You can now rely on a built-in security plugin to keep your deny rules in force when other plugins try to lift them. It can also refuse plugins that did not come from your organization. Plugins can now build the system prompt themselves through a new prompt.compose hook, and Claude Code falls back to its own prompt if that fails. Setting CLAUDE_CODE_AUTO_MODE_TIER to any value, even "full", puts auto mode on its strict tier. With CLAUDE_CODE_ARTIFACT_SHARE set, Claude can share an artifact with your organisation or named colleagues after you confirm. A new notice offers a key, ctrl+y by default, to make a newer model your default.
This release has 16 entries in the build that are not switched on yet. On Linux, project hooks can run in a locked-down sandbox called bubblewrap, with no network and a hidden home folder. That sandbox waits on a server switch. Keepalive pings that hold a one-hour prompt cache open during idle pauses are also off unless switched on remotely. A background task for importing local memory notes is taking shape, with a "memory import" entry in the task list. Remote tool permission checks gain retries for timed-out safety checks, behind three switches.
Prompts rewritten by a hook on submit now reach Claude as rewritten. Resumed sessions restart interrupted turns by mistake less often. Resuming in --print mode with an SDK connection now always runs its cleanup step, even after a failure. The ultrareview details dialog no longer offers to open the review in a browser. Starting a remote session no longer sends file sync, folder seeding or sync consent options. The /plugin-types command is now hidden from command listings but still works.
Written by our agent from the shipped bundle, not by Anthropic.
Setting CLAUDE_CODE_AUTO_MODE_TIER to any value selects the "strict" auto mode tier, and it is passed on to processes Claude Code starts
The claude-test plugin now explains why it failed to start, gives new advice on duplicate copies, and drops its terminal-only message
ElsewhereA new early plugin sync step at startup runs only when CLAUDE_CODE_CCR_EARLY_PLUGINS_SYNC is set, and not in interactive sessions or with a proxy auth helper
ExtensionsA permission setting now accepts own_record for unattended sessions, and one more outcome now counts as stopped
A built-in plugin restores deny rules that other plugins lift, and can refuse plugins that did not come from your organization
Permissions & safety
/plugin-types no longer shows in the command listExtensionsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Claude Code can ping the API to keep a one-hour prompt cache alive during pauses, unless the allow_cache_keepalive policy denies it
Unclear It is not known whether the remote switch for this feature is on for any account.
Remote tools gains a bubblewrap sandbox for project hooks, reasons for auto mode being off, and finer handling of hook input rewrites
Unclear What the further check requires, and exactly which hook runs take the Linux sandbox path.
The auto-mode classifier gains rules for messages relayed from a project's coordinator or another thread, with a new env var, flag and killswitch
Unclear It is not traced where the member-session prompt or the gate check is actually used.
Setting CLAUDE_CODE_AUTO_MODE_TIER to any value selects the "strict" auto mode tier, and it is passed on to processes Claude Code starts
Unclear What the "strict" tier restricts in practice is not clear.
The claude-test plugin now explains why it failed to start, gives new advice on duplicate copies, and drops its terminal-only message
Unclear Whether Claude Test is available to everyone or held behind a switch is not known.
New built-in plugin cc-plugin-you-should-know can suggest a learning topic above the prompt while Claude works; you have to turn it on
Unclear What the extra availability check tests, and what it falls back to, is not clear.
Claude can offer to share an artifact with your organisation or named colleagues, with you confirming each share on a card
Unclear It is not clear whether CLAUDE_CODE_ARTIFACT_SHARE is meant to be set by you or by the app hosting Claude Code.
A new resumable 'memory import' background task for local memory notes is wired into the task list, and the footer's memories pill is gone
Unclear It is not clear what command starts the import or whether it is switched on.
A new early plugin sync step at startup runs only when CLAUDE_CODE_CCR_EARLY_PLUGINS_SYNC is set, and not in interactive sessions or with a proxy auth helper
Unclear It is not clear what normally sets this variable, for example a server that launches hosted sessions.
A permission setting now accepts own_record for unattended sessions, and one more outcome now counts as stopped
Unclear Which configuration this belongs to and what own_record does are not known.
A built-in plugin restores deny rules that other plugins lift, and can refuse plugins that did not come from your organization
Unclear Whether this built-in plugin is active by default is not known.
A new prompt.compose hook point lets a plugin module build the system prompt from its sections, and Claude Code falls back to its own if that fails
awsAuthRefresh and gcpAuthRefresh now run in one Claude Code process at a time, report clearer outcomes, and respect Stop
Unclear It is unclear which program sets this variable and what the configuration check it describes does.
