Claude Code's bundled default model is now Opus 5.5 at medium effort, replacing Opus 5 at high effort. You can set CLAUDE_CODE_SKIP_PLUGIN_LOCAL_MCP_SERVERS to keep only the remote MCP servers that plugins bring. A program that runs claude mcp serve can pick which plugins load with CLAUDE_CODE_MCP_SERVE_ENABLED_PLUGINS. A new allowNestedUserNamespaces sandbox setting lets browsers or rootless podman run inside the sandbox on Linux. It is off by default because it weakens the sandbox. Plugin modules can now read and override the settings in effect through a new settings.read event.
Some work in this build is not switched on yet. In-app surveys for enterprise organizations stay off unless turned on remotely. Setting CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY skips them. Groundwork for showing skills as plugins has landed but cannot be reached. Leaving a worktree now checks whether to keep it, but that check always says no in this build. A launch option to turn off plan or auto mode is partly built, with no visible setting yet.
Creating a worktree no longer resets an existing branch with the same name. Claude Code now stops with an error instead. Your cached remote settings are no longer cleared when a proxy answers with a 204 or 404 reply. Very long timeouts are now capped instead of firing immediately. Removing one skill's hooks no longer removes matching hooks added by another skill. Claude Code no longer fetches skills from MCP servers when it connects to them.
Written by our agent from the shipped bundle, not by Anthropic.
New environment variables add low disk and memory warnings, limit plugin MCP servers, and pass startup and project details to child sessions
ExtensionsA new settings.read event lets plugin hooks see and override your effective settings, re-checked whenever settings or plugins change
ExtensionsA new carry_across_restarts option lets post-turn memory extraction save and restore its progress when its worker restarts
Sessions & agentsprompt.fill and suggest-prompt requests now carry answersPress, plugins get press_drawn and press_fill hook events, plus two new defaults
Extensions
CLAUDE_CODE_ATTRIBUTION_PROJECT setting checked against claude.ai Project IDsClaude Code now recognises CLAUDE_CODE_ATTRIBUTION_PROJECT and drops a value that is not a valid claude.ai Project ID from saved jobs
Want the reasoning? Read walks the 43 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
New environment variables add low disk and memory warnings, limit plugin MCP servers, and pass startup and project details to child sessions
Unclear What the other newly recognised variables, such as CLAUDE_CODE_WARN_DISK_FREE_GIB, actually do is not shown.
A new settings.read event lets plugin hooks see and override your effective settings, re-checked whenever settings or plugins change
A new carry_across_restarts option lets post-turn memory extraction save and restore its progress when its worker restarts
Unclear It is not known exactly what is kept across a restart when carry_across_restarts is true.
MCP-served skills are no longer fetched when servers connect, and their files are now checked against what the server listed
Unclear Whether this handling is switched on is not stated.
prompt.fill and suggest-prompt requests now carry answersPress, plugins get press_drawn and press_fill hook events, plus two new defaults
Unclear What a "press" is, and so what a plugin can do with these events, is not stated.
A new survey that an enterprise organisation can send its members appears above the prompt, behind a server flag
Plugin hook modules can now be scanned for a ui.render hook, and a UI press can return a freshly drawn tree in one step
Unclear It is not clear whether mods can use the ui.render hook yet or whether it is switched off.
CLAUDE_CODE_ATTRIBUTION_PROJECT setting checked against claude.ai Project IDs#Claude Code now recognises CLAUDE_CODE_ATTRIBUTION_PROJECT and drops a value that is not a valid claude.ai Project ID from saved jobs
Unclear What Claude Code does with the Project ID once it is set is not shown.
The model catalog shipped with Claude Code now defaults to claude-opus-5-5 at medium effort instead of claude-opus-5 at high effort
The SDK initialize request accepts codeRunningMcpTools so auto mode judges code-running MCP tools, and the reply reports whether it applied
Unclear Exactly which permission rules are removed when tools are marked this way is not stated.
The sandbox proxy now checks request targets, Host and SNI, and credential-file denies can no longer be reopened by broader allows
Unclear Whether Claude Code itself sets any of these options is not stated.
The device bridge that offers local MCP servers to cloud sessions can now be denied by settings, and remembers a "not now" consent answer
Unclear Which setting blocks the serving is not named.
The command that resets a session limit can now show the argument hint [fable|full|5-hour|weekly]
Unclear It is not clear what makes this command and its hint available, so most readers cannot tell whether they will see it.
