You can now set subagentInheritVerifiedTurns to true so subagents start with your earlier verified messages. MCP servers can now provide skills to Claude Code. Each skill's size and fingerprint is checked against the server's list before it loads. With CLAUDE_CODE_ENABLE_SHARE_BUNDLE set, /share sends your whole session transcript along with your feedback. In remote sessions, CLAUDE_CODE_REMOTE_MCP_CONFIG points the runner to a file of MCP servers sent by the host. Routing WebFetch through a proxy now depends on CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY instead of being worked out from session state.
19 entries are in the build but not switched on yet. Claude Code can fetch context for a claude.ai Project into a session, but only once it is turned on remotely. Apps built on the SDK will be able to word their own permission prompts from a PreToolUse hook. A stricter plan mode check can ask before any action that is not read-only. Project tools can read an uploaded PDF or Word file as the original document. Agents may later start in the background by default.
MCP allow rules no longer approve tools from a different MCP server. On Windows, sandboxed git now gets your git name and email for commits. Environment variables from settings or /env now reach sandboxed Windows commands too. The resume command printed on exit now includes --worktree for worktree sessions. If CLAUDE.md fails to load, Claude Code tries again later in the session. The MCP tasks feature is now off for everyone and can no longer be turned on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Remote runners get host-delivered MCP servers through CLAUDE_CODE_REMOTE_MCP_CONFIG, and --mcp-config sources are filtered by scope and ownership
Sessions & agents/feedback bundles can now carry a transcript.jsonl file, and /share can send the whole transcript when CLAUDE_CODE_ENABLE_SHARE_BUNDLE is set
In the agent view, /model opens a picker and model, effort and fast mode can be set for new sessions from that window without being saved
Sessions & agentsFive new CLAUDE_CODE_* environment variables tune startup, changed-file checks, MCP loading and transcripts, and are forwarded to remote sessions
Platform & internalsThe self-hosted runner can wait up to --shutdown-drain-sec seconds for running work on SIGTERM, and supports a tool-server session kind
Elsewhere
tengu_glowing_lark gate controls background launch and MCP task codeSessions & agentsWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →19 more of these are in What probably matters to you, on page 1.
Claude Code no longer follows redirects on authenticated MCP requests and now discards the reply body to notification messages
Unclear It is not clear whether an MCP server that answers with a redirect still connects, or now fails.
Claude Code's list of things that drive cost gains maximum effort, workflows, always-on context and large tool results
Claude Code now checks each skill's name and may skip it as not offered or not shown, and drops duplicate skills from sources that aren't synced
Unclear Which skills the new check skips is not stated.
The usage breakdown now flags max effort, workflows, always-on context over 40k tokens and tool results over 10k tokens, with advice
deniedModels#The gateway now rejects models in a role's deniedModels list and hides them from the model list, alongside the availableModels allowlist
Claude Code now sends telemetry metrics to the customer metrics endpoint only when a check allows it; logs still go to the customer logs endpoint
Unclear It is not clear what decides whether metrics go to the customer metrics destination.
project_write accepts an optional if_version and refuses to overwrite an existing doc that changed since that version
MCP servers a subagent asks for are skipped unless approved for the project, with a note to approve them through /mcp
Edit and Write now refuse files that are not valid UTF-8, contain NUL bytes or are UTF-16 big-endian, and write nothing
Unclear Whether the refusal itself is enforced in this release, or only the messages are present, is not confirmed.
A runner orchestrator that is shutting down can now finish or hand back the sessions it already claimed, and logs a stop summary
Unclear Whether this orderly shutdown is used by default or only when the orchestrator is started with it is not known.
Claude Code no longer requires ANTHROPIC_AUTH_TOKEN to name claude-gateway as its audience and uses a different check instead
Unclear What the replacement check requires of the token is not stated.
