You can now name backup models in the new accessFallbackModels setting, for use when the main model can't be used. A new per-server disableAutoBackground option stops Claude Code from moving that MCP server's tool calls to the background. In remote sessions, CLAUDE_CODE_HOST_SKILL_CATALOG can list which skills are allowed to load. Setting CLAUDE_CODE_ARTIFACT_PREVIEW to false now turns artifact preview off. A new Publish plugin tool sends a plugin to your organization's library after you confirm. Organisations under the HIPAA policy are blocked from publishing plugins this way.
Several features are in the build but not switched on yet. An option for screen-reader users to move through suggestions with the arrow keys is built but held behind a remote switch that is off. WebFetch can ask about blocked URLs one prompt at a time, but only once a server switch is turned on. An emulator engine for artifact previews in remote sessions is built but cannot be selected yet. Plugin rating now also needs a server switch, and that switch defaults to off. Pressing Enter on a slash-command suggestion can run only the one you picked with the arrow keys, once that behaviour is switched on.
Composed characters and IME typing are no longer dropped from the prompt. In vim mode, h and l now stop at the start and end of a line. The vim f, t, F and T searches now stay on the current line. The ; and , keys now repeat the last vim search even when the character was not found. Web search in remote sessions no longer skips the proxy when web fetch is disabled. A slow-starting local MCP server is no longer wrongly remembered as an older server after a timeout.
Written by our agent from the shipped bundle, not by Anthropic.
A new CLAUDE_CODE_HOST_SKILL_CATALOG variable lets a remote session's host name which skills to load, from a new host catalog at /mnt/skills/public
SDK results gain a safety_stops count, interrupts gain an internal worker_epoch, and turn handoffs can carry server-side safeguard verdicts
Sessions now reject every poll event unless the host set CLAUDE_CODE_POLL_EVENTS, and own-events-only remote sessions stop advertising session notices
The CLAUDE_CODE_REPO_CHECKOUTS lookup moves into a new accessor, and the workspace diff scan now returns which repo root it uses and whether it follows the shell
Sessions & agentsA new accessFallbackModels setting lists models Claude Code may fall back to when the main model can't be used
Sessions & agentsWant the reasoning? Read walks the 51 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Artifact preview can pick a cloud emulator engine instead of local Chrome, though in the code examined a built-in switch keeps it off
Unclear It is not clear whether anything in this release ever turns the internal switch on, so the emulator may or may not be reachable.
A new CLAUDE_CODE_HOST_SKILL_CATALOG variable lets a remote session's host name which skills to load, from a new host catalog at /mnt/skills/public
A new Publish plugin tool can upload a plugin to claude.ai and submit it to an org library; organisations under HIPAA policy are denied it
Unclear Whether the publish tool is switched on by default is not stated.
SDK results gain a safety_stops count, interrupts gain an internal worker_epoch, and turn handoffs can carry server-side safeguard verdicts
WebFetch's URL approval prompts were reworked: approvals are remembered while prompts wait, and tengu_orderly_lantern shows one prompt at a time
Unclear It is not clear whether remembering approvals and retrying before asking also depend on the switch, or apply to everyone.
The artifact tool gains reads of earlier artifact versions, new page_versions and emulatorPreview kinds, and a new CLAUDE_CODE_ARTIFACT_VERSIONS variable
Unclear What the variable does, and whether these lists pass it through or strip it out, is not clear.
Sessions now reject every poll event unless the host set CLAUDE_CODE_POLL_EVENTS, and own-events-only remote sessions stop advertising session notices
The CLAUDE_CODE_REPO_CHECKOUTS lookup moves into a new accessor, and the workspace diff scan now returns which repo root it uses and whether it follows the shell
Unclear What Claude Code uses this list of repository checkouts for is not stated.
A new feature name for uploading files as MCP tool input appears in Claude Code's feature list, with nothing yet using it
Unclear What this feature does and whether it is switched on anywhere is not clear.
