You can now set subagentInheritVerifiedTurns to true so subagents start with your earlier verified messages. MCP servers can now provide skills to Claude Code. Each skill's size and fingerprint is checked against the server's list before it loads. With CLAUDE_CODE_ENABLE_SHARE_BUNDLE set, /share sends your whole session transcript along with your feedback. In remote sessions, CLAUDE_CODE_REMOTE_MCP_CONFIG points the runner to a file of MCP servers sent by the host. Routing WebFetch through a proxy now depends on CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY instead of being worked out from session state.
19 entries are in the build but not switched on yet. Claude Code can fetch context for a claude.ai Project into a session, but only once it is turned on remotely. Apps built on the SDK will be able to word their own permission prompts from a PreToolUse hook. A stricter plan mode check can ask before any action that is not read-only. Project tools can read an uploaded PDF or Word file as the original document. Agents may later start in the background by default.
MCP allow rules no longer approve tools from a different MCP server. On Windows, sandboxed git now gets your git name and email for commits. Environment variables from settings or /env now reach sandboxed Windows commands too. The resume command printed on exit now includes --worktree for worktree sessions. If CLAUDE.md fails to load, Claude Code tries again later in the session. The MCP tasks feature is now off for everyone and can no longer be turned on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Remote runners get host-delivered MCP servers through CLAUDE_CODE_REMOTE_MCP_CONFIG, and --mcp-config sources are filtered by scope and ownership
Sessions & agents/feedback bundles can now carry a transcript.jsonl file, and /share can send the whole transcript when CLAUDE_CODE_ENABLE_SHARE_BUNDLE is set
In the agent view, /model opens a picker and model, effort and fast mode can be set for new sessions from that window without being saved
Sessions & agentsFive new CLAUDE_CODE_* environment variables tune startup, changed-file checks, MCP loading and transcripts, and are forwarded to remote sessions
Platform & internalsThe self-hosted runner can wait up to --shutdown-drain-sec seconds for running work on SIGTERM, and supports a tool-server session kind
Elsewhere
tengu_glowing_lark gate controls background launch and MCP task codeSessions & agentsWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
tengu_glowing_lark gate controls background launch and MCP task code#A new gate, tengu_glowing_lark, sits in front of background-launch settings for agents and several MCP task and worker-wake paths
Unclear Whether the remote setting actually controls background launch is not known.
Claude Code can fetch context for a claude.ai Project into the session, behind a switch that is off unless turned on remotely
Remote runners get host-delivered MCP servers through CLAUDE_CODE_REMOTE_MCP_CONFIG, and --mcp-config sources are filtered by scope and ownership
Unclear What CLAUDE_CODE_REMOTE_MCP_CONFIG does when set is not stated.
/feedback bundles can now carry a transcript.jsonl file, and /share can send the whole transcript when CLAUDE_CODE_ENABLE_SHARE_BUNDLE is set
In the agent view, /model opens a picker and model, effort and fast mode can be set for new sessions from that window without being saved
Unclear Whether the effort and fast-mode choices can actually be set yet is not known; only the model choice was traced to /model.
Five new CLAUDE_CODE_* environment variables tune startup, changed-file checks, MCP loading and transcripts, and are forwarded to remote sessions
Unclear It is not clear which values CLAUDE_CODE_JIT_POLICY_AFTER_STARTUP accepts besides 1.
Agent tool calls can now default to running in the background, a new message can refuse background launches, and the tool checks working folders
Unclear It is not clear what decides whether a subagent now defaults to the background.
Overage consent and usage-credit billing can now be decided per model through tengu_saffron_lattice, instead of once for the whole plan
Unclear Which models are billed this way is set remotely and is not stated.
Messages sent to a bridge address can find a connected MCP server's send_message tool, but only when the tengu_flickering_lagoon flag is on
Claude Code now sends is_ultracode_active with session state, so remote and bridge clients can tell when ultracode is on
Unclear It is not clear how ultracode mode is turned on or which models qualify.
mcp serve adds a minimum-version variable and managed-hook tools, and --session-tunnel watches its runner and stops when its stated token expiry passes
The artifact publish tool takes old_str/new_str edits, applies them to the local file, publishes it, and reports edits applied or not written
The output a hook returns can now include an optional field meant only for the desktop app
Plugin hook modules can respond to more events, while plugins people install themselves face limits where an organization manages Claude Code
Unclear Whether the remote switch covers all of these changes or only the warning text is not clear.