CLAUDE_CODE_MCP_PREWAIT_SERVERS and CLAUDE_CODE_MCP_PREWAIT_SERVERS_MS let a remote host hold the first turn for named MCP servers
Unclear It was not confirmed how the named wait is applied afterwards, or whether these variables are allowed through to the Claude Code process in every remote setup.
SDK hosts passing MCP server manifests now get a per-server outcome, a freshness marker, and separate rules for remote sessions
Unclear It is unclear whether Claude Code has a separate switch that must be on before it uses remote manifests.
Running Remote Control bridges now shut down with a notice when org policy refuses them; the SDK bridge can also switch SDK MCP servers on and off
Unclear What makes Claude Code re-check the policy, and how the switch for SDK MCP servers is exposed, are not known.
Claude Code now recognises a relay connection type and stores a Chrome tab group key
Unclear What relay connections are used for, and how the Chrome tab group key is used, is not known.
Claude Code gained a cache keepalive part that can switch itself off for your login or for a while after a refusal
Unclear What starts the keepalive and whether it is switched on is not established.
Forked agents can now replace some of the main conversation's tools with altered copies and receive a count of API attempts left
Unclear It is not clear which parts of Claude Code pass tool replacements to a forked agent, or whether this is in use yet.
CLAUDE_CODE_CONFIG_PROBE variable skips two startup steps#When the CLAUDE_CODE_CONFIG_PROBE environment variable is set, Claude Code skips two of the routines it normally runs at startup
Unclear It is not clear what the two skipped startup routines do or who is expected to set this variable.
A new announcement says your saved model is your default and offers a key, ctrl+y by default, to make a newer model the default instead
Unclear It is unclear when exactly the notice appears, since what marks a newer model as pending was not traced.
The artifact tool can now share an artifact with your organization or with named people, as view-only or with commenting
Unclear What makes the artifact tool available, and so whether sharing is reachable for everyone, is not known.
A prompt can offer to continue a resumed old session on a newer model of the same family; it is off unless switched on remotely
Unclear How long the session must be idle and how often the question may be asked are not known.
The /pause-memory command can now describe pausing both account memory and local auto-memory, and the rule for when it is hidden changed
Unclear Because the command still reports as not enabled, it is not clear who can see or use it.
A check that only allowed a locked or person mode on macOS now also allows it on Linux when a further check passes
Unclear It is not clear which feature this availability check belongs to.
Claude Code now contains a new prompt composition hook point and a cache keep-alive beta setting, with no sign they are in use
Unclear Whether any of these are switched on or used yet is not clear.
Claude Code gained internal tracking for drafting and running tests, reading comments, and blank images from MCP servers in remote sessions
Unclear What each of these pieces does in practice is not traced.
Remote tool permission checks can retry a timed-out safety check and treat unreadable shell commands as needing a person, behind three switches
Unclear What each of the three switches controls on its own, and exactly how the settings file exception works, is not clear.
Claude Code installs plugin dependencies from a checked package-lock.json or bun.lock using npm ci --ignore-scripts or bun, preferring npm lockfiles
Unclear It is unclear what starts this install and whether anything gates it.
Sessions started over the bridge now get a CLAUDE_CODE_BRIDGE_SOURCE_DIR environment variable holding their source directory
Unclear What reads this variable, and when the source directory is set, are not known.
Plugin hooks can now call a new prompt.compose method, and prompt.submit now accepts an asUser option that must be true or false
Unclear It is not known what uses prompt.compose or whether it is switched on for anyone.
Plugins that submit prompts can now pass an asUser flag, which marks the queued prompt as sent on the user's behalf
Unclear How Claude Code treats a prompt marked as sent on the user's behalf is not clear.
send_task_message#A request named send_task_message joins interrupt and stop_task in Claude Code's list of control requests
Unclear What this list of control request names is used for is not known.
When set, the option withholdScriptFromSdkEvents replaces workflow phase titles with numbers and scrubs agent details from SDK progress events
Unclear It is not known what sets this option.
In print and SDK mode, a message waiting in the queue can now be pushed to the front and delivered during a running turn
Unclear What decides whether send-now is available is not known.
When connecting to a remote session, Claude Code now reads whether only the owner's account or only others may write to it, and logs the answer
Unclear It is not clear whether anything other than the log record uses this value.
A scan result in Claude Code now includes whether person files can be written and details about how they are cited
Unclear It is not clear which feature these fields belong to or what switches it on.
Programs driving Claude Code through the SDK can now disable and re-enable MCP servers they registered themselves
Unclear The exact name of the request an SDK program sends to do this is not known.
