You can now hold project settings changes made from a cloud session until you approve them, by running claude apply-project-settings in that folder. This applies when your computer serves the cloud session. Admins can force unattended serving off through managed settings with unattended_serving_off. Resumed sessions no longer keep the prompt cache warm unless the new resumeTouches setting is on. Claude Code's own stand-in for gh, added last release, can now reach any GitHub Enterprise host when ghesHosts is set to "any". Host apps can block file writes in chosen folders, except inside one declared worktree.
A /restart command that keeps your session is in this build but not switched on yet. It also answers to /update and offers newer versions. A shortcut that answers some artifact edit requests with direct file edits is also off for now. Cloud sessions can hand finished file writes to the next turn's worker, but only once that is switched on remotely. A setup guide feature is wired into the prompt box but does nothing yet.
An oversized reply from an MCP server over HTTP now fails only that request and keeps the connection open. Language server requests now time out instead of waiting forever. Reads and rewrites of a session transcript now wait for each other, so compaction and resume cannot clash. Resumed teammates no longer bring back an agent type that a rule or plugin now blocks. The Read tool instructions no longer include the guidance on PDF page ranges.
Written by our agent from the shipped bundle, not by Anthropic.
An rm hidden in a bash -c script with a run-time target now needs explicit approval, with CLAUDE_CODE_DISABLE_INLINE_SHELL_RM_PROMPT to turn it off
When your computer serves a cloud session, changed project settings are held back until claude apply-project-settings, and user settings can only tighten
Two new environment variables let an embedding app block file writes inside chosen paths, except inside one declared worktree
Tools & output
claude mcp serve lists agent types and blocks background agents in restricted modeclaude mcp serve now offers custom subagent types, and new switches can block background-agent launch and remote isolation, used in its http mode
The agents fleet view adds find and jump-between-groups actions, and its keys, including rename and set group, can now be rebound
Sessions & agentsWant the reasoning? Read walks the 53 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →16 more of these are in What probably matters to you, on page 1.
Plugins are now refused network access when CLAUDE_CODE_EVAL_CONFINED is set, and a message says the session's credential is withheld
Unclear Which sessions count as being in the mode that gets the credential-withheld message is not known.
ANTHROPIC_DEFAULT_SONNET_MODEL#If ANTHROPIC_DEFAULT_SONNET_MODEL names an excluded model, auto mode's classifier uses the Sonnet 5 default and logs the reason once
Unclear Which models are on the exclusion list is not stated.
When a permission check fails with an error and a certain option is set, Claude Code asks for your approval instead of passing the action on
Unclear What sets this option is not stated, so it is unclear when it applies.
When pulling shared team memory partly fails, Claude Code now logs how many files failed and keeps them queued for the next sync
When a conversation grows too long for auto mode's checks, Claude is told which actions did not run and to issue them again
Unclear What triggers this reminder and whether anything controls it is not established.
Notices about held or expired messages between sessions now say plainly they were not delivered and explain why
Unless a launch-folder policy allows them, settings such as enabledPlugins and modelOverrides from the launch folder are now removed
Unclear It is not clear what sets the policy that decides whether these settings are kept or removed.
When subagents are nested as deep as allowed, the Agent tool is taken away from the next one, even if its definition asks for it
Unclear The depth limit is not stated, and it is not clear where the record that the tool was withheld shows up.
Auto mode's classifier floor can now take effect even when the automatic checker cannot run, which it could not before
Unclear It is not clear what the classifier floor does to a tool call when the classifier cannot run.
An artifact's database now refuses writes with a specific error when its total stored size hits the limit, including when a document grows
When two machines try to host the same Remote Control session, one can now follow the newer one or step down
Unclear It is unclear what decides which of these paths runs, or whether this tracking is active.
Approving Claude's plan to leave plan mode now switches the session to default permission mode, and the mode indicator shows an "on" hint
Unclear It is not clear what the busy state for slash commands changes for you in practice.
If sign-in succeeds in the browser but your credentials cannot be stored, login now shows a dedicated screen explaining what happened and what to do
Unclear It is not clear when the Escape hint to continue without logging in is shown.
The updater now checks the installed claude runs, fails with native_binary_missing if it is only a stub, and shows clearer failure hints
Unclear Where this failure category is shown to the person installing is not stated.
