MCP tools that take file inputs can now accept local file paths. Claude Code uploads the file and passes the tool a reference instead. The Read tool's new allow_large option lets Claude read an oversized text file when there is room left in the conversation. Hook commands now take an on_failure setting of continue or block. You can set CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to choose the model subagents use during a workflow run. Administrators can switch off messaging beyond a user's own agents with the managed setting messagingBeyondOwnAgentsDisabled.
This build holds 11 features that are not switched on yet. Claude can ask a subagent for lower or higher effort than its own, but the option is off by default. A session moved to the cloud from auto mode is being prepared to stay in auto mode. Remote sessions gain a check that probes a stream after about 8 seconds of quiet. That check is controlled remotely and is not on yet. A new restriction could limit an agent to messaging only its own agents.
Messages you typed ahead are no longer lost when a turn is cancelled. They go back into the input box or to the front of the queue. A PreToolUse hook that blocks a tool now shows its full reason in the error. Workspace diffs now follow renamed files and show deleted files as removed. On Windows, MCP servers now get a chance to shut down cleanly before being force-closed. Resumed sessions no longer restore saved MCP tasks from the 2025-11-25 tasks protocol.
Written by our agent from the shipped bundle, not by Anthropic.
allowedProviders can now set ANTHROPIC_BASE_URL automaticallySettings & configCLAUDE_CODE_AGENT_PROGRESS_SUMMARIES, CLAUDE_CODE_SLEEP_COMPACT_AFTER_MS and CLAUDE_CODE_RESUME_SESSIONSTART_HOOKS_WAIT_MS are new and are read by Claude Code
SDK set_model requests can swap the system prompt only if a named model is running, failing with model_not_current otherwise; Remote Control refuses it
Sessions & agentsA managed setting, messagingBeyondOwnAgentsDisabled, now turns this feature off and overrides CLAUDE_CODE_HARBOR_KITE
Gateway policies can use a code block for Claude Desktop's Code tab, cannot mix it with cli or settings, and get clearer warnings about serve_to_desktop
Platform & internalsModel catalog entries can set min_claude_code_version, and older clients see the model as unavailable with a message naming the version to update to
Extensions.mcp.json files can now be skipped when loading MCP serversExtensionsWant the reasoning? Read walks the 38 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Model catalog entries can set min_claude_code_version, and older clients see the model as unavailable with a message naming the version to update to
Unclear It is not clear which manifest this field belongs to or whether Claude Code acts on it.
allowedProviders can now set ANTHROPIC_BASE_URL automatically#When managed settings use allowedProviders, Claude Code may set ANTHROPIC_BASE_URL itself unless the managed settings already set it
Unclear It is not clear what address Claude Code sets or which setups meet the conditions.
Starting a cloud session with --tools now checks the list and gives a clear error for lists, environments or existing sessions it cannot honour
Unclear Which --tools lists are now accepted for cloud sessions is not stated.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
12 more of these are in What probably matters to you, above.
Claude Code now limits how many tools one MCP server can list, and MCP tools marked for file grants get a wrapper and skip XML-tag stripping
Unclear The maximum number of tools Claude Code keeps from one server is not stated.
Pressing left arrow to background a session now stops the turn in progress, and queued messages that arrive late are not sent
Unclear It is not known which sessions meet the condition that lets Claude Code stop the running turn.
Skills run as separate tasks and hooks from synced plugins can now be refused when plugin sync is off or has no folder
Claude Code's file upload code now checks files after sending, refuses credential files, limits sizes and is tied to an organization policy
Unclear It is not known how this upload is started or whether the allow_cobalt_plinth policy allows it by default.
Hooks are labelled personal or checkout by source, checkout hooks cannot silently replace settings hooks, and a failing matcher stops its hook running
Unclear What the personal and checkout labels change about how those hooks run is not shown.
Claude Code now checks pasted-text placeholders before sending and refuses with a "Not sent" message when the paste is blank or no longer available
Unclear Which part of Claude Code shows this refusal, such as the VS Code extension, is not stated.
When a resumed remote session cannot read its saved state, Claude Code now exits with an error instead of starting a turn with nothing
Claude Code now refuses a permission answer from a host program if it would lose deny or ask rules that answer added
In fleet view, failed or taken jobs no longer become the next tab, and quitting with no session left to open prints a quit line
Unclear Whether these session tabs are available to all users, or only behind a setting, is not stated.
If an allow answer's updatedPermissions are too large or malformed and might hide a deny or ask rule, the call is now refused
Claude Code can remove hooks from synced plugin skills, and records why a plugin skill or command was refused or run without its hooks
Unclear It is not stated what turns plugin sync on, so whether this applies to a given account is unknown.
