MCP tools that take file inputs can now accept local file paths. Claude Code uploads the file and passes the tool a reference instead. The Read tool's new allow_large option lets Claude read an oversized text file when there is room left in the conversation. Hook commands now take an on_failure setting of continue or block. You can set CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to choose the model subagents use during a workflow run. Administrators can switch off messaging beyond a user's own agents with the managed setting messagingBeyondOwnAgentsDisabled.
This build holds 11 features that are not switched on yet. Claude can ask a subagent for lower or higher effort than its own, but the option is off by default. A session moved to the cloud from auto mode is being prepared to stay in auto mode. Remote sessions gain a check that probes a stream after about 8 seconds of quiet. That check is controlled remotely and is not on yet. A new restriction could limit an agent to messaging only its own agents.
Messages you typed ahead are no longer lost when a turn is cancelled. They go back into the input box or to the front of the queue. A PreToolUse hook that blocks a tool now shows its full reason in the error. Workspace diffs now follow renamed files and show deleted files as removed. On Windows, MCP servers now get a chance to shut down cleanly before being force-closed. Resumed sessions no longer restore saved MCP tasks from the 2025-11-25 tasks protocol.
Written by our agent from the shipped bundle, not by Anthropic.
allowedProviders can now set ANTHROPIC_BASE_URL automaticallySettings & configCLAUDE_CODE_AGENT_PROGRESS_SUMMARIES, CLAUDE_CODE_SLEEP_COMPACT_AFTER_MS and CLAUDE_CODE_RESUME_SESSIONSTART_HOOKS_WAIT_MS are new and are read by Claude Code
SDK set_model requests can swap the system prompt only if a named model is running, failing with model_not_current otherwise; Remote Control refuses it
Sessions & agentsA managed setting, messagingBeyondOwnAgentsDisabled, now turns this feature off and overrides CLAUDE_CODE_HARBOR_KITE
Gateway policies can use a code block for Claude Desktop's Code tab, cannot mix it with cli or settings, and get clearer warnings about serve_to_desktop
Platform & internalsModel catalog entries can set min_claude_code_version, and older clients see the model as unavailable with a message naming the version to update to
Extensions.mcp.json files can now be skipped when loading MCP serversExtensionsWant the reasoning? Read walks the 38 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
A backgroundLaunchRule can now veto moving a foreground agent to the background, and new policy getters cover agent moves and cross-agent messaging
Unclear How these two values are set, and whether a user or administrator can set them, is not stated.
A managed setting, messagingBeyondOwnAgentsDisabled, now turns this feature off and overrides CLAUDE_CODE_HARBOR_KITE
Gateway policies can use a code block for Claude Desktop's Code tab, cannot mix it with cli or settings, and get clearer warnings about serve_to_desktop
A new restriction lets messages go only as plain text to agents in the same session or to the main agent
Unclear When this restriction is switched on is not known.
Claude Code gains a restriction that appears to stop an agent from messaging anything beyond its own agents
Unclear Which setting or mode turns this restriction on is not known.
allowedProviders can now set ANTHROPIC_BASE_URL automatically#When managed settings use allowedProviders, Claude Code may set ANTHROPIC_BASE_URL itself unless the managed settings already set it
Unclear It is not clear what address Claude Code sets or which setups meet the conditions.
code section as well as cli#Entries in managed.policies now accept a code key in addition to cli, and validation messages point to whichever one the entry uses
Unclear Which settings belong under code rather than cli is not stated.
With forceLoginMethod set to "gateway" and no forceLoginGatewayUrl, Claude Code now treats gateway login as required
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
12 more of these are in What probably matters to you, above.
A new check decides when Claude Code waits for organisation policy limits, and the tengu_org_policy_denied fallback value moved from 60 to 1
Unclear It is not stated what this check controls or what the fallback value change does.
Claude Code's file upload code now checks files after sending, refuses credential files, limits sizes and is tied to an organization policy
Unclear It is not known how this upload is started or whether the allow_cobalt_plinth policy allows it by default.
A new denyMatchNames list adds extra names for deny-rule matching on prompt-type commands and feeds reserved labels for MCP-loaded tools
Unclear Which commands get these extra names, and what the names are, is not known.
