Claude Code v2.1.290

Clearer wording when a settings file is skipped for cloud sessions#

The reason shown for skipping a settings file now says the cloud session may change it

Attachment error messages show the file path in a tidied form#

Errors about attachment paths now show a tidied version of the path instead of exactly what was typed

Unclear It is not clear what tidying is applied to the path.

Git file attribute check now looks at every attribute#

Claude Code now asks git for all of a file's attributes and marks files that git converts on checkout

Unclear It is not clear what Claude Code does differently with a file marked as converted.

More awk and find commands now ask for permission first#

Claude Code now asks before running awk or find commands that trip an extra wildcard check, not only ones with unquoted wildcards

Unclear What the second wildcard check looks for is not clear.

File changes from a git step are no longer presented as Claude's edits#

Claude Code now notes that a git step in a shell command may have changed files, so those changes may not be edits

Unclear Where this note appears is not stated.

PreToolUse hook overrides log the deny reason type, with a second permission check#

When a deny rule overrides a PreToolUse hook, the debug log shows the deny's reason type and a second permission check can apply

Unclear What the fallback permission check looks at is not clear.

Claude Code removes more git environment variables before running git#

Before running git, Claude Code now clears a wider fixed set of git environment variables, not just GIT_CONFIG and GIT_ATTR_SOURCE

Unclear Which additional variables are removed is not known.

Changes to how shell commands are read when checking permissions#

The shell command reader now splits words at non-ASCII characters, checks folder changes differently and drops some entries from its blocked-read list

Unclear The overall effect on which commands are asked about or allowed is not clear.

Permission suggestions no longer propose allowing pyright#

The skill that suggests permission rules to cut down prompts is now told never to allow pyright, since it starts Python in your folder

Unclear Whether Claude Code's own command checker still lets some pyright commands through automatically is not settled.

Clearer messages when an agent's worktree cannot be removed#

When cleaning up an agent's worktree fails, Claude Code now says whether its own deletion failed or git refused, and keeps the worktree

Adding a plugin marketplace checks for clashing names#

Adding a GitHub plugin marketplace now runs an extra check against names already registered, and the name-taken error can show the name you asked for

Unclear Exactly which names the new registered-name check rejects is not clear.

Remote session updates slow down when nobody is watching#

The bridge that streams a session's events now tracks queued internal events and sends updates more slowly when no viewer is present

Unclear Whether this is switched on for users, and whether any of it is visible to them, is not clear.

MCP connections are dropped if the server changed while connecting#

If an MCP server is removed, changed, disabled or refused while Claude Code connects to it, the connection is now marked failed with a reason

GitLab token detection adjusted, plus WSL drive and git directory helpers#

GitLab token patterns gain a display setting, and new helpers detect Windows drives under WSL and run git against other folders

Unclear What the new display setting on GitLab token detectors actually controls is not known.

Uploads refuse symlinks that point outside their folder#

When preparing files for upload, Claude Code now refuses symlinks that lead outside their folder and reports links that have moved

Session list errors show the HTTP status, and titles are cleaned up#

Failing to fetch code sessions now reports the HTTP status code, and session titles are cleaned and squeezed onto one line

Unclear Exactly which characters the title cleanup removes is not stated.

Remote Control separates expired sessions from other access errors#

A 403 on an expired Remote Control session now fails as expired straight away, while other 403s note when a poll-sessions permission is missing

Unclear How the poll-sessions marker is used once it has been passed on is not known.

Service error details are shown only when short and on one line#

Claude Code now shows a service's error text only if it is a single plain line of at most 1,024 characters

Unclear Which errors go through this check is not known.

Shell command parsing gains wildcard detection and a reworded nesting error#

Claude Code's shell command parser can now spot wildcard patterns, and its error for deeply nested command substitutions is reworded

Unclear How the new wildcard check is used in permission decisions is not known.

