You can now rely on a built-in security plugin to keep your deny rules in force when other plugins try to lift them. It can also refuse plugins that did not come from your organization. Plugins can now build the system prompt themselves through a new prompt.compose hook, and Claude Code falls back to its own prompt if that fails. Setting CLAUDE_CODE_AUTO_MODE_TIER to any value, even "full", puts auto mode on its strict tier. With CLAUDE_CODE_ARTIFACT_SHARE set, Claude can share an artifact with your organisation or named colleagues after you confirm. A new notice offers a key, ctrl+y by default, to make a newer model your default.
This release has 16 entries in the build that are not switched on yet. On Linux, project hooks can run in a locked-down sandbox called bubblewrap, with no network and a hidden home folder. That sandbox waits on a server switch. Keepalive pings that hold a one-hour prompt cache open during idle pauses are also off unless switched on remotely. A background task for importing local memory notes is taking shape, with a "memory import" entry in the task list. Remote tool permission checks gain retries for timed-out safety checks, behind three switches.
Prompts rewritten by a hook on submit now reach Claude as rewritten. Resumed sessions restart interrupted turns by mistake less often. Resuming in --print mode with an SDK connection now always runs its cleanup step, even after a failure. The ultrareview details dialog no longer offers to open the review in a browser. Starting a remote session no longer sends file sync, folder seeding or sync consent options. The /plugin-types command is now hidden from command listings but still works.
Written by our agent from the shipped bundle, not by Anthropic.
Setting CLAUDE_CODE_AUTO_MODE_TIER to any value selects the "strict" auto mode tier, and it is passed on to processes Claude Code starts
The claude-test plugin now explains why it failed to start, gives new advice on duplicate copies, and drops its terminal-only message
ElsewhereA new early plugin sync step at startup runs only when CLAUDE_CODE_CCR_EARLY_PLUGINS_SYNC is set, and not in interactive sessions or with a proxy auth helper
ExtensionsA permission setting now accepts own_record for unattended sessions, and one more outcome now counts as stopped
A built-in plugin restores deny rules that other plugins lift, and can refuse plugins that did not come from your organization
Permissions & safety
/plugin-types no longer shows in the command listExtensionsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →9 more of these are in What probably matters to you, on page 1.
Claude Code now tracks when something was last active and whether a remotely set lifetime has run out; with no remote setting, nothing expires
Unclear What the tracker is used on, and so what would expire, is not known.
Claude Code gained internal event names for restoring and handing over a task list, plus support for one more kind of web request
Unclear Whether task-list restore is reachable in this build, and what it does, is not established.
Claude Code reads a new remote switch whose purpose is not known, and treats it as off when the server sends nothing
Unclear What this switch controls is not known.
4 more of these are in What probably matters to you, on page 1.
Claude Code now reads CLAUDE_CODE_CONFIG_PROBE, CLAUDE_CODE_ARTIFACT_SHARE and CLAUDE_CHROME_TAB_GROUP_KEY when it starts
Unclear It is not known what any of the three variables changes.
Code for sharing artifacts with other people appears, with outcomes such as consent and person checks, plus proxy refusal and cache keepalive names
Unclear It is not known what the list is used for, so whether these features are live is unclear.
CLAUDE_CHROME_TAB_GROUP_KEY is used only in remote sessions and then cleared#Claude Code now keeps CLAUDE_CHROME_TAB_GROUP_KEY only in remote sessions and removes it so programs it starts do not inherit it
The plugin test scan list now includes the SubagentStop hook and calls to connect to MCP servers and show toasts, and drops two calls
Unclear It is unclear whether this list limits what plugins may do or only describes it.
Startup requests in remote sessions now carry a creation time and a list of stream writers, and the remote client can react when the process exits
Unclear It is not clear what reads the new startup details.
Approvals that arrive through a relay and are confirmed as genuine are now labelled as relayed
Unclear It is not known where relayed sessions are turned on.
The skill, Chrome and worktree editor commands now use one shared check before refusing to run from inside a Claude Code session
Unclear Whether the shared check uses the same conditions as the old CLAUDE_CODE_CHILD_SESSION test is not established.