Claude Code includes a dialog that lets you keep the current model or resume on a newer one
Unclear Where this dialog appears and what switches it on is not known.
An internal list that also holds an auto mode bypass entry now includes one named for account standing rule changes
Unclear What the list is used for, and whether this entry changes anything a user sees.
CLAUDE_DISABLE_ADOPT now covers more handoff checks#Setting CLAUDE_DISABLE_ADOPT now turns off handoff behaviour in several more places, including background exit and agent checks
Unclear It is not clear what the handoff does for a user in each of the newly covered places.
/hooks now opens on a list of every configured hook with its event, source, command and matcher, with the event list one step away
The send-now key can now deliver a queued message to a named agent you are viewing, not only to the main agent
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
6 more of these are in What probably matters to you, above.
Gateway docs inside Claude Code now say to ignore unknown input, describe auto-mode safeguards fields, and change the managed settings response format
Artifact comments get a separate commentWrite permission, allowed in turns not started by a human, and unasked writes are now tracked
Unclear What turns this permission on, and which feature it belongs to, is not known.
For unattended runs, Claude Code keeps a session's permission mode only in certain cases and otherwise uses the default
Unclear What calls this check, and so which runs are affected, is not known.
Claude Code can now work out an alternate model to suggest from the current one, behind a server switch
Unclear Where the suggestion appears, if anywhere, is not known.
/model can now refuse a switch or ask you to confirm it#/model now runs a check first that can block a model switch with a message or ask for extra confirmation, sometimes with a reason
Unclear What makes the check refuse or ask for confirmation is not known.
Prompts asking to change who can access something now say "open or comment on", default to No, and are marked person-only
Text from a plugin marked to act as the user is now passed on as plain text, without the plugin's name wrapped around it
Unclear What sets a plugin message to act as the user.
The terminal scrollbar can now show clickable arrows at each end that scroll on click and keep scrolling while held
Unclear Which scrollbars actually show the arrows.
The message shown when plugin hooks modules are off now blames CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=0 or a rollout switch, not early access
Unclear Whether hooks modules are actually on by default now when nothing is set.
Artifact changes sent through the relay are refused if the person running the session did not approve them
A remote machine set to run calls only inside a sandbox now refuses a call when no sandbox is available, and tells Claude why
Unclear It is not clear who is affected by this or whether it is active yet.
The prompt hint element now accepts optional trailing text, and under the HIPAA policy connector suggestions are denied when the policy check fails open
Unclear It is not clear where the PromptHint element appears or whether the HIPAA rule is active for any account yet.
A plugin marketplace registered under the name npm, in any capitalisation, is now ignored because that name is reserved
Workflow agents can now be labelled agent 1, agent 2 and so on, instead of a shortened version of their prompt
Unclear What turns on the numbered labels is not known.
If a tether thread has been idle as long as the server keeps it, Claude Code now starts a new thread rather than continuing the old one
Unclear Whether the tether feature is in use for readers is not known.
Claude Code now tracks which Artifact comments are yours and has new rules for when a turn only read your own comments
Unclear What you will see differently, and what switches this behaviour on, is not known.
The git and commit instructions Claude receives can now include an extra line about checks before shipping, depending on which skills are loaded
Unclear It is not clear whether the extra line actually shows up in the instructions Claude receives.
The footer indicator is read from CLAUDE_CODE_FOOTER_INDICATOR, then from the main model's configuration, then from startup data
Review launches can pass findingsArriveInSession, and the launch message can say findings arrive here instead of giving a Track link
Unclear Whether a failed download is reported to Claude or to you some other way is not known.
Gateway sign-in endpoints are used only if they are absolute same-origin URLs, otherwise defaults apply; reverse proxies on another hostname are covered
Unclear Whether the client code behaves exactly as this text describes is not confirmed.
The ultrareview dialog no longer offers "Open in browser", shows a completion note, and its stop prompt now focuses Back by default
Claude Code can now warn that auto-compaction is thrashing, and forked agents in remote sessions skip compaction the normal threshold would not trigger
Unclear It is unclear where the thrashing message is shown.
The Status panel now reads a machine status alongside account status, and its lists gain scroll arrows and clickable more-above and more-below markers
Unclear It is unclear what the machine status contains and whether it shows up as a new row.
Claude Code now checks an agent's last message for phrases like 'awaiting your approval' and marks it as asking you
Unclear Where the asking status is shown or used is not known.
Choosing to remove a worktree when you exit now runs the removal during shutdown, can be interrupted, and reports if it was skipped
Unclear When removal ignores a lost terminal and when the resume hint leaves out the worktree is not clear.