Bash permission checks handle heredocs, fd redirects and export prefixes differently#

Claude Code's Bash command checker now treats text after a heredoc, {fd}> redirects and variables set before export differently

Unclear Exactly which commands are newly approved or newly sent to a prompt is not settled.

Sandbox re-checks protected paths for moved symlinks before the first command#

Before its first sandboxed command, Claude Code re-checks where blocked and credential paths point and rebuilds the sandbox if they moved

Unclear What triggers the re-check, and whether it only happens when sandboxing is turned on, is not settled.

MCP error scrubbing now stops on overly long or deeply encoded text#

Claude Code's scrubbing of MCP server details from error text now has limits and fails with an error when text is too long or too deeply encoded

Unclear The actual limits, and whether these new errors can appear on your screen, are not settled.

Errors from failing to start a cloud session are cleaned up before you see them#

When starting a cloud session fails, Claude Code now cleans up the error it shows and logs the original wording separately

Unclear What the clean-up removes from the error text is not settled.

Untrusted repository message now tells you to reconnect the computer#

When a cloud session refuses a request because its repository is not trusted, the message now says to ask Claude to reconnect the computer

Hint about remote background commands no longer says the output shows how they ended#

A hint about commands running in the background remotely now says their output file shows what printed, not whether they are still running

Claude is no longer told about MCP servers that are still connecting#

MCP servers still connecting during a short hold are left out of the pending-tools notice Claude receives, and nothing is sent if nothing is left

Wildcard URL rules handle international domain names more safely#

Wildcard web address rules now protect punycode host names, and a rule with the wildcard inside part of a host name is refused

Unclear It is not clear whether every rule with a wildcard inside a host name part is refused, or only ones involving punycode.

GitHub CLI setup no longer stalls when looking for gh fails#

If finding the gh command times out or fails during setup, Claude Code skips its gh stand-in and carries on, except in hosted runs

Clearer message when only some of your settings could be applied#

When settings were refused but permission rules exist, a status line now says only the deny and ask rules could be applied

Unclear It is not clear which feature or situation shows this status line.

Extra check before shell commands are treated as safe to run#

The check deciding if a shell command is read-only or allowed now has one more test that can rule it out

Unclear It is not clear what kind of command the new test catches.

Clearer errors when uploading a repository to start a cloud session#

Uploading your repository for a cloud session now checks how far ahead of the remote your branch is and gives clearer errors

Unclear How Claude Code decides a branch is ahead of the remote before counting is not clear.

Safer checks when staging files for a cloud upload#

Files staged for a cloud upload are now re-checked after reading so a swapped or linked file is caught

Unclear Any effect you would notice is not known.

Old job worktrees are rechecked just before cleanup#

Cleanup of old job worktrees now skips recently changed ones and checks their age again right before removing them

Cloud session file staging refuses backslashes and paths that leave its folder#

When placing a file for a cloud session, Claude Code now rejects folder names with backslashes and destinations outside the staging folder

Unclear It is not clear when these checks run or what the settings helper is used for.

Repeated messages still waiting in the queue are now held back#

A repeat of a message Claude Code is still waiting to process is now marked as a withheld echo, and repeats get new timing diagnostics

Unclear What the skipped release step does, and so what you would notice, is not clear.

Better detection of scripts passed directly to shells, including PowerShell#

Claude Code recognises more ways of handing a shell an inline script, including PowerShell options like -EncodedCommand, in any capitalisation

Unclear Whether this check is used for permission decisions was not confirmed.

Files containing NUL bytes are refused when read as text#

Claude Code now refuses to read a file as text when it contains a NUL byte, a zero character typical of binary files

Unclear Which feature reads files through this helper is not identified.

Changed error when a cloud session cannot be tied to this machine#

The error shown when a cloud session started here could not be bound to this machine has changed

Unclear Which command produces this error is not known.