If the sandbox fails to start, Claude Code retries without real-path twins, and otherwise refuses commands that would run inside it
In stream-json mode, slash commands that support inline output can now run while Claude is still working on a reply
Unclear It is not clear what condition decides whether this mid-turn path is used.
In auto mode, an allow answer from a PermissionRequest hook is now ignored for certain tools
Unclear It is not clear which tools this applies to.
Writing to a memory store or with project_write now needs if_version, and a write is refused if the document changed since it was read
Unclear It is not clear whether these tools are available by default.
In some sessions, resuming a background subagent now stops with a clear message if it was started in a worktree or its saved folder is refused
Unclear Which sessions count as diskless is not stated.
When Claude Code removes old media from a long conversation, it can now apply a separate size limit to documents such as PDFs
On Windows, the sandbox instructions now cover localhost limits, profile folder reads, certificate issues and placeholder files
! commands are skipped in terminals attached to a remote session#When your terminal is attached to a remote session, queued ! shell commands are skipped with a warning while other queued prompts still run
A client joining a shared session now warns if it dropped messages other clients sent while it waited for the session to start
Hooks that can't run in a cloud session or fail on another machine now return a clear reason, and shell prefix handling for plugin and skill hooks changed
A repeated side_question request now joins the one already running, and a run that doesn't answer in time is given up and stopped
With --permission-prompt-tool, Claude Code now checks whether a permission request carries wording from the host app instead of a local-only mark
Unclear What this changes in which requests the prompt tool or a hook ends up answering is not clear.
Permission prompts for inline shell commands such as bash -c now depend on whether the command contains rm or rmdir
Unclear Whether setting CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT brings back a prompt for every inline shell command or removes the prompt is not settled.
New messages tell you to commit the files you want a cloud session to see before you try again
The eval harness now fails when any run ended on an API error, even if all the scores pass
When a subagent's permission answer is a denial, Claude Code now skips PermissionRequest hooks instead of always running them
When a subagent's web page fetch is not approved, it is now told not to retry and to report the blocked address
Messaging an agent you stopped now returns a clear refusal, and a queued message tells Claude to wait instead of resending
Windows sandbox startup runs extra checks, and the sandbox setup is rebuilt when a plugin folder joins a running session
Unclear It is not clear whether a plugin folder that joins mid-session on Windows is brought into the sandbox or refused.
Fast mode and profile lookups now use an API key only when no OAuth login is available and the key starts with sk-ant-
The sandbox network proxy now checks each response's status and headers before forwarding it, rather than passing it straight through
Unclear What the new check rejects, and so which responses are now blocked, is not known.
Lists of disallowed tools from a base configuration and an override are now combined, so the base list no longer gets dropped
A session with Remote Control on now tells its Remote Control clients itself when files sent by reference did not arrive
Unclear Whether sending this notice is switched on for every session is not stated.
Plugins without a types field can now provide their types contract in a default file, and missing-path errors read more clearly
Agent task notifications now say when messages arrived too late and the agent is being resumed, and when a usage limit has paused its work
Plugin calls that submit a prompt or run a command are refused if you stopped the session and haven't typed anything since
The link to remote sessions can now watch a live stream with its own check intervals, skip repeated work, and limit reconnect retries
Unclear What turns the live stream on is not stated, so it is unclear whether a given setup uses it.
Claude Code now uses its saved copy of policy limits only when a signed copy verifies against the organisation; otherwise it starts without it
Unclear It is not known whether this stricter check is switched on for everyone or held behind a remote switch.
With CLAUDE_CODE_REMOTE set, Claude Code skips trusted-device enrollment and tells you nothing was sent to Remote Control targets
Registering MCP folders past a limit is refused, mcp_set_servers skips filtered servers with errors, and /mcp reports blocked servers
Unclear Which servers mcp_set_servers now filters out is not stated.
