Sessions can now start in a sandbox VM by default when an option is set. The new --unsandboxed flag opts out of that and of cloud-by-default too. Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH turns on the send-file tool and stops Claude Code uploading the files it sends you. On self-hosted runners, all session traffic can now go through a proxy you run. Admins get a beta selfHosted section in managed settings for self-hosted session hosts. A new codeAllowedRepositories setting lists the git repositories Claude Code may work in on those hosts.
Claude Code is now listed as a reader of organization-managed settings, but those settings are not served to it yet. Organization config also gains an Allow Quick Write setting that is not switched on. Claude Desktop accepts codeAllowedRepositories but does not apply it to on-device sessions yet. The memory dialog has a new cloud memory option that does nothing yet. A new check for one tool in a permission mode called arbiter stays off unless the server turns it on.
An MCP tool whose parameter description the API rejects no longer breaks the conversation. Claude Code now blanks that description, warns you and retries, so the tool stays callable. Starting with --worktree now loads plugin WorktreeCreate hooks first, so a plugin can handle worktree creation. Command hooks now stop when their configured timeout runs out. The CLAUDE_CODE_FORCE_SANDBOX environment variable is removed. Passing --sandbox or --no-sandbox to claude remote-control is now an error instead of being silently accepted.
Written by our agent from the shipped bundle, not by Anthropic.
Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH enables the send-file tool without its usual checks, skips uploads and counts the session as remote
ElsewhereAdmin config gains a selfHosted block and a codeAllowedRepositories list for self-hosted sessions; the repo list isn't applied on-device yet
Settings & configSession start can now place a session in a sandbox VM by default, and a new --unsandboxed flag opts out of that and of cloud-by-default
Permissions & safetyThe prompt draft can now tag edits with their origin and report changes, and extensions reach it through composer.attribute and attributeDraft
ExtensionsNew ui.view plugin capability switches the main view to an agent's transcript, and plugin calls judged under an outdated policy are refused
Extensions
CLAUDE_CODE_FORCE_SANDBOX no longer existsPermissions & safetyWant the reasoning? Read walks the 47 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →9 more of these are in What probably matters to you, on page 1.
Before handing a session over to the cloud, Claude Code now waits for another pending task to finish instead of starting at once
Several cloud session checks now get your sign-in token a new way and share one error message when you are not signed in
Unclear The wording of the new shared message is not given, so it is unclear whether it still tells you to run claude auth login.
When you resume from a cloud session, Claude Code now includes your account profile when it fetches the session's history
Claude Code now uses an extra check to sort errors, so some now count as host problems instead of conversation problems
Unclear It is not clear which errors the new check catches.
When an internal queue-recording option is on, Claude Code no longer takes a queued prompt's raw text directly
Unclear What this changes for someone using Claude Code, and what turns the queue-recording option on, is not stated.
Claude Code running as a hosted worker now records a count of what fills its memory, at most three times, when memory use passes set limits
When Claude Code cannot replace its own process with another program, it now reports the error instead of starting the program separately
When Claude Code installs its IDE extension, the result now also says whether the extension was installed before
A new Linux-only entry for the spellcheck dictionary download is covered by the disableNonessentialServices setting
When the set of deferred tools changes, tools already loaded are no longer listed to the model again as newly added
The code that stops processes now reports permission problems early, can send a chosen signal, and double-checks a process has exited
When Claude Code names a session automatically, it can now limit the messages it bases the title on instead of always using all of them
Two internal text caches now hold at most 8192 entries, and one also has a total size cap
Claude Code now uses a call's origin to tell whether a plugin's own tool call was rewritten by another hook
Unclear It is not clear what this changes in practice for someone using plugins with hooks.
When a hook runs its own agent, Claude Code now keeps the result of that agent's first reply as well as counting its turns
When a hook runs, a timeout given for that run now takes the place of the timeout written in the hook's definition
Unclear It is not clear where the replacement timeout comes from or which hooks it applies to.
When a plugin hook is skipped to avoid running inside itself, the skip can now be recorded as "rewritten" as well as "lent"
Hook checks can now look only at hooks that plugins hold back, and plugin hook matching now handles those held hooks explicitly
Unclear It is not clear what makes a plugin hook held, or whether held hooks now fire differently for users.
