You can now rely on a built-in security plugin to keep your deny rules in force when other plugins try to lift them. It can also refuse plugins that did not come from your organization. Plugins can now build the system prompt themselves through a new prompt.compose hook, and Claude Code falls back to its own prompt if that fails. Setting CLAUDE_CODE_AUTO_MODE_TIER to any value, even "full", puts auto mode on its strict tier. With CLAUDE_CODE_ARTIFACT_SHARE set, Claude can share an artifact with your organisation or named colleagues after you confirm. A new notice offers a key, ctrl+y by default, to make a newer model your default.
This release has 16 entries in the build that are not switched on yet. On Linux, project hooks can run in a locked-down sandbox called bubblewrap, with no network and a hidden home folder. That sandbox waits on a server switch. Keepalive pings that hold a one-hour prompt cache open during idle pauses are also off unless switched on remotely. A background task for importing local memory notes is taking shape, with a "memory import" entry in the task list. Remote tool permission checks gain retries for timed-out safety checks, behind three switches.
Prompts rewritten by a hook on submit now reach Claude as rewritten. Resumed sessions restart interrupted turns by mistake less often. Resuming in --print mode with an SDK connection now always runs its cleanup step, even after a failure. The ultrareview details dialog no longer offers to open the review in a browser. Starting a remote session no longer sends file sync, folder seeding or sync consent options. The /plugin-types command is now hidden from command listings but still works.
Written by our agent from the shipped bundle, not by Anthropic.
Setting CLAUDE_CODE_AUTO_MODE_TIER to any value selects the "strict" auto mode tier, and it is passed on to processes Claude Code starts
The claude-test plugin now explains why it failed to start, gives new advice on duplicate copies, and drops its terminal-only message
ElsewhereA new early plugin sync step at startup runs only when CLAUDE_CODE_CCR_EARLY_PLUGINS_SYNC is set, and not in interactive sessions or with a proxy auth helper
ExtensionsA permission setting now accepts own_record for unattended sessions, and one more outcome now counts as stopped
A built-in plugin restores deny rules that other plugins lift, and can refuse plugins that did not come from your organization
Permissions & safety
/plugin-types no longer shows in the command listExtensionsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →6 more of these are in What probably matters to you, on page 1.
/compact, /clear and /rewind ask to confirm inside an agent view#Typing /compact, /clear or /rewind while viewing an agent now asks you to confirm running it on the main conversation
The theme picker previews each theme as you move through it, ticks the current one and restores your saved theme if you cancel
Unclear How many rows the output style picker now shows is not settled.
When Claude Code falls back to a model with a smaller context window, the notice shows both sizes and suggests /clear or a larger fallback
Unclear It is not clear whether this notice is shown to everyone or only when some setting allows it.
Typing / now also matches the start of words in command descriptions, and suggestions are ordered by a new set of rules
Claude Code's search for nested memory folders now handles git worktrees and no longer mistakes similarly named folders for subfolders
When you open your prompt in an external editor, Claude Code now tells the editor to start at the line your cursor was on
Unclear Which editors are given the line number in this form.
Under a new condition, an MCP tool call no longer gets a timer for moving itself to the background, and plugin sync logs two more details
Unclear It is not clear which sessions meet the condition that turns off automatic backgrounding.
If the account's plugin list returns in a degraded state, plugin sync now treats it as pending rather than finished
Before sending to a bridge address, SendMessage now runs a check and reports failure straight away if that check objects
Unclear What the check actually tests is not resolved.
Automatic discovery of MCP servers now also stays off when an additional check at the start of its conditions is true
Unclear What the new first check tests is not known, so it is unclear when it turns automatic MCP discovery off.
When a feature check passes, questions Claude asks you that have no type are now marked as multiple choice
Unclear It is not clear what the feature check tests or who it is on for.
If Claude uses an option that was offered earlier in the conversation but is not available now, the error says so and tells it to continue
Unclear It is unclear whether the Artifact family of tools is itself switched on for everyone.
Claude Code now refuses to serve device tools when seccomp is unavailable or more sandbox-weakening settings are on
Unclear It is not confirmed which remote feature uses these device tools.