Installed plugin mods now load or unload when their rollout switch changes mid-session, and a turn waits for your organization's mods to load
Unclear The rollout switch's name and its default are not stated, so it is unclear whether installed mods are on for a given account.
The VS Code extension has two new remotely controlled settings, about stored startup configuration and Python, that are on by default
Unclear It is not known what either setting does in the VS Code extension.
Apps embedding Claude Code can supply the wording of a permission prompt from a PreToolUse hook, off unless switched on remotely
The fleet view has groundwork for a settings picker that pauses typing while open, but the code that would use it does nothing yet
The agent view gained the internal state needed to open, close and move through a settings picker
Unclear Whether the settings picker is actually shown anywhere in this release.
With subagentInheritVerifiedTurns set to true, subagents start with the main session's earlier verified user messages, trimmed if long
Unclear Whether subagentInheritVerifiedTurns is something a user can set in their own settings is not stated.
Claude Code can load skills listed by MCP servers, checking each one's size and fingerprint against the server's list first
Unclear It is not clear whether loading skills from MCP servers is switched on by default.
A new maxImageTokens limit lets image resizing cap images by token count, and one model's limit moves from 2000x2000 to 2576x2576 with a 4784-token cap
Unclear Which model gets the higher limits is not stated.
With CLAUDE_CODE_HOVER_REST on, a diskless session loads config only from its storage service, uses defaults if that fails, and skips backups
Claude Code now suggests publishing a mod to your organization's library when it can, and otherwise a GitHub repository, public or private
Unclear Which conditions turn this sharing guidance on is not stated beyond an organization setting being involved.
Claude Code now waits for plugins to finish setting up before a turn, and refuses to start if your organization's mods cannot be loaded
Typing /effort or /fast in agent view now sets effort or fast mode for new sessions from that window instead of showing an unavailable hint
With a non-Anthropic ANTHROPIC_BASE_URL, the remote settings fetch withholds the API key; features it turns off are explained and gateway use is marked
Hooks can now return permissionDisplay in their output, next to additionalContext, to supply details for a permission prompt
Unclear Which hook event accepts permissionDisplay and how the prompt uses it is not shown.
Plugin hooks can now read, in chunks, the bytes of an image or document attached to the prompt being sent
Plugin hook modules can now call session.identity and prompt.media, mark registrations as withheld, and get fuller error details
Unclear What session.identity and prompt.media return or do is not stated.
A slim mode can blank file contents and command output in the copies of tool results Claude Code saves to disk
Unclear Where toolResultCopiesOnDisk is set, and whether a reader can set it, is not clear.
Routing WebFetch through the CCR proxy now depends on CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY instead of being worked out from session state
Unclear Which value of CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY turns the proxy on is not stated.
CLAUDE_CODE_DISABLE_FILE_MENTIONS#Claude Code now recognises a CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable, listed with other variables that turn features off
Unclear What the variable turns off when set is not stated; the name suggests @-mentions of files, but that is unconfirmed.
CLAUDE_CODE_LAZY_ENV_GETTERS#Setting CLAUDE_CODE_LAZY_ENV_GETTERS makes Claude Code read each environment variable only when it is first needed
An MCP server that can reach the account memory server but is not the cloud service's own entry is now refused at connect
Unclear It is not clear what the second check is that lets such a server connect anyway.
When a device key is held and a feature check passes, Claude Code now signs the request that creates a remote session
claude mcp serve reads a session id sent with each tool call#When Claude Code runs as an MCP server, it reads a session id from each call's anthropic/session metadata and warns when it is invalid
The plugin runtime's list next to tool.register and tool.list now also includes ui.log, env.get and env.set
Unclear It is not clear whether this list grants plugins these abilities, sets permissions for them, or does something else.
A tools entry naming an MCP server or ending in __* now expands to that server's tools, with a warning if none match
--disallow-tools option for running case files#A command that runs case files gains --disallow-tools, which keeps chosen built-in tools from Claude in every case
Unclear It is not clear which command this is or whether it is available to everyone.