On Linux, sandboxed commands can no longer create user namespaces unless allowNestedUserNamespaces is set, and credential deny rules are hardened
CLAUDE_CODE_PERSONAL_CONFIG_FIX environment variable#A new environment variable, CLAUDE_CODE_PERSONAL_CONFIG_FIX, is read by Claude Code and passed on to tmux sessions and child processes
Unclear What values CLAUDE_CODE_PERSONAL_CONFIG_FIX accepts and what it changes are not known.
Claude Code can now prepare background agents orphaned by a restart so they can be resumed, and the restart notice says which ones
Unclear Which sessions meet the further condition besides the server setting is not known.
Claude Code has a new prompt asking whether to turn on mods Claude writes in a session, with a warning that a mod is code running with your access
Unclear What causes this prompt to appear is not stated.
When an MCP server supplies artifact tools, Claude Code can hide its built-in artifact tools and apply your permission rules to the MCP ones instead
Unclear It is not clear what decides whether the MCP tools replace the built-in artifact tool, or whether that is on by default.
In a session running with no disk, Claude Code skips feedback drafts, the changelog cache, teammate spawning and the plugin relevance scan
Unclear What starts a session with no disk, and whether a user can choose it, is not stated.
CLAUDE_CODE_MCP_SERVE_ENABLED_PLUGINS lets a program that launches claude mcp serve pick which plugins are turned on
A launch path now uses the branch from --on-branch first, then the ref from --ref, and records which flag supplied it
Unclear It is not clear whether anything uses this path yet, so whether these flags change where a task starts is unknown.
The total-tokens reminder now defaults to on only for models with a new total_tokens_reminder capability, and is off for others
Unclear It is not clear what sets the explicit choice, or whether the reminder style used by default has changed.
Claude Code can now check organization configuration at startup and in the agents view, and show a screen that blocks use
Unclear What turns this check on, and what configuration it compares, is not stated.
In what appears to be a diskless mode, Claude Code skips caching organisation memory, project local settings and some folder creation
Unclear Whether a user can start a diskless session, and how, is not stated.
Hook plugins can now intercept a queued message, and a plugin's session.send is refused if Claude Code cannot read whether plugin input is held
Remote-control clients can now run a skill's command hooks, unless settings keep them off, and see skills from your user settings
The way slash commands are set up now lets a command carry a policy gate, which can make it subject to organisation policy
Unclear Which slash commands, if any, carry a policy gate is not stated.
Claude Code's check for turns ending with no reply now supports a policy that can ask again several times
Unclear Where this policy comes from, and whether a user can set it, is not stated.
When a tool would ask for your permission, PermissionRequest hooks can now run first and turn that question into a refusal
Your computer's tools can now be reported unavailable to a cloud session because the repository is excluded, and notices say "Linux VM" not "sandbox"
Unclear How a repository comes to be excluded is not stated.
Messages about calls waiting on or refused by your computer now say "Linux VM" instead of "sandbox"
Claude Code gains an unused way to step away from a served channel ahead of a restart, which nothing calls yet
Auto mode's automatic safety check now gets a rule about the cloud remote browser, based on your connected MCP servers
Unclear What the remote browser rule allows or blocks is not stated.
Claude Code adds an organisation setup name, a managed-agents-secure entry and a new switch that is off unless turned on remotely
Unclear What any of the three controls is not stated.
The whiteboard no longer picks a live or solo mode per session and instead follows a single switch controlled remotely
Unclear It is not clear what the whiteboard does differently for a user when this switch is on or off.
The auto-compact window env var accepts 200k or 1M shorthand, clamps or warns on bad values, and /config shows an extra note about it
Adding remote-devices to deniedMcpServers now stops this machine offering MCP servers to cloud sessions already running
A plugin hook that answers "ask" can now mark that a person must decide, so the automatic check cannot approve it
The command that resets your session limit now accepts a reset name such as full, 5-hour or weekly, and can show a chooser
Unclear The command's name and whether it is available to every account are not stated.
--system-prompt-snapshot still defaults to on, except under --bare outside cloud and background sessions
In some mode, Claude Code no longer checks or deletes handover files on your disk and records those reads and discards another way
Unclear It is not clear what turns this mode on or whether it ever applies to a normal session.
/login accepts an argument and drops its cloud-session workaround#The cloud-session tip for /login is gone, and /login now reads an argument and reports when it does not recognise it
Unclear Which arguments /login accepts, and whether it now works inside cloud sessions, is not stated.