A carried server safety verdict can be reused at turn hand-off when tengu_auto_mode_config allows it, with new usage data for hand-off and rewind
Skill sync can read skill zips from a mounted folder, and server skills now keep their userInvocable and disableModelInvocation settings
Workflow runs with withholdScriptFromSdkEvents now record the script's hash, offer resuming only with the unedited script, and are refused for v2 runs
A new accessFallbackModels setting lists models Claude Code may fall back to when the main model can't be used
Claude Code now reads CLAUDE_CODE_MANAGED_CONFIG_PREFETCH at startup and keeps CLAUDE_CODE_ARTIFACT_VERSIONS out of programs it starts
Unclear It is not clear what setting CLAUDE_CODE_MANAGED_CONFIG_PREFETCH does to startup, or where CLAUDE_CODE_ARTIFACT_VERSIONS is used.
Usage-credits consent, the /model and --advisor hints, and the limit message now name the model involved instead of assuming Fable
Unclear It is not stated which models other than Fable use this consent prompt.
A new per-server disableAutoBackground setting stops Claude Code moving an MCP server's tool calls to the background, for tools that wait on a person
Unclear The option is marked internal, and it is not confirmed that setting it takes effect in this release.
A screen-reader option to move through suggestions with the arrow keys is built in, behind a remote switch that defaults to off
Unclear It is not clear how the suggestion list behaves differently when this is on.
Claude Code has a new interface event type for prompt autocomplete, switched off by default like the other interface event types
Claude Code has a session storage mode that keeps nothing on disk and refuses every attempt to save
Unclear It is not clear what turns this mode on, so you may not be able to use it.
The Artifact tool gains a way to list an artifact's versions and to read a named earlier version, limited to artifacts you own
Unclear It is not clear what switches artifact versions on, so they may not be available to you.
When available, the footer's artifacts shortcut opens a frame or a frame picker in Claude Code, and otherwise still runs /artifacts
Unclear What decides whether the in-app frame viewer is used instead of /artifacts is not stated.
The plugin rating path now needs a server-side switch that defaults to off, plus an Anthropic account and a non-local marketplace
Before a tool runs, Claude Code can wait for files still being staged, but only when a remote switch that defaults to off is on
New instructions tell Claude about the desktop app's built-in browser, remote computer-use tools and chats not linked to a computer
Unclear It is not clear when these instructions are given to Claude.
Claude Code's built-in model table renames one family from Mythos to Fable and adds a per-image token limit alongside pixel limits
Agents that watch a session now receive non-user messages, queued commands and polled events, and only read the part since the last reply or summary
In emulator mode, the page preview tool is described as looking at a page in the artifact viewer and accepts only file_path
Unclear It is not stated what puts Claude Code into emulator mode.
The SDK's background-task notification has two new optional fields, handback and handback_report, for subagent reports
The sandbox now accepts a seed-admin settings source and a new check for whether a trusted source closes the unsandboxed fallback
Unclear It is not stated what the seed-admin source is or how you would set it.
Tool results can now include a list of withheld memory entries, each with its path and a stated reason
SDK and -p output now include a permission_check_status message when a tool call waits about four seconds on the auto-mode classifier
CLAUDE_CODE_ARTIFACT_PREVIEW can now turn artifact preview off#Setting CLAUDE_CODE_ARTIFACT_PREVIEW to false now switches artifact preview off, and emulator mode always gets preview
Two artifact actions let Claude Code list an artifact's kept versions and save an earlier version's page to a local file
Unclear The availability check that decides whether these actions work in a given session is not described.
A new 'Artifacts in this session' list opens the artifact you choose, checking first in cloud sessions that it can be opened
Unclear How the dialog is opened, and whether it is switched on for everyone, is not stated.
Claude Code contains a claude plugin install <plugin> --marketplace <source> flow that adds the marketplace first if needed
Unclear It is not clear whether the --marketplace option is available on claude plugin install in this release.
A new prompt.autocomplete plugin hook lets plugins add completion rows under the prompt, including for desktop, mobile and VS Code composers
Unclear It is not clear whether plugins can register for this hook yet, or what switch controls it.