Claude Code now checks whether a marketplace source you add would replace one you already have, and explains accepted source formats on failure
Unclear Which command runs this check is not settled, though it appears tied to claude plugin marketplace add.
A remote user message with attached files can now start Claude's reply before the files are written, and Claude is told if any could not be saved
Unclear It is not clear what decides whether a message takes this earlier-start path.
If an MCP server sign-in is still in progress, Claude Code now reuses its link instead of starting a new sign-in that would break the first
Unclear How recent the earlier sign-in must be for its link to be reused is not stated.
The prompt asking permission to run a shell command now shows its description above the command and lists network hosts only when there are some
When a response stream fails, the wait before retrying is now capped to the time remaining, and stalled requests are retried more readily
Unclear The length of the deadline, the minimum time left, and one further condition on retrying are not known.
Claude Code now times its wait for MCP servers added during a session to the moment they answer, and gains a relay hold option
Unclear What sets relayHold and what decides which of the two waiting paths is used are not known.
Claude Code now reports a key managed through /login as an API key rather than a claude.ai login
Unclear It is not certain the other conditions that lead to the API key label are exactly the same as before.
The /ultrareview stop and failure messages are reworded, and /fast, login status and the output style picker change slightly
Unclear It is not clear what the additional check is that lets /fast turn fast mode on.
When a workflow agent's response stream goes silent, Claude Code now reports a lost reply, retries, and gives a specific error if all tries fail
Unclear What makes Claude Code give up on the stream, and the value of the new cap, are not known.
extraKnownMarketplaces#When a plugin marketplace fails a trust check, the suggested fix now names the extraKnownMarketplaces setting
A URL path allowlist now treats only entries ending in / as prefixes; any other entry must match the path exactly
Unclear It is unclear which allowlist in Claude Code this check belongs to.
When a background session is blocked from starting, Claude Code now records whether a disclaimer or the folder trust check stopped it
Unclear It is not clear whether the symlink change to the trust check makes any difference you would see.
--bare sessions#In --bare sessions, a plugin that tries to register a tool while running is now refused with an error
Approving a monitor now shows its description in dim text, and some permission prompt text sits in padded boxes
Installing a plugin from npm now rejects invalid names, tarball links to code hosts, and unencrypted http registries
Requests to switch an MCP server on or off now check their inputs, treat SDK-provided servers separately and refuse servers that policy blocks
Unclear It is not clear whether this handling is new behaviour or existing behaviour moved elsewhere.
Claude Code now explains that cross-machine file transfer is off because your provider or privacy setup blocks uploads through Anthropic
Unclear It is not clear exactly which provider or privacy settings trigger the message.
When sending messages to sessions on another machine is blocked, Claude Code now gives the reason and says local sessions still work
Unclear What causes cross-machine messaging to be blocked is not stated.
The preview shown when Claude asks to edit a Jupyter notebook now sizes itself to your terminal and drops an extra indented box
In a group of tool calls, error lines now appear only from the latest real tool result onward instead of for every call
Unclear It is unclear exactly which error lines are now hidden.
The summary shown when you return after being away now uses a second timestamp to judge cache age, so fewer are skipped
Unclear It is not known exactly what the second timestamp records.
Messages about providers that don't get Anthropic's first-party-only beta features now say Claude Code doesn't send them
The OAuth provider documentation built into Claude Code now says endpoint paths come from the discovery document and explains re-login after a certificate change
Files attached through a remote connection now get a note when unverifiable, and early-downloaded copies are released when unused
Unclear The exact wording of the new prompt note and the purpose of the extra download header are not known.
Managed plugins that are not yet present on this machine are now logged as a plain note instead of a load-error warning
Claude Code's secret scrubber now also hides Bearer tokens that contain URL-encoded characters such as %2F
Unclear It is not stated which logs or outputs the scrubber is applied to.
At startup, the skills and plugins checks now share a single manifest download instead of each fetching it
A log message about failing to save remembered MCP server checks now uses a shorter prefix and describes a different retry
Unclear Whether the behaviour changed along with the message is not known.
Git remote addresses whose path has backslashes, percent codes or . and .. segments are now treated as unusable
The hint line under the prompt can now show an extra dimmed piece of text after a dot, only when it fits the width
Unclear What supplies the extra text, and when the hint is shown at all, is not settled.