When a worktree gets a new numbered branch name that already exists, Claude Code now stops with an error instead of resetting that branch
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
14 more of these are in What probably matters to you, above.
Headless Claude Code now streams startup checkpoints as keep_alive lines with a startup_mark, and the SDK records them with a timestamp
/usage-credits can now show server-driven bonus and discount offers in the menu, a hint and a banner, and refuses to charge if prices changed
13 more of these are in What probably matters to you, above.
Offline peer entries and unreachable-session results now include lastHeardAt and a busy hint, so busy and gone can be told apart
In sessions with no plan file, Claude now hands the whole plan to ExitPlanMode for your approval instead of writing it to a file
Unclear Which sessions have no plan file, and so need the plan passed this way, is not stated.
Claude Test now checks its agents are loaded, explains why it can't run without a disk, and gains a placeholder progress pane
Plugin sync now fetches required plugins first, handles server-side renames, and can sync skills as plugins outside hosted sessions
In remote sessions, /model can open a picker of kept model rows, and the cloud model list is now cached and refreshed per session
Unclear What the kept model rows are and what creates them is not stated.
Worktree exit and removal now report what is at stake, handle a detached HEAD, and refuse to quietly delete worktrees nested inside
The resume picker and rewind dialog gain a redesigned layout behind an isRedesign switch, and the compaction resume message lists tools used
SendMessage checks a message can be delivered before sending, and only a teammate session can now approve a shutdown request
Certain managed memory files are flagged unverified, passed to Claude as quoted text, and re-sent when that flag changes
Unclear It is not clear which locations trigger the flag or what Claude Code does differently with an unverified file.
Organization-managed skills and agents in the managed .claude folder are filtered out while a managed-folder hold is active
Unclear What turns the managed-folder hold on is not stated.
After a permission prompt times out unanswered, later subagent prompts in the same turn return quiet_spell instead of asking again
Unclear It is not shown what the subagent does when its request is held back, for example whether it treats it as a refusal.
apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh and otelHeadersHelper now pass a guard, and their trust checks accept another source
Unclear What makes a process count as pinned to the stored login, or as a tool-server daemon, is not stated.
Idle hints and the idle-cache quota now follow pastUsageLimitUntil, and a model_requires_usage_credits error gets new handling
The check for protected files can now skip named files per request and only checks git config inside .git folders when asked
Unclear It is not clear which actions pass these exceptions or the git config option, so which writes now prompt differently is unknown.
The dialog for buying extra usage now reads an offer, a remaining monthly bundle cap and custom discount tiers sent from the server
Unclear How the offer, monthly cap and discount tiers are shown in the dialog is not stated.
When a skill is turned off in claude.ai, Claude Code can mark the synced plugin that provides it as turned off in your local settings
Unclear When this sync runs, and whether it is switched on for every account, is not stated.
ant commands before they run#The /claude-api skill now blocks ant commands with certain IDs and managed-agents-secure commands changed from the guide
The agents view can now be told which job to open from another source and can send you back to a cloud session when that job is missing or failed to restart
Unclear It is not clear how the view is opened this new way, or whether the cloud-session path is switched on for everyone.
The SDK context usage report now gives categories stable ids and can list MCP instructions per server plus agent and skill paths
Unclear It is not clear whether these fields are new in this release or were already in the report before.
The menu shown at a rate limit can now list one reset option per kind and answer with a message, a confirmation or a choice
Unclear It is not clear what decides whether these reset options appear for a given account.
The login screen can now show a refusal notice instead of the login form, or allow only claude.ai login, and startup can show a blocked screen
Unclear It is not clear what leads to a refused login or when the blocked screen appears.
Tool search is now tried with a custom ANTHROPIC_BASE_URL and switched off for a day only if refused, and stays off in conversations that ran without it
Claude Code can now refuse to start a session when your organization's required settings can't be loaded
Unclear Which accounts and plans the server applies this check to is not known.
Dialogs opened through request_user_dialog can now close on their own when you send a new prompt, and can set their own waiting time
When a remote worker restarts, background agents it left behind can now be offered for resuming, and memory extraction picks up where it stopped
Unclear Whether the offer to resume these agents is shown to the user is not stated.
When Claude Code runs as an MCP server, records of its background commands can now be saved and shown again as ended after a restart
Unclear It is not clear whether anything turns this saving on in this version.
