You can now set subagentInheritVerifiedTurns to true so subagents start with your earlier verified messages. MCP servers can now provide skills to Claude Code. Each skill's size and fingerprint is checked against the server's list before it loads. With CLAUDE_CODE_ENABLE_SHARE_BUNDLE set, /share sends your whole session transcript along with your feedback. In remote sessions, CLAUDE_CODE_REMOTE_MCP_CONFIG points the runner to a file of MCP servers sent by the host. Routing WebFetch through a proxy now depends on CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY instead of being worked out from session state.
19 entries are in the build but not switched on yet. Claude Code can fetch context for a claude.ai Project into a session, but only once it is turned on remotely. Apps built on the SDK will be able to word their own permission prompts from a PreToolUse hook. A stricter plan mode check can ask before any action that is not read-only. Project tools can read an uploaded PDF or Word file as the original document. Agents may later start in the background by default.
MCP allow rules no longer approve tools from a different MCP server. On Windows, sandboxed git now gets your git name and email for commits. Environment variables from settings or /env now reach sandboxed Windows commands too. The resume command printed on exit now includes --worktree for worktree sessions. If CLAUDE.md fails to load, Claude Code tries again later in the session. The MCP tasks feature is now off for everyone and can no longer be turned on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Remote runners get host-delivered MCP servers through CLAUDE_CODE_REMOTE_MCP_CONFIG, and --mcp-config sources are filtered by scope and ownership
Sessions & agents/feedback bundles can now carry a transcript.jsonl file, and /share can send the whole transcript when CLAUDE_CODE_ENABLE_SHARE_BUNDLE is set
In the agent view, /model opens a picker and model, effort and fast mode can be set for new sessions from that window without being saved
Sessions & agentsFive new CLAUDE_CODE_* environment variables tune startup, changed-file checks, MCP loading and transcripts, and are forwarded to remote sessions
Platform & internalsThe self-hosted runner can wait up to --shutdown-drain-sec seconds for running work on SIGTERM, and supports a tool-server session kind
Elsewhere
tengu_glowing_lark gate controls background launch and MCP task codeSessions & agentsWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →19 more of these are in What probably matters to you, on page 1.
Claude Code now checks a file's encoding when reading it and gives a file-specific error when the file is not text
Prompt hooks now see slash command names and arguments, and some rewrites stop the prompt with a "Prompt not sent" message
Unclear It is not clear which kinds of hook changes lead to the "Prompt not sent" message.
In some environments, /restart now stops straight away with a message saying it isn't available there
Unclear Which environments trigger the refusal is not known, so it is unclear who can still use /restart.
Sandbox read and write lists now accept literal path entries, and ripgrep failures now include its error output and partial results
When a tool's result is too large to send back, the message now names the tool and suggests asking for less or checking what it changed
When settings cannot be checked for an action, the refusal now says "the rules and hooks in your settings" could not be checked
When showing hooks, Claude Code now treats every hook not from a settings file the way it used to treat only personal hooks
Unclear It is not clear what visibly changes for hooks that are not from a settings file.
The check that decides whether a skill folder value looks like a web address now matches more values and no longer rejects unusual characters
Unclear It is not clear whether values that now match are treated as web addresses or accepted as ordinary skill folder paths.
Claude Code now stops retrying one particular kind of error instead of retrying it like rate-limit and server errors
Unclear Which kind of error is no longer retried is not identified.
Claude Code can now refuse names with hidden or direction-changing characters, < or >, or more than 256 characters
Unclear Exactly which names the rule covers is not stated.
Messages explaining why a permission approval ended now name the approval explicitly
A failed MCP reconnect now says the server's tools could not be listed, when that is the actual cause
On Windows, the error when a skill needs Git Bash and cannot find it now uses a shared install hint
/mnt/wslg/distro to its mount list#Claude Code now includes the /mnt/wslg/distro mount point in a list of mount points, apparently when running under WSL
Unclear It is not clear what the mount list is used for, so the effect on WSL users is unknown.
Reading an artifact type's files now shows a count such as "read N of M files" instead of a single read or unread line
The sandbox's file-write check now returns a negative answer when its stored deny lists may be incomplete, as it already did with sandboxing off
Unclear It is not clear whether the negative answer means affected writes now ask for permission or are handled some other way.