When a PermissionRequest hook allows with permission updates, Claude Code withholds the allow if any stricter rule was lost
Unclear It is not stated what Claude Code does instead of allowing, such as asking or denying.
Claude Code now refuses paths in its temp folders or in folders background sessions write to freely, including for cloud credential settings
Unclear It is not clear exactly when this check runs or what Claude Code does when it refuses a path.
Claude Code no longer grants a permission when saving it would discard a rule that blocks or restricts an action
Unclear It is not clear what happens to the request after the approval is withheld, for example whether you are asked again.
NotebookEdit now refuses to edit a notebook that is not valid UTF-8 and leaves the file untouched
Repository setup now adds origin with the plain upstream URL instead of the credentialed one, and git subprocesses no longer inherit GIT_CONFIG
Unclear What Claude Code does when the ANTHROPIC_CUSTOM_HEADERS values match or differ is not known.
Task update and notification messages in the SDK stream now include a failureKind and have output paths and raw error text sanitized
Unclear It is not clear exactly where the failure kind appears in these messages.
Claude Code now refuses a workflow script that contains control characters an approval prompt cannot display, such as escape bytes
Claude Code now limits how many JSON keys and how much nesting it reads from a background hook's output
Unclear It is not clear when this limit applies, since an unidentified check decides whether the old unlimited reading is used instead.
Prompt hooks now use their own configured model or the default small model, without a gateway special case
Unclear It is not settled whether gateway setups without ANTHROPIC_DEFAULT_HAIKU_MODEL or ANTHROPIC_SMALL_FAST_MODEL still get the main model for prompt hooks by another route.
Claude Code now reads only about the first 16 MB of an MCP listing and returns an error for directory listings that are too large
On Linux and WSL, when the system clipboard copy works in a VTE terminal such as GNOME Terminal, Claude Code no longer also sends OSC 52
Sandbox options passed in now merge with your sandbox settings, deny lists add up, and failIfUnavailable defaults to true
On resume, saved MCP tasks that used the 2025-11-25 tasks protocol are dropped, not restored, and are not cancelled on the server
One route for MCP tool calls now always makes a plain call instead of asking the server to run it in the background
Unclear Whether MCP servers still receive background-task tool calls through the remaining mechanism, and under what conditions, is not settled.
Claude Code no longer tells MCP servers it can handle requests for your input as background tasks; it still supports plain input requests
Published verbatim by Anthropic for v2.1.296. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 79 bullets, 15 name something an entry on this page also names, 27 name something no entry here does, and 37 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
code key to the Claude apps gateway's managed.policies[]: the same settings as cli, also applied in Claude Desktop's Code tab; beside desktop, it turns on Claude Desktop's gateway mode
No entry names this autoCompactWindow to subagent frontmatter and --agents definitions, so a subagent can auto-compact earlier than the main conversation's window
Probably agent-definitions-can-carry-an-autocompactwindow-passed-to, agent-auto-compact-threshold-now-takes-a-second-window-sourc, plugin-agent-frontmatter-gains-autocompactwindow-passed-thr CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run every workflow agent on one model while other subagents keep theirs
Probably new-env-var-claude-code-workflow-subagent-model-overrides-th CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS environment variable to set a longer maximum delay for the backoff when retrying an overloaded (529) request
No entry names this /plugin on a plugin whose hooks are left out because another enabled plugin has the same name
No entry names this allow_large option to the Read tool so Claude can read a text file past the usual size limits in one call when it needs the whole file and the context has room
Probably read-tool-allow-large-override-messages-added, read-tool-gains-allow-large-option-sized-to-remaining-contex PreToolUse hooks that deny a tool call with "continue": false, and managed prompt hooks that block one, refusing the call but not ending the turn
Probably pretooluse-hook-stop-reason-is-appended-correctly, pretooluse-hook-stop-attachment-helper-and-422-to-400-error updatedMCPToolOutput in some sessions
Probably posttooluse-hooks-can-rewrite-mcp-tool-output-via-updatedmcp .mcp.json or plugin MCP server that was switched off for that folder, after changing directory or reloading plugins
Probably telemetry-for-auto-approved-project-mcp-servers, project-mcp-config-skipped-when-a-flag-checked-helper-is-on allowedProviders with "gateway" locking out laptops that name that gateway in user settings
Probably managed-settings-env-now-injects-a-computed-anthropic-base-u forceLoginMethod to gateway with no forceLoginGatewayUrl (regression in 2.1.295)