Side queries now retry without the structured-output format when the API rejects output_config.format, and new helpers recognise PDF and format errors
Unclear It is not clear what check now decides whether the format is requested at first.
Errors for headless cloud sessions now name the flag you used, --cloud or --environment, instead of always saying --environment
Unclear The exact wording the errors now use in each case is not known.
Chrome tool permission prompts now carry the client platform, the granting rule and classifier status, and settings rows can show a short notice
Unclear Whether these details are shown to you anywhere is not established.
Cleanup of unused Remote Control placeholder sessions now keeps connected sessions and checks title, use and server state before archiving
Unclear It is unclear what records that a placeholder session was used.
The cannot-install message for blocked plugins no longer says you need a direct Anthropic API connection, and always says the plugin is unavailable
Unclear It is not clear whether the requirement itself was removed or only the wording about it.
The idle tool now tells Claude that "(no pending events)" means only that nothing arrived on that call
After sending a message to another session, Claude is told it sits in that session's inbox, not yet read by its Claude
Messages about hooks that can't run in a cloud session were reworded, and a failed plugin hook on another machine is now logged as an error
Unclear It is not clear how widely hooks in cloud sessions are available.
If hooks modules are off because of a saved remote switch, the error now suggests starting claude once with network access
The skill for running tests now describes itself as "Run tests on this machine (local)", with its longer text moved to when-to-use guidance
The status line can show a paused-workflow message, themes get an auto-accept shimmer colour, and hosts can no longer send one task message
Automatic replies to artifact comments now count as declined by auto mode when its safety checker is unavailable, and can show the decline notice
Unclear It is not clear what the server-side check involved here does, or which setting controls this path.
The Poll tool now records how each use ended, and refusing it outside the main conversation shows "Poll refused for this agent"
The Claude in Chrome permission dialog can now show a dimmed notice naming the site, above the answer options
Unclear It is not clear in which situations the notice is shown or exactly what it says.
Read, Edit, Write and NotebookEdit now refuse a file path that ends in white space once . and .. are worked out
Failed MCP tool calls now say if the response passed the size limit or the connection closed, and warn the tool may already have run
A script hook whose JSON output is badly formed is now recorded as its own failure, and exit code 2 still blocks
Unclear It is not clear whether the message you see when a hook's output is badly formed changed.
Pasting a link into the prompt box can now show it as a placeholder even when it is short, with a space added before your next paste
Unclear It is not clear which links qualify, for example whether only GitHub links do.
If you don't answer a permission request for a URL in time, it is withdrawn and Claude is told a retry will ask you again
Unclear It is not clear which tools or situations use this message.
In bare mode, /login now prints an explanation instead of a sign-in that would have no effect
If the current model cannot accept a whole PDF, Claude Code now attaches the PDF as a reference instead of sending the entire file
Resent or unchecked home-file announcements now do nothing, scheduler lock release has a fallback folder, and Ctrl+C copy changed
Unclear The purpose of each change, and what the extra Ctrl+C action does, is not clear.
Permission prompts for a domain that is already allowed no longer offer an 'always allow' choice
Unclear It is not clear where Claude Code decides that a domain is already allowed.
When an auto-update fails, the status line now says why and suggests running claude doctor
Unclear It is not clear which reasons Claude Code can show.
Filling in a plugin's ${user_config.*} placeholders can now leave an unset option as written instead of always failing; failing is still the default
Unclear It is not clear which parts of Claude Code use the new mode that leaves unset options as placeholders.
If an installed plugin's marketplace entry cannot be found, Claude Code now looks the plugin up in the plugin directory instead
Unclear It is not clear exactly what the new option for loading only missed listings does.
When Claude edits or writes a local file, Claude Code now records the file's path for loading memory files in nested folders
Unclear It is not confirmed that this causes nested CLAUDE.md files to be loaded after an edit.
When the last reason to keep a finished agent around is released, Claude Code now clears its stored context
Unclear It is not clear which kinds of agent tasks this affects.
If the server keeps rejecting Remote Control's credential within an hour, Claude Code pauses reconnecting, warns you, and says why it stopped
Unclear How many rejections within an hour trigger the pause is not stated.
An MCP tool result that is too large, or a connection that closes for a recognised reason, now raises its own error instead of looking like an expired session
Unclear Which close reasons count as recognised is not stated.