The plugin eval runner accepts --disallow-tools and a per-case disallowed_tools list, and scores runs that end on an API error as 0
Sandbox file rules can now mark a path as literal, so it is matched exactly rather than treated as a pattern
Unclear It is not stated which setting a reader writes literal path entries in.
When you deny a tool permission, the turn now ends the same way an interrupt does, instead of Claude carrying on
Unclear Which kinds of sessions, such as headless or remote ones, this applies to is not stated.
The configuration for cloud and headless runs now accepts an optional disallowed_tools list next to allowed_tools
Unclear Whether Claude Code actually blocks the tools named in disallowed_tools is not shown, only that the setting is accepted.
An unrecognized model now gets a visible warning banner, and setting CLAUDE_CODE_MAX_CONTEXT_TOKENS can exempt first-party models from the check
Unclear Whether setting CLAUDE_CODE_MAX_CONTEXT_TOKENS now removes the unknown-model warning for first-party models is not settled.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
22 more of these are in What probably matters to you, above.
A plugin can now deny the automatic resume of a local agent left over from a previous session
19 more of these are in What probably matters to you, above.
Plan mode can run without a plan file, blocks write tools more firmly, and warns when the session started with bypass permissions
Unclear It is not clear which sessions get the fixed reminder.
The Remote Control bridge gains a sessions-watch stream that learns of new or changed sessions as they happen, controlled by four watch_* settings
Unclear The default value of watch_sessions is not stated, so it is unclear whether session watching is used by default.
A plugin can now refuse to let an agent or agent task resume, and new notices report denied resumes, refused calls and withheld results
project_read can return an upload's original file and project_write can take if_version to refuse a stale write, both behind tengu_mossy_wirth
Unclear What switches on the original and document-version options is not stated.
Plugin sync now tracks a listing stamp and loaded folders, and hosted sessions can reload account plugins at each turn when they change
Unclear Whether the server-controlled setting this check needs is switched on is not known.
--bg stops when it cannot be told apart from prompt text, and --exec joins the special launch flags#claude --bg now exits with an error instead of starting anything when the flag might be prompt text, and --exec is handled alongside other launch flags
MCP tasks that expire, are lost or ask a question the session cannot show now get clear messages, and such input requests cancel the task
Sandbox read and write grants now follow links folder by folder, drop risky entries on Windows, and handle glob patterns and read denies differently
On Windows, sandbox setup now grants folder and executable access, gives sandboxed git your name and email, and reports more on failures
Blocking hook errors now carry a noVerdict reason, a missing Git Bash blocks, and SDK messages gain a prompt_submit_outcome object
Rewind now checks a server-provided deadline against the service's clock instead of only looking at how old the conversation is
Claude Code's hardened git runner can run git inside an OS sandbox, and a sandbox problem is reported with exit code 126 and a stated reason
Unclear Nothing shows any part of Claude Code currently asking for sandboxed git runs, so it is unclear whether this affects anyone yet.
On WSL, deny, ask and edit permission rules can also be checked against the other mount spelling of a path, when a switch is on
On Windows, the sandbox now installs and renews its file deny rules itself; set CLAUDE_CODE_SANDBOX_LEAVE_DENIES_TO_SRT_WIN to turn this off
A plugin can now block events from waking a background agent, and blocked events are not delivered again
Files you @-mention can now be sent with their contents if Claude Code already read them, while files that are too large are marked unread
Unclear It is not clear what reads files ahead of time, or whether that happens in ordinary sessions.
Plugins reading policy settings now see managed MCP servers, and calls that time out get their own error
A model setting sent through apply_flag_settings must now be an object with "for" and "models" instead of a plain list of model IDs
Unclear Which setting under apply_flag_settings takes this value is not named.
Hook code from plugins you installed is skipped at startup unless a remote rollout switch answers in time; organization and built-in plugins still load
Unclear The name of the rollout switch and what it falls back to are not known, so it is unclear whether your own plugin hooks run by default.