When a proxy answers with a redirect, Claude Code now says the redirect is not followed and that retrying will not help
MCP servers configured with a reserved name or address are now refused with an explicit message saying why
Unclear It is not stated which names and addresses are reserved.
If the model calls a browser, computer use or simulator MCP tool before loading it, Claude Code now returns an error saying to load it first
Unclear It is not clear whether the new error is returned to the model for everyone or only recorded in some cases.
Claude Code's watch on plugin files now compares file stamps to decide whether a change still needs to be loaded
The Linux sandbox's check for missing system pieces now runs one more test and can add its warning to the list
Unclear What the extra check tests and what its warning says are not known.
Failures loading organization settings now share one message format, and usage data about where those settings came from has more detail
If a plugin synced from claude.ai is missing on disk, the error now tells you to restart Claude Code
When the cloud file sync is told to slow down, it now waits the time the server asks for instead of a fixed delay
When a settings file cannot be saved because the folder is read-only or off limits, Claude Code now suggests starting in a writable project folder
After a failed inbox read, Claude Code now waits before checking the inbox again instead of retrying at once
An awk program that pipes output to a command, or reads from one, is no longer treated as safe to run without asking
Claude Code now records when a permission mode change is refused, and a refused switch to auto mode reports that it cannot be set
Refused project document writes now say the document changed since the given version and how to retry, or that the version cannot be checked
Unclear Which tool or feature writes these project documents is not stated.
When an upstream server sends an invalid status or headers through Claude Code's proxy, Claude Code now returns 502 Bad Gateway
The sandbox credential path setting now says it accepts the same path forms as filesystem.denyRead, and error output may be dropped when busy
When an MCP server returns a malformed task handle, Claude now hears that the task may still be running, and Claude Code tries to cancel it
When Claude Code can't package your code because the repository is empty, the failure now comes with advice
Headless cloud sessions now deny permission requests that arrive in the wrong shape, with a clear message
If a hook returns fields for a resumed agent that it can only refuse, Claude Code now says they were ignored
When applying environment variables from settings files, Claude Code now records when a git-related key was dropped and reads each layer's own block
Unclear Which git-related key gets dropped, and whether it is one a reader might set on purpose, is not stated.
In a list of jobs, the selection now starts on the first remote job, falling back to the earlier choice if there is none
The path shown for an attached skill is now worked out from a different base folder, or shown in full when there is none
When showing changes in a Git repository, Claude Code now checks file contents against Git's record and skips files whose real location differs
Claude Code now asks permission for a PowerShell New-Object argument with nothing after its colon, since it cannot tell what would be created
Something called Spinner is now allowed in the VS Code extension, and the team and enterprise account check passes in one more case
Unclear The extra condition that now makes an account count as team or enterprise is not known.
A hook "if" condition that names a file path now gives a message instead of an error when the session has no working directory
In print mode, MCP task notifications are held back until a waiting permission request is settled, then released
A restarted background job can now be marked as owing a reply, and the auto-updater status line shows only in certain states
In FleetView, /model is now described as setting the model for new sessions from this window, without saving it
On Linux, the sandbox no longer always sets up a placeholder for a missing blocked path, and file masks now win over read blocks
Cloud session launches now give plainer errors for --tools on self-hosted environments, missing sign-in and some git failures
Claude Code now says when plugin hook modules are not loaded because their rollout switch has not been answered yet
Scheduled times now round up to the next whole minute, settings copies skip __proto__, and output errors stop waiting on unwritten output
Attachment downloads in bridge sessions are capped at about 35 MB, stop if they stall, and retry once after a refused sign-in
When a hook allows a tool call but Claude Code still has to ask you, the explanation now lists plan mode as one of the reasons
Unclear It is not clear whether plan mode newly forces these prompts in this version or was already doing so and is only now named in the message.
A hook blocked on Windows because Git Bash wasn't found now gets its own explanation instead of being blamed on personal-config restrictions
The self-hosted runner setup guide now warns that repositories must clone over HTTPS without a sign-in prompt and explains how to recover
/reload-skills now says when Claude will see the updated skills#/reload-skills now reports "none added or removed" and says Claude gets the full skill list with your next message
The auto-update row is hidden unless an update is running, finished, failed or lacks permission, and the update notice is now right-aligned
Messages arriving through Remote Control now report attachments whose files could not be created, and queued notifications are handled differently mid-turn
Unclear What a user of Remote Control actually sees differently because of these changes is not stated.
