Claude Code's bundled default model is now Opus 5.5 at medium effort, replacing Opus 5 at high effort. You can set CLAUDE_CODE_SKIP_PLUGIN_LOCAL_MCP_SERVERS to keep only the remote MCP servers that plugins bring. A program that runs claude mcp serve can pick which plugins load with CLAUDE_CODE_MCP_SERVE_ENABLED_PLUGINS. A new allowNestedUserNamespaces sandbox setting lets browsers or rootless podman run inside the sandbox on Linux. It is off by default because it weakens the sandbox. Plugin modules can now read and override the settings in effect through a new settings.read event.
Some work in this build is not switched on yet. In-app surveys for enterprise organizations stay off unless turned on remotely. Setting CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY skips them. Groundwork for showing skills as plugins has landed but cannot be reached. Leaving a worktree now checks whether to keep it, but that check always says no in this build. A launch option to turn off plan or auto mode is partly built, with no visible setting yet.
Creating a worktree no longer resets an existing branch with the same name. Claude Code now stops with an error instead. Your cached remote settings are no longer cleared when a proxy answers with a 204 or 404 reply. Very long timeouts are now capped instead of firing immediately. Removing one skill's hooks no longer removes matching hooks added by another skill. Claude Code no longer fetches skills from MCP servers when it connects to them.
Written by our agent from the shipped bundle, not by Anthropic.
New environment variables add low disk and memory warnings, limit plugin MCP servers, and pass startup and project details to child sessions
ExtensionsA new settings.read event lets plugin hooks see and override your effective settings, re-checked whenever settings or plugins change
ExtensionsA new carry_across_restarts option lets post-turn memory extraction save and restore its progress when its worker restarts
Sessions & agentsprompt.fill and suggest-prompt requests now carry answersPress, plugins get press_drawn and press_fill hook events, plus two new defaults
Extensions
CLAUDE_CODE_ATTRIBUTION_PROJECT setting checked against claude.ai Project IDsClaude Code now recognises CLAUDE_CODE_ATTRIBUTION_PROJECT and drops a value that is not a valid claude.ai Project ID from saved jobs
Want the reasoning? Read walks the 43 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
MCP-served skills are no longer fetched when servers connect, and their files are now checked against what the server listed
Unclear Whether this handling is switched on is not stated.
The model catalog shipped with Claude Code now defaults to claude-opus-5-5 at medium effort instead of claude-opus-5 at high effort
The sandbox proxy now checks request targets, Host and SNI, and credential-file denies can no longer be reopened by broader allows
Unclear Whether Claude Code itself sets any of these options is not stated.
On Linux, sandboxed commands can no longer create user namespaces unless allowNestedUserNamespaces is set, and credential deny rules are hardened
The total-tokens reminder now defaults to on only for models with a new total_tokens_reminder capability, and is off for others
Unclear It is not clear what sets the explicit choice, or whether the reminder style used by default has changed.
Claude Code can now check organization configuration at startup and in the agents view, and show a screen that blocks use
Unclear What turns this check on, and what configuration it compares, is not stated.
When a tool would ask for your permission, PermissionRequest hooks can now run first and turn that question into a refusal
The auto-compact window env var accepts 200k or 1M shorthand, clamps or warns on bad values, and /config shows an extra note about it
--system-prompt-snapshot still defaults to on, except under --bare outside cloud and background sessions
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
13 more of these are in What probably matters to you, above.
Plugin sync now fetches required plugins first, handles server-side renames, and can sync skills as plugins outside hosted sessions
Worktree exit and removal now report what is at stake, handle a detached HEAD, and refuse to quietly delete worktrees nested inside
SendMessage checks a message can be delivered before sending, and only a teammate session can now approve a shutdown request
Organization-managed skills and agents in the managed .claude folder are filtered out while a managed-folder hold is active
Unclear What turns the managed-folder hold on is not stated.
After a permission prompt times out unanswered, later subagent prompts in the same turn return quiet_spell instead of asking again
Unclear It is not shown what the subagent does when its request is held back, for example whether it treats it as a refusal.
apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh and otelHeadersHelper now pass a guard, and their trust checks accept another source
Unclear What makes a process count as pinned to the stored login, or as a tool-server daemon, is not stated.
When a skill is turned off in claude.ai, Claude Code can mark the synced plugin that provides it as turned off in your local settings
Unclear When this sync runs, and whether it is switched on for every account, is not stated.
ant commands before they run#The /claude-api skill now blocks ant commands with certain IDs and managed-agents-secure commands changed from the guide
The login screen can now show a refusal notice instead of the login form, or allow only claude.ai login, and startup can show a blocked screen
Unclear It is not clear what leads to a refused login or when the blocked screen appears.