A beta listed in ANTHROPIC_BETAS that is now generally available is dropped from requests, and a debug message says so
In some cases Claude Code now leaves the Project and Local memory scopes out of its list, keeping auto-memory only when it exists
Unclear It is not clear when the shorter list applies or where it appears.
Under some conditions, the managed-settings value of CLAUDE_CODE_ATTRIBUTION_HEADER now wins over one passed in by the program that starts Claude Code
Unclear The conditions under which the managed value wins are not stated.
When a container restarts mid-turn, Claude is told which agents it launched were stopped and to resume them by messaging them
The size limit on images and media sent to the model now comes from new remote settings, with checks and a separate second limit
Unclear The actual limits, and which setups get the second limit, are not settled.
New instruction text says WebFetch is for links you gave or a tool returned, and that recalled or edited links may need approval
Unclear Whether this text is actually shown to the model during a session is not clear.
Mockups and HTML pages Claude builds now set side padding of at least 16px that grows to clear phone screen edges and notches
Default deny responses for plugin hooks such as tool.check and agent.spawn now include a reason alongside the decision
Claude in Chrome tool calls are now denied straight away with 'no browser connected' when no browser extension is attached
Updating a project document can now send a fingerprint of the content it started from, and reading a project can return a version
Resuming a teammate agent now checks plugin hooks first, and fails with an error if a hook denies it
At startup Claude Code now lists settings files that failed to load, including their hooks and permission rules, and entries it skipped
Headless runs now end with a stated reason: the turn limit, the spending limit, or the host closing its input
If Claude names a skill without its plugin prefix and exactly one enabled skill matches, the Skill tool now runs that skill instead of failing
A PreToolUse hook with onFailure: continue that does not finish lets the call run; otherwise the call is blocked with advice
MCP server failures, including servers blocked by managed policy, now share one error builder, and all reserved server names are rejected
Claude Code now refuses MCP servers at an address it reserves for itself and tells Claude that retrying will not help
CronCreate and CronList now give each job's next run time, and the scheduler shifts jobs by a per-job offset of up to 50% of the period
Unclear Whether the larger 50% / 30 minute offset applies to everyone or only to a version of the tool description that is switched on remotely is not known.
--tools or --disallowed-tools cannot block MCP tools#--tools now explains it cannot remove MCP tools, and cloud sessions warn when a --disallowed-tools connector wildcard blocks nothing
Unclear Whether this error appears only when starting a cloud session is not confirmed.
/btw keeps your scroll position and suggestions no longer block typing#/btw side questions no longer move the main conversation's scroll, and slow slash-command suggestions fill in later instead of holding up typing
Hook errors that block an action on a remote runner now say the runner refused, and the VS Code panel can learn when a command's hooks already ran
When an approval request sent to another machine goes unanswered or is withdrawn, Claude is now told the session stopped waiting
After a cloud session restarts, the note telling Claude about lost tool calls can say they are no longer shown and calls unknown tools 'another tool'
Engine elements in interface layouts Claude builds may now have only a type and a ref, and scaled spacing counts toward the layout limit
Unclear Which feature these layouts belong to, and so who sees this change, is not stated.
The message about a plugin trying to lift a deny rule in your settings is replaced by one saying something did not answer in time
Unclear It is not clear whether the ability for plugins to lift deny rules was removed or only its message moved.
NotebookEdit now refuses a notebook it reads as not being text, using a new check in place of the earlier decoding check
Unclear It is not clear whether notebooks in other text encodings are still refused, or only files that are not text at all.