Claude Code now records more internal data, including time spent waiting for organization hooks and when background tasks are evicted
A hook sent to run on another machine can now include an optional time limit, and its error message no longer says plugin
Each hook's record can now include the settings source it was defined in
The summary Claude Code builds of your hooks now also stops at a limit on the total length of hook matchers
When prompt hooks give no decision, the run is cut short, or a slash command is handed on, the prompt is now marked as having no verdict
When a session starts, Claude Code now finishes a step tied to SessionStart hooks before it begins processing messages
Part of a bundled data-checking library is now locked against changes when Claude Code loads, with no visible effect
Claude Code's bundled data-checking library now recognises IBAN bank account numbers and has some internal rework
Claude Code's bundled data-checking library was updated, and some text-format checks no longer add pattern details to generated schemas
The bundled Zod library is updated, adding checks such as IBAN and changing how some object and union checks behave
The library Claude Code uses to check data now locks a shared list and builds error details only when needed
Claude Code's bundled copy of zod has a rewritten email check and locked format patterns
The schema-checking library bundled with Claude Code now has a properties schema type, with no visible effect described
Claude Code's bundled validation library has been updated, with little visible effect
A restricted context object now exposes tools, messages, the message queue, MCP clients and the permission phase, and drops file-read state
Unclear It is not shown whether hooks or anything else a user writes can read this object.
A plugin that holds ownership of an item but has stood down is now left out when commands and hooks are loaded
Unclear What causes a plugin to stand down is not stated.
Plugin hooks now reload when admission text is present and a condition holds, not only when policy or user settings change
The check for mods that hook prompt submission now applies an extra test, so some mods that counted before no longer do
Unclear It does not say what the extra test checks, so it is unclear which mods are no longer counted.
When Claude Code looks up a loaded module by name, it now also checks the module is valid, so inactive ones are no longer returned
Unclear It is not clear what makes a module count as inactive, so which hooks this affects is unsettled.
Claude Code adds codes for MCP server entries with no transport or malformed OAuth scopes, and a new ccs_repo_rules entry
Unclear Whether these codes are shown to you when an MCP server entry is rejected is not clear.
A check that matched MCP servers against a remote list can now read a single on/off switch instead, depending on how it is called
Unclear What being on the list turns on for an MCP server is not stated.
Relayed MCP connections now wait a limited time for a server's offer and report more specific reasons when they cannot connect
Restoring saved MCP task data now gets the session ID and a snapshot of the conversation, and a matching save step runs from start-up
When signing back in to an MCP server fails, Claude Code now records whether it was refused again or had no refresh token
Each session now has a place to remember tool schemas that the API refused
Claude Code now records when a command creates a GitHub repo, plus new events for prompt edits, remote control and idle compaction
Claude Code's usage data can now record the length of a prompt, and one event also carries a prompt-check setting when it is not off
Some analytics events now record how the credential was supplied, such as an environment variable, a file descriptor or none at all
Claude Code's usage reports can now include three new details about rewinding a conversation and signing in to cloud sessions from the console
Claude Code's startup timing report now includes one more measurement about resuming a session and waiting on hooks
In sessions that run without disk storage, Claude Code keeps pasted content in memory instead of writing it to a file
In hosted claude-code-server sessions, Claude Code now refuses to refresh OAuth login tokens and skips creating its memory folder
In sessions that don't write settings to disk, Claude Code saves settings through a separate store and refuses changes that would make them too large
Unclear Which sessions count as not writing settings to disk is not stated.
In sessions without disk storage, Claude Code now skips refreshing its sign-in token and never creates the lock file for it
Under one condition, several session storage helpers now skip saving to disk and report no storage location
Unclear What triggers this condition, and so when session data stops being saved, is not known.
A permission mode can now carry a marker saying it came from the creator's settings rather than being chosen at launch
A turn handed off after an unanswered permission request now records which turn and messages it came from
Unclear What this changes for someone using Claude Code is not stated.
Records of permission decisions can now say which setting and which decider produced the decision
The permission check for tool calls Claude Code serves to other programs is now wrapped in a tracing step, and one release step was removed
Unclear It is not clear whether removing the release step changes what happens when a served call has to ask for permission.
