You can now run gh api REST calls in sessions that do not have the GitHub CLI installed. Claude Code supplies its own limited gh and sends those calls through the session's GitHub proxy. A new command, claude daemon remote-control stop-shell, stops a background shell command running for a cloud session. Programs driving Claude Code can now read a background task's output with a get_task_output request. Compression of requests sent to the model is available through CLAUDE_CODE_GZIP_REQUEST_BODY_BLOCKS and is off by default. Admins can now set CLAUDE_CODE_TRANSCRIPT_LOCAL_GC through managed policy to turn on local transcript clean-up.
This build holds 7 things that are not switched on yet. Claude Code can offer to move you to a newer model, as a one-line notice or a dialog. A reworked way of saving your shell's functions, aliases and options for Bash commands is also in the code. Both stay off unless Anthropic turns them on remotely. Groundwork has landed for running the SessionStart hooks of plugins that load mid-session. None of this changes what you see today.
Remote sessions no longer forget their background tasks when they reconnect. A stalled live-update connection now times out and reconnects instead of hanging forever. Relaunching after /update now resumes your conversation even when Claude's last reply could not be saved. Messages from Amazon Bedrock guardrails now show up in the reply instead of going missing. A shell command that only names a web address is no longer escalated as if it touched a protected file path. /plugin-types is no longer listed among the command categories.
Written by our agent from the shipped bundle, not by Anthropic.
The /plugin help screen can show /plugin directory [query] for searching the Anthropic Directory in Discover
Claude Code now reads four new startup environment variables and passes them through to cloud sessions; they do nothing unless set
Sessions & agentsA new environment variable, CLAUDE_CODE_MCP_SERVE_TOOL_OUTPUT, appears alongside the other MCP server-mode variables
Claude Code can compress the requests it sends to the model in gzip blocks, controlled by CLAUDE_CODE_GZIP_REQUEST_BODY_BLOCKS and off by default
plugin install --replace explains that it needs a full plugin idRunning plugin install --replace without a name@marketplace id now says that id is needed and that nothing was installed
gh api stand-in for sessions without the GitHub CLITools & outputWant the reasoning? Read walks the 64 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →29 more of these are in What probably matters to you, on page 1.
With transcript cleanup on, Claude Code works out where to rewind using only messages after the last boundary
Unclear What turns the transcript cleanup option on is not known.
The panel listing this machine's hooks for a cloud session has shorter text and makes room for a section about plugin hooks
Unclear It is not clear what decides when this panel is shown.
Feedback after a skill proposal can now report that the skill was kept elsewhere, and this message comes before the unread or stale notices
Unclear It is not clear what situation counts as a skill being kept elsewhere.
Claude Code now checks network access before replying to an artifact comment, and refuses the reply when it is off
Unclear Exactly what the network check looks at is not known.
When an organization network policy covers a session, artifact tools now refuse to post or fetch and explain that network access is off
Unclear What decides whether the organization policy applies to a session is not known.
For remote background commands with a task id, Claude is now told which tools to use to check and stop them, and not to use pgrep, pkill or kill
Unclear It is not clear what condition decides when the new message is used.
In remote sessions, project environment variables supplied by served settings can now be held back and not applied
Unclear It is not clear what condition decides whether the variables are withheld.
In a new mode, a SessionStart hook from a plugin loaded after the session began has its initial user message ignored, with a warning
Unclear It is not clear what makes Claude Code run hooks in the newly-loaded-plugins mode.
Directory plugin installs must now match the reviewed commit and recorded repository, or Claude Code refuses them
Unclear It is not clear what switches on installs from the plugin directory.
Claude Code now shows when a call is waiting for a disconnected peer to come back, has stopped waiting, or has given up
Unclear It is not clear what switches this waiting on or how long the wait lasts.
Claude Code can now ask for your approval before a message goes to another machine, even when isolatePeerMachines is off
Unclear It is not clear which part of Claude Code turns on the always-ask option, or when.
A tool call moved to the background can no longer ask you a question later, and headless sessions can move tool calls to the background
Unclear The extra check that lets non-interactive sessions detach tool calls is not described, so it is unclear whether headless detaching actually takes effect.