Claude Code now explains how to trust a folder: run Claude Code there once, or set hasTrustDialogAccepted in the settings file
On Windows without Git Bash, Claude Code now warns once that skill commands and hooks run in PowerShell and suggests installing Git for Windows
Resuming a session now frees data fetched in advance once it is used, and interrupted-turn reports now note subagent calls that were cut off
If the permission check for a file write fails to finish, Claude Code now asks you, or refuses in plan mode, instead of continuing
The permission prompt for publishing now says how many edits it will also make to the file on disk
Claude Code now runs git status with --no-optional-locks, so it does not compete with your own git commands for git's lock
Hooks are now labelled as plugin, managed or repo, where managed hooks used to be labelled as repo
When a command's output is cut short, the notice now names the file where the start of the output was saved
If error output backs up for over 10 seconds and 1 MiB, Claude Code now drops it and leaves a notice saying messages were dropped
A new autocompact warning links to the docs on correcting the context window for a gateway or custom model id
Claude Code now checks reads blocked by permission rules in a narrower mode and against the project's real folder path
Unclear Whether the narrower mode blocks fewer reads, or blocks them differently, is not known.
When a feedback or session bundle lacks the transcript or has only part of it, Claude Code now tells you why
When a path matches a permission rule only indirectly, Claude Code now checks both paths point to the very same file on disk
Unclear What the further condition for operations other than deleting requires is not stated.
Commands a plugin registers now carry the plugin's name, and reserved network addresses are treated as blocked by policy
Unclear It is not stated which addresses count as reserved or what is blocked from reaching them.
Listing project commands no longer refuses a command because of where it was loaded from, and refusal messages now name the command
Unclear It is not clear which commands now appear in the project command list that were refused before.
When settings change while Claude Code is building a command's sandbox rules, it now starts over instead of using old rules
Setting the permission mode to auto now checks whether auto mode is available, and asks you to try again if that is not known yet
When a UserPromptSubmit hook or prompt.submit handler stops a prompt, Claude Code now records which kind of stop it was
On a machine whose default shell is PowerShell, a command hook that isn't set up for PowerShell can now be flagged with a "noBash" reason
Unclear How the "noBash" reason is shown to the user, or what it does to the hook, is not stated.
Information prepared for UserPromptSubmit hooks now includes the command and whether the prompt is an internal one
Unclear It is not confirmed that command and isMeta reach the input your hook script receives.
On macOS, the sandbox now adds a list of exact paths to block inside otherwise writable folders, plus extra rules derived from existing ones
Unclear It is not stated where the new list of exact blocked paths comes from or whether users can set it.
When creating a git worktree fails to find its starting point, Claude Code now explains why and how to fix it
The note Claude gets about an attached PDF no longer tells it to read the whole file
CLAUDE_RUNNER_TRUST_CANONICAL_PREWARM now also needs a matching owner value, or the runner cleans up anyway
Unclear What the owner value is and how to set it is not stated.
The usage warning shown when resuming an old session now caps its estimate at the model's context size and can use your current rate-limit tier
Claude Code can now put off naming a session and try again after a later turn, using your most recent message
Plugins registering a slash command are now refused if the name matches an alias of an enabled command, built-in ones included
Creating a worktree from a folder whose .git points to a bare repository now stops at once and tells you where to start Claude Code instead
The remotely supplied default for the byte-stream idle timeout is now used only for the Anthropic API, not Bedrock, Vertex or other providers
Unclear It is not settled what timeout applies on providers other than the Anthropic API now.
