You can now use claude-sonnet-5 with high effort and automatic thinking switched on by default. The high effort option is now labelled Recommended instead of Default. Admins can use the new managed setting allowedProviders to limit which API providers Claude Code may run on. Setting CLAUDE_CODE_DISABLE_WEB_FETCH turns off WebFetch, the tool Claude uses to download web pages. Claude Code can now load relevant memories saved to your account before a turn. The new claude plugin configure command shows a plugin's options and can save values piped in as JSON.
Seven changes are in the build but not switched on yet. A new plugin test command runs a mod's tests and is marked as early access. Waking and retrying background MCP tasks now sits behind a remote switch that is off by default. A report-delivering tool can end the agent's turn, but only when a server switch allows it. The precomputeCompactionEnabled setting still stays hidden unless a server switch turns it on.
Directory sync for cloud sessions is now fully removed. The CLAUDE_CODE_DIR_SYNC_* variables and CLAUDE_CODE_DISABLE_DIR_SYNC no longer do anything. Launching with --cloud no longer offers to sync your folder, and bundle upload still works. On macOS and Linux, CLAUDE_CODE_LEGACY_BUNDLE is now ignored with a warning. Passing unrestrictedPaths to the agent toolset now throws an error. An @-mentioned audio file no longer gets turned into a transcript for Claude.
Written by our agent from the shipped bundle, not by Anthropic.
New ui_* messages let desktop, mobile and VS Code surfaces attach to a session and draw plugin UI, and a gated list_directory request is added
ExtensionsNew claude plugin configure, plugin install --config reaching bundled MCP server settings, and plugin list --data-size for scripts
claude --desktop opens a session in the Claude Desktop appThe new --desktop flag opens Claude Desktop instead of the terminal, and can pick a session with --continue or --resume <id>
ElsewhereThe new managed setting allowedProviders lists the API providers allowed, and Claude Code refuses to run on any other
Claude Code now handles an mcp.connect request that takes the name of an MCP server
plugin test command runs a mod's testsExtensionsWant the reasoning? Read walks the 34 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
The effort picker labels options 'Recommended' instead of 'Default', claude-sonnet-5 gets thinking settings, and one model now defaults to medium effort
Unclear It is not clear whether the level the picker selects by default also changed.
New ui_* messages let desktop, mobile and VS Code surfaces attach to a session and draw plugin UI, and a gated list_directory request is added
Unclear It is not settled whether all of these messages are new or whether the feature is switched on for anyone.
plugin test command runs a mod's tests#A new plugin test [dir] command runs a mod's tests, marked as early access
Unclear It is not clear how the hooksModules early access is turned on.
Two new switches, tengu_mcp_tasks and tengu_mcp_task_worker_wake, guard an MCP tasks feature and default to off unless the server enables them
Unclear It is unclear what the switch's further condition checks, and whether the old resume switch is still used anywhere else.
Before a turn, Claude Code can now load relevant memories saved to your account as well as local ones, and /pause-memory stops that too
Unclear It is not clear what decides whether account memory recall is turned on.
Background MCP tasks can take a follow-up message mid-run, and a crashed one is reported as failed with the code drive_crashed
Unclear It is not clear what switches this on or whether it is reachable yet.
Memory recall gains a new account memory source and 'local' labels, and withdrawn memory snapshots get clearer wording
Unclear It is not clear what switches on account memory or what decides when the local label appears.
Resuming a conversation that is still running in the background now attaches to it and delivers your prompt, instead of stopping with instructions
Unclear Exactly when a session counts as one Claude Code can open is not settled.
New claude plugin configure, plugin install --config reaching bundled MCP server settings, and plugin list --data-size for scripts
Unclear It is not clear whether --data-size shows up in the command's help or is hidden.
claude --desktop opens a session in the Claude Desktop app#The new --desktop flag opens Claude Desktop instead of the terminal, and can pick a session with --continue or --resume <id>
Unclear It is not clear whether the option is hidden or available only on some platforms.