Claude Code now checks all changed files for the generated-file marker in one git call and no longer silently ignores git failures during attribution
Unclear It is unclear what a user sees when one of these git errors is raised.
When you send feedback or share a session, Claude Code now passes the transcripts through a processing step instead of attaching them as-is
Unclear It is unclear what the processing step does to the transcripts, including whether it removes any data.
Plugin lookup now finds nothing when the marketplace has a reserved name, and marketplace refusals now carry a reason
Unclear It is unclear which marketplace name is reserved.
When a call to an MCP server is rejected, the error result now carries the rejection's metadata in its _meta field
Claude Code's check for suspicious web addresses now rejects one more kind of address before comparing hosts
Unclear It is not clear what kind of address the new early test catches.
Claude Code can now spot an error saying the requested model does not support the speed setting
Unclear It is not clear where this check is used or what Claude Code does when it matches.
Cloud session messages now say "screened git" instead of "sync git", and a storage message says "for now" instead of "for this spawn"
When compaction hits a switch to a backup model, it now raises that as an error and can put the current model back into the backup list
Unclear It is not clear what condition decides whether the current model is put back into the backup list.
The title row of a permission prompt can now show a dimmed note at its right end when there is room for it
Unclear It is not clear which permission prompts supply this note or what it says.
The "Event dropped" telemetry message is now a warning only when CLAUDE_CODE_ENABLE_TELEMETRY is set, and a quieter debug message otherwise
Claude Code now ignores plugin marketplaces with one reserved name and reads marketplace catalogs slightly differently
Unclear It is not clear what the reserved name is or what the extra input to catalog reading does.
The account information panel now builds the Profile line as text with a suffix in some cases, and shows Organization and Email by a new rule
Unclear It is not clear what the added text says or exactly when the Organization and Email lines now appear.
A running task can now skip being moved to the background automatically, and messages sent with Enter are tagged as typed by a person
Unclear The condition that turns off automatic backgrounding is not known.
Pressing Ctrl-C during a remote review now says it may still be running in the cloud, and the live progress link is gone
Unclear It is not clear whether a link to the review session is still shown after the new cancel message.
A marketplace Claude Code does not use now shows as added but ignored, with the reason, instead of registered but refused
When one kind of error stops pull request attribution stats, Claude Code logs a skip message instead of reporting it as an error
Unclear It is not clear which kind of error leads to the quiet skip.
Shell commands with a line Claude Code cannot read now need your approval, and downloaded plugin marketplaces have their name checked
Unclear It is not clear what makes a shell line unreadable, or what happens when a marketplace's name does not match.
skipLfs alongside sparsePaths#Claude Code now strips skipLfs as well as sparsePaths from github and git marketplace sources, and plugin MCP loading takes a new filter
Unclear Where skipLfs is used and what the admits option filters are not known.
The notice that a user plugin setting is ignored because managed policy sets it is now logged once, and no longer as a warning
When your organization's configuration includes HIPAA, an extra dimmed line now appears under the Organization configuration row
Unclear What the extra line says.
When cleaning up a git worktree, Claude Code now reports entries it could not check instead of silently skipping them
Unclear It is not clear where, or whether, this report is shown to the user.
The patterns Claude Code uses to hide secrets were extended, and reads of auto-managed memory are now recorded in a different place
Unclear It is not known what extra text the extended patterns now match.
The skill permission prompt now has padding, one small option row became a confirm-or-cancel dialog, and fork messages show a plain instruction
Unclear It is not clear where in Claude Code the confirm dialog and the fork message are shown.
The notes in the hooks screen that explain where each hook comes from are now written as full sentences
When the stored sign-in token is unusable, Claude Code rechecks the stored credentials, rate-limited, alongside other sign-in changes
Unclear An extra condition controls when the recheck runs, and it is not clear what it checks or how often the recheck helps in practice.
When a hook rewrites your prompt on submit, Claude Code now applies the new text to your message so Claude sees the rewritten version
Unclear It is not certain the old behaviour was actually broken in practice.