If a subagent is not allowed to run in another folder, Claude Code now stops before starting it and says to start it without cwd
Unclear The conditions under which a different working folder is refused are not stated.
The Text component accepts a new faintInk style, and the styler can show that text as dim in some cases
When Claude Code shortens long text by cutting out the middle, it now measures both ends so the result fits the available width
The description of the small random timing offset applied to tasks scheduled with CronCreate was changed
The message when a sed edit cannot be previewed now says the file is not UTF-8 text, instead of not valid UTF-8
The package-manager auto-update notice can now be shown with a dim dot separator beside it
A cloud upload notice can now say "Left out of this upload", and the feedback sign-in error may read differently
The error for an empty repository no longer tells you to run git add . && git commit -m "initial" and retry
Unclear The new wording of the empty-repository message is not shown.
The warning about dropping a worktree registration now names a submodule's git directory as its example, not a reftable repository's refs
If preparing a cloud session's upload fails, Claude Code advises committing the files you changed by name, then retrying
Unclear Whether this wording actually differs from the previous release.
The Linux sandbox depth setting's description now says it is how far below the working directory dangerous names are looked for
Messages about deny patterns ending in a separator and about unreadable settings now use new wording, and the settings one is more general
Unclear It is not clear whether deny patterns now match differently or only the message changed.
The description Claude reads for the CronCreate scheduling tool was rewritten in its main system prompt
Unclear The exact wording that changed is not shown, so it is unclear how Claude's scheduling behaviour differs in practice.
The CronCreate tool description was rewritten in the prompt Claude Code uses when Claude runs as an agent
The CronCreate tool description was rewritten in the prompt used when Claude Code compacts a long conversation
The CronCreate tool description was rewritten in the prompt behind the /init command
The CronCreate tool description was rewritten in the prompt behind the /security-review command
The CronCreate tool description was rewritten in the prompt used by the team onboarding command
MCP allow rules are matched more strictly, and Claude Code warns when one cannot approve a tool from another MCP server
Unclear It is not clear whether an allow rule that matched before this change will now prompt instead.
When auto mode is unavailable, sessions started through Remote Control are no longer granted it
After a trusted-device refusal, Claude Code renews enrollment once and stops looping if the renewed device is still refused
.config.json files no longer take over your configuration#Claude Code now uses .config.json only if it has content, or if it is empty and writable and the other config file does not exist
When you exit a session that ran in a worktree, Claude Code now prints a resume command that includes --worktree
If Claude Code fails to read project files such as CLAUDE.md, it now tries again after 5 seconds, 30 seconds and 2 minutes
On Windows, environment variables from settings or /env now reach sandboxed commands, and ones that cannot be passed are logged as left out
Unclear Which variables cannot be passed into the sandbox is not stated.
Without the interactive screen, Claude Code now waits for plugin hooks to register at startup, and /reload-plugins records hook reloads
Configured MCP headers are now sent when finding OAuth details and revoking tokens, only to the same server
Claude Code now recognises UTF-16LE text when reading a stream line by line and decodes it correctly instead of garbling it
When a rewind targets a message no longer in the transcript, Claude Code now adds and saves a stand-in system message
On Windows, if Claude Code cannot read your shell's PATH, it now warns and uses the current PATH instead of silently keeping a stale one
Repository setup for cloud sessions now handles an empty repository and skips pushing some branches when a session is released
A project .mcp.json file that is empty or holds only spaces is now read as listing no MCP servers, with no error
Claude Code no longer misreads the first file in git status output and now handles Windows-style line endings
If a hook's "if" condition throws an error, Claude Code now keeps the hook and marks it as not tested instead of failing
A job marked as owing a replayed turn now resets to idle and clears that mark, instead of being marked blocked
When a synced plugin's folder is gone, Claude Code now finds its new location in the sync record and loads it from there
In one case, shell snapshots now save your shell's own PATH plus any missing plugin folders instead of a fixed PATH
Unclear Which situations take this new snapshot route is not shown.