Claude Code looks for a GitHub token in GH_TOKEN, GITHUB_TOKEN or enterprise variants, then falls back to gh auth token
A Remote Control inbox message that says it is from the owner is treated as from an unknown sender unless the server confirmed it
Some actions blocked by the permission checker now ask you first, defaulting to No; the chromeFloorBlockPrompts setting can turn this off
In a list of component types that also covers agents, output styles and LSP servers, keybindings changed from off to on
Unclear It is not stated what this list controls, so it is unclear whether plugins can now provide keybindings.
Agents are now told that a final report written as plain text is not delivered, and SendMessage gains new refusal messages
Unclear Which mode or setting this applies under is not stated.
A model option list now includes a fast mode switch labelled "Fast", with "Enable fast mode" and "Off"
Unclear Which screen shows this switch, and what decides whether it appears, is not stated.
Adding a folder mid-session now rebuilds the sandbox so shell commands stay out of it, with clear errors when that cannot be done
Unclear Which command or action adds a folder this way is not stated.
Subagent status summaries can now say a worker is waiting on its own background work, so its result may be interim and another update may follow
Auto mode's safety check is now told how to treat your earlier messages that are copied into a subagent's record, and what a trimmed record means
Auto mode's check of allowed MCP write tools now accepts rules from a command and adds a server-side decision path that is off by default
Sandboxed commands can no longer write to the dev-mods folder in Claude Code's config home or to more files next to remote settings
When you resume a session whose last reply was recently cut off, Claude Code now treats it as an interrupted turn and can nudge to continue
Unclear It is not clear what you actually see when this nudge applies.
Validating a plugin can now check the state keys it uses against an expected contract, with a custom message when one is refused
When auto mode checks a subagent or a handoff, it is now given the parent session's verified human turns instead of the raw parent messages
Unclear How this changes what auto mode allows or blocks for subagents is not stated.
If the service needed to publish an artifact cannot be reached, Claude is now told nothing was published and you must publish from the web
The note Claude Code adds when ultra effort starts now also appears on turns delivered remotely, not only on prompts you type
A teammate's permission request with host-specific wording is no longer passed on; the teammate is told to have the team lead run the call
Replies from teammates now carry their own label, and session state gains two fields recording whether ultracode was active
Claude Code now says when a paused background agent could not be resumed, or was not resumed and can be resumed by messaging it
When Claude Code lists skills from an MCP server, it now keeps declined entries with a reason instead of silently dropping them
A restriction tied to subscription sign-in no longer applies to some non-Enterprise, non-Team plans when a certain condition holds
Unclear Neither the condition that lifts the restriction nor what the restriction blocks is known, so it is unclear who is affected and what they can now do.
Resumed remote sessions recover cut-off foreground agents, a Stop on a waiting permission is confirmed stored before the turn ends, and cancellations are complete
Unclear It is not known whether CLAUDE_CODE_RESUME_INTERRUPTED_TURN is set by default in remote sessions.
MCP server reconnects now pass keepConnectionInUse, so a connection with tool calls still running is kept instead of torn down
--safe-mode is now shown in the agent list footer, carried over when jobs restart, and its how-to-leave hint is built on the fly
Unclear It is not clear what turns safe mode on.
MCP tool descriptions are limited per server, tool calls mark timing phases, and tool display data carries server_id, server_id_stamp and tool_name
Unclear It is not clear which servers get which description limit.
Plugin hooks gain turn.start and tool.register events, a managed-install notice, restoreArgument, and skill frontmatter passed to skill.prompt
Unclear The events whose plugin hooks are skipped are not named.
cancel_async_message can now be declined for a re-run of an interrupted turn#SDK cancels of a queued re-run that also answers other clients' messages are now declined until an interrupt lists the message
Claude Code no longer follows redirects on authenticated MCP requests and now discards the reply body to notification messages
Unclear It is not clear whether an MCP server that answers with a redirect still connects, or now fails.
Claude Code's list of things that drive cost gains maximum effort, workflows, always-on context and large tool results
Claude Code now checks each skill's name and may skip it as not offered or not shown, and drops duplicate skills from sources that aren't synced
Unclear Which skills the new check skips is not stated.