Claude no longer reads a command's output file to tell if it finished#

For background commands on a remote host, Claude is now told the host reports whether a command is still running, not its output file

Specific error for subscribers when a sign-in refresh times out on an expired token#

Subscribers whose sign-in token has expired get a dedicated error when Claude Code times out waiting to refresh it

Unclear It is not clear whether this behaves any differently from the previous build.

More shell commands using $$ now ask for permission#

Shell commands using patterns like $$[ are now treated as too complex to judge and prompt for permission

Unclear The exact commands that now prompt when they did not before are not fully stated.

Mode indicator in the prompt footer rearranged#

The mode indicator below the prompt is now one piece, with a second piece shown after the hint text in some cases

Unclear It is not clear what condition decides when the second piece appears after the hint.

Clearer error when a session writes into a different worktree#

When an isolated session tries to write into another worktree, Claude Code now says so instead of calling it the shared checkout

Unclear It is not clear whether there are other conditions that turn the guard on or off.

Error details from a remote proxy are checked before use#

Claude Code now drops error types and messages from a remote proxy if they look malformed or are too long

Clearer refusals for plugin MCP server types and marketplace names#

Plugins that declare a restricted MCP server type are now told which rule applies, and marketplace-name refusals give fix steps

Unclear It is not clear what condition decides when the reworded marketplace-name refusal is shown.

Late SessionStart hook output now waits for running tool calls#

Output from a SessionStart hook that arrives late is now held until any open tool call finishes, instead of being added at once

Some marketplace entries are now left out when saving#

When Claude Code saves its plugin marketplace list, a new check now leaves out some entries

Unclear It is not clear which entries the new check leaves out.

New wording when Claude Code refuses a marketplace name that looks like Anthropic's#

Refusing a reserved plugin marketplace name can now say the name looks like one of Anthropic's own marketplaces and that reloading won't help

Unclear It is not clear what decides which of the two wordings you see.

Shorter error when the list of environments cannot be loaded#

When fetching environments fails, the error now shows only the HTTP status code, for example "HTTP 500"

Saved MCP server details are dropped when the server's settings changed#

Claude Code stops reusing saved MCP server details when the server's settings changed, and reloads claude.ai connectors after a policy change

Unclear It is not clear exactly when each of these checks runs.

Button labels are no longer rejected for being too long#

The check that rejected button labels over a character limit is gone; labels with control characters are still rejected

Unclear It is not clear whether label length is still limited somewhere else.

Permission denials are reported based on the final decision#

Claude Code now reports a permission denial to SDK programs based on the final decision, after any overrides

Unclear It is not clear which denials are left out of the report.

Approvals from a permission prompt tool are now labelled "user" instead of "person"#

When a permission prompt tool answers a permission request, Claude Code now labels who approved it as "user" rather than "person"

Unclear Where this label is read or shown is not stated.

Transcript rewrites wait for the file to finish loading#

Claude Code now waits for a transcript file to finish loading before rewriting it, and gives up with a warning if loading stalls

Unclear When Claude Code rewrites a transcript is not stated.

Shell command reading now handles words that start with non-ASCII characters#

Claude Code's shell command parser now accepts characters outside plain ASCII, such as accented letters, at the start of a word

Unclear The exact effect on how such commands are parsed and approved is not shown.

Small wording changes for remote control, inbox errors and helper-agent budgets#

Remote control gains an "off in this window" label, inbox fetch errors show the server's detail, and helper agents get a token-budget note

Unclear It is not clear what triggers each of these messages to appear.

Plugin validation now checks hooks that can refuse an action#

Plugin validation now reports hooks that can block an event, whether they handle errors with .catch, and warns about late refusals

Unclear It is not clear whether this validation output is shown to ordinary users or only to plugin authors.

Saved plugin marketplaces with look-alike names are now refused#

Claude Code now refuses to load or refresh a saved marketplace whose name fails its look-alike check, even if it was added earlier

Unclear Exactly which names the look-alike check refuses is not stated.