--permission-prompt-tool was restructured#The handler behind --permission-prompt-tool is now wrapped in a separate helper, and a related input and output shortcut changed
Unclear What the new wrapper does to permission prompts, if anything, is not known.
Claude Code reads a new on/off switch from the server, and treats it as on when the server sends nothing
Unclear What this switch controls is not shown.
Six features controlled from Anthropic's servers are now checked early at startup, and five are off unless switched on remotely
Unclear What each of these six switches controls is not stated.
An internal eligibility check now returns a reason when it says no, instead of a plain yes or no
Unclear It is not clear which feature this check controls or where the reason is shown.
A server-controlled switch tied to session check-ins now has a different name; its built-in value is still on
Unclear What this switch controls beyond its place next to the session check-in timing is not known.
A flag that could stop request bodies from being compressed now applies only to remote worker requests, not to every source
Unclear It is not clear which requests are affected, or whether compression is now actually on for them.
In standalone relay mode, the agent proxy no longer starts its hosted relay and logs that it skipped it
Claude Code's local HTTP proxy gains a connect-only mode for plain web addresses and an option that lets the process exit while it listens
redirector.gvt1.com and *.gvt1.com are now listed as hosts used to download spellcheck dictionaries
Claude now gets a message that a local_file is read-only, how to copy it before editing, and that project_write refuses it
When a further server-side switch is on, the changed-file check can judge files through an outputs link and count each outcome
Unclear It is not clear what the outputs link changes about how a file is judged.
Claude Code's check on whether a file changed since it was read now records a reason, and accepts an outputs path that is a link when one is set
The background-agent status note sent to Claude now skips more agents, on top of those already read, pending, or Claude's own
Unclear Which background agents the new condition leaves out is not clear.
Forked helper agents now receive the main session's model as a separate settings layer, and the effort setting is dropped unless a condition holds
Unclear It is not clear whether forked helpers now actually run on a different model or effort level than before.
Finished subagent tasks no longer all use one fixed retention time; it is now worked out for each task
Unclear Whether the retention time actually differs between tasks, and by how much, is not known.
For messages arriving through the bridge, Claude Code now checks whether slash text was actually typed before handling it as a command
Unclear It is not clear whether slash text that was not typed now runs as a command or is sent on as plain text.
Claude Code now skips the regular check-in signal for a remote session that already sent one recently
The check for preparing compaction ahead of time was reorganized, and a separate server-controlled switch was added beside it
Unclear What the new tengu_woolly_forest check controls is not known.
The check deciding when to cap reply length right after compaction now uses a shared helper instead of its own inline test
In headless sessions, handed-back messages can now stay out of follow-up batching after a stop, behind a server-side setting
When Claude Code runs without its interactive screen, it now runs a memory check after every turn and adds extra fields to its end-of-run report
When a session holds tool calls until you write, Claude Code skips its background pass that saves memories
Unclear What puts a session into the state where tool calls are held is not stated.
AGENTS.md files takes a simpler path#When Claude Code reads an AGENTS.md file, it no longer runs a per-session setup step or logs a shared event on that path
Unclear It is not clear whether this changes anything you see when Claude Code reads an AGENTS.md file.
Usage data sent after each successful request now includes how long the message part of the prompt cache is kept
Claude Code's record of each API request now counts cache-write tokens separately for the 5-minute and 1-hour cache
Remote Control now checks where its sign-in token came from and classifies failed refreshes, and stops reporting a sandbox field
Before handing a session off to a remote session, Claude Code now sends the current git state, such as the branch
Sessions resumed with the resume-as-is option now skip a startup step that used to run whenever no pull request number was given
Unclear What the skipped startup step does is not shown.
When you resume a session, Claude Code now skips reapplying the saved agent under one more condition
Unclear The new condition that stops the saved agent being reapplied is not known.