Claude Code now tracks and waits for plugin hooks to finish loading at startup instead of starting the load and moving on
A new high-priority notice reports how many skill or command names were refused and tells you to rerun with --debug to see which
A plugin command whose allowed-tools are too long or name a folder holding a variable or $ now has them left empty, with a warning
Published verbatim by Anthropic for v2.1.299. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 190 bullets, 54 name something an entry on this page also names, 39 name something no entry here does, and 97 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents
Probably new-env-var-claude-code-disable-file-mentions CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later
No entry names this $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
Probably userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, plugin-input-refusal-gate-on-promptsubmit-and-commandr, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight
No entry names this --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
Probably runner-tool-server-sessions-and-shutdown-drain-logging, self-hosted-runner-sigterm-drain-with-shutdown-drain-sec skill.prompt hook receives
Probably plugin-hooks-module-only-plugins-count-as-having-hooks-res /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker
Probably usage-insights-add-four-new-suggestion-cards, fleetview-model-description-reworded, agent-view-model-picker-and-new-session-settings-for-model, agent-view-gains-effort-and-fast-typed-commands --safe-mode
Probably agentsconfig-panel-shows-safe-mode, safe-mode-is-now-a-respawn-flag-job-respawn-stripping-rew, safe-mode-hint-text-changed --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs
Probably evalworkflow-execution-disallowed-tools-merged-across-layer, eval-harness-gains-disallow-tools-and-per-case-disallowed, cloudheadless-session-config-accepts-disallowed-tools, new-disallow-tools-option-in-a-case-runner-cli-command CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy
Probably policy-managed-claude-code-attribution-header-is-protected-f CLAUDE_CODE_ATTRIBUTION_HEADER=0
Probably policy-managed-claude-code-attribution-header-is-protected-f queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
Probably plugin-hook-modules-managed-policy-restrictions-and-new-ses /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code
No entry names this /usage warnings for max effort, workflows, always-on context and large tool results
No entry names this apiKeyHelper was in use
No entry names this ANTHROPIC_BASE_URL ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation
Probably headless-run-host-with-max-turns-max-budget-usd-limits .claude in it
Nothing to match on UserPromptSubmit or mod prompt.submit hooks were still running (regression in 2.1.296)
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, plugin-input-refusal-gate-on-promptsubmit-and-commandr, prompt-submit-hook-chain-rewritten-to-handle-slash-commands, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox
No entry names this --debug, --debug-file), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
Probably warning-when-skill-or-command-names-are-refused -c scripts that don't run rm. An rm built at run time in a script Claude Code can't read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1
Probably strict-inline-shell-rm-prompt-new-env-var-and-tengu-pale-ke #99320Inline-shell rm check (2.1.288) asks in bypass mode on bash -c $'...' scripts that contain no rm Open
#99249Inline-shell rm check (2.1.288) asks on zsh -c scripts that contain no rm Open
#100884Inline-shell rm check flags a command with no -c shell script and no rm (bash script.sh + python3 -c in a loop, bypass mode) Open
#100848Bash safety check says a `sh -c` script "runs rm" when it does not (only with a `cd … &&` prefix) Open
#99630Inline-shell rm check asks on bash -c with a $VAR command and a {…,…} argument (no rm present) Open
#100850Bash safety check says "This shell -c script runs rm" for `$VAR … -- sh -c '…'` with no rm anywhere (bypass mode) Open
#99894False-positive deletion check: read-only compact Bash command flagged as running rm (2.1.291) Open
claude mcp list, claude doctor and /status reporting an empty .mcp.json as invalid
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, blank-project-mcpjson-is-read-as-no-servers /btw jumping the transcript to the bottom when asked while scrolled up in fullscreen
Probably btw-side-question-keeps-scroll-position bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode when the sandbox can write to the Windows drive
Probably wsl-mntwslgdistro-added-to-mount-list, wsl-path-rules-also-matched-through-second-root-mount-gate claude remote-control sessions
No entry names this #87146[BUG] ScheduleWakeup never fires in Remote Control child sessions (sdk-cli bridge) even though the session stays alive and task notifications are delivered Closed
prompt.submit rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
Probably userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, plugin-input-refusal-gate-on-promptsubmit-and-commandr, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id .config.json in the config directory