When a model rejects fast mode, Claude Code now uses standard speed for that model for the session and shows a warning
Unclear It is not clear who sees the warning, because two conditions that can skip it are not explained.
When a message sent over Remote Control has files still arriving, Claude Code now waits for them before a tool runs or the turn ends
Unclear How long Claude Code waits before giving up on a missing file is not stated.
Claude Code now spots every rejected beta feature in an API error, including thinking display settings, instead of checking for just one
Unclear How Claude Code uses the list once it has it is not clear.
The separate AutoMemPinned memory type now becomes AutoMem, its own label is gone, and relevant memories are no longer logged as reads
Unclear Whether this removes read tracking or only moves it elsewhere is not clear.
Cloud sessions now say when your computer's tools are withheld because the sandbox is starting or unavailable, or settings are unreadable
Unclear Which setting controls this is not known.
When resuming without the interactive screen, Claude Code holds the session until saved state loads, with a time limit
Unclear What difference this makes on screen is not known.
The send-now path can now push one chosen queued message into the running turn, in prompt mode, instead of only the queue as a whole
Unclear It is not clear whether any key or button lets you pick a single queued message yet.
An MCP tool call can now be moved to the background even when no auto-background timer is set, if a new check says the call can be moved
Unclear It is not clear what the new check looks at to decide that a call can be moved.
When resuming a session, Claude Code uses a new check to decide whether to continue from the newest message or the recorded last point
Unclear How the new check decides between the two points is not shown.
If the permission check for sharing an artifact fails before the confirmation appears, Claude Code refuses the share and nothing is shared
Unclear It is not clear what controls whether the artifact sharing feature is available.
Image and document attachment size limits are set per connection type, with 1.5 MB images and 3,380,000-byte documents on session and relay
Unclear It is not clear whether these limits are actually applied yet, or what the limits were before.
On self-hosted runners, Claude Code can now request a fresh inference token immediately instead of waiting for the next scheduled refresh
Unclear What triggers an immediate refresh is not shown.
SendMessage now checks cross-machine file transfer before and after the permission ask and before sending, and names the reason when refused
Unclear What allow_send_file falls back to when the server sends nothing is not known.
A single check now matches Remote Control and cloud sessions to their organization policies and returns a clear message when one is turned off
Unclear It is not clear which parts of Claude Code call this check.
The feature that quickly submits typed input is now tied to a specific agent and handles cases where interrupting to submit is not possible
Unclear It is not clear which parts of Claude Code use it under a different name.
An agent's instruction to restate what you said now asks it to do so in the first sentence of its answer, not as a separate recap
Unclear It is not clear which mode or agent uses this instruction, or whether it reaches any prompt currently sent.
Claude Code contains an error saying Claude Test did not start because its browser helper did not connect, with steps to try
Unclear It is not clear when this message is shown, whether /claude-test is available to readers, or what replaced the skill file this message took the place of.
When Claude sends a message to a cloud or Remote Control session, it checks whether sending is allowed both before and after you approve it
Unclear What the check actually tests for each kind of session is not clear.
CLAUDE_CODE_ENABLE_CFC no longer forces Claude in Chrome on in every case#Claude in Chrome is now off in one more situation, and setting CLAUDE_CODE_ENABLE_CFC does not turn it back on there
Unclear It is not clear what condition the new check tests.
The sandbox status now says whether seccomp is unavailable and whether ripgrep has been overridden, on platforms other than macOS and Windows
Unclear Where this sandbox status is shown or used is not known.
Messages sent while Claude is still working can now be wrapped in text telling the model where they came from
Unclear Where this wrapper is used, and whether it is active by default, is not known.
Claude Code now lists the managed settings folder, managed-settings.d and policy settings paths among the paths it protects
Unclear It is not clear whether the new protected-path list is actually used by the write check yet.
When the model picking relevant memories refuses a request, Claude Code now tries the next model on a list instead of giving up
Unclear Which models are on the candidate list is not stated.
In some sessions Claude Code now ignores autoConnectIde and CLAUDE_CODE_AUTO_CONNECT_IDE=true when deciding whether to connect to your editor
Unclear It is not clear which sessions the new check applies to.
The plugin directory and connector suggestions are now denied for HIPAA orgs when the org policy check can't complete
Unclear Which features are marked to be denied, and the exact condition that triggers the refusal, are not known.
When WebFetch reads an artifact made by someone else, Claude Code now weighs more settings in deciding which permission prompt to show
Unclear It is unclear what the new settings default to and how the prompts you see differ.