Tool search is now tried with a custom ANTHROPIC_BASE_URL and switched off for a day only if refused, and stays off in conversations that ran without it
Claude Code can now refuse to start a session when your organization's required settings can't be loaded
Unclear Which accounts and plans the server applies this check to is not known.
In some modes, Claude now asks "Enter plan mode?" before switching, and only you can answer
Unclear Apart from the current mode, what decides whether the question is asked is not stated.
Claude Code now decides per session whether to add function hooks, and hooks record where they came from and when their notice shows
Unclear In which sessions function hooks are now left out is not stated.
An mcp_tool hook can now be refused because of its MCP server's configuration, and hook matching treats Claude Code's own MCP tools like built-in ones
Unclear It is not clear which server settings cause an mcp_tool hook to be refused.
Claude Code now refuses an @-mentioned MCP resource in a loaded skill's folder unless the skill lists it, and image reads can be cancelled
--await-claim can no longer be combined with --sdk-url#Claude Code now refuses to start when --await-claim and --sdk-url are used together
How Claude Code picks between sources of managed settings has been reworked, affecting permissions, sandbox domains and MCP allow lists
Unclear It is not clear which host or settings layout triggers the held-settings handling.
Scheduled /loop wakeups now record an owner and plugin, missed runs get their own handler, and ScheduleWakeup can refuse a request
Org policy fetches now record server error codes and auth denials, and attaching files before the policy loads returns a policy_pending error
When the main session is in auto mode, a subagent asking for a mode other than plan now falls back to the main session's mode
Over-long path patterns in permission rules are now flagged as too costly, and a pattern can also match everything inside the folder it names
Unclear The length limit is not stated, nor whether a pattern that is too long ends up as a refusal or an error.
rm on a mounted drive or a drive's top level now needs your approval#Claude Code now asks before rm removes a mounted drive, its parent folder or a top-level item on a drive; an environment variable turns this off
Unclear Exactly which paths count as a mounted drive, and whether the check runs outside Windows and WSL, is not stated.
A skill whose hooks exceed new limits now gets none of its hooks and no tools, and Claude Code logs a warning
Unclear The actual numeric limits on hook count and matcher length are not given.
If an MCP request's login token is withheld, the request now fails instead of being sent unauthenticated
Claude Code now refuses a managed skill whose files the session could have changed, that is too large or deep, or that links elsewhere
Unclear What switches this check on, and whether it applies to ordinary users, is not stated.
Plugin MCP servers that don't set alwaysLoad can now be deferred until needed in some cases, not only those with alwaysLoad set to false
Unclear Which entry points this applies to, and what the further check tests, is not known, so it is unclear whose sessions are affected.
After Stop, a mod's attempt to start background work is refused, and you see a notice that a mod cannot resume work after Stop
Unclear It is not clear what counts as a mod, or whether the block also applies to background work you start yourself.
A workflow script is not run if a '/' could mean either a pattern or division; the error says to end the statement with ';'
Unclear It is not known whether this check is switched on by default.
In a cloud session, MCP servers listed in a subagent's own definition are no longer started
If a session's managed settings come from its organisation, Claude Code no longer loads skills from the managed skills folder
When reattaching a Remote Control session, Claude Code can refuse if it cannot confirm the session belongs to your account
Unclear Whether this stricter check is switched on is not stated.
The sandbox now blocks changes to a .git file, as used in git worktrees, not only to a .git folder
One type of permission rule now ignores upper and lower case when it matches, and compares names in a normalized form
Unclear It is not clear which type of permission rule this applies to, possibly rules for web domains.
Claude Code's dangerous rm and rmdir check now recognises mounted drive paths such as /mnt, /Volumes, /media and /run/media
Unclear Whether a flagged command is blocked outright or only needs your approval is not stated.
A path check gains a new reason for refusing paths on a mounted drive, and a refused dialog answer now passes through unchanged
On Linux, the sandbox now follows symlinks to see where a write would land, and blocks the link when it cannot tell
The sandbox now also blocks reading paths taken from credentials, and the warning about an old bubblewrap no longer mentions leftover mount points
Unclear It is not clear whether the oldest bubblewrap version that triggers the warning has actually changed.