On self-hosted runners, output from child processes no longer restarts the startup idle timer once startup is over
Usage warnings and reports for five-hour and weekly plan limits now cap at 100% instead of showing higher numbers
live_cwd and related folder fields are now left out of permission and classifier data when the current folder is unavailable
When saving sandbox settings fails, Claude Code now records it as a failure instead of always recording success
When the git file listing behind worktree include fails, Claude Code now treats its output as empty instead of stopping early
The next-run preview for scheduled tasks that run only once is now worked out as a one-time job
Claude Code now correctly labels Chrome browser tool failures caused by a dropped connection as a lost connection
Published verbatim by Anthropic for v2.1.299. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 190 bullets, 54 name something an entry on this page also names, 39 name something no entry here does, and 97 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents
Probably new-env-var-claude-code-disable-file-mentions CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later
No entry names this $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
Probably userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, plugin-input-refusal-gate-on-promptsubmit-and-commandr, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight
No entry names this --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
Probably runner-tool-server-sessions-and-shutdown-drain-logging, self-hosted-runner-sigterm-drain-with-shutdown-drain-sec skill.prompt hook receives
Probably plugin-hooks-module-only-plugins-count-as-having-hooks-res /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker
Probably usage-insights-add-four-new-suggestion-cards, fleetview-model-description-reworded, agent-view-model-picker-and-new-session-settings-for-model, agent-view-gains-effort-and-fast-typed-commands --safe-mode
Probably agentsconfig-panel-shows-safe-mode, safe-mode-is-now-a-respawn-flag-job-respawn-stripping-rew, safe-mode-hint-text-changed --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs
Probably evalworkflow-execution-disallowed-tools-merged-across-layer, eval-harness-gains-disallow-tools-and-per-case-disallowed, cloudheadless-session-config-accepts-disallowed-tools, new-disallow-tools-option-in-a-case-runner-cli-command CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy
Probably policy-managed-claude-code-attribution-header-is-protected-f CLAUDE_CODE_ATTRIBUTION_HEADER=0
Probably policy-managed-claude-code-attribution-header-is-protected-f queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
Probably plugin-hook-modules-managed-policy-restrictions-and-new-ses /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code
No entry names this /usage warnings for max effort, workflows, always-on context and large tool results
No entry names this apiKeyHelper was in use
No entry names this ANTHROPIC_BASE_URL ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation
Probably headless-run-host-with-max-turns-max-budget-usd-limits .claude in it
Nothing to match on UserPromptSubmit or mod prompt.submit hooks were still running (regression in 2.1.296)
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, plugin-input-refusal-gate-on-promptsubmit-and-commandr, prompt-submit-hook-chain-rewritten-to-handle-slash-commands, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox
No entry names this --debug, --debug-file), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
Probably warning-when-skill-or-command-names-are-refused -c scripts that don't run rm. An rm built at run time in a script Claude Code can't read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1
Probably strict-inline-shell-rm-prompt-new-env-var-and-tengu-pale-ke #99320Inline-shell rm check (2.1.288) asks in bypass mode on bash -c $'...' scripts that contain no rm Open
#99249Inline-shell rm check (2.1.288) asks on zsh -c scripts that contain no rm Open
#100884Inline-shell rm check flags a command with no -c shell script and no rm (bash script.sh + python3 -c in a loop, bypass mode) Open
#100848Bash safety check says a `sh -c` script "runs rm" when it does not (only with a `cd … &&` prefix) Open
#99630Inline-shell rm check asks on bash -c with a $VAR command and a {…,…} argument (no rm present) Open
#100850Bash safety check says "This shell -c script runs rm" for `$VAR … -- sh -c '…'` with no rm anywhere (bypass mode) Open
#99894False-positive deletion check: read-only compact Bash command flagged as running rm (2.1.291) Open
claude mcp list, claude doctor and /status reporting an empty .mcp.json as invalid
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, blank-project-mcpjson-is-read-as-no-servers /btw jumping the transcript to the bottom when asked while scrolled up in fullscreen
Probably btw-side-question-keeps-scroll-position bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode when the sandbox can write to the Windows drive
Probably wsl-mntwslgdistro-added-to-mount-list, wsl-path-rules-also-matched-through-second-root-mount-gate claude remote-control sessions
No entry names this #87146[BUG] ScheduleWakeup never fires in Remote Control child sessions (sdk-cli bridge) even though the session stays alive and task notifications are delivered Closed
prompt.submit rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