Probably config-file-path-choice-changed /sandbox reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why
Probably sandbox-settings-save-reports-failure, sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-install-passes-program-permission-result-to, sandbox-command-now-reports-result-of-settings-write constructor or prototype in an MCP config never being connected
Nothing to match on constructor or toString asking for permission in auto mode and bypass permissions mode
No entry names this .catch, being run again without end when it waits on another mod's noun that does its work outside the call
Nothing to match on availableModelsMatch: exact or deniedModels blocks; it now answers 400 and leaves them out of its model lists
Probably gateway-supports-a-deniedmodels-denylist ANTHROPIC_BASE_URL
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening ANTHROPIC_BASE_URL being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening tool.describe or prompt.section answer that changed after $.ui.invalidate never reaching Claude; the new answer is now sent on the next turn
No entry names this enabledMcpjsonServers or disabledMcpjsonServers held a single server name (letters, digits, - or _) as a plain string
No entry names this #100254[BUG] enabledMcpjsonServers in settings.json changes from an array to a string without notice, then fails validation ("Invalid settings") Open
claude plugin test pausing a hook's time budget while a served $ method it had called kept making $ calls after answering
No entry names this next(), returns, or sends to a $ method being refused whole when one of its getters throws a RangeError; now only that key is refused
No entry names this /usage, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (anthropics/claude-code#92238)
No entry names this mcp__<server>) not applying when the server's normalized name contains a double underscore
No entry names this plugin_loaded telemetry event reporting has_hooks as false for plugins whose hooks are a hooks module, built-in plugins included
No entry names this ANTHROPIC_BASE_URL); Anthropic API keys are still sent
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening $ to a function declaration imported from another file of the mod
Nothing to match on __proto__ keys silently removed, which could skip a tool.check guard on a tool call another mod made
Probably policy-blocked-mcp-servers-now-report-richer-failure-info-r, cron-minute-rounding-and-settings-proto-guard, hook-default-responses-become-functions-with-reason, plugin-runtime-mods-gain-uilog-envget-envset claude -p saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
No entry names this forceLoginOrgUUID
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta claude mcp list, claude mcp get and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
No entry names this #95020[BUG] `claude mcp list` ignores allowedMcpServers/deniedMcpServers — empty allowlist still returns every server connected Open
/reload-plugins not loading a plugin installed from another terminal a moment earlier
Probably plugin-hook-registration-deferred-and-awaited-at-startup-pl --bare, which keeps the mode; they now name /stop and claude --resume, as safe mode ones do
Probably stderr-writes-are-bounded-dropped-messages-reported, resume-hint-now-includes-worktree-flags-and-advice, exec-added-to-a-list-of-cli-flags-next-to-resume-session, await-claim-error-message-names-the-subprocess-sandbox, safe-mode-hint-text-changed, fetch-size-check-skips-for-certain-status-codes-self-hosted ← not saying why it stayed put over a queued message while Remote Control is on
Nothing to match on $.http.fetch in mods refusing a 304, 204 or 205 response that declares a Content-Length over the 4 MiB body limit
No entry names this /config push notification toggles sending your account the previous setting instead of the one you just chose
No entry names this --input-format stream-json running together without a line break when merged into one turn
No entry names this --exec-path wrapper's own --mcp-config when connectors change mid-session
Probably mcp-mcp-config-handling-and-remote-control-remote-tool-cal, claude-code-remote-mcp-config-runner-receives-delivered-mcp claude plugin eval passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
No entry names this forceLoginOrgUUID and forceLoginMethod from MDM or the managed-settings file being hidden or replaced by server-managed settings
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta --bare sessions leaving out an MCP server named constructor or prototype that --channels asked for
Probably safe-mode-hint-text-changed /clear reattaching to the Remote Control session of the conversation after it
No entry names this #99717Remote Control: /clear and in-process /resume share one remote session across conversations; phone messages route to whichever conversation the holding process has loaded Closed
/, sent with the Agent SDK's verbatimPrompts option, running as a slash command when CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran it after a restart
Probably remote-resume-can-recover-cut-off-foreground-agents --safe-mode silently leaving safe mode when the session was woken or restarted