A new plugin event, prompt.autocomplete, is defined to let a plugin suggest completions while you type, though nothing raises it yet
Unclear It is not clear whether anything in Claude Code triggers this event yet, so plugins may not receive it.
mcp_read_resource can now be refused on hosted desktop#The mcp_read_resource request now runs a check first and can be refused with the code hosted_desktop
Unclear When the hosted_desktop refusal applies is not shown.
When a proactivity level would start auto mode, Claude Code now holds it and shows a notice if your organization's policy has not loaded
Claude Code now recognises messages saying a model requires usage credits, and a failed turn can report a usage-limit refusal
Interrupt requests can now fail with stale_worker_epoch or invalid_worker_epoch, and result totals now include a count of safety stops
Unclear What safetyStops counts, and when it is nonzero, is not stated.
Hooks calling $.model.complete can now pass promptBlocks and systemBlocks and mark blocks with cache: true for prompt caching
Plugins gain a prompt.autocomplete hook point, and the plugin checker lists hooks that answer a plugin's own command separately
Unclear What a prompt.autocomplete hook receives or can do when it runs is not stated.
When an API stream fails, stalls or ends early, the stop event can now say which partial content blocks to throw away
Plugins can supply extra autocomplete suggestions while you type, which you can pick with Tab, Enter or a click
Unclear It is not clear what switches this on, or whether installed plugins can supply suggestions yet.
The Agent tool now takes an optional effort field, used only when you or your instructions ask for delegated work at a specific effort level
Unclear It is not stated whether every agent type and every build accepts the effort field.
Claude Code stops reading one server-sent setting for a launch notice; the auto-mode start and effort reminder settings remain
SDK messages gain an optional agent_id naming the exact subagent that produced them; it is absent on main-thread messages
Unclear Whether Claude Code always fills in agent_id on subagent messages is not confirmed.
SDK api_error messages can now carry rate_limit_info describing the limit that refused the request, including when it resets
--marketplace#plugin install <plugin> --marketplace <source> now checks its arguments and explains what is wrong when they don't fit
SDK error messages gain a usage_limit_reached kind for refusals caused by your plan limit or usage-credit spend cap, with which limit and when it resets
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
8 more of these are in What probably matters to you, above.
Artifact deploys can fetch content through a frame route with retries, and failed later sends now give a clearer cloud gateway error
The prompt box gets cursor parking, Vim normal-mode end-of-line fixes, an arrowed suggestion that Enter respects, and a suggestion list that scrolls less
Unclear Which suggestion lists use the steadier scrolling is not clear.
The usage view can now show a dollar credit row with how much is used, the limit and an expiry date, when the server sends one
Automatic compaction gains a case for when the last reply came from a model with a bigger context window than the current one
Unclear Whether this case leads to compaction, a suggestion to switch models, or both is not stated.
claude -p can keep waiting for background commands past its time limit#In print mode Claude Code can hold on for background commands instead of stopping at the wait limit, and its give-up warning now lists running tasks
Unclear Which setting turns on the hold for background commands, and whether it is on by default, is not stated.
In remote sessions, a permission request left unanswered long enough can be declined automatically, with Claude told not to retry
Unclear Whether a built-in waiting time of 0 leaves this off unless it is set remotely is not confirmed.
Previewing an artifact can now open a private copy in an artifact viewer inside the session and return pictures, instead of using local Chrome
Unclear What decides whether the emulator or local Chrome is used is not known.
Reading a project document that is too large can now save it to a local file instead of returning the text, with a fallback if saving fails
Unclear It is not stated in which situations Claude Code supplies the size limit that turns this on.
With CLAUDE_CODE_RESUME_INTERRUPTED_TURN set, resume now finds tool calls the previous worker recorded but the transcript left unfinished
Unclear Whether CLAUDE_CODE_RESUME_INTERRUPTED_TURN is set by default in remote sessions is not known.
A new ui_prompt_autocomplete request lets remote apps ask for plugin autocomplete suggestions for the word at the cursor
Unclear Whether this request is available outside internal use, or sits behind a switch, is not known.
When a workflow starts an agent, a plugin hook can now refuse it, and the workflow stops with a "denied by a plugin" error
Unclear Which hook event a plugin must handle to refuse a workflow agent is not shown.