Scheduled tasks that are not running now say the session doesn't recognize this machine as trusted, and to start a session from it
Unclear It is not clear where this message is shown or what marks a sender as unverified.
The SendFile tool's permission check and approval flow were reworked, and refusals with a known reason are reported in one shared way
Unclear What difference this makes to the approval prompts you see is not clear, nor whether the tool is switched on for everyone.
When auto mode approves an action that only you can approve, Claude now retries once and then stops and tells you it needs your approval
cleanupPeriodDays now also clears old files in .claude/state/served-calls#Claude Code now deletes old files under .claude/state/served-calls after the number of days set by cleanupPeriodDays
Unclear It is not clear whether the served-calls files existed before this release or what they record.
Shell commands in remote-served sessions now keep a live tail of their output, skipped when PostToolUse hooks or tool.call handlers exist
Unclear When this behaviour is switched on is not known.
Claude in Chrome's file_upload is now refused in sessions with no disk, alone or inside browser_batch, and Claude asks you to pick the file
Unclear Exactly which sessions count as having no disk is not known.
A rewind_conversation request that is refused or loses a race now re-queues the messages it dropped, and keeps tool calls running in the background
Unclear It is not clear how much of this a person using Claude Code will notice, or whether any of it is switched off by default.
Plugin checks now give an error for names that start with claude-, anthropic- or similar, and a warning for looser look-alikes
Unclear It is not clear whether installing a plugin from a marketplace also enforces this, or only validation, tagging and loading from a path.
Plugin install and uninstall failures now report specific error codes, and --config is skipped when an install changed nothing
Unclear It is not clear whether the name matching and new failure codes are switched on for everyone.
A built-in request asking Claude where a session's tokens went now groups usage by source and asks for a chart with caveats
Unclear It is not clear how this request is reached or which of its parts differ from the earlier version.
Remote turns now hold the machine awake, and a remote send-now request can stop a running turn when messages are queued
Unclear It is not clear what setting, if any, controls the keep-awake hold.
Background commands that cloud sessions start on your machine are now recorded, listed, capped and can be stopped with a new command
Unclear It is not clear what decides whether this feature is available.
Installing a plugin's dependencies now fails for yarn or pnpm lockfiles, a binary bun.lockb, or when npm or bun is missing
Unclear It is not clear whether this check runs on every plugin install.
Artifact previews now share a Chrome browser kept open for a while and reused, instead of launching and closing Chrome for every preview
Unclear How long the shared Chrome stays open while idle, and how long a preview waits for it to start, is not stated.
The plugin browser now shows a plugin listed in several marketplaces once, notes the other listings, and hides copies of plugins you already have
Unclear It is not clear which marketplace's listing is kept as the main entry when duplicates are merged.
A PDF returned by an MCP tool can now be handed to Claude as a document, and only the first PDF in a result is kept
Unclear The size limit's value is not known, and if it is zero, PDFs would never be passed directly.
An MCP server can now hold back all its tools from loading up front, and more MCP tools can count as safe to run in parallel
Unclear It is not clear what marks a server as deferring all its tools or a call as allowed to overlap.
If the device hooks away notice fails, Claude Code now reports the failure and uses the default notice
Unclear It is not clear where the away notice is shown.
In some cases the propose_skills tool now returns an error asking to try once more if it cannot check a proposal
Unclear What turns this mode on is not known.
In the design login dialog, the box for pasting your code is now focused and shows a cursor
When publishing a design, Claude is now told to write each file directly instead of through a shell step or a generating script
The description of the built-in cc-plugin-sec-default@builtin plugin no longer mentions wherever hooks modules can load
Unclear It is not clear whether the plugin now applies in different places or only its wording changed.
Claude Code now withholds environment variables set by a served folder that nobody has trusted
Unclear It is not clear what a served folder is in practice, what triggers this filtering, or whether it is switched on for everyone.
Artifact tool guidance now says SVG images copy when you publish, while HTML and XML documents still do not
Unclear It is not clear what decides when the "writes still work" wording is dropped.
Switching permission mode is now checked against the latest state, and is refused instead of applied if things have moved on
Unclear It is not clear which of the ways you can change permission mode go through this check.