The review skill's cap on how many findings it reports is now a setting with defaults of 4, 10 and 15 by effort level
Unclear It is not clear whether anything passes a limit other than the defaults.
An MCP reply too large or unreadable to accept now gets a new error telling Claude the tool may have run, and no automatic retry
Unclear It is not clear exactly which MCP calls can raise the new error.
Claude Code no longer sends its idle notification while background agents are still running, and restarts the idle timer once they finish
Unclear What the idle notification shows you, and exactly which helpers count as background agents, is not known.
A reply stopped while a tool call waited for permission now finishes with the reason aborted_tools and a count of queued turns
Unclear When this result is produced is not established.
Resuming a session now checks the saved model before using it, and a saved "default" resolves to the current default model
Unclear It is unclear where the logic for restoring a model after a refused launch model is used, so its effect is unknown.
Claude Code now checks the data it sends to a hook against a size limit and reports an error instead of sending an oversized payload
Unclear The size limit and the list of events that now stop with an error are not known.
A new check allows cd <dir> && read-only command without asking when the folder is a plain path, reads stay in allowed paths and output goes only to /dev/null
Unclear It is not known whether the new allow check is used yet.
Sending a message that interrupts Claude now only stops a turn that is still running, and later transcript messages are marked as following that cut
Unclear It is not clear whether the new marking changes anything you can see in the transcript.
A new light purple theme colour for an auto-accept shimmer effect sits next to the existing auto-accept colour
Unclear It is not clear where the new colour is shown.
Accepting a plan with auto mode or a kept-context mode now shows a lasting notice naming the mode that is on
Unclear The exact text shown for each mode is not confirmed.
Claude Code no longer suggests a command prefix for a permission rule when it is shorter than that command's minimum length
Unclear It is not known which commands have a minimum or what each minimum is.
When auto mode in a cloud session asks you instead of approving on its own, the prompt now explains why
Unclear It is not clear what turns on auto mode's handling for cloud sessions.
Claude Code now clones a [email protected] address over HTTPS when SSH is clearly not configured, and retries with SSH if HTTPS fails
Unclear It is not confirmed which clone paths actually use the new fallback.
A keypress now clears held screen-reader announcements and redraws the screen, and right-click copy first removes the current selection
The error for an oversized server response now says the server streamed more than a set number of MB, so the response was not read
Claude's instructions for the Bash tool no longer say how timeout limits a command running in the background, or what happens at that limit
Unclear It is not clear whether the actual timeout behaviour for background commands changed, or only the instructions.
Claude Code's error for a failed plugin task the plugin never waited on is now shared and can be reported from more places
Unclear It is not clear whether the additional places that produce this message are actually reached.
The Interrupted line now leaves out its extra detail when the interruption came from send now
A new option lets the shell command checker accept unquoted heredocs that only use simple variables instead of flagging them as too complex
Unclear It is not clear whether anything in Claude Code turns this option on.
When the GitHub proxy fails, Claude Code now tells a refused connection apart from one that could not open, and suggests one retry for the second
Uninstalling a plugin now checks links and symlinks before reading the settings file, and reports why it refused to read one
Unclear It is not clear what a user sees when a settings file is refused, beyond the logged message.
If fetching a plugin marketplace from GitHub fails over both SSH and HTTPS, Claude Code now shows one error that covers both attempts
Unclear It is not clear when Claude Code switches from one transport to the other.
When usage credit requests are not allowed, Claude Code now says they are turned off for your organization
The medium and high review effort labels dropped their "≤8 findings" and "≤10 findings" endings
Unclear Only the label text changed visibly, so it is unclear whether the limit on findings was removed as well.
If a directory fails to load, the plugin list now says no plugins will show until it loads
Unclear It is not clear which directory the message refers to.
A plugin pinned to a commit must now give the full 40- or 64-character hash; short hashes are rejected
If Claude Code cannot write a change to its config file, it now says nothing changed and asks you to check the file can be written
Unclear It is not clear which actions show this message.
Marketplace, plugin, login and auto-mode CLI commands now finish recording their result before exiting, and marketplace update notes skipped built-ins
Unclear It is not clear whether you see anything when marketplace update skips a built-in directory.