$.audio.speak is cut short instead of rejected#$.audio.speak no longer fails on long text; it warns and speaks only the first part, up to a set number of characters
Browser actions on an allowed site with a grant rule can be approved without the auto-mode classifier unless that setting is false
Unclear Whether chromeGrantAllowlistWithoutClassifier is a setting you can change yourself or one set remotely is not clear.
Compaction requests now carry a retry budget and fall back from the compaction model; more API errors count as retryable and rewind gains an expired reason
Remote and headless sessions now hold back a repeated usage-limit alert instead of querying again, and track reads and nudges for queued remote notifications
Claude Code no longer removes outdated managed or duplicate plugin entries unless it can use plugin-directory-bindings.json, and it now warns when it keeps them
Attachments are re-checked when opened, Grep reads through an inherited file handle, and new directories are private to your user
Ultrareview now passes bundleFollows for branch reviews, and a missing preflight response can block the launch instead of letting it proceed
Unclear The condition that decides whether the launch is blocked is not identified.
PDFs whose files are still downloading are now waited for and reported to the model, and PDF reads use an already-open file handle
Remote sessions can record programs a command left running and, on restore, tell Claude which ones are no longer running
Stdio MCP servers now use automatic protocol negotiation unless a server-side setting explicitly turns it off
Claude's Bash instructions now give background commands a default timeout of 600000 ms (10 minutes), down from 1800000 ms (30 minutes)
Unclear It is not settled whether background commands are actually stopped sooner, or whether only the wording Claude reads has changed.
When a session is resumed, Claude Code can now load the artifacts saved from the last session back in
Unclear It is not clear what these session artifacts are or whether this is switched on for readers.
Vim mode keeps your column across j/k, gj/gk and $, adds space and backspace motions, and fixes yank and Escape cursor handling
Claude Code now only overwrites your saved default model when your current model is in the same model family as the one being set
Unclear Which situations trigger this automatic overwrite of the saved default model is not clear.
The reminder Claude gets after a container restart can now include a reason for the restart
Whether Claude Code says a model is drawing from usage credits is now worked out from that model, not one fixed check
Unclear Which models now show the usage-credits notice is not stated.
Messages handed off or marked as not typed are now handled separately from your typed input and left out of prompt history
Unclear It is not clear which feature produces messages marked as not typed.
Closing a plugin test now reports whether it failed, and the plugin code scan catches redeclared names and the plugin's own commands
A publish Claude Code makes without asking can now only create a new artifact; anything else is refused and later publishes need permission
Claude Code skips its background memory runs when a permission rule would refuse writes to the memory folder, and can warn you
Claude Code can refuse to send an MCP task to the background, and end it, when too many were started since you last wrote
Unclear The limit and whether this check is switched on are not stated.
The background memory agent now follows your permission rules, may only write .md files in the memory folder, and says when saving is blocked
Unclear It is not settled whether this is new behaviour or existing behaviour that was moved, so it may not change anything for you.
Setting MCP servers from the SDK no longer delays connecting behind a remote switch, and calls to some servers are now refused
Unclear Which servers mcp_call now refuses is not stated.
When a tool needs you to interact with it, Claude Code's own permission decision now overrides a plugin's tool.check hook
Project uploads from a local path now refuse credential files, devices, Claude Code's own config, hard-linked files and files you are not allowed to read
SendMessage calls shown to hooks and transcripts now include recipient_kind, and messages to cloud and Remote Control sessions use new routing
The notice shown to Claude after a worker restart now lists stopped agents it can resume by messaging their id
/workflows#Claude Code includes a 'Large workflow · /workflows to stop' label, and its task-numbering step now reports whether it changed anything
When Claude Code falls back to a backup sandbox setup, it now logs the specific cause and reduces credential masks a moved path may cover
WebSearch is now only available when a new check passes, and the artifact tool lists items most recently opened or updated first
Unclear What the new WebSearch check tests, and whether it passes by default, is not known.