Remote sessions now count dropped delivery acknowledgements and can confirm a flush, alongside MCP disconnect and remote diagnostics changes
Unclear Whether any of this has an effect a user can notice is not known.
The MCP connect path accepts dialInConnect and onDialStart, changing when --mcp-config servers connect; headless startup waits are now recorded
Unclear It is not clear what sets these options or how the timing changes in practice.
Claude Code now reads the API's cache_creation breakdown, tells 5m and 1h cache writes apart, and uses it for cache lifetime decisions
Unclear What the new fallback rule for the main conversation returns is not clear.
Claude Code's estimate of when the prompt cache expires now draws on usage figures from the last response
Unclear How the usage figures change the estimated cache lifetime is not known.
Error categories used for model-fallback suggestions and logging have new names, and running out of retry attempts is now logged too
Unclear It is not clear what reads these renamed categories apart from Claude Code's own logging.
Claude Code gained a few new internal names for logging and events, tied to model lists, prompts, MCP images and Chrome tab groups
Unclear What reads these new names, and what they lead to, is not known.
The filter that picks running agents now matches agents belonging to a given parent agent, not only agents with no parent
Unclear It is not clear what a user will see differently on screen as a result.
Turn timing now splits out tool_pool_refresh, model_gates, request_build and redrive phases, and result messages carry new timing fields
Unclear It is unclear whether these timings are sent anywhere or only kept locally.
WebFetch approval prompts now track wait time, how many prompts were showing, and whether a subagent raised them; a redirect bug is fixed
Unclear It is not clear whether passing the open-prompt count to the approval prompt changes what you see.
memoryOps is no longer attached to transcript messages or merged into per-turn stats
Unclear Whether memory operations are now recorded somewhere else or dropped from these statistics entirely.
The internal timing for handling an SDK message now shows startup wait and waits behind earlier messages as their own steps
When a lock has no owner record, Claude Code now checks whether the lock file changed and reports that case separately
Unclear Which lock this check applies to is not stated.
Claude Code's internal lag check now records when work was first sent and what caused it to be sent again
Unclear It is unclear whether any of this is visible to you.
A freshness check now counts a saved item's age from the later of its save time and a second timestamp, not the save time alone
Unclear It is unclear what kind of item is being saved and what the second timestamp records.
Session state in headless runs now includes the messages in view, and a timer skips its timeout when none is set
Unclear What difference these make for users is not known.
The rule that lets Claude Code skip saving and announcing unchanged flag settings now depends on how it was launched and on policy, not a remote switch
Unclear It is not certain which launch mode and which policy setting the new conditions check.
Claude Code's logger now passes multi-line messages through an extra transform and applies a replace step to single-line ones
Unclear What the new processing actually does to log text is not known.
The environment a self-hosted runner gives the processes it starts gained an empty entry that adds nothing
Unclear What this entry originally was is not known, and it may simply be a build leftover.
Claude Code now registers a prompt.compose event alongside prompt.submit, prompt.fill and prompt.suggest
Unclear It is not clear what uses prompt.compose or whether plugins or users can reach it.
Listing skills now tells the sync when it runs at startup, and the plugin sync response can now carry a degraded status
Unclear The effect of the startup hint is unclear, and so is which of these calls the CLAUDE_CODE_SYNC_SKILLS environment variable controls.
Claude Code now removes a field called asUser from results that come from a plugin, and hooks accept one more output format
Unclear It is not clear what the asUser field did for plugin results, or what the added hook output format contains.
/plugin is now recorded#Actions in the /plugin menu now record which plugin was enabled, disabled or uninstalled and in which scope
Unclear It is not clear whether the record is usage reporting sent elsewhere or state kept on your computer.
A plugin install error code is renamed, a workflow option is renamed, and a new MCP startup usage event is added
Unclear What reads these names is not known.
The main plugin dependency install step no longer checks for a bunfig.toml before running bun, and now hands the install to a helper
Unclear It is not known whether the new helper still performs the bunfig.toml check.