The first request an SDK client sends to Claude Code now accepts a work and environment ID, used only by Claude Desktop's helper
set_max_thinking_tokens now checks thinking_display and can refuse part of a request#The SDK set_max_thinking_tokens request now validates thinking_display, refuses bad parts, and does not apply the value "highlights"
Unclear It is unclear whether this message can be reached in normal use.
The new managed setting allowedProviders lists the API providers allowed, and Claude Code refuses to run on any other
Unclear It is unclear whether a policy sent from the server is enforced the same way as one set on the machine.
Claude Code now handles an mcp.connect request that takes the name of an MCP server
Unclear It is not clear which interface accepts this request.
In hosted remote sessions, the agent proxy can read its certificate authority from CCR_AGENT_PROXY_CA_CERT_B64 instead of always downloading it
Unclear It is not clear what normally sets this variable, or whether the background certificate check always runs.
$.session.append#Workflow scripts gain $.session.append, which appends to a session without sending a turn, next to the existing send
Unclear It is not clear what appending does to the session once it arrives.
Behind a server-controlled switch, the tool that delivers a report to its caller can now make the agent stop straight after
Unclear It is not clear which tool this is or what in Claude Code acts on the instruction to end the turn.
A program asking Claude Code to re-initialize a session can now turn on prompt suggestions, if a remote setting allows it
Admins can turn workflows off through managed settings with disableWorkflows or CLAUDE_CODE_DISABLE_WORKFLOWS; cloud Code Review and /ultrareview are not stopped
Unclear It is not clear which wins when the environment variable, the setting and the organization's own policy disagree.
Commands run in the background now stop after 30 minutes by default, up to 2 hours with a longer timeout, and Claude is told to restart them
Unclear It is not clear what switches these off or whether the time limit applies to everyone.
On Bedrock and Vertex, a probed Haiku default no longer counts as your own setting, and models your account cannot use now fall back to the next tier
Unclear What switches the fallback ladder on and which providers it covers are not known.
A new list_directory request lets an app that hosts or controls Claude Code ask it to list a folder's contents
Unclear Which apps send this request and what, if anything, limits it is not known.
Programs driving Claude Code can now send requests to press, type, select, scroll and show or close panes in its interface
Unclear It is not clear what sends these requests or whether anything gates them.
When a model request fails with permission denied, Claude Code can now retry with the next model on a fallback list
Unclear The purpose of the change is inferred, and what part of Claude Code uses this list is unclear.
--desktop opens the Claude Desktop app and now errors when combined with background or worktree options
Setting the environment variable CLAUDE_CODE_DISABLE_WEB_FETCH turns off WebFetch, the tool Claude uses to download web pages
Unclear Other parts of Claude Code also read this variable, and it is not clear what it changes there.
When 'highlights' is unavailable, Claude Code now names the reason: provider, experimental betas turned off, model, or the API rejecting it
Unclear It is not clear where the reason is shown to a reader.
Artifact pinning now defaults to available unless CLAUDE_CODE_ARTIFACT_PIN turns it off, and no longer checks tengu_cobalt_plinth_holly
Unclear What Claude Code does with this setting once it is on was not checked.
The precomputeCompactionEnabled option still only appears in settings when a server-side switch is on, which falls back to off
Unclear What the setting does once shown is not established.
/memory can turn auto memory on or off for just this session#/memory gains a session-only auto memory toggle and new refusals, and its Account memory line is removed
Unclear When the session toggle row appears is not stated.
A new allowedProviders managed setting can block claude auth login and setup-token when the policy disallows Anthropic's own sign-in
With CLAUDE_CODE_DIAGNOSTICS_FILE set, Claude Code can log a record whenever a piece of a streamed response arrives slowly
Unclear It is not clear whether every streamed response is watched once the diagnostics file is set, or only some.
In one of Claude Code's lists, ctrl+n is now accepted wherever the down arrow or Return is accepted
Unclear It is not clear which list or menu this handler belongs to.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
10 more of these are in What probably matters to you, above.