When several kinds of rate-limit reset are available you can be asked to choose, and you are told which ones you can use
When a remote connection is refused because this computer is untrusted, Claude Code can enroll it and try once more
Unclear Whether this retry is active for everyone or held behind a switch is not stated.
In some modes, Claude now asks "Enter plan mode?" before switching, and only you can answer
Unclear Apart from the current mode, what decides whether the question is asked is not stated.
Claude Code no longer skips its saved copy of an MCP server's capabilities just because the server offers skills
Opening an artifact published through an MCP server now uses the same path as artifacts from cloud sessions
Unclear It is not clear whether anything in this version marks an artifact as published through MCP.
Claude Code now decides per session whether to add function hooks, and hooks record where they came from and when their notice shows
Unclear In which sessions function hooks are now left out is not stated.
Claude Code's startup announcement now always picks the top-priority one and can swap in alternate text about unused limit resets
Unclear It is not clear whether the per-announcement display limit is now applied somewhere else, so whether announcements actually repeat is unknown.
Opening an artifact published through MCP now runs a check first, and a second open is refused until that check finishes
An mcp_tool hook can now be refused because of its MCP server's configuration, and hook matching treats Claude Code's own MCP tools like built-in ones
Unclear It is not clear which server settings cause an mcp_tool hook to be refused.
Claude Code now refuses an @-mentioned MCP resource in a loaded skill's folder unless the skill lists it, and image reads can be cancelled
Starter files for a hooks module now include examples/pane.test.tsx next to the existing pane example
Cloud sessions now say when setup was restored from a saved snapshot, how long that saved, and when saving or restoring failed
Requests to attach to a session now open cloud sessions separately from local sessions, which still switch by short ID
Unclear It is not clear whether anything you can click or type currently opens a cloud session this way.
/workflows instead of /tasks#The "Running in background" hint can now suggest /workflows to monitor the work, instead of /tasks to view it
Device tool warnings are now written into the conversation instead of a pop-up that vanished after 30 seconds
--await-claim can no longer be combined with --sdk-url#Claude Code now refuses to start when --await-claim and --sdk-url are used together
Mods enabled while Claude is mid-turn now load when the turn ends instead of starting a new turn
Unclear It is not clear how a user enables these mods or when this message would be shown.
How Claude Code picks between sources of managed settings has been reworked, affecting permissions, sandbox domains and MCP allow lists
Unclear It is not clear which host or settings layout triggers the held-settings handling.
A rule can now stop a subagent from being resumed, and resuming is also counted against a concurrency limit
When a usage limit is hit, which grants are offered now depends on usableNow and paused rather than on nextGrantId
Scheduled /loop wakeups now record an owner and plugin, missed runs get their own handler, and ScheduleWakeup can refuse a request
When the usage endpoint is rate limited, /usage now shows when you can try again instead of a generic 'try again in a moment'
Org policy fetches now record server error codes and auth denials, and attaching files before the policy loads returns a policy_pending error
Background and retention cleanup now pause when a session can't know its server-managed settings, and some disk writes bail out in a new session mode
On macOS, sandboxed git over SSH now goes through the sandbox proxy with a credential when one is available
Unclear What supplies the proxy credential, and so which macOS setups use the new route, is not stated.
The background task detail screen now also opens for remote agents and local workflows, not only shell, monitor and MCP tasks
Claude Code now re-sends a skill only when its name or content fingerprint is new to the conversation, so edited skills show up mid-session
Claude Code can now give a new worktree a numbered name, and when removing one it checks more carefully for commits
Unclear When Claude Code picks a numbered name instead of the requested one is not stated.