Probably gateway-login-method-now-counts-as-gateway-required --teleport opening an empty conversation when the session's history could not be read
No entry names this #95873[BUG] Regression since ~2026-09-12: Remote Control sessions have 0 teleport-events, so opening them from another machine (VS Code Remote tab / --teleport) yields an empty session (worked 2026-08-26 → 09-11) Open
52;c;… escape sequence printed on screen after copying in older VTE-based terminals such as MATE Terminal
No entry names this /diff panel or dialog was open
No entry names this #99026[BUG] Built-in /diff pane holds mod toasts, undocumented and contradicted by the screen map Open
UserPromptSubmit hook or a mod's prompt.submit hook ending headless sessions, clearing the typed prompt, or letting the unchecked prompt through
Probably prompt-submit-hook-interrupted-while-checking, input-hooks-interrupted-by-abort-now-return-interrupted-resu, prompt-submit-hook-handling-blocked-prompt-tracking-and-abo, interrupted-while-prompt-checked-handling, userpromptsubmit-hook-cancellation-distinguishes-interrupts claude self-hosted-runner printing misleading errors when registration is refused: it now names the org admin setting, or says a restarted on-demand runner needs a fresh work order
No entry names this --capacity above 1
No entry names this $ methods running in the main session's working directory instead of the calling agent's, and ignoring the turn their calling hook holds
Nothing to match on $.agent.register succeeding from a mod's hook that was still running after the mod was reloaded or removed; the call is now refused
No entry names this $.http.fetch in mods refusing a HEAD request when the response declares a Content-Length over the 4 MiB body limit
Probably custom-headers-check-function-replaced-and-git-subprocess-e, api-client-adds-per-request-extra-headers-and-awaits-a-heade, git-commit-detection-from-reflog, web-fetch-head-requests-skip-the-content-length-size-refusa, new-x-claude-code-wiggly-dove-request-header-off-by-default claude plugin marketplace add, marketplace update and plugin install failing with an internal error for a marketplace named like constructor; add now refuses such names clearly
Probably plugin-install-gets-replace-for-same-repo-duplicates-mcp constructor or prototype being deleted by the next save of that plugin's options
Nothing to match on CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a finished turn after a restart when an MCP tool result had ended that turn
No entry names this BASH_ARGV0 shell variable and then use it; these now prompt for approval
Probably bash-variable-list-adds-bash-argv0 ← being run twice, once unseen in the foreground, when the background service was slow to answer
Nothing to match on ← moved the session to the background; it is still not sent, but ↑ now brings it back
Nothing to match on /clear in headless sessions
No entry names this /mcp or claude mcp when an MCP server needs authentication
Probably auth-needed-prompt-for-remote-sessions-without-oauth, remote-environment-classifier-and-ccr-artifacts-endpoints /code-review ending on a raw JSON array in cloud sessions, the Agent SDK and IDE integrations; the findings now print as a numbered list
No entry names this tool_result events missing git_commit_id after git commit -q or git -C <dir> commit
No entry names this #95934OTel: git_commit_id still silently dropped for `git -C <path> commit` and quiet/redirected commits (2.1.278) — recurrence of #77237 Open
CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping a message from the saved transcript when its text held a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this claude purge leaving a prompt in the history file when its text held a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this claude plugin install failing for GitHub owner/repo plugin sources on machines with no GitHub SSH key; the clone is now retried over HTTPS
No entry names this rm -rf /c/Users/<name> in Git Bash not asking in bypass permissions mode
No entry names this code settings, the reason shows as a reply
Nothing to match on --debug output to name unrecognized frontmatter fields in custom agent files, with a hint for likely typos
No entry names this --debug output for hooks: command hooks on tool calls, prompts, SessionStart and Stop now log their command, plugin, outcome and duration when they finish, so a slow hook is identifiable
No entry names this CLAUDE_CODE_TRANSCRIPT_LOCAL_GC: a large transcript file is no longer rewritten when that would free under 10% of it
No entry names this /cost, the status line, --max-budget-usd and the SDK's cost figures to price Sonnet 5.5 cache reads at $0.10 per million tokens (was $0.20)
No entry names this ←: a turn or ! command started while the session moves to the background is now stopped instead of finishing out of sight
Nothing to match on claudeCode.spinnerVerbs missing from the extension's settings, so settings.json now completes and validates it; a malformed value no longer breaks the chat panel
No entry names this @browser, as the terminal does; allowing a site for the session stops repeat asks
No entry names this prefersReducedMotion setting
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
910 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 43 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?