Sessions can now start in a sandbox VM by default when an option is set. The new --unsandboxed flag opts out of that and of cloud-by-default too. Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH turns on the send-file tool and stops Claude Code uploading the files it sends you. On self-hosted runners, all session traffic can now go through a proxy you run. Admins get a beta selfHosted section in managed settings for self-hosted session hosts. A new codeAllowedRepositories setting lists the git repositories Claude Code may work in on those hosts.
Claude Code is now listed as a reader of organization-managed settings, but those settings are not served to it yet. Organization config also gains an Allow Quick Write setting that is not switched on. Claude Desktop accepts codeAllowedRepositories but does not apply it to on-device sessions yet. The memory dialog has a new cloud memory option that does nothing yet. A new check for one tool in a permission mode called arbiter stays off unless the server turns it on.
An MCP tool whose parameter description the API rejects no longer breaks the conversation. Claude Code now blanks that description, warns you and retries, so the tool stays callable. Starting with --worktree now loads plugin WorktreeCreate hooks first, so a plugin can handle worktree creation. Command hooks now stop when their configured timeout runs out. The CLAUDE_CODE_FORCE_SANDBOX environment variable is removed. Passing --sandbox or --no-sandbox to claude remote-control is now an error instead of being silently accepted.
Written by our agent from the shipped bundle, not by Anthropic.
Setting CLAUDE_CODE_ATTACHMENTS_BY_PATH enables the send-file tool without its usual checks, skips uploads and counts the session as remote
ElsewhereAdmin config gains a selfHosted block and a codeAllowedRepositories list for self-hosted sessions; the repo list isn't applied on-device yet
Settings & configSession start can now place a session in a sandbox VM by default, and a new --unsandboxed flag opts out of that and of cloud-by-default
Permissions & safetyThe prompt draft can now tag edits with their origin and report changes, and extensions reach it through composer.attribute and attributeDraft
ExtensionsNew ui.view plugin capability switches the main view to an agent's transcript, and plugin calls judged under an outdated policy are refused
Extensions
CLAUDE_CODE_FORCE_SANDBOX no longer existsPermissions & safetyWant the reasoning? Read walks the 47 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →12 more of these are in What probably matters to you, on page 1.
Prompts to review a dynamic workflow can now include a reason, and when they do, no always-allow option is offered
When attaching to a remote session on a self-hosted runner, Claude Code now skips checking whether the project is synced
--worktree from a pull request now tracks its host and names the head commit#With --worktree and a pull request, Claude Code now passes on which host the request came from and shows the head commit in its message
deviceToolsEnabled and the selfHosted credential keys are retired, and gateways now reject settings that run Desktop sessions off the device
If an uploaded plugin is not its current version, publishing now says nothing was submitted and to make the new version current first
Claude now says it cannot share a skill for you, but that a Share button may appear on the skills card, sharing only within your organization
If unattended serving is on and set to ask, the background service dashboard now opens straight on the consent dialog, then moves to Remote Control
When a message is nothing but pasted text, Claude now does what the paste asks without asking you to confirm first
After a permission request gets no answer, Claude is told you may be away, to stop asking, finish what it can, and then say what it needed
Unclear Which modes or sessions give Claude this instruction is not stated.
Startup hooks and plugin hooks now wait for organisation managed settings, and are skipped with a warning if those never arrive
Unclear Whether this waiting applies to every setup or only to some is not stated.
Signing in now checks the new account against the pinned organisation and rolls the sign-in back if it is refused
The strict sandbox text now says every command the model runs must be sandboxed, and the prefetch memory message no longer names a 64 MiB limit
Unclear It is not clear whether the sandbox now actually covers more commands or only the wording changed.
In Cowork cloud, once certain managed policy settings are tightened, a later settings update can no longer loosen them
When Claude Code reads a pull request link, it now notes whether it is GitHub or GitLab, and recognizes GitLab merge request links
In auto mode, publishing a file with edits is now denied if the automatic permission check cannot see those edits
Unclear It does not name the tool or command that does this publishing, so it is unclear where you would run into the denial.
An organisation setting for plugins is now marked as read by both the desktop app and Claude Code, with a stand-in for when it cannot be read
When the model running an agent hook refuses, Claude Code now reruns the hook on a fallback model instead of cancelling it
claude daemon stop now force-kills a daemon that will not stop#claude daemon stop now asks a stuck daemon to stop, waits, then force-kills it, and explains clearly when it cannot
Teleporting a session to the cloud is now refused when the branch has untracked files, with advice to commit and push them or run git stash -u
Before Remote Control starts, Claude Code can now ask once whether to allow tool calls while you are away, unless --allow-unattended-tool-calls is passed
Unclear It is not clear what starts this question or whether it is shown when Remote Control starts in this release.