Shell command permission checks were tightened in several places#

Claude Code's shell permission checks changed for sudo shell flags, += variable prefixes, command -v and backslashes

Unclear The overall effect on any particular command is not clear.

Files that git converts are now treated as unsupported#

Claude Code now marks any file git converts through its attributes as unsupported, not only those with a filter or encoding set

Unclear It is not clear what Claude Code does with a file marked unsupported, or how often the no-attributes case occurs.

Small changes to background service messages and token reading#

The background service's idle hint now mentions cloud session clients, and one error now names /proc/self/mountinfo

Unclear The condition that makes the token read stop early is not settled.

Cloud session sign-in error now tells you to run claude auth login#

The error for cloud sessions without a claude.ai sign-in is shorter and names the claude auth login command

Remote permission replies are ignored if a request ID repeats#

If a permission request ID comes up twice in one session, replies to it from a channel are ignored and you are asked to answer in the terminal

Shorter cloud hook warning and a clearer error for nested project paths#

The warning about forwarding hooks to a cloud session is shorter, and {owner}/{repo} endpoints now fail for project paths with more than two parts

Uploading a partial Git clone now explains why it is refused#

Uploading a partial clone with missing files is refused, and the message says to use a full clone or run git fsck --name-objects

Unclear It is not clear which upload feature shows this error.

Broken Git worktree links are detected more directly#

When a Git worktree's link does not point back to its repository, Claude Code now treats it as unregistered without guessing from the error text

Unclear What a user sees differently after this change is not shown.

Small changes to skills and to shell commands written into prompts#

Shell commands in prompts are read differently, skill use is recorded by the skill's name, and a pull request skill no longer takes a proactivity level

Unclear None of these was followed through, so their effect for users is not known.

Stricter failure handling when MCP servers reconnect#

MCP reconnects now restore earlier state if the older HTTP+SSE fallback fails, and a refused sign-in step-up fails with adopt_refused

Unclear Whether the legacy HTTP+SSE fallback path is switched on for any account is not known.

Clearer errors and a missing-folder notice when moving a session to the cloud#

Cloud session errors give reworded advice, and a notice warns when uncommitted files stay local because the launch folder can't be reached

Unclear What changed in the rules for which files are read into the cloud bundle is not described.

Folder listing on Linux and macOS can return file names that aren't valid text#

On Linux and macOS, Claude Code can list folders through the system library so unusual file names come back exactly as stored

Unclear It is not clear whether this listing is used anywhere besides removing worktrees.

Remote Control label shows rc instead of /rc#

The Remote Control label now begins with rc rather than /rc, and its short form is rc

Unclear Where in the interface this label appears is not established.

Missing-file error messages now go through an extra processing step#

Errors for files, paths, folders and artifacts that do not exist, and their suggestions, are now passed through a cleaning step

Unclear It is not clear what the processing step does to the paths.

Autocomplete suggestions leave more room for descriptions#

The suggestion list now sizes its name column to leave room for each item's description

Unclear The exact visual effect has not been checked.

Shorter explanations when a shell launch is refused#

The reasons Claude Code gives for refusing to analyse certain shell launches are now shorter

Unclear Whether the way these shell launches are matched also changed is not settled.

Shorter reasons when a shell command needs your approval#

The reasons Claude Code gives for asking you to approve a shell command are shorter, with some explanations in brackets removed

Shorter warning when git is run with hooks or include paths on the command line#

The permission warning for git commands that set core.hooksPath or an include path on the command line is now shorter

Shorter explanations in permission prompts for project tools and relative paths#

Permission prompts now say 'it runs a project tool, such as make or npm' and 'it runs a file by a relative path'

Sign-in browser pages now come from one shared template#

The browser pages shown after signing in to Claude Code now share one template and are allowed to use embedded fonts

Unclear What changed in the pages' styling is not settled.