Claude Code's check for version ranges now rejects some inputs outright before its usual checks run
Unclear Which inputs are now rejected.
Plugin messages can be marked as coming from the user, a chat key format is now validated, and MCP servers can be refused or removed on remote workers
Unclear It is not clear what switches these paths on or what the user-only flags change in practice.
Several internal pieces used by remote and bridged sessions gained new options, and trusted-device enrollment now identifies its client
Unclear What reads these new options and what difference they make to a user is not established.
The part of Claude Code that carries messages over a connection can now report when a message has been delivered
Unclear It is not clear what uses these new capabilities.
When a handed-off turn names the client platform it came from, Claude Code tags the first untagged user message as coming from a human
Unclear It is not clear which client platforms trigger this.
While Claude Code is shutting down, it skips reporting certain incoming events as received
Unclear Which kind of event is skipped is not known.
Claude Code now removes certain fields from some messages before forwarding them, leaving other messages unchanged
Unclear It is not known which fields are removed.
A request Claude Code sends to a remote server no longer includes the User-Agent header that names the client program
Unclear It is not settled exactly which request this is, though it appears to be the one that creates a remote bridge session.
When Claude Code loads MCP servers set by an organization, it can now filter them with a check before combining them with the rest
Unclear It is not known what supplies the filter or which servers it keeps.
Whenever Claude Code loads MCP server settings, at startup, on reconnect or when enabling one, it now passes an extra admission value
Unclear It is not clear what the new admission value allows or blocks.
A log message about an unreadable file now speaks of MCP servers in general, and a new remotely controlled switch appears
Unclear It is unclear what the new switch controls.
A cache upgrade step now catches its own errors, and MCP sign-in now tracks when extra re-sign-in attempts have run out
Unclear It is unclear whether either change is something you would notice.
Claude Code now remembers which protocol version an MCP server speaks for more server types, not only servers connected through claude.ai
Unclear It is not clear exactly which kinds of MCP server now have their protocol version remembered.
The rule that exempts MCP server policy denials in remote bypass-permissions sessions behaves the same as before
Commands waiting in the queue now carry a delivery ID, and a timeout report for SDK MCP updates gained a new field
Prompt submission messages now default to not waiting and to the session's origin, and can be marked as coming from the user
Unclear What sends these messages, and whether this is in use yet, is not known.
A queued prompt now takes the place of the earlier message it points back to, instead of sitting apart from it
Unclear What difference, if any, a user will see in the conversation.
Prompts taken from the queue are now marked as having waited, which may affect how their placeholder is shown
Unclear It is not clear how the screen uses this mark.
Claude Code now records whether a prompt was queued when it starts processing it
Unclear What changes for a user when a prompt is marked as queued is not established.
Messages you send while Claude is working are now wrapped by one shared step, which plugin messages marked as yours also use
Unclear Whether the wording the model actually sees for mid-turn messages changed is not settled.
if conditions now match differently for some plugins#A hook's if condition now checks whether a command hook comes from a plugin that is specially marked, which can change what the condition matches
Unclear It is not clear what marks a plugin for this treatment or who sets that mark.
While hooks are running, Claude Code now records the name of the tool they were triggered for
Unclear It is not clear which part of Claude Code uses the recorded tool name.
Your turns now carry a note of where the input came from, and hook progress entries now include the tool's name
Unclear What reads these new fields, and whether either shows up anywhere a user can see.
The hook status line now shows a hook run chosen for it, instead of looking up the latest one from the main conversation itself
Unclear It is not clear which run is now chosen or whether what you see changes.
One request Claude Code makes to Anthropic's API now includes a User-Agent header naming the program that sent it
Many of Claude Code's own network requests, including the web page safety check and sign-in lookups, now send a User-Agent header
Unclear The exact value Claude Code sends in the header is not stated.
Claude Code reworked how it spots rejected thinking display settings, and now processes tool results from workers before passing them on
Unclear What the processing does to tool results, and whether the error pattern itself changed, is not clear.