Probably userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, plugin-input-refusal-gate-on-promptsubmit-and-commandr, hook-default-responses-become-functions-with-reason, plugin-hooks-module-only-plugins-count-as-having-hooks-res, plugin-hooks-can-read-prompt-attachments-by-id .config.json in the config directory
Probably config-file-path-choice-changed /sandbox reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why
Probably sandbox-settings-save-reports-failure, sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-install-passes-program-permission-result-to, sandbox-command-now-reports-result-of-settings-write constructor or prototype in an MCP config never being connected
Nothing to match on constructor or toString asking for permission in auto mode and bypass permissions mode
No entry names this .catch, being run again without end when it waits on another mod's noun that does its work outside the call
Nothing to match on availableModelsMatch: exact or deniedModels blocks; it now answers 400 and leaves them out of its model lists
Probably gateway-supports-a-deniedmodels-denylist ANTHROPIC_BASE_URL
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening ANTHROPIC_BASE_URL being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening tool.describe or prompt.section answer that changed after $.ui.invalidate never reaching Claude; the new answer is now sent on the next turn
No entry names this enabledMcpjsonServers or disabledMcpjsonServers held a single server name (letters, digits, - or _) as a plain string
No entry names this #100254[BUG] enabledMcpjsonServers in settings.json changes from an array to a string without notice, then fails validation ("Invalid settings") Open
claude plugin test pausing a hook's time budget while a served $ method it had called kept making $ calls after answering
No entry names this next(), returns, or sends to a $ method being refused whole when one of its getters throws a RangeError; now only that key is refused
No entry names this /usage, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (anthropics/claude-code#92238)
No entry names this mcp__<server>) not applying when the server's normalized name contains a double underscore
No entry names this plugin_loaded telemetry event reporting has_hooks as false for plugins whose hooks are a hooks module, built-in plugins included
No entry names this ANTHROPIC_BASE_URL); Anthropic API keys are still sent
Probably remote-settings-fetch-refuses-to-send-api-key-to-non-anthrop, stuck-permissionanswer-and-api-key-hardening $ to a function declaration imported from another file of the mod
Nothing to match on __proto__ keys silently removed, which could skip a tool.check guard on a tool call another mod made
Probably policy-blocked-mcp-servers-now-report-richer-failure-info-r, cron-minute-rounding-and-settings-proto-guard, hook-default-responses-become-functions-with-reason, plugin-runtime-mods-gain-uilog-envget-envset claude -p saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
No entry names this forceLoginOrgUUID
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta claude mcp list, claude mcp get and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
No entry names this #95020[BUG] `claude mcp list` ignores allowedMcpServers/deniedMcpServers — empty allowlist still returns every server connected Open
/reload-plugins not loading a plugin installed from another terminal a moment earlier
Probably plugin-hook-registration-deferred-and-awaited-at-startup-pl --bare, which keeps the mode; they now name /stop and claude --resume, as safe mode ones do
Probably stderr-writes-are-bounded-dropped-messages-reported, resume-hint-now-includes-worktree-flags-and-advice, exec-added-to-a-list-of-cli-flags-next-to-resume-session, await-claim-error-message-names-the-subprocess-sandbox, safe-mode-hint-text-changed, fetch-size-check-skips-for-certain-status-codes-self-hosted ← not saying why it stayed put over a queued message while Remote Control is on
Nothing to match on $.http.fetch in mods refusing a 304, 204 or 205 response that declares a Content-Length over the 4 MiB body limit
No entry names this /config push notification toggles sending your account the previous setting instead of the one you just chose
No entry names this --input-format stream-json running together without a line break when merged into one turn
No entry names this --exec-path wrapper's own --mcp-config when connectors change mid-session
Probably mcp-mcp-config-handling-and-remote-control-remote-tool-cal, claude-code-remote-mcp-config-runner-receives-delivered-mcp claude plugin eval passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
No entry names this forceLoginOrgUUID and forceLoginMethod from MDM or the managed-settings file being hidden or replaced by server-managed settings
Probably machine-admin-policy-can-pin-the-sign-in-org, server-policy-forcelogin-settings-take-precedence-over-serve, stored-remote-settings-copy-must-pass-a-trust-gate-sync-sta --bare sessions leaving out an MCP server named constructor or prototype that --channels asked for
Probably safe-mode-hint-text-changed /clear reattaching to the Remote Control session of the conversation after it
No entry names this #99717Remote Control: /clear and in-process /resume share one remote session across conversations; phone messages route to whichever conversation the holding process has loaded Closed
/, sent with the Agent SDK's verbatimPrompts option, running as a slash command when CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran it after a restart