A new per-session auto-memory-off state gets its own notice, passes to background sessions, and pause messages now say only the user can resume
Unclear How these pieces fit together, and whether auto-memory being off really carries into background sessions, is not confirmed.
Starting a cloud session no longer uses directory sync, CLAUDE_CODE_LEGACY_BUNDLE stops working on macOS and Linux, and creation messages are clearer
Unclear It is not clear what decides whether the older upload method is still allowed.
Headless stream-json sessions now send ui_* messages (toasts, status, panes, prompt fill and more) so a host app can show plugin interface pieces
Unclear It is not clear which host apps answer these requests, or which plugin features send them.
The CCR remote session transport adds inbound read receipts, a flushDeliveryAcks method and a flush-on-first-delta option that falls back to off
Unclear What turns read receipts on, and whether anything uses the new acknowledgement step, is not known.
Claude Code now waits for a pending organization policy before starting in auto mode, can withhold auto mode for HIPAA reasons, and skips it in remote sessions
Unclear It is not clear what marks a session as flagged under the HIPAA policy, or whether this behaviour is switched on remotely.
The bundled SDK's agent toolset and environment worker now refuse unrestrictedPaths and gain a workspace header, a work secret and sturdier heartbeats
Unclear It is not clear how much of this can be reached from the Claude Code command line rather than only through the SDK.
Mentioning or pasting an audio file no longer produces a transcript, and tools can now opt out of automatic approval in bypass mode
Unclear It is not clear which tools, if any, exclude themselves from bypass permissions mode.
A new 'self-managed tasks' kind is collapsed into a single expandable row in the background tasks dialog and excluded from one task-type check
Unclear It is not clear which tasks count as self-managed or what controls the self-managed section.
A repository whose visibility can't be verified may now be treated as blocked by policy, logged once per host and repo; Chrome's native host also reports the computer name
Unclear It is not clear whether this depends on a remotely controlled setting or when it applies.
Claude Code sends a background /v1/me request to prepare sign-in, and new HIPAA policy entries can deny it and MCP task worker wake-up
Unclear Where the worker-restart policy is checked, and so what exactly stops happening, is not confirmed.
Some sessions now turn off local uploads and memory for the Projects tool, file handling is size-capped, and project_write refuses content with NUL bytes
Unclear Which sessions get the restricted mode, and where the file store's size limit comes from, is not clear.
Creating a cloud session with --environment can now send a list of blocked tools, though that list is always empty in this build
Unclear Because the list is always empty in this build, it is unclear whether any of this changes how a cloud session behaves yet.
The sandbox now tracks one-time notices for ignoring a repository's own network, file and allowed-domain settings
Unclear It is not confirmed that these repository settings are actually dropped, or under which conditions.
If the remote host supplies Claude in Chrome through --mcp-config, Claude Code uses that and does not start its own Chrome server
Unclear How Claude Code recognises that an entry came from the remote host is not known.
Attachment uploads can now convert BMP, TIFF, HEIC, HEIF and AVIF images to PNG or JPEG previews, falling back to the original file when needed
Unclear It is not clear which parts of Claude Code pass the originalsOnly option.
Starting a cloud session can now send a turn limit and a list of built-in tools, and the server confirms the turn limit
Unclear It is not clear what sets the turn limit or when this newer interface is used.
A new organisation policy, allow_bundled_skills, is denied for HIPAA organisations, so bundled skills are not allowed there
Unclear It is not clear how the policy is fetched or exactly what happens to the skills list when it is denied.
Plugin MCP servers now report clear reasons when they are not connected, such as sign-in needed, still connecting, --bare or policy blocks
Unclear Whether this plugin hook feature is available to users yet is not clear.
A reply that continues a background job now fails with the error code ESKEW if the job runs a different Claude Code build
A plugin hook that runs before a tool call can now deny it, and plugins get a clear reason when a message they add to the session is refused
Unclear It is not clear whether this plugin hook path is switched on for anyone, or what check decides that.