Claude Code records two new timings for attachments, and the hidden edit-hook command's refusal in child sessions now uses a shared check
Unclear It is not clear whether the shared check refuses in more cases than when CLAUDE_CODE_CHILD_SESSION is set.
Code that put a placeholder in place of an attachment that could not be downloaded now reads a server-controlled switch instead
Unclear What the switch does, and whether the placeholder text is still used anywhere, is not known.
Claude Code now counts delivered attachments and clears any earlier refusal of an attachment before handling it again
Unclear What changes for you in practice, and whether this is behind a switch, is not known.
After you reply to a comment on an artifact, Claude Code can now take a further step using the new reply's comment
Unclear What the extra step on the new comment actually does.
The artifact database tool was rewritten internally but behaves the same
Unclear A small behaviour change inside the rewrite cannot be completely ruled out.
The checker behind auto mode now builds its deny rules from one set, records how its template was chosen, and reads tools differently
Unclear It is not clear what switches these changes on or how much of them you would notice.
The two-wording experiment in auto mode's safety check has ended, and the classifier now always uses a single wording
Unclear It is not stated which of the two wordings was kept.
When starting a background task fails, the report Claude Code records now includes what blocked it
Unclear The possible values of the new cause are not known.
A session whose latest content starts with a request for your approval can now be reported as blocked
Unclear It is unclear where this blocked status is shown to you.
Claude Code's tracking of Cowork memory now records the version a memory write expects and keeps each memory path's latest version across turns
Unclear It is unclear what switches this on and what uses the recorded versions.
Claude Code's usage records now count memory writes but no longer list each individual write, outside team memory
Unclear It is not clear what the list that gained task_message_user is used for.
Claude Code's global config gains a new key, savedModelSuccessorShown, stored alongside the records of notifications already seen
Unclear It is not clear how or when Claude Code sets or reads this key, or whether any notice is shown to users because of it.
The model list shipped inside Claude Code moved from version 1330 to 1400, with new issue and expiry dates
Unclear Which model entries changed between the two versions is not known.
The rules that hide key, token, password and Bearer values in logs are now supplied by each part of Claude Code that uses them
Unclear Which patterns each part of Claude Code passes in, and whether any hide less than before.
The step that hides tokens, keys and passwords in text now uses shared patterns instead of its own inline ones
Unclear Whether the shared patterns match exactly what the old inline patterns matched is not known.
Claude Code labels and groups each part of its system prompt, and a new detached mode skips a setup step; the prompt text is the same
Unclear What the labels are used for, and what makes a session detached, is not known.
Three usage reports sent while splitting the system prompt now fire only when the calling code does not ask to skip them
Unclear It is not clear which parts of Claude Code ask to skip these reports.
Claude Code can now compare two versions of a changing schema and label the difference, such as text only or new live additions
Unclear What the comparison and prompt.compose are used for is not clear.
Comparing recorded tool definitions now gives a more detailed result than yes or no, and an error during the check is caught
Claude Code can now strip prompt previews and step titles from workflow events and replace their errors with a withheld notice
Unclear What causes a workflow's details to be withheld is not clear.
The workflow check for agent output formats that can never be met behaves the same as in the previous build
The footer no longer offers an entry or hint for opening session memories
Unclear It is not clear whether session memories can still be opened some other way.
Starting a remote session no longer sends the file sync, folder seeding or sync consent options it used to
Unclear Whether folder sync for remote sessions still happens some other way.
A check that used to ask the server whether to turn on a feature now always answers off, so no server setting can switch it on
Unclear Whether this check is the one that chose between file-based memory and memory tools, or guards something else.
The footer hint line lost its click action for opening session memories, while its action for opening artifacts stays
Unclear Whether session memories can now be opened from somewhere else instead is not checked.
One of the ways Claude Code displayed memories it had read in the conversation has been removed
Unclear It is not clear under what conditions the removed display used to appear.
The row of selectable items in the footer below the prompt no longer includes a memories item
Unclear It is not clear whether the memories item moved somewhere else or was removed entirely.
Claude Code no longer counts memory writes in its tool summaries, and a memory session viewer name is dropped from an allowed list
Unclear It is not clear whether this changes anything you see on screen.