When a PDF must be read page by page, Claude is now told it has not seen the file and must use the Read tool with a page range first
Progress summaries for helper agents now follow a server-provided schedule of waits instead of a fixed interval, and skip until due
--restricted no longer lists REPL among the removed tools#The help text for --restricted drops REPL from its list of code-running tools that restricted mode removes
Unclear Whether restricted mode still removes the REPL tool is not stated.
Claude Code explains that a Console-profile sign-in has no trusted-device token, because that token belongs to a claude.ai login
When a hook blocks a slash command run in a fork, Claude Code shows the original prompt in fewer cases
Claude Code now checks something more about the conversation before suggesting a switch to a model with a larger context window
Unclear It is not clear what the new check looks at, so it is unknown when the suggestion is now held back.
When Claude Code picks up a handed-off task, it now reads the handoff file with a size limit and rejects task, agent and schedule IDs that are too long
Claude Code's Bash tool now rejects commands that match a new check with error code 13, unless you typed the command yourself
Unclear Which commands the new check blocks, and the message shown when it does, is not clear.
If a plugin upload is not the plugin's current version, Claude now passes that on and does not try publishing again by itself
The model can no longer write into Claude Code's jobs folder, and some other internal folders are protected when a server-side switch allows it
Unclear It is not clear whether the daemon, shell-snapshots and session-env protections are switched on by default.
The allowed outbound hosts setting now says it covers Chat, including web fetch, alongside Cowork tasks and Code sessions
Unclear It is not clear whether Chat traffic is newly restricted by this list or was already restricted and only now described.
A PostToolUse hook that ran in another environment can no longer replace a tool's result, and Claude is told it read the original
Remote Control now retries sign-in errors when renewing its connection and, if it gives up, says why and how long the connection still works
Output from the self-hosted runner now goes through one writer that stamps each line with the time, including stderr from the git --version check
Claude Desktop managed settings now refuse a config URL whose host, user name or password looks like an API key or token, and list crash dumps as data sent
/autocompact warns about high token usage only for larger windows#The high-token-usage warning in /autocompact now shows only when the chosen window is bigger than the auto window for your model
When Claude in Chrome tools are missing, Claude Code now tells the model the specific reason and what to do, instead of one fixed message
Gateway login now limits how long it waits to look up the gateway host and the HTTP proxy, and says which one could not be resolved in time
Highlighting in the prompt box now depends on a new condition, and a settings reload can keep your last user settings in place
Unclear What either change looks like to a user, and when the settings part is switched on, is not clear.
When a command runs in the background, Claude Code now tells Claude it will be notified and should not keep checking the output file
Unclear It is not clear what decides whether the new wording is used, so it may not apply to every account or model.
The status note about broken MCP servers now says whether a server needs sign-in, is retrying, or has failed for the rest of the session
Transcript entries whose type starts with api-request are no longer copied to the transcript mirror, and empty batches are not sent
Environment-management requests now use a Console-profile session's credential when one is active, instead of requiring OAuth
If Claude Code hits an internal fault while checking permission for a tool, the action is now denied instead of carrying on
In vim mode, the prompt box now treats the cursor as sitting on a character in every mode except insert mode
disableBundledSkills and coworkEgressAllowedHosts are now marked in the settings schema as read by both Claude Desktop and Claude Code
Unclear Whether Claude Code now enforces these two settings differently, or only the schema labels changed, is not stated.
Claude Code now enforces the JSON Schema rules for unique items, required contents and property counts, which it used to ignore
When --worktree uses a pull or merge request number, Claude Code fetches the full PR reference and refuses if it can't tell which commit is meant
/teleport shows clearer access errors and syncs git state first#The /teleport session picker now shows the actual reason when cloud access is refused, and /teleport publishes git state before taking over a session
Signing in now checks the new token against the organisation required by managed settings before saving it, and fails if it does not match
Enabling or disabling an MCP server can now carry a request id so a repeated request returns the earlier result instead of switching again
Traces of tool use now include standard GenAI fields such as the tool name, and the MCP server name for MCP tools
Some errors raised while Claude Code works out which hooks apply now stop the operation instead of being logged and skipped
The read-only folders setting's description no longer says SSH ignores it, and now lists where read-only is enforced and where it is not
Unclear Only the description text changed here, so it is not shown whether the SSH enforcement itself works in this version.