Runners now check remote.origin.url in cloned repositories, correct or log it, and fetch through a temporary remote with credentials passed separately
Self-hosted runners now check governed repositories' origin, note pending settings, and report several new diagnostic stages
Claude Code can now warn that rules your organization sets on a gateway, such as blocked commands, may not apply to it
The runner now sends its Claude Code version when it starts up, and its drain and exit messages differ when started from a work order
Repository setup now adds origin with the plain upstream URL instead of the credentialed one, and git subprocesses no longer inherit GIT_CONFIG
Unclear What Claude Code does when the ANTHROPIC_CUSTOM_HEADERS values match or differ is not known.
The built-in troubleshooting table for self-hosted runners now covers unenabled organizations, single-use work orders and on-demand poll auth failures
Prompt hooks now use their own configured model or the default small model, without a gateway special case
Unclear It is not settled whether gateway setups without ANTHROPIC_DEFAULT_HAIKU_MODEL or ANTHROPIC_SMALL_FAST_MODEL still get the main model for prompt hooks by another route.
Claude Code no longer warns about a gateway when it reports no Code tab rules, and says when the check could not be made
Self-hosted runners now say when a work order is used up or when the organization has not allowed self-hosted environments
When cloud sessions are blocked by organization policy, the message now says which API key or token Claude Code checked the policy for
Gateway connections now say the certificate is for another name instead of showing a generic secure-connection error
Self-hosted runner errors about lock_to_account_id now point to --lock-to-account and say the value must be an organization member
When counting tokens on Bedrock, Claude Code now builds the thinking settings for your configured model instead of using a fixed budget
5 more of these are in What probably matters to you, above.
Managed settings entries can now set underCode, which builds the desktop session's settings from the CLI settings without needing serve_to_desktop
New managed-settings plumbing can detect a gateway serving /managed/settings and verify signed documents saying no settings exist, with an expiry
Unclear Nothing was seen using this check, so whether it runs at all in this version is not known.
In VS Code, two server-controlled settings are now refreshed only when the product feedback setting changes
The conditions for running without policy limits when none can be fetched are unchanged, and only internal names moved
Permission records for MCP tools now carry a reason code when the server's highest allowed permission is ask
A usage report for denials now includes session_archived when the session had been archived
Metrics counting lines added and removed now label the model with a normalised name instead of the raw value
Unclear It is not clear how the model name is normalised, so the new label values are unknown.
Requests Claude Code builds for Amazon Bedrock now also pass along the model you configured
Unclear What passing the configured model to Bedrock changes, and what the new switch controls, is not stated.
Published verbatim by Anthropic for v2.1.296. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 79 bullets, 15 name something an entry on this page also names, 27 name something no entry here does, and 37 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
code key to the Claude apps gateway's managed.policies[]: the same settings as cli, also applied in Claude Desktop's Code tab; beside desktop, it turns on Claude Desktop's gateway mode
No entry names this autoCompactWindow to subagent frontmatter and --agents definitions, so a subagent can auto-compact earlier than the main conversation's window
Probably agent-definitions-can-carry-an-autocompactwindow-passed-to, agent-auto-compact-threshold-now-takes-a-second-window-sourc, plugin-agent-frontmatter-gains-autocompactwindow-passed-thr CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run every workflow agent on one model while other subagents keep theirs
Probably new-env-var-claude-code-workflow-subagent-model-overrides-th CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS environment variable to set a longer maximum delay for the backoff when retrying an overloaded (529) request
No entry names this /plugin on a plugin whose hooks are left out because another enabled plugin has the same name
No entry names this allow_large option to the Read tool so Claude can read a text file past the usual size limits in one call when it needs the whole file and the context has room
Probably read-tool-allow-large-override-messages-added, read-tool-gains-allow-large-option-sized-to-remaining-contex PreToolUse hooks that deny a tool call with "continue": false, and managed prompt hooks that block one, refusing the call but not ending the turn
Probably pretooluse-hook-stop-reason-is-appended-correctly, pretooluse-hook-stop-attachment-helper-and-422-to-400-error updatedMCPToolOutput in some sessions
Probably posttooluse-hooks-can-rewrite-mcp-tool-output-via-updatedmcp .mcp.json or plugin MCP server that was switched off for that folder, after changing directory or reloading plugins
Probably telemetry-for-auto-approved-project-mcp-servers, project-mcp-config-skipped-when-a-flag-checked-helper-is-on allowedProviders with "gateway" locking out laptops that name that gateway in user settings