Replies to a background session can be marked for its next turn, and a reply to a blocked session is no longer typed into its terminal
Unclear It is not clear which part of Claude Code sends these replies or how a reader would use the next-turn option.
Claude Code's check of which Vertex models your account can use was rebuilt: the old cached check is gone and a new one remembers refused models
Unclear It is not clear what starts the test, whether it is switched on for everyone, or whether it leads to Claude Code switching models on its own.
Headless mode now waits, with a time limit, for a pending settings check and accepts details for handing a live session to the background
Unclear It is not clear what supplies the handover details or whether this path is switched on.
The Agent tool now considers whether it was called by a subagent in a non-interactive session when deciding to run in the background
Unclear The exact conditions and whether nested subagents end up more or less likely to run in the background are not clear.
claude ssh credential changes#Policy limits now refetch or hold back some settings when the credential supplied by the claude ssh launcher changes
Turning on writes to organization memory is now refused unless the session is of a supported kind
Unclear It is not clear which kinds of session are allowed to write.
The debug message for an MCP tool hidden from Claude now says the session hides that tool or every tool from its server
Unclear It is not clear what hides a whole server's tools or how it is turned on.
When a routed agent's single clean handback goes to that same agent, Claude Code can use a short pointer notice instead
Unclear What the pointer notice looks like and when this path is reached are not known.
Auto mode's list of automatically allowed tools can now leave out a tool that marks itself as excluded, so that tool is never allowed automatically
Unclear Which tools, if any, mark themselves as excluded is not known.
Claude Code has a new message saying auto mode isn't your organization's default and that Shift+Tab switches to it
Unclear It is not clear where this message appears or what makes Claude Code show it.
Memory settings information now has room for a per-session status and account memory, with a message for when memory is paused
Unclear The per-session status may never appear in this build, since nothing supplies it yet.
Saved-memory notices in the conversation now say when memory is local, and memory saved to your account gets its own summary
Unclear It is not clear what turns on account memory or who can use it.
When the server sends no setting, the one-time offer to make auto mode your default permission mode now falls back to on instead of off
When a pass that saves memories from your conversation stops early, the next pass looks at the same turns again
Unclear It is not clear which setups use the MCP mode of memory extraction.
Messages from GitHub, Slack and other sessions are now treated as information rather than orders, and Claude no longer proceeds without a human
In remote sessions, an unanswered WebFetch permission question can now be withdrawn, and one kind of denial now fails without asking
Unclear Exactly what a user sees when an unanswered question is withdrawn is not clear.
Account memory tool inputs and results can be replaced with a placeholder, and remote sessions now fetch memory at the start and end of a turn
Unclear When the placeholder replacement is applied is not stated.
Plugins sending a message now pass along decorations when present, and filling the input box takes an extra piece of information
Unclear What decorations look like on screen, and whether any normal release path uses them, are not known.
Cloud sessions reject a git HEAD on a symbolic ref and suggest git switch, alongside sandbox config and untrusted-device enrollment tweaks
Unclear It is not clear what condition decides when the administrator-managed merging applies.
The 'Use this machine's settings in cloud sessions' toggle now checks first and can say why it cannot turn on; in this build it reports unsupported
Unclear Which situations can block the change is not known.
WebFetch now says when its domain safety check is rate-limited, sorts fetch failures by cause, and checks read_file rules for artifact links
Unclear It is not clear whether these categories are shown to you or only used in usage reporting.
Built-in plugins gain cc-plugin-* names, and enabledPlugins lookups and writes now treat old and new spellings as one plugin
Unclear Which names count as aliases of which marketplace is not spelled out.
SDK login requests now reuse a sign-in already under way and are blocked by the allowedProviders managed setting; --desktop can't be combined with subcommands
Unclear What --desktop does and whether it appears in the help output are not stated.
The release notes bundled inside Claude Code were refreshed and now cover 2.1.283 and earlier
Unclear Whether notes for the version this build ships as are included is not clear.