The matcher for file patterns such as * and ** has been rewritten, so unusual patterns may now match differently
Published verbatim by Anthropic for v2.1.304. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 76 bullets, 13 name something an entry on this page also names, 24 name something no entry here does, and 39 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
decider: "person" to a mod's tool.check answer: only the permission dialog or a host's callback can approve the ask, and it is refused with the mod's reason where nobody can be asked
No entry names this e.isReadOnly to a mod's tool.check event, set when the tool call is read-only
No entry names this /auto-mode-setup: a guided setup that reads your project and recent sessions to teach auto mode about your environment, now also available on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions
No entry names this /claude-api managed-agents-secure, which compares a Managed Agents agent's settings with Anthropic's published security guide, without changing anything
Probably claude-api-managed-agents-secure-guard-on-ant-commands ANTHROPIC_API_KEY at startup or switching "Use custom API key" in /config
Probably policy-limits-re-fetch-after-an-api-refusal-anthropic-api-k, auto-compact-window-dialog-shows-an-extra-warning-line sandbox.filesystem.denyRead glob contains brackets that are not a character class, such as a [user-id] route folder
No entry names this rm -r of a mounted drive or a folder at its top level (/Volumes, /media, WSL's /mnt/c) not getting the safety prompt that rm -rf /Applications gets
Probably dangerous-rm-detection-for-mounted-drive-paths CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping messages from the saved transcript when the disk filled up while the file was being trimmed
No entry names this --max-turns, Stop, or ended input by spawning subagents or re-running a finished one
No entry names this key were redrawn unchanged
Nothing to match on plugin-authoring skill stopping at the secret scan on machines with managed settings and on Team and Enterprise plans
No entry names this ../../…; they now show ~/… or the full path
No entry names this context_management: Extra inputs are not permitted errors behind LLM gateways; Claude Code now resends the request without that field
No entry names this /privacy-settings offering choices that may not apply to you after a network or server error
No entry names this claude --help text for --tools, --resume, --debug, --json-schema, --disable-slash-commands, --system-prompt-snapshot and claude update to match actual behavior
Probably usage-rate-limit-message-shows-hold-time, tools-help-text-default-now-means-the-default-set, json-schema-help-says-it-only-works-with-print, sandbox-runtime-probes-bwrap-style-binary-for-disable-user, misc-ui-custom-api-key-prompt-disable-slash-commands-tex, claude-update-description-mentions-package-manager-installs, await-claim-now-rejected-with-sdk-url, resume-help-text-now-says-session-id-or-name, system-prompt-snapshot-now-defaults-off-under-bare-outside claude --worktree removing the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits
No entry names this /effort status, /effort ultracode and the prompt's effort indicator showing a guessed effort level when CLAUDE_CODE_EFFORT_LEVEL is auto or unset and no level is sent
No entry names this /loop wakeups scheduled at the 1-hour maximum firing just after the 1-hour prompt cache expired, so those wakeups no longer re-read the conversation uncached
Probably dynamic-loop-wakeups-carry-an-owner-and-plugin, schedulewakeup-and-loop-plugin-aware-scheduling-and-missed once hook also removing another skill's identical hook after it ran
Nothing to match on { and } landing the prompt on an inconsistent row, or off screen, instead of the transcript's first row
Nothing to match on CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently setting a 100K window: the variable now accepts k and M suffixes like --autocompact, and warns when a value is out of range or ignored
Probably auto-compact-window-setting-shows-a-note-about-the-env-var, claude-code-auto-compact-window-parsing-with-km-shorthand-a /usage to say when a rate limit on usage data ends instead of "try again in a moment"
Probably usage-rate-limit-message-shows-hold-time, usage-credit-purchase-flow-gains-offers-discount-tiers-and, usage-credit-promo-offer-starry-waterfall-read alwaysLoad: true
No entry names this claude -p invalid-settings warning: a file that did not load lists only what stopped it, and long lists are capped per file
Probably claude-test-plugin-checks-agents-and-renders-a-pane settings.read hooks to receive each settings layer and rewrite the merged settings, so a managed mod can make an organization's setting a ceiling, including the cleanupPeriodDays the retention sweep uses
Probably remote-settings-unknowable-pause-for-retention-cleanup-disk, hooks-module-settingsread-merge-is-re-raised-when-plugins-o, new-settingsread-plugin-event-mods-runtime, queue-and-plugin-input-hold-refactor-with-a-plugin-settings /artifacts delete confirmation to show numbered choices: 1 or Enter keeps the artifact, 2 deletes it, and y, n and Esc still work
No entry names this ANTHROPIC_BASE_URL; a 400 or 422 from the gateway is retried without it
Probably tool-search-refusal-by-a-custom-anthropic-base-url-endpoint /reload-skills now sends only new or changed skills
No entry names this allowed-tools
No entry names this ant CLI on Claude Platform on AWS instead of falling back to the SDK or curl
Probably claude-api-managed-agents-secure-guard-on-ant-commands claude plugin validate that predicted where a mod's hooks would run
No entry names this /fast dialog title on Opus 5.5
Probably fast-mode-label-drops-research-preview-conditionally claudeCode.claudeProcessWrapper is set
No entry names this @Claude !fork typed outside a thread getting no visible reply; Claude now shows you a private note saying to run it from inside a thread
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
4 of 29 tool descriptions changed. 2 of 27 tool schemas changed. The appended system-reminder blocks moved: 14 lines added, 1 line removed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
622 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 47 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?