Probably remote-resume-can-recover-cut-off-foreground-agents --safe-mode silently leaving safe mode when the session was woken or restarted
Probably safe-mode-is-now-a-respawn-flag-job-respawn-stripping-rew, safe-mode-hint-text-changed /btw side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
Probably btw-side-question-keeps-scroll-position denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-filesystem-grant-checks-rewritten, sandbox-credentials-schema-wording-stderr-writes-may-be-dro allowRead and allowWrite entries not being re-checked when the directory they start from is replaced by a symlink
Probably sandbox-prompt-gains-windows-localhost-and-profile-access-gu, windows-sandbox-filesystem-grant-checks-rewritten claude mcp add <name> -- <command> --background being started as a background session
No entry names this --bg or --background to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
Probably bg-refuses-when-the-flag-cannot-be-told-from-prompt-text --worktree sessions leaving a folder behind in .git/worktrees in repositories using git's reftable ref storage
Probably resume-hint-now-includes-worktree-flags-and-advice, worktree-creation-refuses-bare-repository-layouts-with-a-cle claude self-hosted-runner sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
No entry names this ultracode is on in settings
Nothing to match on #101541[BUG] Desktop scheduled tasks lost ultracode in 2.1.289: "Ultracode is on" reminder skipped on scheduled-trigger turns Open
headers/headersHelper values, which broke servers behind an authenticating proxy
Probably mcp-configured-headers-on-oauth-discoveryrevocation-reser <head> is published again unchanged
Nothing to match on $.ui.open reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and claude -p
No entry names this #101403[BUG] VS Code extension: mod Pane never draws, but $.ui.open resolves { isPlaced: true } Open
#99401[FEATURE] VS Code extension: draw function-hook mod UI (AbovePrompt band, Pane) Open
agent.spawn mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries resume, and a mod can refuse it
Probably hook-default-responses-become-functions-with-reason, subagent-cwd-is-refused-with-a-clear-error claude plugin validate rejecting a mod's $.state references when plugin.json has no types key and the contract is at ./types/index.d.ts
No entry names this dimColor text looking the same as plain text under the dark ANSI theme and on 16-color terminals
No entry names this PreToolUse hook or a mod's tool.check hook allowed
Probably hook-failure-on-pretooluse-can-carry-advice-onfailure-conti, hook-default-responses-become-functions-with-reason, tengu-linear-owl-gates-host-worded-permission-display-from-p, plugin-runtime-mods-gain-uilog-envget-envset SendMessage not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
Probably stopped-agents-refused-for-resume-via-sendmessage-live-agen, subagent-report-delivery-and-send-message-errors, send-message-via-an-mcp-bridge-tool-behind-tengu-flickering CLAUDE_CODE_RESUME_INTERRUPTED_TURN sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step
Probably remote-resume-can-recover-cut-off-foreground-agents $.env.set changing the environment or shell prefix that command hooks from managed settings start with
No entry names this setup and doctor say when the runner's machine has no git credentials
Nothing to match on --retire-at and delaying shutdown
No entry names this claude auth login
Probably cloud-launch-error-messages-and-git-bundle-advice anthropic-skills: prefix to it
No entry names this /reload-skills to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
Probably reload-skills-message-changed < or > is no longer offered until renamed; such a name: is ignored
Nothing to match on ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it
No entry names this claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does
No entry names this mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name
No entry names this tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*
No entry names this MCP_PROTOCOL_NEGOTIATION=legacy opts out
No entry names this api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters
Probably result-messages-gain-api-error-origin PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied
Probably permission-prompt-deny-answers-skip-permissionrequest-hooks, auto-mode-hooks-cannot-approve-tools-via-permissionrequest -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
Nothing to match on /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
Probably btw-side-question-keeps-scroll-position UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, prompt-submit-hook-chain-rewritten-to-handle-slash-commands UserPromptSubmit hook to first run on the prompt after the one that invokes the skill
Probably prompt-submit-outcome-field-on-sdk-system-messages, userpromptsubmit-and-promptsubmit-hook-blocks-now-carry-str, userpromptsubmit-hook-blocked-prompt-reasons-and-commandis, prompt-submit-hook-chain-rewritten-to-handle-slash-commands turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)
Probably hook-turnstart-now-counted-when-deciding-whether-hooks-are /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env
Probably empty-repo-error-message-reworked, upload-failure-advice-now-says-to-commit-changed-files-by-na A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 27 tool descriptions changed.
Claude Code, interactive mode
11 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
659 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 88 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?