Published verbatim by Anthropic for v2.1.304. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 76 bullets, 13 name something an entry on this page also names, 24 name something no entry here does, and 39 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
decider: "person" to a mod's tool.check answer: only the permission dialog or a host's callback can approve the ask, and it is refused with the mod's reason where nobody can be asked
No entry names this e.isReadOnly to a mod's tool.check event, set when the tool call is read-only
No entry names this /auto-mode-setup: a guided setup that reads your project and recent sessions to teach auto mode about your environment, now also available on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions
No entry names this /claude-api managed-agents-secure, which compares a Managed Agents agent's settings with Anthropic's published security guide, without changing anything
Probably claude-api-managed-agents-secure-guard-on-ant-commands ANTHROPIC_API_KEY at startup or switching "Use custom API key" in /config
Probably policy-limits-re-fetch-after-an-api-refusal-anthropic-api-k, auto-compact-window-dialog-shows-an-extra-warning-line sandbox.filesystem.denyRead glob contains brackets that are not a character class, such as a [user-id] route folder
No entry names this rm -r of a mounted drive or a folder at its top level (/Volumes, /media, WSL's /mnt/c) not getting the safety prompt that rm -rf /Applications gets
Probably dangerous-rm-detection-for-mounted-drive-paths CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping messages from the saved transcript when the disk filled up while the file was being trimmed
No entry names this --max-turns, Stop, or ended input by spawning subagents or re-running a finished one
No entry names this key were redrawn unchanged
Nothing to match on plugin-authoring skill stopping at the secret scan on machines with managed settings and on Team and Enterprise plans
No entry names this ../../…; they now show ~/… or the full path
No entry names this context_management: Extra inputs are not permitted errors behind LLM gateways; Claude Code now resends the request without that field
No entry names this /privacy-settings offering choices that may not apply to you after a network or server error
No entry names this claude --help text for --tools, --resume, --debug, --json-schema, --disable-slash-commands, --system-prompt-snapshot and claude update to match actual behavior
Probably usage-rate-limit-message-shows-hold-time, tools-help-text-default-now-means-the-default-set, json-schema-help-says-it-only-works-with-print, sandbox-runtime-probes-bwrap-style-binary-for-disable-user, misc-ui-custom-api-key-prompt-disable-slash-commands-tex, claude-update-description-mentions-package-manager-installs, await-claim-now-rejected-with-sdk-url, resume-help-text-now-says-session-id-or-name, system-prompt-snapshot-now-defaults-off-under-bare-outside claude --worktree removing the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits
No entry names this /effort status, /effort ultracode and the prompt's effort indicator showing a guessed effort level when CLAUDE_CODE_EFFORT_LEVEL is auto or unset and no level is sent
No entry names this /loop wakeups scheduled at the 1-hour maximum firing just after the 1-hour prompt cache expired, so those wakeups no longer re-read the conversation uncached
Probably dynamic-loop-wakeups-carry-an-owner-and-plugin, schedulewakeup-and-loop-plugin-aware-scheduling-and-missed once hook also removing another skill's identical hook after it ran
Nothing to match on { and } landing the prompt on an inconsistent row, or off screen, instead of the transcript's first row
Nothing to match on CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently setting a 100K window: the variable now accepts k and M suffixes like --autocompact, and warns when a value is out of range or ignored
Probably auto-compact-window-setting-shows-a-note-about-the-env-var, claude-code-auto-compact-window-parsing-with-km-shorthand-a /usage to say when a rate limit on usage data ends instead of "try again in a moment"
Probably usage-rate-limit-message-shows-hold-time, usage-credit-purchase-flow-gains-offers-discount-tiers-and, usage-credit-promo-offer-starry-waterfall-read alwaysLoad: true
No entry names this claude -p invalid-settings warning: a file that did not load lists only what stopped it, and long lists are capped per file
Probably claude-test-plugin-checks-agents-and-renders-a-pane settings.read hooks to receive each settings layer and rewrite the merged settings, so a managed mod can make an organization's setting a ceiling, including the cleanupPeriodDays the retention sweep uses
Probably remote-settings-unknowable-pause-for-retention-cleanup-disk, hooks-module-settingsread-merge-is-re-raised-when-plugins-o, new-settingsread-plugin-event-mods-runtime, queue-and-plugin-input-hold-refactor-with-a-plugin-settings /artifacts delete confirmation to show numbered choices: 1 or Enter keeps the artifact, 2 deletes it, and y, n and Esc still work
No entry names this ANTHROPIC_BASE_URL; a 400 or 422 from the gateway is retried without it
Probably tool-search-refusal-by-a-custom-anthropic-base-url-endpoint /reload-skills now sends only new or changed skills
No entry names this allowed-tools
No entry names this ant CLI on Claude Platform on AWS instead of falling back to the SDK or curl
Probably claude-api-managed-agents-secure-guard-on-ant-commands claude plugin validate that predicted where a mod's hooks would run
No entry names this /fast dialog title on Opus 5.5
Probably fast-mode-label-drops-research-preview-conditionally claudeCode.claudeProcessWrapper is set
No entry names this @Claude !fork typed outside a thread getting no visible reply; Claude now shows you a private note saying to run it from inside a thread
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
4 of 29 tool descriptions changed. 2 of 27 tool schemas changed. The appended system-reminder blocks moved: 14 lines added, 1 line removed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
570 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 47 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?