The usage breakdown now flags max effort, workflows, always-on context over 40k tokens and tool results over 10k tokens, with advice
project_write accepts an optional if_version and refuses to overwrite an existing doc that changed since that version
MCP servers a subagent asks for are skipped unless approved for the project, with a note to approve them through /mcp
Edit and Write now refuse files that are not valid UTF-8, contain NUL bytes or are UTF-16 big-endian, and write nothing
Unclear Whether the refusal itself is enforced in this release, or only the messages are present, is not confirmed.
Published verbatim by Anthropic for v2.1.299. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 190 bullets, 54 name something an entry on this page also names, 39 name something no entry here does, and 97 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents
Probably new-env-var-claude-code-disable-file-mentions CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later
No entry names this $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
Probably userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, plugin-input-refusal-gate-on-promptsubmit-and-commandr, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight
No entry names this --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
Probably runner-tool-server-sessions-and-shutdown-drain-logging, self-hosted-runner-sigterm-drain-with-shutdown-drain-sec skill.prompt hook receives
Probably plugin-hooks-module-only-plugins-count-as-having-hooks-res /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker
Probably usage-insights-add-four-new-suggestion-cards, fleetview-model-description-reworded, agent-view-model-picker-and-new-session-settings-for-model, agent-view-gains-effort-and-fast-typed-commands --safe-mode
Probably agentsconfig-panel-shows-safe-mode, safe-mode-is-now-a-respawn-flag-job-respawn-stripping-rew, safe-mode-hint-text-changed --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs
Probably evalworkflow-execution-disallowed-tools-merged-across-layer, eval-harness-gains-disallow-tools-and-per-case-disallowed, cloudheadless-session-config-accepts-disallowed-tools, new-disallow-tools-option-in-a-case-runner-cli-command CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy
Probably policy-managed-claude-code-attribution-header-is-protected-f CLAUDE_CODE_ATTRIBUTION_HEADER=0
Probably policy-managed-claude-code-attribution-header-is-protected-f queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
Probably plugin-hook-modules-managed-policy-restrictions-and-new-ses /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code
No entry names this /usage warnings for max effort, workflows, always-on context and large tool results
No entry names this apiKeyHelper was in use
No entry names this ANTHROPIC_BASE_URL ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation
Probably headless-run-host-with-max-turns-max-budget-usd-limits .claude in it
Nothing to match on UserPromptSubmit or mod prompt.submit hooks were still running (regression in 2.1.296)
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, plugin-input-refusal-gate-on-promptsubmit-and-commandr, prompt-submit-hook-chain-rewritten-to-handle-slash-commands, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox
No entry names this --debug, --debug-file), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
Probably warning-when-skill-or-command-names-are-refused -c scripts that don't run rm. An rm built at run time in a script Claude Code can't read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1
Probably strict-inline-shell-rm-prompt-new-env-var-and-tengu-pale-ke #99320Inline-shell rm check (2.1.288) asks in bypass mode on bash -c $'...' scripts that contain no rm Open
#99249Inline-shell rm check (2.1.288) asks on zsh -c scripts that contain no rm Open
#100884Inline-shell rm check flags a command with no -c shell script and no rm (bash script.sh + python3 -c in a loop, bypass mode) Open
#100848Bash safety check says a `sh -c` script "runs rm" when it does not (only with a `cd … &&` prefix) Open
#99630Inline-shell rm check asks on bash -c with a $VAR command and a {…,…} argument (no rm present) Open
#100850Bash safety check says "This shell -c script runs rm" for `$VAR … -- sh -c '…'` with no rm anywhere (bypass mode) Open
#99894False-positive deletion check: read-only compact Bash command flagged as running rm (2.1.291) Open
claude mcp list, claude doctor and /status reporting an empty .mcp.json as invalid
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, blank-project-mcpjson-is-read-as-no-servers /btw jumping the transcript to the bottom when asked while scrolled up in fullscreen
Probably btw-side-question-keeps-scroll-position bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode when the sandbox can write to the Windows drive
Probably wsl-mntwslgdistro-added-to-mount-list, wsl-path-rules-also-matched-through-second-root-mount-gate claude remote-control sessions
No entry names this #87146[BUG] ScheduleWakeup never fires in Remote Control child sessions (sdk-cli bridge) even though the session stays alive and task notifications are delivered Closed
prompt.submit rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