The Bedrock client now passes its options correctly, stops looking up default credentials by itself and identifies itself as AnthropicBedrock/JS
Unclear Whether this client is the one Claude Code uses for your own Bedrock connection is not clear.
When the organization policy has not loaded, the status message now says web fetch and design sync stay off until it does
Unclear What causes those policy details to be held back is not known.
Some skills withheld by an organization's Skills policy now fail as unknown, and plugin install checks installed plugins for conflicts first
Unclear It is not clear where the Skills policy comes from or what counts as a conflict during plugin install.
The plugins that ship with Claude Code were renamed with a cc-plugin- prefix, such as agents-md becoming cc-plugin-agents-md
Unclear It is not clear whether existing settings that use the old names are updated automatically.
The login screen now follows the allowedProviders managed setting, hiding sign-in options your organization does not permit
Claude Code can now write an index file into a memory folder that has topic notes but no index, linking each note with its title and description
Unclear It is not known what triggers this or whether a setting controls it.
A --max-turns limit on a cloud headless run is now sent to the cloud session, and Claude Code records whether the limit was confirmed
Unclear Whether the cloud service actually enforces the turn limit is not known.
Bedrock, Mantle and Vertex clients now share one set of headers and add an X-Api-Key header from ANTHROPIC_API_KEY unless one is set
Unclear Whether CLAUDE_CODE_SKIP_AWS_CRED_CACHE still has any effect, and how the new credential lookup caches credentials, is not clear.
mcp serve can apply permissions and refuse calls#When Claude Code runs as an MCP server, tool calls can now carry permission settings and be refused with a message
Unclear What supplies these permission settings with each call is not clear.
alwaysLoad is set#With alwaysLoad on, a tool an MCP server marks with anthropic/alwaysLoad set to false now still waits behind tool search
Unclear Only the option's description is known to say this; it is not confirmed that tool loading follows it.
Claude is no longer told to ignore output from commands you run in Claude Code, and now treats it as context for later messages
When a model is denied on Bedrock, Vertex or Mantle, Claude Code now checks lower model tiers in the background and remembers which ones work
Unclear It is not clear what starts the background check or whether a setting controls it.
Spawned sessions now keep your disallowedTools and tools restrictions and your maxTurns limit
Cloud sessions now have messages for limiting a session to the tools you list with --tools, covering empty lists, unsupported cases and org limits
Unclear It is not clear whether limiting cloud sessions with --tools can be used yet.
Cloud sessions no longer flag a turn limit as unenforced, and the flag table for cloud sessions gains a desktop entry
Unclear It is not clear whether the cloud side actually enforces the turn limit, or what the new desktop entry does.
Claude Code can refuse to start with provider_not_allowed when managed settings limit providers with allowedProviders
Unclear Only the description of this refusal reason was seen, not the code that enforces it.
On Windows, Claude Code has two new reasons to ask before running a cloud session command that one of your hooks cannot vet
Unclear It is not clear whether these new approval prompts are behind a flag.
Publishing a workshop page with a <select> element now fails with a specific explanation and a suggested alternative
Claude Code now starts loading memory before file downloads begin and checks it again after a turn when a recheck is due
Unclear It is not clear whether a switch controls whether this runs.
When the server refuses a device as untrusted, Claude Code now tells a refused token apart from a missing signature
Unclear The wording a user sees for each of these cases is not known.
Changing the model now refreshes the data Claude Code loaded at startup, as part of reworked model-switch handling
Unclear It is not clear what the remotely controlled setting changes for someone switching models.
Claude Code has a new error saying it could not read managed policy settings, which may restrict allowed API providers
Unclear It is not clear what triggers this error or how it relates to a related remotely controlled setting.
Anthropic has not published official notes for v2.1.285 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
1 of 27 tool descriptions changed. 1 of 25 tool schemas changed. The appended system-reminder blocks moved: 1 line added.
Claude Code, interactive mode
392 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 87 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?