Before teleporting a session, Claude Code now runs an extra git check and can report the branch as untracked
Claude Code will not restart a session onto a new version if a file passed with --settings or --mcp-config can no longer be read
Immediate slash commands now record what was actually run through a ranAs value, and over the bridge may leave their arguments out of the record
Unclear Exactly what now appears in prompt history, and when recording is skipped, is not stated.
Claude's instructions for the Bash tool were rewritten, including how background commands and waiting work
The settings warning dialog has a separate message for when only hooks failed to load and no settings file was skipped
The warning for keys a settings file cannot set now says only the launch environment or Claude Code itself can set them, and covers more keys
Setting inferenceGatewayAuthScheme to "sso" will keep working with no end date, instead of a warning that inference would stop
The rule for when Claude Code shows the notice that auto mode was declined has changed
Unclear When the notice now appears, compared with before, is not stated.
The Edit and NotebookEdit tools now run an extra check on the file path first, so some paths that passed before may be refused
Unclear It is not clear which paths the new check refuses.
The not-signed-in error for cloud agents now shows a specific message when one is available, instead of always the same text
A command containing the invisible characters U+FEFF or U+180E is now refused, with a note on how to write them safely
Unclear It is not clear which command tool runs this check, the Bash tool or the PowerShell tool, or whether the check is always on.
A new size cap is set to 16 MB under one condition and 64 MB otherwise
Unclear It is not clear what this limit applies to or which condition chooses the 16 MB value.
The cloud-settings notice now shows as a warning only when the check timed out or deny or ask rules are missing, and as a debug line otherwise
When web fetches go through the remote-session proxy, Claude Code now tidies the address first and records which addresses failed and why
When the outbound proxy rejects a connection, the message now says a refusal most often means the host is not allowed for this session
When a hook returns a setting that workflow agents ignore, the message now says that setting does not apply to a workflow agent
If your organization's managed settings haven't been read yet, Claude Code now says it can't yet tell whether hooks are allowed
The automatic artifact reply notice now says replies keep going in the background session, where you won't see each one as it's posted
The sandbox option that auto-allows commands is now labelled "Sandbox commands, with auto-allow" instead of "Sandbox BashTool, with auto-allow"
If invalid managed settings include PreToolUse or PermissionRequest hooks, the startup message now says those hooks are not loaded
The on-disk session journal now tells a harmless half-written last line apart from an unreadable line, and reports the latter
When synced files may not have arrived, the warning now says if a copy failed for lack of disk space or because a file name was too long
When a function hook is cancelled for an unreported reason, the error now shows fixed text instead of that reason
If a web address contains something that looks like an API key, Claude Code now refuses to read it and reports no hostname
The teleport error screen has a "refused" case with its own message, alongside network, sign-in, API and other errors
A sign-in error when sending a file from a cloud session now explains that the sign-in expired and says to wait about five minutes
When an agent proxy connection is refused, the failure note can now include an extra hint line before the line pointing to curl for details
The sandbox mode picker now labels its options "Sandbox commands" rather than "Sandbox BashTool"
The error shown when plugins fail to load can now add that the organization's managed settings could not be read either
When an internal fault stops Claude Code from finding the hooks for a call, the message now says nothing in the session can fix it
Claude Code can now retry checking your OAuth sign-in token after short waits, and logs a failure only once the retries run out
The check that you signed in to your required organization now reuses an organization ID already fetched instead of fetching your profile again
Claude's instructions now ask it to write the full absolute path, in one piece, when it names a file in its scratchpad
When a marketplace was not updated because organization settings have not arrived yet, the notice now says so instead of telling you to ask your admin
Remote sessions, rewind, resume and error reporting each received small internal changes
Unclear What any of these changes does for a user is not known.
The built-in default for recording API requests into transcripts moved to true, and requests whose CLAUDE_CODE_EXTRA_BODY can't be recorded are skipped
When the API rejects one MCP tool's input schema, Claude Code swaps in an empty schema and retries instead of failing the request
Unclear It is not known whether the server-controlled switch is on by default, so readers may not get this behaviour.
With --worktree, Claude Code now registers plugin worktree hooks before creating the worktree, and setup gains PR forge and resume options
Unclear How a reader asks Claude Code to reuse an existing worktree as it is is not stated.