Plugin update summaries pass names through a formatter#

Marketplace and plugin names in plugin update result lines now go through a formatter instead of being printed as is

Unclear It is not clear what the formatter does to the names or when each formatting is chosen.

Skill list length now counts each skill's display name#

When fitting the skills list into its space limit, Claude Code now counts each skill's displayed name instead of its raw name

Unclear How the display name differs from the raw name is not known.

Clearer wording when a command nests shells too deeply#

The refusal reason for a command that passes shell code through too many nested shells now reads more simply

Two more git merge files are on Claude Code's list of git's own files#

MERGE_RR and MERGE_AUTOSTASH join MERGE_HEAD and MERGE_MSG on Claude Code's list of git's internal file names

Unclear It is not clear what Claude Code does with this list, for example whether these files are now protected from edits.

Clearer message when a config file save fails#

A failed config save now shows: Could not save this to the config file, so nothing changed

Unclear It is not clear where in Claude Code this message is shown.

Missing-file errors now carry the "Did you mean" suggestion#

When a file does not exist, the error Claude Code returns now includes its "Did you mean" suggestion for a similar file

Unclear It is not clear whether the earlier message already contained the suggestion in some form.

Session-events fetch errors now show the HTTP status code#

When fetching session events fails, the error now reads "Failed to fetch session events: HTTP" followed by the status code

Shorter reasons shown for risky shell and PHP commands#

Some reasons Claude Code gives for flagging a shell command are shorter, including the one for risky PHP options

Unclear It is not confirmed whether the restricted-mode handling in the file-reading check was moved elsewhere or removed.

Clearer error for file paths that end in a space, with a new error code#

A path ending in white space now gets a clearer refusal, and its error code changed from 2 to 20

Shorter reasons when a shell command runs Python#

Permission prompts for shell commands that run Python now give shorter reasons, such as "it runs python with -i"

Delisted-plugin check skips one marketplace, and Gemini command translation is fixed#

The check for delisted plugins now skips one particular marketplace, and translating Gemini commands handles shell blocks correctly

Unclear Which marketplace the delisted-plugin scan skips is not stated.

A remote cancel no longer throws away every queued prompt#

A cancel sent from outside the terminal now targets specific queued input instead of discarding everything you had queued

Unclear It is not clear what decides which queued commands a cancel is aimed at, or whether this behaviour is switched on for everyone.

Stopping a remotely served background command no longer waits for it to end#

A remotely served background command still counts as running while it is being stopped, and the stop result returns without waiting

Unclear What difference this makes to someone using Claude Code is not clear.

Plugin hook error handlers survive a restart of the hooks worker#

If the worker running plugin hooks is replaced mid-event, Claude Code now waits for the new one and lets the plugin's error handler run there

Unclear It is not clear whether plugin hook modules are themselves behind a switch.

Scheduled task details are kept when parts of a conversation are rewritten#

Attachments that carry a scheduled task's state no longer stop Claude Code from rewriting a stretch of the conversation, and are kept

Unclear It is not clear where the kept attachments are used afterwards.

Plugin names changed by version 2.1.287 are restored#

Claude Code now repairs plugin listings so they use the names their installed plugins use again, and logs how many it fixed

Unclear When the repair step runs is not known.

Resuming a large conversation no longer freezes the screen#

Loading a saved conversation now pauses regularly so the interface stays responsive when you resume a large session

Replies that stall after your computer sleeps are now stopped#

If a reply's idle timer goes off because the computer slept, Claude Code now stops that reply and writes a warning to its log

Starting an agent now reports the agent's own ID#

The agent_id line Claude sees after starting a new agent now holds the agent's ID instead of the teammate ID

Taking ownership of a tool host now needs a valid link to it#

Claude Code now decides a device owns a bound tool host only when there is also a valid link to that tool host

Unclear It is not clear what a tool host is or which feature it belongs to.

Starting with /login on first run keeps it if you skipped sign-in#

A /login you start Claude Code with is now cleared after setup only if you did not skip sign-in