse-f, and-n-more-lists-can-say-at-least-n-more, markdowntable-rows-wrap-the-last-column-instead-of-overflow, forwarded-call-dispatch-schema-accepts-request-id-and-instan, client-attach-merges-viewport-updates-for-already-attached-c, enableddisabled-status-indicator-shows-onoff, plugin-data-dir-deletion-reports-removedabsentfailed, text-in-unrenderable-characters-is-shown-as-unreadable-tex, mcp-manage-mcp-servers-dialog-rebuilt-on-a-shared-scrolli, bridge-stops-work-items-that-carry-an-unsupported-mode, shell-refuses-to-fall-back-to-another-directory-when-a-pinne, docker-read-only-auto-allow-tightened-for-tilde-expansions, plugin-install-rollback-restores-the-earlier-install-record, plan-style-dialog-now-renders-title-paragraphs, sdk-mcp-servers-now-have-a-connect-timeout, remote-session-debug-level-sync-lines-no-longer-shown-in-th, remote-control-and-other-policy-gated-features-latched-an, headless-turn-continues-when-the-working-directory-has-disap, new-bareelicitationcapability-mcp-server-option, notebookedit-network-path-message-softened, api-error-text-html-error-pages-collapse-to-status-code-r, sandbox-survives-an-invalid-settings-change-instead-of-faili, mcp-and-plugin-cli-subcommands-load-lazily-from-separate-chu, sse-transport-can-hold-incoming-frames-and-closes-through-em, lsof-i-with-a-argument-now-needs-permission, dirsync-stamps-character-devices-by-identity-instead-of-full, daemon-background-sessions-the-host-tombstone-now-records-t, bypass-permissions-safety-check-asks-now-get-a-timed-approva, memory-prompt-index-reports-a-policy-pending-state, ios-project-detection-collects-evidence-from-every-tool-call, permission-block-outside-reads-new-sandbox-refresh-skipped, remote-session-creation-explains-environmentrepository-mism, picker-hint-text-says-again-to-close-instead-of-again-to, agent-tool-preserving-tool-results-in-subagents-is-dark-lau, bundled-model-catalog-opus-5-quick-select-entry-is-now-o, agents-can-now-take-a-file-path-instead-of-inline-json-bu, cloud-sessions-now-restore-claudes-earlier-work-when-the-co, claude-plugin-update-scope-now-defaults-to-auto-detect CLAUDE_CODE_AUTO_MODE_SERVER to also apply on a direct Anthropic API connection: 0 opts out of the server-side auto mode classifier (the local classifier then counts toward usage), 1 opts in
Probably setting-claude-code-auto-mode-server-now-controls-the-server, claude-code-auto-mode-server-split-into-a-tri-state-user-swi, claude-code-auto-mode-server-now-overrides-the-server-classi rm prompt in --dangerously-skip-permissions and auto mode to wait 2 minutes for an answer, then deny the command with a rewrite hint so unattended sessions keep going (CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns this off)
Probably safety-check-permission-dialogs-can-now-auto-deny-after-a-ti, hidden-claude-p-cloud-headless-cloud-print-path-added, auto-mode-safety-check-dialog-now-auto-denies-on-a-timer-te, destructive-command-safety-prompts-now-deny-themselves-after managedMcpServers entry's envHelper path starts with \??\ or /??/, a path form current Claude Desktop refuses to run
Probably helper-path-validation-rejects-windows-prefix command hook that appends --system-prompt or --append-system-prompt must switch to --system-prompt-file or --append-system-prompt-file
Probably tmux-worktree-relaunch-absolutizes-path-arguments ⧉ name or ⧉ N) that opens /artifacts, which now lists this session's artifacts first
Probably footer-frame-item-now-opens-artifacts-in-footer-frame-cy, artifacts-panel-reworked-around-session-artifacts-open-vs-a /config, to tint the row instead of drawing a second ❯ pointer beside the focused row's
Probably thinking-cant-be-turned-off-for-models-that-reject-disabled, config-model-picker-no-longer-passes-skipsettingswrite, settings-panel-receives-remote-tool-serving-status, hover-highlight-and-new-change-callbacks-in-the-config-sett, gates-in-this-group-whose-fallbacks-did-not-change-settings claude plugin uninstall --json and the /plugin dialog to say a plugin's data was kept when its folder stays because another installed plugin uses it or install records cannot be read
Probably plugin-list-mouse-wheel-scroll-a-scrollbar-and-a-sign-in, plugin-directory-detection-recognises-marketplace-roots, plugin-detail-menu-coloured-actions-version-in-the-result, plugin-skills-list-synced-skills-no-longer-hidden-by-same, plugin-directory-now-opens-the-discover-view-scoped-to-th, plugin-marketplace-sorting-all-filter-and-a-check-for, plugin-detail-view-now-uses-the-standard-select-list-and-n, plugin-manager-guard-against-double-actions-scroll-follow, plugin-errors-removing-a-marketplace-now-handles-ignored-n, plugin-marketplace-list-escapes-source-strings-and-hides-bui, marketplace-search-helper-by-component-name-is-a-stub, plugin-manage-list-rewritten-into-aligned-columns, hookplugin-api-gains-sessionversion /tasks): pressing x on a running /ultrareview now asks for confirmation before stopping the review
No entry names this /agents entry from the command menu and /help; typing /agents still explains where the wizard went
Probably removed-agents-command-is-now-hidden No change to the system prompt since v2.1.280.
Claude Code, interactive mode
383 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 109 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?