Published verbatim by Anthropic for v2.1.286. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 88 bullets, 14 name something an entry on this page also names, 16 name something no entry here does, and 58 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude --resume and --continue sometimes losing every turn after a batch of parallel tool calls when the earlier session crashed or was killed
No entry names this /login succeeds in another Claude Code window when a leftover ~/.claude/.credentials.json exists
Probably auth-source-classification-changed-login-managed-key, ultrareview-stop-message-and-other-small-changes, oauth-provider-docs-tls-and-client-guarantees-text-updated claude remote-control) staying connected after your organization's policy turns Remote Control off; they now disconnect with a notice
Probably remote-control-tears-down-when-org-policy-starts-refusing-it --fallback-model retries failing when the fallback model can't run fast; they now run at standard speed, with a one-time notice in interactive sessions
No entry names this claude auth status reporting a Console sign-in's stored API key as claude.ai; it now reports api_key, and the VS Code extension treats that session as an API key session
Probably auth-source-classification-changed-login-managed-key, mcp-discover-prior-tracking-generalized-beyond-claudeai-prox /status listing an Anthropic profile beside an API key as if both were in effect; the profile is now marked as not in use
No entry names this ), quotes, ], & or a second @, or that runs past a / to a bracketed host such as [::1] in an ssh URL
No entry names this /feedback saves to disk containing invalid JSON lines after secret redaction
No entry names this /usage not crediting an MCP server for a tool call made while that server was still connecting or had only just connected, such as right after a restart
No entry names this /compact, /clear, and /rewind typed while viewing a background agent's or teammate's transcript silently acting on the main conversation: a dialog now names the target and asks first
Probably agent-view-slash-commands-compact-clear-rewind-now-prom, fallback-model-switch-warns-about-a-smaller-context-window #97857[BUG] `/compact` typed inside the subagent view compacts the main conversation instead Open
/plugin's Discover tab showing a marketplace name unquoted in its "Checking … for new plugins" line when its rows already show that name in quotes
Probably hook-descriptions-reworded, plugin-installenabledisableuninstall-in-plugin-ui-now-re, claude-test-plugin-conflict-message-and-runner-rewritten, plugin-types-command-hidden, you-should-know-builtin-plugin-side-agent-suggests-things verify, Claude is now told to run it right before committing, except for docs-only and tests-only commits
Nothing to match on /hooks: the closing line of a hook's detail screen now says "this hook" instead of "it"
Probably hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks -p sessions when a host re-sends an MCP server enable for a server that is already connected
Nothing to match on /protocol: it now says not to reject unknown input and matches what Claude Code sends today
No entry names this --bare to connect only the MCP servers named on the command line, send the model no system reminders, and start no background tasks; under --bare, a shell command that reaches its timeout now stops instead of moving to the background
Probably bare-sessions-refuse-plugin-toolregister /artifacts, /mcp, /skills, /hooks and others) to always line up each row's details in one column after the names
Probably mcp-oauth-tool-reuses-an-in-progress-sign-in, mcp-reconnect-and-ccr-diagnostics-additions, hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks /hooks to open on one list of your configured hooks grouped by event, so viewing a hook takes one Enter instead of three
Probably hooks-dialog-now-opens-on-a-flat-list-of-configured-hooks /exit's Remove worktree to run after Claude Code stops the servers and shells it started there, which on Windows could keep the folder from being deleted
No entry names this claude-api skill's Managed Agents examples to create environments with limited networking
No entry names this /ultrareview and claude ultrareview output
Probably ultrareview-stop-message-and-other-small-changes, stop-ultrareview-dialog-uses-confirmcancel-control-with-key, ultrareview-detail-dialog-drops-open-in-browser-and-shows, ultrareview-launch-message-can-say-findings-arrive-in-the-se claude --bg and the agents view refusing a folder that claude already trusts when its trust record was saved with different letter case
Probably background-session-workspace-trust-and-gate-blocked-reasons A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
The appended system-reminder blocks moved: 1 line added.
Claude Code, interactive mode
928 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 66 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?