Replying to a job whose session is still starting now fails with ERESPAWNING instead of ENOREPLY
A check that looked for images in a tool's output now also counts document blocks, such as PDFs
Unclear It is not clear which parts of Claude Code rely on this check, so the practical effect is unknown.
Opening a preview in Chrome now closes leftover tabs first, treats a closed tab as an error, and cleans up after itself when it stops
Unclear It is not clear where this preview is used or whether it is switched on for everyone.
With managedInstructionsOnly, CLAUDE.md files pulled in by a file opened in your IDE are filtered to Managed entries too
A plugin turned on by managed settings is treated as organization-managed only if its marketplace source matches what those settings declare
Unclear It is not clear what information Claude Code compares when it decides whether a plugin's source matches.
On macOS, Claude Code now checks one more condition before it stops the computer from sleeping
Unclear It is not clear what the new condition checks or whether sleep prevention is now off unless turned on.
The hint offering a newer version of your saved model now clears when you start typing and is not redrawn over and over
Unclear The exact conditions that decide when the hint can show again are not clear.
A marketplace add can now be refused if its name or clone folder matches one in extraKnownMarketplaces with a different source
Unclear It is not clear which ways of adding a marketplace turn the name-clash check on.
When ExitWorktree returns you to your original folder, it now moves the saved state of background sessions there too
On Windows, Claude Code now warns that a Bash deny rule also removes the PowerShell tool, leaving Claude with no shell
Unclear One further condition for showing the warning could not be identified.
Dependencies from one particular marketplace now check version ranges and warn when they could not be installed, with the reason
Unclear Which marketplace this applies to, and when --filter=tree:0 is still used, is not known.
When Claude Code streams structured output for the SDK, some messages can now wait until the start-up message has gone out
Unclear What causes a message to be held back is not known.
Plugins whose source is the plugin directory are now labelled 'Built in' instead of 'Unknown source'
Unclear It is not clear where the new catalog, switch and toggle names are used.
Replies to a background session now go straight to the session when its worker is new enough, and refusals are logged with a reason
Unclear It is not clear which worker versions qualify for the new route.
When a session is set up, Claude Code's first reply now waits, up to a limit, for the session's start-up work to finish
Auto mode now tells Claude when a PreToolUse hook rewrote a call, so it can retry once and then explain the cause to you
Unclear It is not clear what condition triggers the repeat-once message.
CLAUDE_CODE_TMPDIR#When a cloud session cannot store a verified hook copy safely, the error now explains what is blocked and suggests setting CLAUDE_CODE_TMPDIR
Claude Code can now show a dimmed line saying something is blocked by your organization
Unclear It is not clear which features this notice is shown for.
A Bash command marked as starting outside the project is no longer put back in the default working folder
Unclear It is not clear when a command is marked as starting outside the project.
When you name a skill in a prompt you typed, Claude Code now attaches a note listing the skills you named
Unclear It is not clear what the further check tests, or whether the note is meant to push the model toward using the named skills.
Claude Code now stops offering tips after you type past several of them in a row
Unclear It is not clear how many tips you have to type past before they stop.
The approval dialog for a held message from another session now shows the message body in its own labelled block
/plugin now shows whether this machine's hooks run in cloud sessions#/plugin now shows whether hooks from this machine run in cloud sessions, and project environment variables are flagged as not applied there
Unclear The name of the hidden settings-review command is not known.
When Claude proposes replacing an existing skill, it is shown that skill's current SKILL.md with line numbers first
Unclear It is not clear whether any tool uses this yet.
The check for automatically running commands in the background has dropped two conditions and replaced its non-interactive test
Unclear It is not clear what the new check tests or what the removed conditions covered.
Plugin screens now explain why components are hidden when a marketplace is off or unavailable, and work out what switching a plugin copy would replace
Unclear It is unclear what turns a marketplace off and whether the plugin-switching offer can be reached by users yet.
Unauthenticated requests for the public plugin directory catalog are no longer blocked by the essential-traffic-only or data-residency checks
Unclear It is not clear which parts of Claude Code send these public catalog requests.