Command hooks run through this path now stop when their configured timeout in seconds runs out
Unclear It is unclear whether this applies to every command hook or only to one particular way of running them.
The prompt box now draws placeholder text, such as stand-ins for pasted content, together with highlighting and the cursor
Claude Code now checks with git before treating a leftover cherry-pick, revert or rebase marker file as an operation in progress
Claude Code now looks up the exact commit before creating a worktree from HEAD, so the starting point can't shift partway through
Fetching pull request status now caps the reply size and checks each entry, so a bad reply no longer breaks the display
Claude Code's text cleanup now keeps the invisible joining characters that Indic, Sinhala and Arabic text and multi-part emoji rely on
In Remote Control start-up settings, leaving sandbox unset no longer means off, so another default can apply
Unclear Which default applies when sandbox is left unset is not stated.
The stop action in the background tasks list now handles some local agents that are not running, and some tasks are dismissed instead
Published verbatim by Anthropic for v2.1.300. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 88 bullets, 18 name something an entry on this page also names, 28 name something no entry here does, and 42 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
virtualText to a mod's prompt decorations: text drawn in the prompt box that never enters the draft or the submitted prompt
No entry names this cache_creation_5m_tokens and cache_creation_1h_tokens to the OpenTelemetry api_request event, splitting cache writes by lifetime
Probably cache-creation-5m1h-token-split-in-api-telemetry $.ui.view({ agentId }) for mods: shows an agent's transcript in the main view when you ask, and $.ui.view({}) goes back
No entry names this dir prop on a mod's Text for right-to-left text: on Windows and in VS Code's terminal its rows read in that direction and sit flush right
No entry names this /advisor on Claude Platform on AWS; no advisor runs until you pick one with /advisor, advisorModel or --advisor, and CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns it off
No entry names this gen_ai.provider.name, gen_ai.conversation.id, gen_ai.tool.name and error.type
Probably tool-error-span-attribute-for-failed-non-interrupted-tool-c, otel-spans-get-gen-ai-attributes-prompt-redaction-handle, tool-and-llm-telemetry-spans-gain-gen-ai-attributes prompt and model in the agent.spawn mod hook, which could only refuse workflow agents before
No entry names this prompt.change mod hook, raised when the prompt box's text changes without a typed edit: a recalled history entry, a clear, an undo, or a plugin's fill
Probably new-telemetry-and-event-names, mod-event-table-gains-promptchange-policy-decision-gets-se, prompt-change-hook-dispatcher-with-loop-stall-guard /autocompact warning about high token usage when you choose a smaller auto-compact window
Probably autocompact-telemetry-expanded-and-the-high-token-warning-m claude --help naming a removed tool in its description of --restricted
Probably restricted-help-text-no-longer-names-repl claude agents not refreshing any pull request's status when the data for one of them came back incomplete
No entry names this /tasks shortly after finishing, leaving no way back to the conversation
No entry names this ENABLE_TOOL_SEARCH=auto) turning off part-way through a conversation, for example while MCP servers reconnect after a resume
No entry names this forceLoginOrgUUID leaving the refused organization's token stored, or live after /login
Probably remote-control-credential-renewal-explains-sign-in-failures, cloud-agents-not-logged-in-error-can-carry-a-custom-message, oauth-login-paths-gain-an-org-pin-verification-step-before-c, forceloginorguuid-check-refactored-with-a-reusable-verifier, cloud-session-creation-has-a-separate-console-profile-path Artifact("(unprintable path)") while a call's input arrives; its row now shows "Waiting…" and "Running…" as Bash's does
No entry names this /branch dropping messages, and claude purge skipping subfolder projects, when they contain a Unicode line or paragraph separator (U+2028, U+2029)
No entry names this WorktreeCreate and WorktreeRemove hooks not running when Claude Code starts with --worktree (not yet with --tmux)
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work #100905[BUG] Plugin `WorktreeCreate` hook still ignored for `claude --worktree` on 2.1.296 (#46664 closed as stale, never fixed) Open
tool_result events missing git_commit_id after git commit -q in repositories using reftable ref storage
No entry names this prompt.submit hook rewrote or dropped still being recorded as typed in the OpenTelemetry user_prompt event and interaction span, and in session title requests
Probably user-prompt-telemetry-helper-and-orphan-answer-skip-flag-att, userpromptsubmit-hook-detection-restricted-by-a-new-module-c, mod-event-table-gains-promptchange-policy-decision-gets-se model: aliases like haiku now resolve, a subagent's model no longer overrides it, and an unavailable model falls back to the caller's instead of allowing the action