The Brief tool rechecks attachments when it runs, and agent definitions from untrusted folders are now skipped entirely
Unclear Whether the skipping of untrusted-folder agent definitions is reachable in this build is not known.
claude update#A document that needs a newer Claude Code now fails with a message naming the versions and telling you to run claude update
Unclear Which kind of document this applies to, and how the message differs from before, is not known.
Device attestation now rejects certificate chains that run too long, end in an authority certificate, or name the wrong issuer
Unclear Where in Claude Code this check is used is not stated.
Without the interactive screen, Claude Code finishes the previous turn's end summary before starting the next queued command
Unclear It is not clear whether this makes any visible difference to someone using headless mode.
When a cloud session blocks a command editing Claude Code settings, Claude now says to change them on the host instead of suggesting a workaround
Unclear It is not clear whether editing those settings files with Edit or Write is also blocked elsewhere.
One usage credit settings error now reads "Couldn't send your request. Try again later." instead of telling you to contact your admin
Unclear Which situation leads to this error is not known.
When hooks are turned off for installed plugins, the message now gives the actual reason instead of always blaming a rollout switch
Unclear Which reasons the message can now name is not established.
A cloud session asked to change its Claude Code settings files now tells Claude nothing was changed and that you must do it yourself
Unclear It is not clear which sessions or targets produce this refusal.
Results from some edit and search tools now pass along any warnings they contain
Unclear It is not clear which tools these are or where the warnings are shown.
Claude Code now skips deleted files in a diff in more cases, and reads a worktree's current Git commit from its HEAD file
Unclear What the new check for skipping deleted files tests is not known.
When a PreToolUse hook cannot run and blocks a tool call, the message now says plainly that the call was not run
Unclear The situations in which this message appears are not known.
Hooks that are skipped now come with a reason, such as a missing script or a script in an unread dot-folder
Unclear Where in Claude Code these reasons are shown is not established.
Messages about blocked unattended commands from cloud sessions no longer give step-by-step directions and no longer mention /config
When Claude writes to an artifact database, the result now includes any warnings the server sent, shortened and cleaned up
Unclear It is not clear which Claude Code feature this artifact database belongs to.
When uninstalling a plugin fails, the message now covers settings files that can't be read here or point to another machine, and when to retry
!#Deny or ask rules arriving in an answer to a permission request are now dropped with a warning if they start with !
Claude Code has a new message saying a file path cannot be attached when the tool cannot read files in the session
Unclear It is not clear where in Claude Code this message appears.
When Claude Code checks for running background tasks, it now ignores paused tasks and agents that are waiting rather than working
Unclear It is not clear which part of Claude Code uses this check, or what it does with the answer.
The footer's agents hint can read "to go back" instead of "for agents", and answered question tabs can show a marker
Unclear It is not clear what condition switches the hint to "to go back", or which feature it belongs to.
When every marketplace fails to load, the plugin browser can now report a directory failure instead of a general one
Unclear It is unclear what condition makes the plugin browser report a directory failure rather than all marketplaces failing.
Claude Code now treats one more kind of error from MCP servers as not worth retrying
Unclear It is unclear which kind of error is now treated as final.
Headless and SDK runs now wait for model configuration to load before building Claude's instructions, unless no request will be sent
Unclear It is not clear what configuration is fetched or how long Claude Code will wait for it.
The warning for a first cloud-session message that may not have arrived now gives a plain reason, such as the service being busy
Some MCP sign-in fetch failures now trigger one retry instead of failing at once, and saved tokens record where they were stored
Unclear It is not clear what is being fetched or what the extra step before the retry does.
Permission prompts for timeout, env, command -p/-v and jobs -x now use shorter wording that names the option that couldn't be checked
Messages about shell commands that cannot be checked before running were reworded, alongside several small internal changes
Unclear It is not clear what the device channel setting or the other internal changes control.
The awk permission refusal now reads "awk is given text that can't be checked before it runs", and two plugin catalog cases were removed
Unclear It is not clear what changes for plugins now that the data-residency and essential-traffic-only cases are gone.
When Claude Code can't check in advance what a command will run, the reason now reads "What '<command>' starts can't be checked before it runs"
Unclear It is not clear what extra information is added when a guard that could not run blocks a command.
Anthropic has not published official notes for v2.1.288 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
2 of 27 tool descriptions changed. 1 of 25 tool schemas changed. The appended system-reminder blocks moved: 1 line added, 1 line removed.
Claude Code, interactive mode
2 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
698 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 67 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?