Probably userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, plugin-input-refusal-gate-on-promptsubmit-and-commandr, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id .config.json in the config directory
Probably config-file-path-choice-changed /sandbox reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why
Probably sandbox-settings-save-reports-failure, sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-install-passes-program-permission-result-to, sandbox-command-now-reports-result-of-settings-write constructor or prototype in an MCP config never being connected
Nothing to match on constructor or toString asking for permission in auto mode and bypass permissions mode
No entry names this .catch, being run again without end when it waits on another mod's noun that does its work outside the call
Nothing to match on availableModelsMatch: exact or deniedModels blocks; it now answers 400 and leaves them out of its model lists
Probably gateway-supports-a-deniedmodels-denylist ANTHROPIC_BASE_URL
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening ANTHROPIC_BASE_URL being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening tool.describe or prompt.section answer that changed after $.ui.invalidate never reaching Claude; the new answer is now sent on the next turn
No entry names this enabledMcpjsonServers or disabledMcpjsonServers held a single server name (letters, digits, - or _) as a plain string
No entry names this #100254[BUG] enabledMcpjsonServers in settings.json changes from an array to a string without notice, then fails validation ("Invalid settings") Open
claude plugin test pausing a hook's time budget while a served $ method it had called kept making $ calls after answering
No entry names this next(), returns, or sends to a $ method being refused whole when one of its getters throws a RangeError; now only that key is refused
No entry names this /usage, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (anthropics/claude-code#92238)
No entry names this mcp__<server>) not applying when the server's normalized name contains a double underscore
No entry names this plugin_loaded telemetry event reporting has_hooks as false for plugins whose hooks are a hooks module, built-in plugins included
No entry names this ANTHROPIC_BASE_URL); Anthropic API keys are still sent
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening $ to a function declaration imported from another file of the mod
Nothing to match on __proto__ keys silently removed, which could skip a tool.check guard on a tool call another mod made
Probably policy-blocked-mcp-servers-now-report-richer-failure-info-r, cron-minute-rounding-and-settings-proto-guard, hook-default-responses-become-functions-with-reason, plugin-runtime-mods-gain-uilog-envget-envset claude -p saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
No entry names this forceLoginOrgUUID
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta claude mcp list, claude mcp get and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
No entry names this #95020[BUG] `claude mcp list` ignores allowedMcpServers/deniedMcpServers — empty allowlist still returns every server connected Open
/reload-plugins not loading a plugin installed from another terminal a moment earlier
Probably plugin-hook-registration-deferred-and-awaited-at-startup-pl --bare, which keeps the mode; they now name /stop and claude --resume, as safe mode ones do
Probably stderr-writes-are-bounded-dropped-messages-reported, resume-hint-now-includes-worktree-flags-and-advice, exec-added-to-a-list-of-cli-flags-next-to-resume-session, await-claim-error-message-names-the-subprocess-sandbox, safe-mode-hint-text-changed, fetch-size-check-skips-for-certain-status-codes-self-hosted ← not saying why it stayed put over a queued message while Remote Control is on
Nothing to match on $.http.fetch in mods refusing a 304, 204 or 205 response that declares a Content-Length over the 4 MiB body limit
No entry names this /config push notification toggles sending your account the previous setting instead of the one you just chose
No entry names this --input-format stream-json running together without a line break when merged into one turn
No entry names this --exec-path wrapper's own --mcp-config when connectors change mid-session
Probably mcp-mcp-config-handling-and-remote-control-remote-tool-cal, claude-code-remote-mcp-config-runner-receives-delivered-mcp claude plugin eval passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
No entry names this forceLoginOrgUUID and forceLoginMethod from MDM or the managed-settings file being hidden or replaced by server-managed settings
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta --bare sessions leaving out an MCP server named constructor or prototype that --channels asked for
Probably safe-mode-hint-text-changed /clear reattaching to the Remote Control session of the conversation after it
No entry names this #99717Remote Control: /clear and in-process /resume share one remote session across conversations; phone messages route to whichever conversation the holding process has loaded Closed
/, sent with the Agent SDK's verbatimPrompts option, running as a slash command when CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran it after a restart
Probably remote-resume-can-recover-cut-off-foreground-agents --safe-mode silently leaving safe mode when the session was woken or restarted