Artifacts saved with a cloud session are now restored, and the SDK's background task list adds run_id and parent_task_id
Automatic approval of artifact writes now considers existing allow rules, whether a person started the turn, and pending changes; a first publish can be approved automatically
Unclear Which setting or switch turns on the new automatic approval for a first publish is not known.
How prependPlugins and appendPlugins are worked out has changed, and file search can now stop with an error when it cannot read its input
Unclear What the reworked handling of prependPlugins and appendPlugins changes for an organization is not stated.
For a restricted kind of caller, shell commands that ask to skip the sandbox or run in the background are refused or forced off
Unclear Which callers count as restricted, and so who is affected, is not clear.
When approval cannot be asked, the security prompt for managed settings is now skipped and recorded as not asked
Unclear Whether the session stops or carries on after the prompt is skipped is not shown.
An MCP tool whose name is longer than the API allows is no longer sent to Claude, and Claude Code logs a warning for that server
When cleared prompt text is not restored, Claude Code can now add it to your prompt history with the time it was cleared
Unclear It is not clear which ways of clearing the prompt save the text to history.
Published verbatim by Anthropic for v2.1.292. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 92 bullets, 14 name something an entry on this page also names, 25 name something no entry here does, and 53 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
--marketplace <source> to claude plugin install: adds the marketplace if needed, under the same policy checks as claude plugin marketplace add, then installs the plugin from it
Probably marketplace-argument-validation-for-plugin-install, claude-plugin-install-marketplace-flow-added-only-the-fun effort parameter to the Agent tool, so Claude runs a sub-agent at the effort level you ask for
Nothing to match on CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS environment variable to set a longer base delay for the backoff when retrying an overloaded (529) request
No entry names this prompt.autocomplete, an event a mod hooks to add its own rows to the prompt box's autocomplete list
Probably prompt-cache-relay-message-and-commandrun-annotation, new-ui-prompt-autocomplete-control-request-for-remote-compos, new-plugin-hook-event-promptautocomplete, plugin-hook-table-gains-promptautocomplete-validator-treat, new-promptautocomplete-hook-surface-plugin-supplied-rows-u $.model.complete for mods: prompt and system take blocks of text, and cache: true on a block caches the request up to it
Probably hooks-modelcomplete-accepts-cached-promptsystem-blocks agent.spawn mod hook, with their run and index, so a mod can refuse them
No entry names this permissionMode: auto entering auto mode when auto mode is unavailable (disabled by settings, circuit breaker, or a model that doesn't support it)
No entry names this /ultrareview uploads under ~/.claude/seed-admin
No entry names this rm -rf on the 8.3 short name or another alternate Windows spelling of the home folder or a drive not being treated as removing it
No entry names this #99193[BUG] Windows: sub-agent rm -rf on the 8.3 short-name alias of the home dir wiped ~116 GB; TaskStop left it running ~50 min; agent reported 'looks intact' (related: #92593, #95426, #97660) Open
#99198[CRITICAL] Sub-agent ran `rm -rf` on the user's Windows home directory (via 8.3 short name), no hard guard; delete kept running after the task was stopped Open
allowed-tools rule coming back in a later turn when you leave auto mode or plan mode partway through that turn
No entry names this NO_PROXY being ignored for Claude Code's own API requests (sign-in, policy, feedback, artifacts) when HTTPS_PROXY is set
No entry names this claude plugin commands such as marketplace add and install running before an organization's managed settings had loaded on a first run
Probably plugin-commands-wait-for-remote-managed-settings-before-runn, plugin-remove-explains-blocked-legacy-local-settings-file, marketplace-argument-validation-for-plugin-install, claude-plugin-install-marketplace-flow-added-only-the-fun claude -p and Agent SDK runs stopping a background command 5 seconds after the final result, and one-shot claude -p runs dropping a scheduled wakeup; both are now waited for
Probably print-mode-can-hold-open-for-background-shells-before-the-ce #86447[BUG] Print mode (-p --output-format stream-json): session ends with result: success while background tasks are running and a ScheduleWakeup is pending — scheduled wakeup can never fire, background tasks are killed Duplicate
claude --resume session picker or with /resume