The usage-data event recorded when you send a prompt now gets its prompt fields from a different step, so its contents may change
Unclear It is not clear which fields the event now contains.
On Bedrock and Vertex, Claude Code now skips models flagged as unavailable when checking upgrade and fallback options
Unclear How Claude Code decides that a model is unavailable is not shown.
In headless cloud sessions, the reconnect timer can now pause while Claude is waiting for your answer, with a notice saying so
Unclear What turns the hold setting on is not stated.
A new message says when a model was skipped for a check, fallback or upgrade because managed settings do not allow it
Unclear Where this message is shown is not stated.
When a tool call is refused by the safety check, Claude is now told to retry once, then stop and tell you the tool needs your approval
Auto-update for the official plugin marketplace is now read only from user, --settings and managed settings, not from project files
Unclear It is not fully confirmed which built-in marketplace entry this applies to or the exact condition that triggers it.
The diff pane now gets changes for many files with one batched git command instead of one per file
Unclear Whether the diff pane is available to everyone or behind a switch is not shown.
When a serve-only connection drops, Claude Code now tries to resume it instead of ending the session straight away
Unclear What a serve-only connection is and how the resume attempt works are not shown.
--cloud stops early when it would need a keyboard it can't read#If --cloud would open a session in your terminal but there is no keyboard to read from, Claude Code now exits with an error before creating it
Unclear The exact conditions that decide when the session would stay open in the terminal are not clear.
On Vertex, Claude Code's list of fallback models now leaves out models that fail a check, and Opus can fall back to Sonnet
Unclear It is not clear what the check on each model tests.
A reply to a background session on a different Claude Code version now goes only through a direct connection or is refused
Unclear Exactly what the version check tests is not known.
Claude Code now records each retry of a remote MCP server that failed to connect, and uses servers that recover as soon as they connect
Unclear It is not clear what the wait between retries is now tied to.
Several pending permission prompts can now be open at once, ordered, with the top one shown; status lines also gain output notes
Unclear It is not clear what you see differently when several prompts are waiting.
In stream-json mode commands_changed is sent only when the command list changes, and SDK MCP servers are closed on removal, replacement or disable
Unclear What causes the message to be held back is not known.
The screen-reader select now says 'Nothing to select', accepts empty submits, can hide its prompt while disabled, and the rewind dialog uses these
When a hook cannot run for a cloud session, Claude Code now says why in plainer words and how to fix it
Plugin hook modules can no longer use dynamic import or export then, and more unsafe values are refused
Unclear It is not clear whether plugin hook modules are switched on for every user.
The warning for an output schema that would not convert now starts with "tool types:" and reports the actual error
Project hooks served remotely now use a temp folder only if it lies outside what the session can write, and log a specific error if none does
Hooks in cloud sessions now get specific labels such as "is not sent to the cloud" in place of the old "stays local"
When an organization's policy blocks a plugin marketplace, the error now carries a reason code and can say the directory was disabled
Unclear It is not clear exactly when the directory-disabled note is attached or how it is worded on screen.
Command hooks sent from a cloud session to your machine now run in a private folder or are refused if there is none
claude plugin marketplace remove now turns off affected plugins first, and plugin settings and secrets are copied when you switch plugins
Unclear It is unclear whether the built-in plugin directory marketplace is actually in use in this version.
Shell snapshots now copy their helper commands using the shell's own built-in commands, and fall back to cat only when the shell cannot
Unclear It is not clear what decides whether the built-in method or the cat fallback is used.
Replying to or resolving an artifact comment now stops with a message, posting nothing, when Claude Code can't tell if the page keeps its own threads
Unclear What causes the comment-thread check to fail was not stated.
A sandboxed project hook now runs only if Claude Code confirms it is a deny-by-default sandbox launch; otherwise it is skipped and an error is logged
If a comment reply fails and network access is off, Claude is told not to retry and to point you to the artifact's own page
Unclear It is not clear which tool shows this message or how often it is reached.
A cloud session that was not recognised as a cloud launch at start-up now exits with an error before doing anything
Unclear It is not known what the start-up check examines or what normally marks a launch as a cloud one.