New messages explain how skills and plugins load when a wake fetches no rollout switch: organization ones load at once, personal ones wait for org settings
When the tool that lists claude.ai skills finds some, it now hands the model a note along with the list
A task ID from a background local workflow is now accepted only if it matches the expected format and is not too long
CLAUDE_CODE_FORCE_SANDBOX no longer exists#The CLAUDE_CODE_FORCE_SANDBOX environment variable has been removed, and remote bridge setup no longer passes a sandbox option
Unclear It is not shown whether the sandbox can now be forced some other way.
An optional streaming upload for client events in cloud sessions is gone, so events are now sent only by the regular upload
Remote control no longer passes or reports a sandbox option and now records where its sign-in token came from when a refresh fails
A remotely controlled switch that sat beside the request compression setting is no longer read by Claude Code
The word "Musing" was removed from the words shown next to the spinner while Claude works
Published verbatim by Anthropic for v2.1.300. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 88 bullets, 18 name something an entry on this page also names, 28 name something no entry here does, and 42 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
virtualText to a mod's prompt decorations: text drawn in the prompt box that never enters the draft or the submitted prompt
No entry names this cache_creation_5m_tokens and cache_creation_1h_tokens to the OpenTelemetry api_request event, splitting cache writes by lifetime
Probably cache-creation-5m1h-token-split-in-api-telemetry $.ui.view({ agentId }) for mods: shows an agent's transcript in the main view when you ask, and $.ui.view({}) goes back
No entry names this dir prop on a mod's Text for right-to-left text: on Windows and in VS Code's terminal its rows read in that direction and sit flush right
No entry names this /advisor on Claude Platform on AWS; no advisor runs until you pick one with /advisor, advisorModel or --advisor, and CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns it off
No entry names this gen_ai.provider.name, gen_ai.conversation.id, gen_ai.tool.name and error.type
Probably tool-error-span-attribute-for-failed-non-interrupted-tool-c, otel-spans-get-gen-ai-attributes-prompt-redaction-handle, tool-and-llm-telemetry-spans-gain-gen-ai-attributes prompt and model in the agent.spawn mod hook, which could only refuse workflow agents before
No entry names this prompt.change mod hook, raised when the prompt box's text changes without a typed edit: a recalled history entry, a clear, an undo, or a plugin's fill
Probably new-telemetry-and-event-names, mod-event-table-gains-promptchange-policy-decision-gets-se, prompt-change-hook-dispatcher-with-loop-stall-guard /autocompact warning about high token usage when you choose a smaller auto-compact window
Probably autocompact-telemetry-expanded-and-the-high-token-warning-m claude --help naming a removed tool in its description of --restricted
Probably restricted-help-text-no-longer-names-repl claude agents not refreshing any pull request's status when the data for one of them came back incomplete
No entry names this /tasks shortly after finishing, leaving no way back to the conversation
No entry names this ENABLE_TOOL_SEARCH=auto) turning off part-way through a conversation, for example while MCP servers reconnect after a resume
No entry names this forceLoginOrgUUID leaving the refused organization's token stored, or live after /login
Probably remote-control-credential-renewal-explains-sign-in-failures, cloud-agents-not-logged-in-error-can-carry-a-custom-message, oauth-login-paths-gain-an-org-pin-verification-step-before-c, forceloginorguuid-check-refactored-with-a-reusable-verifier, cloud-session-creation-has-a-separate-console-profile-path Artifact("(unprintable path)") while a call's input arrives; its row now shows "Waiting…" and "Running…" as Bash's does
No entry names this /branch dropping messages, and claude purge skipping subfolder projects, when they contain a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this WorktreeCreate and WorktreeRemove hooks not running when Claude Code starts with --worktree (not yet with --tmux)
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work #100905[BUG] Plugin `WorktreeCreate` hook still ignored for `claude --worktree` on 2.1.296 (#46664 closed as stale, never fixed) Open
tool_result events missing git_commit_id after git commit -q in repositories using reftable ref storage
No entry names this prompt.submit hook rewrote or dropped still being recorded as typed in the OpenTelemetry user_prompt event and interaction span, and in session title requests
Probably user-prompt-telemetry-helper-and-orphan-answer-skip-flag-att, userpromptsubmit-hook-detection-restricted-by-a-new-module-c, mod-event-table-gains-promptchange-policy-decision-gets-se model: aliases like haiku now resolve, a subagent's model no longer overrides it, and an unavailable model falls back to the caller's instead of allowing the action