When Claude Code is not honoring local permission rules, it now still applies deny rules from settings and stops sandbox auto-allow
Unclear It is not clear which features or kinds of call run in the mode where local rules are not honored.
claude --cloud sends#The claude --cloud settings-sync text now says it sends your portable permission rules and shows on each launch whether they were sent
Unclear It is not clear whether what the sync actually sends changed, or only its description.
A background task whose result asks for approval is now classed as blocked, unless that result is out of date
Unclear Which screen shows this blocked state is not established.
The Claude Desktop MCP import dialog is now a checkbox list: Space toggles a server, and an Import selected row confirms
Published verbatim by Anthropic for v2.1.286. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 88 bullets, 14 name something an entry on this page also names, 16 name something no entry here does, and 58 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude --resume and --continue sometimes losing every turn after a batch of parallel tool calls when the earlier session crashed or was killed
No entry names this /login succeeds in another Claude Code window when a leftover ~/.claude/.credentials.json exists
Probably auth-source-classification-changed-login-managed-key, ultrareview-stop-message-and-other-small-changes, oauth-provider-docs-tls-and-client-guarantees-text-updated claude remote-control) staying connected after your organization's policy turns Remote Control off; they now disconnect with a notice
Probably remote-control-tears-down-when-org-policy-starts-refusing-it --fallback-model retries failing when the fallback model can't run fast; they now run at standard speed, with a one-time notice in interactive sessions
No entry names this claude auth status reporting a Console sign-in's stored API key as claude.ai; it now reports api_key, and the VS Code extension treats that session as an API key session
Probably auth-source-classification-changed-login-managed-key, mcp-discover-prior-tracking-generalized-beyond-claudeai-prox /status listing an Anthropic profile beside an API key as if both were in effect; the profile is now marked as not in use
No entry names this ), quotes, ], & or a second @, or that runs past a / to a bracketed host such as [::1] in an ssh URL
No entry names this /feedback saves to disk containing invalid JSON lines after secret redaction
No entry names this /usage not crediting an MCP server for a tool call made while that server was still connecting or had only just connected, such as right after a restart
No entry names this /compact, /clear, and /rewind typed while viewing a background agent's or teammate's transcript silently acting on the main conversation: a dialog now names the target and asks first
Probably agent-view-slash-commands-compact-clear-rewind-now-prom, fallback-model-switch-warns-about-a-smaller-context-window #97857[BUG] `/compact` typed inside the subagent view compacts the main conversation instead Open
/plugin's Discover tab showing a marketplace name unquoted in its "Checking … for new plugins" line when its rows already show that name in quotes
Probably hook-descriptions-reworded, plugin-installenabledisableuninstall-in-plugin-ui-now-re, claude-test-plugin-conflict-message-and-runner-rewritten, plugin-types-command-hidden, you-should-know-builtin-plugin-side-agent-suggests-things verify, Claude is now told to run it right before committing, except for docs-only and tests-only commits
Nothing to match on /hooks: the closing line of a hook's detail screen now says "this hook" instead of "it"
Probably hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks -p sessions when a host re-sends an MCP server enable for a server that is already connected
Nothing to match on /protocol: it now says not to reject unknown input and matches what Claude Code sends today
No entry names this --bare to connect only the MCP servers named on the command line, send the model no system reminders, and start no background tasks; under --bare, a shell command that reaches its timeout now stops instead of moving to the background
Probably bare-sessions-refuse-plugin-toolregister /artifacts, /mcp, /skills, /hooks and others) to always line up each row's details in one column after the names
Probably mcp-oauth-tool-reuses-an-in-progress-sign-in, mcp-reconnect-and-ccr-diagnostics-additions, hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks /hooks to open on one list of your configured hooks grouped by event, so viewing a hook takes one Enter instead of three
Probably hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks /exit's Remove worktree to run after Claude Code stops the servers and shells it started there, which on Windows could keep the folder from being deleted
No entry names this claude-api skill's Managed Agents examples to create environments with limited networking
No entry names this /ultrareview and claude ultrareview output
Probably ultrareview-stop-message-and-other-small-changes, stop-ultrareview-dialog-uses-confirmcancel-control-with-key, ultrareview-detail-dialog-drops-open-in-browser-and-shows, ultrareview-launch-message-can-say-findings-arrive-in-the-se claude --bg and the agents view refusing a folder that claude already trusts when its trust record was saved with different letter case
Probably background-session-workspace-trust-and-gate-blocked-reasons A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
The appended system-reminder blocks moved: 1 line added.
Claude Code, interactive mode
928 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 66 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?