On resume, Claude Code checks unanswered tool calls per response and skips restarting a turn whose calls were answered in a restored card
Unclear The exact conditions under which a turn is treated as finished are not clear.
When a session is resumed in --print mode with an SDK connection, Claude Code now runs its cleanup step at the end even if something fails
Unclear What the cleanup step actually releases is not identified.
When the safety check before fetching a web page is rate-limited, Claude is now told to carry on without the page instead of retrying
In fullscreen, some text no longer highlights when the mouse is over the empty space beside it
The check on answers to questions Claude asks you now ignores a harmless difference in how choice questions are marked
On macOS, Claude Code now converts file paths to a single standard Unicode form so names with accents match reliably
Two queued plugin messages now count as the same only when they come from the same plugin name and the same sender setting
Unclear It is not clear where this comparison runs or whether plugin messages reach it yet.
Claude Code now forgets a stale MCP connection result when listing a server's tools fails, and logs a restarting server's error output
Claude Code now handles marking an MCP server as needing authentication correctly, where before it returned the wrong value
Whether a queued message can be delivered now depends only on that agent's own messages, not on other agents' waiting ones
Unclear What the earlier check matched is not known, so it is unclear how often messages were actually held up before.
If the list of plugins to install comes back incomplete, Claude Code keeps previously installed plugins instead of removing them
Unclear What marks the plugin list as degraded is not clear.
Claude Code no longer cuts short Linux cgroup paths that contain a colon, so it reads container memory limits correctly
Unclear It is not known which container setups produce cgroup paths with colons in them.
If an older Java MCP server rejects elicitation again after reconnecting, Claude Code now tries once more in legacy mode
Unclear It is not clear whether the second retry is reached in practice.
When servers are set through the SDK or a control client, Claude Code can now skip MCP servers that are disabled or denied by policy
Unclear The second condition that switches on this check could not be identified.
Claude Code now warns once when usage data from the API is malformed and counts cache and input tokens more fully
If Claude Code cannot tell how much of a change it wrote, pull request attribution now falls back to the default text
When scanning plugin marketplaces listed in settings, Claude Code now skips the built-in marketplace's name whatever its capitalisation
Unclear It is not clear what difference the saved-registry detail makes for users.
When a multisession bridge is at capacity, the next heartbeat is now timed by the heartbeat interval and capped by the at-capacity poll interval
Unclear It is unclear whether this corrects a mistake or deliberately changes the timing.
When an edited prompt's text is blank, Claude Code now keeps only its non-text parts instead of sending an empty piece of text
Unclear It is not shown which feature edits the prompt or what the fallback is.
Tool results that are neither text nor a list are now converted to text, and cut short if long, before Claude Code sends them
Unclear It is not clear when this conversion runs or whether any setting controls it.
Prompt dumping now avoids rewriting an agent's starting data a second time, and resetting now clears prompt-dump state
Unclear Which setting turns on prompt dumping is not known.
A background fetch of internal events now checks the real sign-in headers and uses the correct values for conflict replies and retry waits
Unclear The old code may only have looked wrong after renaming by the build tools, in which case nothing changes in practice.
In the terminal interface, a repeated mouse click now resets the click count, as a stray click already did
Unclear It is unclear exactly which clicks are marked as repeats.
9 more of these are in What probably matters to you, on page 1.
Pending permission prompts, including sandbox network asks, are now counted so each can show its place, such as "1 of 3"
Unclear Where the position label is shown, and whether it is switched on, is not known.
Remote sessions gain a 'relay' transport, record when the server received each message, and can start preparing attachments before file downloads
Claude Code can now work out why auto mode is off and build a notice saying so, behind a remote setting that falls back to off
Unclear It is not clear whether the remote setting controls the notice, or where the notice appears.
New code can restore a task list in one step, with an option to roll back entirely if any task fails
Unclear Nothing shows what calls this code or when it runs.
Behind tengu_dapper_platypus, relay-marked workers only hold for their relay when it is still usable, else wait for MCP servers normally
Unclear Exactly what holding the relay does for the worker is not settled.
Attachments fetched ahead of time in remote sessions can have their hold renewed, and ones that stall show [attachment did not arrive]
Unclear It is not clear whether the [attachment did not arrive] placeholder is shown to you or only to Claude.