Probably safe-mode-is-now-a-respawn-flag-job-respawn-stripping-rew, safe-mode-hint-text-changed /btw side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
Probably btw-side-question-keeps-scroll-position denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-filesystem-grant-checks-rewritten, sandbox-credentials-schema-wording-stderr-writes-may-be-dro allowRead and allowWrite entries not being re-checked when the directory they start from is replaced by a symlink
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-filesystem-grant-checks-rewritten claude mcp add <name> -- <command> --background being started as a background session
No entry names this --bg or --background to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
Probably bg-refuses-when-the-flag-cannot-be-told-from-prompt-text --worktree sessions leaving a folder behind in .git/worktrees in repositories using git's reftable ref storage
Probably resume-hint-now-includes-worktree-flags-and-advice, worktree-creation-refuses-bare-repository-layouts-with-a-cle claude self-hosted-runner sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
No entry names this ultracode is on in settings
Nothing to match on #101541[BUG] Desktop scheduled tasks lost ultracode in 2.1.289: "Ultracode is on" reminder skipped on scheduled-trigger turns Open
headers/headersHelper values, which broke servers behind an authenticating proxy
Probably mcp-configured-headers-on-oauth-discoveryrevocation-reser <head> is published again unchanged
Nothing to match on $.ui.open reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and claude -p
No entry names this #101403[BUG] VS Code extension: mod Pane never draws, but $.ui.open resolves { isPlaced: true } Open
#99401[FEATURE] VS Code extension: draw function-hook mod UI (AbovePrompt band, Pane) Open
agent.spawn mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries resume, and a mod can refuse it
Probably hook-default-responses-become-functions-with-reason, subagent-cwd-is-refused-with-a-clear-error claude plugin validate rejecting a mod's $.state references when plugin.json has no types key and the contract is at ./types/index.d.ts
No entry names this dimColor text looking the same as plain text under the dark ANSI theme and on 16-color terminals
No entry names this PreToolUse hook or a mod's tool.check hook allowed
Probably hook-failure-on-pretooluse-can-carry-advice-onfailure-conti, hook-default-responses-become-functions-with-reason, tengu-linear-owl-gates-host-worded-permission-display-from-p, plugin-runtime-mods-gain-uilog-envget-envset SendMessage not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
Probably stopped-agents-refused-for-resume-via-sendmessage-live-agen, subagent-report-delivery-and-send-message-errors, send-message-via-an-mcp-bridge-tool-behind-tengu-flickering CLAUDE_CODE_RESUME_INTERRUPTED_TURN sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step
Probably remote-resume-can-recover-cut-off-foreground-agents $.env.set changing the environment or shell prefix that command hooks from managed settings start with
No entry names this setup and doctor say when the runner's machine has no git credentials
Nothing to match on --retire-at and delaying shutdown
No entry names this claude auth login
Probably cloud-launch-error-messages-and-git-bundle-advice anthropic-skills: prefix to it
No entry names this /reload-skills to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
Probably reload-skills-message-changed < or > is no longer offered until renamed; such a name: is ignored
Nothing to match on ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it
No entry names this claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does
No entry names this mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name
No entry names this tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*
No entry names this MCP_PROTOCOL_NEGOTIATION=legacy opts out
No entry names this api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters
Probably result-messages-gain-api-error-origin PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied
Probably permission-prompt-deny-answers-skip-permissionrequest-hooks, auto-mode-hooks-cannot-approve-tools-via-permissionrequest -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
Nothing to match on /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
Probably btw-side-question-keeps-scroll-position UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, prompt-submit-hook-chain-rewritten-to-handle-slash-commands UserPromptSubmit hook to first run on the prompt after the one that invokes the skill
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, prompt-submit-hook-chain-rewritten-to-handle-slash-commands turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)
Probably hook-turnstart-now-counted-when-deciding-whether-hooks-are /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env
Probably empty-repo-error-message-reworked, upload-failure-advice-now-says-to-commit-changed-files-by-na A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 27 tool descriptions changed.
Claude Code, interactive mode
11 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
679 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 88 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?