On Windows, paths like /c/... or /cygdrive/c/... are converted to normal Windows paths before Claude Code checks whether a write is allowed
Reasons shown when Claude Code cannot check a shell command ahead of time now say it 'cannot be checked in advance'
In screen-reader mode, Claude Code can reuse lines it already produced when the start of the conversation is cut
Unclear What triggers the cut, and whether this is switched on for everyone, is not known.
When a partial clone's on-demand fetch fails because the connection type isn't allowed, the error now explains why and names the address
Claude Code's secret-hiding rules can now catch a secret assigned inside text with backslash-escaped quotes, such as JSON nested in a string
Unclear It is not clear where this secret-hiding list is applied, for example usage data, transcripts or both.
In screen-reader mode, the view of file changes skips the formatted layout and uses a slightly narrower width
Unclear It is not clear how the text of the change is rewritten in screen-reader mode.
Marketplace names that pair Anthropic or Claude with words like official, directory or healthcare are now refused
Unclear It is not clear at which steps this check is applied.
Published verbatim by Anthropic for v2.1.287. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 106 bullets, 14 name something an entry on this page also names, 40 name something no entry here does, and 52 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
/plugin enable cc-plugin-you-should-know@builtin (for first-party sessions with telemetry on)
Probably plugin-types-removed-from-the-command-category-map, cloud-session-sync-and-memory-update-tweaks, plugin-background-update-failure-now-reported-for-anthropic, disabled-marketplace-notice, plugin-cloud-session-hooks-consent-display-and-project-sett, plugin-type-contract-now-laid-for-dependent-mods, plugin-types-generated-header-comments-reworded-mcp-types, plugin-screen-telemetry-and-marketplace-network-location-mes, plugin-not-found-errors-now-explain-removal-from-the-marke, plugin-marketplace-dedup-across-directories, plugin-types-removed-from-the-open-state-map-skill-folder, plugin-built-in-marketplace-can-be-turned-on-or-off, plugin-help-lists-a-new-plugin-directory-command, public-plugin-directory-search-and-marketplace-catalogue, plugin-install-replace-now-has-an-error-message-requiring, plugin-tip-advertise-enabling-the-you-should-know-side-ag, switch-installed-plugin-copy-confirmation-in-plugin, plugin-marketplace-community-managed-and-pinned-commit-deta n:<text> filter to the agents view that matches session names and tasks; a filter now shows matches in collapsed sections and Enter opens the first match
No entry names this prompt_text to the OpenTelemetry user_prompt event, a copy of prompt for backends that nest dotted keys; drop or mask it wherever you drop or mask prompt (anthropics/claude-code#70763)
Probably user-prompt-telemetry-now-built-by-a-helper-that-spreads-fie gh api (REST only) for sessions that use Anthropic-managed git on macOS and Linux machines where the GitHub CLI is not installed
Probably github-gh-stand-in-described-in-session-proxy-prompt, built-in-gh-api-stand-in-for-sessions-with-no-github-cli asyncRewake waking Claude over and over with "found issues" notifications when the hook's script file is missing; the broken hook is now reported once
Probably asyncrewake-hook-with-an-unopenable-script-reports-once #96087[BUG] Windows desktop (MSIX): plugin hook scripts invisible to externally-spawned interpreter — every hook ENOENTs and asyncRewake Stop hooks loop forever Open
#95727Desktop app: dangling plugin hook (security_reminder_hook.py missing) fires endless 'Background security review found issues' notifications Open
#96148[BUG] Failing asyncRewake Stop hook causes unbounded model re-wake loop (high token burn) Open
#94634[BUG] Security-guidance plugin hook file missing from session snapshot, causes repeated "No such file or directory" notifications Open
#92234[BUG] Broken security_reminder_hook.py plugin persists after reinstall Open
availableModels list, which could collapse /model to one Opus row
Probably managed-settings-denial-message-for-model-checks /model on a claude.ai login saving the current version's id, so your saved default now follows the newest Fable like Opus and Sonnet do
No entry names this /model, opusplan) rewriting earlier MCP tool announcements, which could drop earlier extended thinking
No entry names this rm (such as one on / or the home directory) losing its always-ask safeguard when the same command also redirected output to a ~ or wildcard path
Nothing to match on claude -p and SDK sessions repeating a model fallback on every later message after the model was switched while a reply was running