Nothing to match on --worktree sessions sometimes starting from the wrong commit when a tag or branch was named like a commit ID, and their starting git status naming a branch other than the new worktree's
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work --worktree failing to reopen a worktree in repositories using git's reftable ref storage
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work #96060[BUG] Reftable repos: CLI reads .git/HEAD directly, branch resolves to ".invalid" and PR status is dropped from the statusLine payload Open
claude remote-control servers giving up on renewing their connection after a brief sign-in error, such as a locked keychain; they now retry, and warn when you need to run claude /login
Probably remote-control-credential-renewal-explains-sign-in-failures, cloud-agents-not-logged-in-error-can-carry-a-custom-message, remote-control-asks-about-unattended-tool-calls-up-front-in, remote-control-rejects-sandbox-no-sandbox-instead-of-acc, cloud-session-creation-has-a-separate-console-profile-path #95262remote-control session permanently 401s after token refresh fails; /login cannot reach the process Open
--worktree failing in a worktree of a bare repository when origin's default branch can't be fetched; the fallback base is now the current checkout's HEAD, not the main repository's
Probably worktree-pr-creation-supports-a-forge-and-uses-head-commit, worktree-creation-plugin-worktreecreate-hooks-registered-fi, pr-worktree-fetch-verifies-the-fetched-ref-tengu-melodic-oc, plugin-worktreecreate-hooks-are-now-registered-before-work prompt.edit hook not being raised for a newline entered with the chat:newline keybinding (Ctrl+J, or a rebound Enter)
No entry names this claude daemon stop --any printing "stopped" while a stuck background service kept running: it now waits, force-kills the service, and says so with exit 1 if it is still there
No entry names this claude daemon stop exiting with no output, and leaving sessions listed as running, when telemetry is turned off
Probably daemon-stop-now-escalates-sigterm-to-sigkill-and-explains-st /healthz or SIGTERM shutdown) while nobody reads their output; logs keep the latest 256 KiB and count drops (not on Windows)
No entry names this plugin-authoring skill: Claude scans a mod's files for keys before opening them, and asks before scanning a folder outside the project
Probably secret-scan-tool-for-the-plugin-authoring-mods-built-in-pl CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST sessions to ignore CA-bundle, tool-proxy, git TLS and git config variables like SSL_CERT_FILE in settings; under Claude Desktop, only in project settings
No entry names this forceLoginGatewayUrl names an Anthropic-operated gateway that serves the session's hostname; that gateway must be reachable at start
No entry names this claude gateway to stop at start, naming the key, on a desktop: policy key that Claude Desktop cannot use from a gateway, where it earlier started with a warning
No entry names this CLAUDE_CODE_GZIP_REQUEST_BODIES=0 to turn it off
No entry names this claude-api skill to leave Managed Agents sessions in place unless you ask to archive or delete them
No entry names this /sandbox mode options to read "Sandbox commands" instead of "Sandbox BashTool"
Probably sandbox-option-label-renamed, sandbox-menu-labels-renamed PermissionRequest hooks in Cowork cloud sessions: a setMode update in a hook's allow is now ignored; the rest of the approval still applies
Probably hook-updatedinput-rewrites-are-now-validated-against-the-too, managed-settings-startup-message-distinguishes-unloaded-hook, permissionrequest-hook-setmode-dropped-in-cowork-cloud-cod, hook-load-failures-a-managed-settings-hook-that-cant-be-lo updatedInput from PreToolUse and PermissionRequest hooks is now validated like Claude's own input: unknown keys are dropped, and input the tool rejects denies the call
Probably hook-updatedinput-rewrites-are-now-validated-against-the-too, updatedinput-refusal-message-varies-by-settings-source --sandbox and --no-sandbox flags from claude remote-control, which had no effect; passing either now exits with an error. Set sandbox.enabled in settings to sandbox sessions
Probably remote-control-asks-about-unattended-tool-calls-up-front-in, remote-control-rejects-sandbox-no-sandbox-instead-of-acc, gateway-inference-settings-are-now-read-by-claude-code-cod claudeCode.attachSelection setting to stop text selected in the editor from being added to your messages
No entry names this /c:/… path instead of a mention relative to the working directory
No entry names this /bin/ps directly instead of searching PATH for ps on every check
No entry names this @claude review comments from people with write access whose GitHub organization membership is private; their comments now start a review
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 27 tool descriptions changed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
647 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?