Probably safe-mode-is-now-a-respawn-flag-job-respawn-stripping-rew, safe-mode-hint-text-changed /btw side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
Probably btw-side-question-keeps-scroll-position denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-filesystem-grant-checks-rewritten, sandbox-credentials-schema-wording-stderr-writes-may-be-dro allowRead and allowWrite entries not being re-checked when the directory they start from is replaced by a symlink
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-filesystem-grant-checks-rewritten claude mcp add <name> -- <command> --background being started as a background session
No entry names this --bg or --background to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
Probably bg-refuses-when-the-flag-cannot-be-told-from-prompt-text --worktree sessions leaving a folder behind in .git/worktrees in repositories using git's reftable ref storage
Probably resume-hint-now-includes-worktree-flags-and-advice, worktree-creation-refuses-bare-repository-layouts-with-a-cle claude self-hosted-runner sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
No entry names this ultracode is on in settings
Nothing to match on #101541[BUG] Desktop scheduled tasks lost ultracode in 2.1.289: "Ultracode is on" reminder skipped on scheduled-trigger turns Open
headers/headersHelper values, which broke servers behind an authenticating proxy
Probably mcp-configured-headers-on-oauth-discoveryrevocation-reser <head> is published again unchanged
Nothing to match on $.ui.open reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and claude -p
No entry names this #101403[BUG] VS Code extension: mod Pane never draws, but $.ui.open resolves { isPlaced: true } Open
#99401[FEATURE] VS Code extension: draw function-hook mod UI (AbovePrompt band, Pane) Open
agent.spawn mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries resume, and a mod can refuse it
Probably hook-default-responses-become-functions-with-reason, subagent-cwd-is-refused-with-a-clear-error claude plugin validate rejecting a mod's $.state references when plugin.json has no types key and the contract is at ./types/index.d.ts
No entry names this dimColor text looking the same as plain text under the dark ANSI theme and on 16-color terminals
No entry names this PreToolUse hook or a mod's tool.check hook allowed
Probably hook-failure-on-pretooluse-can-carry-advice-onfailure-conti, hook-default-responses-become-functions-with-reason, tengu-linear-owl-gates-host-worded-permission-display-from-p, plugin-runtime-mods-gain-uilog-envget-envset SendMessage not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
Probably stopped-agents-refused-for-resume-via-sendmessage-live-agen, subagent-report-delivery-and-send-message-errors, send-message-via-an-mcp-bridge-tool-behind-tengu-flickering CLAUDE_CODE_RESUME_INTERRUPTED_TURN sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step
Probably remote-resume-can-recover-cut-off-foreground-agents $.env.set changing the environment or shell prefix that command hooks from managed settings start with
No entry names this setup and doctor say when the runner's machine has no git credentials
Nothing to match on --retire-at and delaying shutdown
No entry names this claude auth login
Probably cloud-launch-error-messages-and-git-bundle-advice anthropic-skills: prefix to it
No entry names this /reload-skills to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
Probably reload-skills-message-changed < or > is no longer offered until renamed; such a name: is ignored
Nothing to match on ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it
No entry names this claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does
No entry names this mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name
No entry names this tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*
No entry names this MCP_PROTOCOL_NEGOTIATION=legacy opts out
No entry names this api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters
Probably result-messages-gain-api-error-origin PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied
Probably permission-prompt-deny-answers-skip-permissionrequest-hooks, auto-mode-hooks-cannot-approve-tools-via-permissionrequest -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
Nothing to match on /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
Probably btw-side-question-keeps-scroll-position UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, prompt-submit-hook-chain-rewritten-to-handle-slash-commands UserPromptSubmit hook to first run on the prompt after the one that invokes the skill
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, prompt-submit-hook-chain-rewritten-to-handle-slash-commands turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)
Probably hook-turnstart-now-counted-when-deciding-whether-hooks-are /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env
Probably empty-repo-error-message-reworked, upload-failure-advice-now-says-to-commit-changed-files-by-na A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 27 tool descriptions changed.
Claude Code, interactive mode
11 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
679 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 88 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?