Probably managed-settings-env-now-injects-a-computed-anthropic-base-u forceLoginMethod to gateway with no forceLoginGatewayUrl (regression in 2.1.295)
Probably gateway-login-method-now-counts-as-gateway-required --teleport opening an empty conversation when the session's history could not be read
No entry names this #95873[BUG] Regression since ~2026-09-12: Remote Control sessions have 0 teleport-events, so opening them from another machine (VS Code Remote tab / --teleport) yields an empty session (worked 2026-08-26 → 09-11) Open
52;c;… escape sequence printed on screen after copying in older VTE-based terminals such as MATE Terminal
No entry names this /diff panel or dialog was open
No entry names this #99026[BUG] Built-in /diff pane holds mod toasts, undocumented and contradicted by the screen map Open
UserPromptSubmit hook or a mod's prompt.submit hook ending headless sessions, clearing the typed prompt, or letting the unchecked prompt through
Probably prompt-submit-hook-interrupted-while-checking, input-hooks-interrupted-by-abort-now-return-interrupted-resu, prompt-submit-hook-handling-blocked-prompt-tracking-and-abo, interrupted-while-prompt-checked-handling, userpromptsubmit-hook-cancellation-distinguishes-interrupts claude self-hosted-runner printing misleading errors when registration is refused: it now names the org admin setting, or says a restarted on-demand runner needs a fresh work order
No entry names this --capacity above 1
No entry names this $ methods running in the main session's working directory instead of the calling agent's, and ignoring the turn their calling hook holds
Nothing to match on $.agent.register succeeding from a mod's hook that was still running after the mod was reloaded or removed; the call is now refused
No entry names this $.http.fetch in mods refusing a HEAD request when the response declares a Content-Length over the 4 MiB body limit
Probably custom-headers-check-function-replaced-and-git-subprocess-e, api-client-adds-per-request-extra-headers-and-awaits-a-heade, git-commit-detection-from-reflog, web-fetch-head-requests-skip-the-content-length-size-refusa, new-x-claude-code-wiggly-dove-request-header-off-by-default claude plugin marketplace add, marketplace update and plugin install failing with an internal error for a marketplace named like constructor; add now refuses such names clearly
Probably plugin-install-gets-replace-for-same-repo-duplicates-mcp constructor or prototype being deleted by the next save of that plugin's options
Nothing to match on CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a finished turn after a restart when an MCP tool result had ended that turn
No entry names this BASH_ARGV0 shell variable and then use it; these now prompt for approval
Probably bash-variable-list-adds-bash-argv0 ← being run twice, once unseen in the foreground, when the background service was slow to answer
Nothing to match on ← moved the session to the background; it is still not sent, but ↑ now brings it back
Nothing to match on /clear in headless sessions
No entry names this /mcp or claude mcp when an MCP server needs authentication
Probably auth-needed-prompt-for-remote-sessions-without-oauth, remote-environment-classifier-and-ccr-artifacts-endpoints /code-review ending on a raw JSON array in cloud sessions, the Agent SDK and IDE integrations; the findings now print as a numbered list
No entry names this tool_result events missing git_commit_id after git commit -q or git -C <dir> commit
No entry names this #95934OTel: git_commit_id still silently dropped for `git -C <path> commit` and quiet/redirected commits (2.1.278) — recurrence of #77237 Open
CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping a message from the saved transcript when its text held a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this claude purge leaving a prompt in the history file when its text held a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this claude plugin install failing for GitHub owner/repo plugin sources on machines with no GitHub SSH key; the clone is now retried over HTTPS
No entry names this rm -rf /c/Users/<name> in Git Bash not asking in bypass permissions mode
No entry names this code settings, the reason shows as a reply
Nothing to match on --debug output to name unrecognized frontmatter fields in custom agent files, with a hint for likely typos
No entry names this --debug output for hooks: command hooks on tool calls, prompts, SessionStart and Stop now log their command, plugin, outcome and duration when they finish, so a slow hook is identifiable
No entry names this CLAUDE_CODE_TRANSCRIPT_LOCAL_GC: a large transcript file is no longer rewritten when that would free under 10% of it
No entry names this /cost, the status line, --max-budget-usd and the SDK's cost figures to price Sonnet 5.5 cache reads at $0.10 per million tokens (was $0.20)
No entry names this ←: a turn or ! command started while the session moves to the background is now stopped instead of finishing out of sight
Nothing to match on claudeCode.spinnerVerbs missing from the extension's settings, so settings.json now completes and validates it; a malformed value no longer breaks the chat panel
No entry names this @browser, as the terminal does; allowing a site for the session stops repeat asks
No entry names this prefersReducedMotion setting
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
910 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 43 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?