Claude Code's memory extraction pass can add a stale-information note to its instructions and records a few more measurements
Unclear What causes the stale note to be added is not clear.
Published verbatim by Anthropic for v2.1.286. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 88 bullets, 14 name something an entry on this page also names, 16 name something no entry here does, and 58 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude --resume and --continue sometimes losing every turn after a batch of parallel tool calls when the earlier session crashed or was killed
No entry names this /login succeeds in another Claude Code window when a leftover ~/.claude/.credentials.json exists
Probably auth-source-classification-changed-login-managed-key, ultrareview-stop-message-and-other-small-changes, oauth-provider-docs-tls-and-client-guarantees-text-updated claude remote-control) staying connected after your organization's policy turns Remote Control off; they now disconnect with a notice
Probably remote-control-tears-down-when-org-policy-starts-refusing-it --fallback-model retries failing when the fallback model can't run fast; they now run at standard speed, with a one-time notice in interactive sessions
No entry names this claude auth status reporting a Console sign-in's stored API key as claude.ai; it now reports api_key, and the VS Code extension treats that session as an API key session
Probably auth-source-classification-changed-login-managed-key, mcp-discover-prior-tracking-generalized-beyond-claudeai-prox /status listing an Anthropic profile beside an API key as if both were in effect; the profile is now marked as not in use
No entry names this ), quotes, ], & or a second @, or that runs past a / to a bracketed host such as [::1] in an ssh URL
No entry names this /feedback saves to disk containing invalid JSON lines after secret redaction
No entry names this /usage not crediting an MCP server for a tool call made while that server was still connecting or had only just connected, such as right after a restart
No entry names this /compact, /clear, and /rewind typed while viewing a background agent's or teammate's transcript silently acting on the main conversation: a dialog now names the target and asks first
Probably agent-view-slash-commands-compact-clear-rewind-now-prom, fallback-model-switch-warns-about-a-smaller-context-window #97857[BUG] `/compact` typed inside the subagent view compacts the main conversation instead Open
/plugin's Discover tab showing a marketplace name unquoted in its "Checking … for new plugins" line when its rows already show that name in quotes
Probably hook-descriptions-reworded, plugin-installenabledisableuninstall-in-plugin-ui-now-re, claude-test-plugin-conflict-message-and-runner-rewritten, plugin-types-command-hidden, you-should-know-builtin-plugin-side-agent-suggests-things verify, Claude is now told to run it right before committing, except for docs-only and tests-only commits
Nothing to match on /hooks: the closing line of a hook's detail screen now says "this hook" instead of "it"
Probably hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks -p sessions when a host re-sends an MCP server enable for a server that is already connected
Nothing to match on /protocol: it now says not to reject unknown input and matches what Claude Code sends today
No entry names this --bare to connect only the MCP servers named on the command line, send the model no system reminders, and start no background tasks; under --bare, a shell command that reaches its timeout now stops instead of moving to the background
Probably bare-sessions-refuse-plugin-toolregister /artifacts, /mcp, /skills, /hooks and others) to always line up each row's details in one column after the names
Probably mcp-oauth-tool-reuses-an-in-progress-sign-in, mcp-reconnect-and-ccr-diagnostics-additions, hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks /hooks to open on one list of your configured hooks grouped by event, so viewing a hook takes one Enter instead of three
Probably hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks /exit's Remove worktree to run after Claude Code stops the servers and shells it started there, which on Windows could keep the folder from being deleted
No entry names this claude-api skill's Managed Agents examples to create environments with limited networking
No entry names this /ultrareview and claude ultrareview output
Probably ultrareview-stop-message-and-other-small-changes, stop-ultrareview-dialog-uses-confirmcancel-control-with-key, ultrareview-detail-dialog-drops-open-in-browser-and-shows, ultrareview-launch-message-can-say-findings-arrive-in-the-se claude --bg and the agents view refusing a folder that claude already trusts when its trust record was saved with different letter case
Probably background-session-workspace-trust-and-gate-blocked-reasons A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
The appended system-reminder blocks moved: 1 line added.
Claude Code, interactive mode
928 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 66 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?