No entry names this #89463Plan mode indicator vs. enforcement desync when resuming a conversation that was in "edits on" Open
/resume, /branch or /clear never firing, and saved tasks ignoring later creates and deletes after two writes to the tasks file milliseconds apart
No entry names this #98219Durable scheduled tasks (CronCreate `durable: true`) never fire after an in-app `/resume` Open
/loop silently stopping when the session's process restarted (for example after a crash), because its pending wakeup was lost
Probably loop-wakeup-scheduling-tracks-tooluseid-and-chain-start, cronloop-tasks-can-fire-after-input-closes-while-waiting-fo pages was a list such as "6,9,15"; it now returns an error saying to read each page or range separately
No entry names this /bug, /share and /feedback <text> starting over after Ctrl+O or Ctrl+Z while a report was being sent, and closing as cancelled after it had been sent
Probably feedback-now-tracks-send-state-and-shows-a-submittingdone, safeguard-flagged-message-text-now-drops-a-sentence-for-some /remote-env replacing your saved default environment when you pressed Enter right away: the list now opens on your default, and no row has a check mark when no default is in effect
No entry names this f/t/F/T/;/, jumping to, or deleting up to, a match on another line of the prompt
Nothing to match on /add-dir path box letting Shift+Enter or a paste add a line break, and treating fast-typed "tab", "up" or "down" as those keys
No entry names this ! leaving the row selected
Nothing to match on /cd or a permission change, and added a transcript line when a nested one isn't loaded
No entry names this /name letting Claude invoke a skill that is reserved for the user
No entry names this $.state calls through one const taking minutes to load or validate
No entry names this claude plugin validate listing a matcher or state value for a hooks module that the engine reads from elsewhere
Probably plugin-commands-wait-for-remote-managed-settings-before-runn claude plugin validate listing a $.state value read through a top-level var that was declared again or reassigned; such a module is now refused
Probably plugin-commands-wait-for-remote-managed-settings-before-runn $ method restarting the hook origin, which could run a guard hook with a .catch above it again without end
Nothing to match on config.set, state.set, env.set or agent.spawn hook that denies after calling next(e) being answered as a refusal: the hook is now reported as failed, by name
No entry names this /theme, the /config Theme menu and the first-run theme step saving a theme before a plugin's config.set hook was asked
No entry names this tool.check hook answering allow running a tool that requires your answer (a question, a plan approval) without showing its dialog
Probably tool-check-hooks-can-no-longer-override-tools-that-require-t, plugin-toolcheck-and-uiscroll-wait-on-pending-work-first next(e) and then failed while the turn was interrupted letting the call through; the call is now rejected
No entry names this $ name that a user-installed mod had added; the mod is now unloaded instead
Nothing to match on tool.call hooks seeing some tool calls before misnamed parameters were repaired; a hook now sees the arguments the tool will run with
No entry names this .catch being skipped silently for calls another mod's hook makes beneath the guard's own $ call; its .catch is now asked
Nothing to match on claude -p and SDK sessions: the first turn no longer waits for HTTP and SSE MCP servers to answer resources/list
Probably print-mode-can-hold-open-for-background-shells-before-the-ce <system-reminder> tags written in a hook's output are escaped before they reach Claude
No entry names this file_path for path, and Write, WebFetch and Read ignore a few stray parameters instead of failing the call
Probably search-tool-accepts-file-path-as-an-alias-for-path, artifact-preview-tool-wording-differs-in-emulator-mode FOO=bar python3 app.py runs unprompted
No entry names this MCP_PROTOCOL_NEGOTIATION=legacy opts out
No entry names this claude plugin test: a failed expect inside a hook the test registered, or a stub answer the engine refuses, now fails the test instead of passing silently
Probably plugin-commands-wait-for-remote-managed-settings-before-runn name longer than that is ignored
Nothing to match on @Claude !status in a channel to say when Claude has stopped reading its untagged messages, why, and that an @-mention starts it reading again
No entry names this !fork to a card showing where it came from, the request, and who asked, with a link to the original thread
Nothing to match on A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 25 tool schemas changed.
Claude Code, interactive mode
11 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
495 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 59 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?