No entry names this claude agents after the agent exited and removed the worktree the session was started in
No entry names this /advisor pairing checks: Sonnet 5.5 can now advise Opus 4.7 and 4.8, and advisors the API would refuse are flagged up front instead of being silently dropped
No entry names this __proto__
Probably org-mcp-permission-maps-now-validated-and-null-prototype claude --teleport progress screen, and an MCP form field while it is being checked, to the screen reader again on every spinner frame
No entry names this CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS not removing the structured-output format from session-title and prompt-hook requests, which Bedrock-backed gateways reject
No entry names this --include-partial-messages sending a cut-short reply's message_stop late or never, so apps could show the reply as still in progress
No entry names this claude agents sometimes not showing the permission prompt a background session is waiting on
No entry names this /ultrareview giving advice about .git/info/attributes when the upload stops on a committed .gitattributes it cannot read, such as one saved as UTF-16
No entry names this claude remote-control failing to register behind an HTTP proxy with a misleading "Check your organization permissions" error (anthropics/claude-code#97352)
No entry names this #97352Remote Control cannot register behind an HTTP proxy: some requests are sent as absolute-URI instead of through CONNECT Closed
claude agents changing every second in screen reader mode; they now change at most every 10 seconds
No entry names this API Error: 401 instead of "OAuth token revoked"; in -p mode the error now starts with "Failed to authenticate"
No entry names this /ultrareview upload refusals advising you to copy a variable named by a repository's settings file into your own user settings
No entry names this --output-format stream-json and the SDK not streaming the turns of a context: fork skill run by typing /<skill> as the prompt, as they do for the Skill tool's fork
Probably strict-relay-post-added-and-skill-mention-attachment-type claude plugin marketplace add --sparse and git-subdir plugin installs failing with "transport 'http' not allowed" when the repository is served over plain http
Probably built-in-plugin-directory-marketplace-add-remove-list-and #96134[BUG] Regression since 2.1.174: plugin installation from HTTP marketplace fails with "fatal: transport 'http' not allowed" Closed
--plugin-url download corrupting the session's cached copy of the plugin archive
No entry names this /desktop quoting partial output when opening Claude Desktop timed out or printed too much output; the error now names the cause
No entry names this claude remote-control stopping mid-turn when the Mac went to idle sleep
No entry names this claude hanging or crashing with "Raw mode is not supported" when its input is piped or redirected; it now says why and exits (use -p for piped input)
No entry names this CLAUDE_CODE_SKIP_*_AUTH sending a different Authorization header than real requests when ANTHROPIC_CUSTOM_HEADERS repeats it
Probably custom-headers-parsing-moved-to-shared-helper, self-hosted-remote-environment-and-custom-header-auth-parsin /config: settings that cycle show ‹ › and step both ways with ←/→, narrow terminals stack each value under its label, and PgUp/PgDn page the list
No entry names this /memory: the left and right arrow keys now flip its on/off settings, such as Auto-memory
No entry names this /skill names typed mid-message: Claude is now told they are skills, including disable-model-invocation ones
No entry names this ~ target too
Nothing to match on [1m] suffix (CLAUDE_CODE_DISABLE_1M_CONTEXT=1 keeps 200K)
No entry names this claude agents to arrive as queued messages; slash commands other than /stop sent while a turn is running now run when it ends
Probably remote-tool-calls-background-command-ownership-and-fleet-s Bash allow rules and allowing hooks to prompt for, not run, shell writes to files Claude Code's file tools refuse outright (the Anthropic profile store, the host credentials file)
No entry names this alwaysLoad: false to defer all of that server's tools behind tool search
Probably tengu-mcp-legacy-url-elicitation-default-flipped-to-true-mc CLAUDE_AX_PREPARK_MS=50 to restore the pause
No entry names this /usage or /context command opening the extension's dialog instead of running when picked from the command menu
Probably context-in-hosted-workers-omits-message-breakdown A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.286.
Claude Code, interactive mode
1187 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?