Nothing to match on --worktree sessions sometimes starting from the wrong commit when a tag or branch was named like a commit ID, and their starting git status naming a branch other than the new worktree's
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work --worktree failing to reopen a worktree in repositories using git's reftable ref storage
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work #96060[BUG] Reftable repos: CLI reads .git/HEAD directly, branch resolves to ".invalid" and PR status is dropped from the statusLine payload Open
claude remote-control servers giving up on renewing their connection after a brief sign-in error, such as a locked keychain; they now retry, and warn when you need to run claude /login
Probably remote-control-credential-renewal-explains-sign-in-failures, cloud-agents-not-logged-in-error-can-carry-a-custom-message, remote-control-asks-about-unattended-tool-calls-up-front-in, remote-control-rejects-sandbox-no-sandbox-instead-of-acc, cloud-session-creation-has-a-separate-console-profile-path #95262remote-control session permanently 401s after token refresh fails; /login cannot reach the process Open
--worktree failing in a worktree of a bare repository when origin's default branch can't be fetched; the fallback base is now the current checkout's HEAD, not the main repository's
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work prompt.edit hook not being raised for a newline entered with the chat:newline keybinding (Ctrl+J, or a rebound Enter)
No entry names this claude daemon stop --any printing "stopped" while a stuck background service kept running: it now waits, force-kills the service, and says so with exit 1 if it is still there
No entry names this claude daemon stop exiting with no output, and leaving sessions listed as running, when telemetry is turned off
Probably daemon-stop-now-escalates-sigterm-to-sigkill-and-explains-st /healthz or SIGTERM shutdown) while nobody reads their output; logs keep the latest 256 KiB and count drops (not on Windows)
No entry names this plugin-authoring skill: Claude scans a mod's files for keys before opening them, and asks before scanning a folder outside the project
Probably secret-scan-tool-for-the-plugin-authoring-mods-built-in-pl CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST sessions to ignore CA-bundle, tool-proxy, git TLS and git config variables like SSL_CERT_FILE in settings; under Claude Desktop, only in project settings
No entry names this forceLoginGatewayUrl names an Anthropic-operated gateway that serves the session's hostname; that gateway must be reachable at start
No entry names this claude gateway to stop at start, naming the key, on a desktop: policy key that Claude Desktop cannot use from a gateway, where it earlier started with a warning
No entry names this CLAUDE_CODE_GZIP_REQUEST_BODIES=0 to turn it off
No entry names this claude-api skill to leave Managed Agents sessions in place unless you ask to archive or delete them
No entry names this /sandbox mode options to read "Sandbox commands" instead of "Sandbox BashTool"
Probably sandbox-option-label-renamed, sandbox-menu-labels-renamed PermissionRequest hooks in Cowork cloud sessions: a setMode update in a hook's allow is now ignored; the rest of the approval still applies
Probably hook-updatedinput-rewrites-are-now-validated-against-the-too, managed-settings-startup-message-distinguishes-unloaded-hook, permissionrequest-hook-setmode-dropped-in-cowork-cloud-cod, hook-load-failures-a-managed-settings-hook-that-cant-be-lo updatedInput from PreToolUse and PermissionRequest hooks is now validated like Claude's own input: unknown keys are dropped, and input the tool rejects denies the call
Probably hook-updatedinput-rewrites-are-now-validated-against-the-too, updatedinput-refusal-message-varies-by-settings-source --sandbox and --no-sandbox flags from claude remote-control, which had no effect; passing either now exits with an error. Set sandbox.enabled in settings to sandbox sessions
Probably remote-control-asks-about-unattended-tool-calls-up-front-in, remote-control-rejects-sandbox-no-sandbox-instead-of-acc, gateway-inference-settings-are-now-read-by-claude-code-cod claudeCode.attachSelection setting to stop text selected in the editor from being added to your messages
No entry names this /c:/… path instead of a mention relative to the working directory
No entry names this /bin/ps directly instead of searching PATH for ps on every check
No entry names this @claude review comments from people with write access whose GitHub organization membership is private; their comments now start a review
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 27 tool descriptions changed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
668 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?