Claude Code's bundled default model is now Opus 5.5 at medium effort, replacing Opus 5 at high effort. You can set CLAUDE_CODE_SKIP_PLUGIN_LOCAL_MCP_SERVERS to keep only the remote MCP servers that plugins bring. A program that runs claude mcp serve can pick which plugins load with CLAUDE_CODE_MCP_SERVE_ENABLED_PLUGINS. A new allowNestedUserNamespaces sandbox setting lets browsers or rootless podman run inside the sandbox on Linux. It is off by default because it weakens the sandbox. Plugin modules can now read and override the settings in effect through a new settings.read event.
Some work in this build is not switched on yet. In-app surveys for enterprise organizations stay off unless turned on remotely. Setting CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY skips them. Groundwork for showing skills as plugins has landed but cannot be reached. Leaving a worktree now checks whether to keep it, but that check always says no in this build. A launch option to turn off plan or auto mode is partly built, with no visible setting yet.
Creating a worktree no longer resets an existing branch with the same name. Claude Code now stops with an error instead. Your cached remote settings are no longer cleared when a proxy answers with a 204 or 404 reply. Very long timeouts are now capped instead of firing immediately. Removing one skill's hooks no longer removes matching hooks added by another skill. Claude Code no longer fetches skills from MCP servers when it connects to them.
Written by our agent from the shipped bundle, not by Anthropic.
New environment variables add low disk and memory warnings, limit plugin MCP servers, and pass startup and project details to child sessions
ExtensionsA new settings.read event lets plugin hooks see and override your effective settings, re-checked whenever settings or plugins change
ExtensionsA new carry_across_restarts option lets post-turn memory extraction save and restore its progress when its worker restarts
Sessions & agentsprompt.fill and suggest-prompt requests now carry answersPress, plugins get press_drawn and press_fill hook events, plus two new defaults
Extensions
CLAUDE_CODE_ATTRIBUTION_PROJECT setting checked against claude.ai Project IDsClaude Code now recognises CLAUDE_CODE_ATTRIBUTION_PROJECT and drops a value that is not a valid claude.ai Project ID from saved jobs
Want the reasoning? Read walks the 43 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →13 more of these are in What probably matters to you, on page 1.
When a sign-in is refused, Claude Code now restores your previous login and cancels the refused one, or asks you to sign in again
If no command matches a name exactly or by alias, Claude Code now tries the one command whose folder name matches
When the main session is in auto mode, a subagent asking for a mode other than plan now falls back to the main session's mode
Over-long path patterns in permission rules are now flagged as too costly, and a pattern can also match everything inside the folder it names
Unclear The length limit is not stated, nor whether a pattern that is too long ends up as a refusal or an error.
The description of the skill that runs tests on your machine now says it is not the claude.ai Claude Test connector
When Claude Code refuses a skill directory address from an MCP server, it now gives a specific reason
The Fast mode dialog title now adds "(research preview)" only under a certain condition, instead of always
Unclear It is not clear what condition decides whether the "(research preview)" label is shown.
When a machine set to run commands only in an isolated environment cannot provide one, the message now calls it a Linux VM instead of a sandbox
The publish step for plugins and skills now says whether an upload is scanned on claude.ai depends on your organization
Unexplained sign-in errors are now sorted into more specific kinds, and the trusted-device refusal message depends on whether you just enrolled
When a request is refused at a usage limit, the limit message now shows an extra line, and Claude Code records that it did
Unclear What the extra line says is not stated.
The dialog that asks to let cloud sessions run commands on your computer now says "in auto mode" instead of "without asking"
rm on a mounted drive or a drive's top level now needs your approval#Claude Code now asks before rm removes a mounted drive, its parent folder or a top-level item on a drive; an environment variable turns this off
Unclear Exactly which paths count as a mounted drive, and whether the check runs outside Windows and WSL, is not stated.
The watchdog that warns about low disk space or memory no longer requires CLAUDE_CODE_DIAGNOSTICS_FILE to be set before it can start
Unclear It is not clear where the low-disk and low-memory thresholds come from, so which sessions now run the watchdog is unknown.
The resume prompt can now label Esc as "dismiss", and it no longer appears while a usage rate limit is active
A skill whose hooks exceed new limits now gets none of its hooks and no tools, and Claude Code logs a warning
Unclear The actual numeric limits on hook count and matcher length are not given.
Cloud session setup now shows "Setup script failed" or "Restored saved setup" instead of always "Ran setup script"
If an MCP request's login token is withheld, the request now fails instead of being sent unauthenticated
When the API refuses a request over an organisation policy the session has not loaded, Claude Code re-fetches its policy limits straight away
When a session is resumed, scheduled tasks carried with it are checked, and any malformed one is dropped
Unclear Whether anything uses this yet, or whether it is switched off, is not stated.
The prompt offering your MCP servers to claude --cloud sessions adds "Not now", which asks again once you add an MCP server
Claude Code may now send a request_user_dialog with no deadline, which stays open until answered or withdrawn with control_cancel_request
When you attach to a remote session, Claude Code now syncs its workflow runs as well as its background tasks
Claude Code now refuses a managed skill whose files the session could have changed, that is too large or deep, or that links elsewhere
Unclear What switches this check on, and whether it applies to ordinary users, is not stated.
When one of your machines is unreachable, Claude is told to explain why and what brings it back, using that machine's status
Claude Code adds clearer load and reload messages for plugins and session mods, including a separate first-load hint pointing to /reload-plugins
Claude Code now finds a remote tool host by a partial name when exactly one host matches it
Plugin MCP servers that don't set alwaysLoad can now be deferred until needed in some cases, not only those with alwaysLoad set to false
Unclear Which entry points this applies to, and what the further check tests, is not known, so it is unclear whose sessions are affected.
When background agents or workflows are still running, the turn-duration line can now show which ones it is waiting for
After Stop, a mod's attempt to start background work is refused, and you see a notice that a mod cannot resume work after Stop
Unclear It is not clear what counts as a mod, or whether the block also applies to background work you start yourself.
A workflow script is not run if a '/' could mean either a pattern or division; the error says to end the statement with ';'
Unclear It is not known whether this check is switched on by default.
In a cloud session, MCP servers listed in a subagent's own definition are no longer started
On Windows, the sandbox now uses its credentials and allowed network domains when working out which files it may reach
Unclear Which files the Windows sandbox can now read or write as a result is not stated.
Claude is now told that some stopped agents resume as their original agent type, and that a refused resume can be retried
Scheduled tasks can name a plugin, and auto mode no longer counts as active when a hook may ask for permission
Unclear When a request counts as person-only, and what the plugin field on a scheduled task does, is not stated.
If a session's managed settings come from its organisation, Claude Code no longer loads skills from the managed skills folder
With TLS termination on, the sandbox now allows 256 intercepted connections at once and closes those not set up within 10 seconds
When reattaching a Remote Control session, Claude Code can refuse if it cannot confirm the session belongs to your account
Unclear Whether this stricter check is switched on is not stated.
Claude Code now re-settles the plan auto-mode setting after a session changes directory or is relocated, and reuses org validation at login
Claude Code remembers a 'not now' answer to sharing local MCP servers with cloud sessions and shows a notice when a deny list blocks the offer
Claude Code now says plainly when no remote machine is attached, and some sessions refuse to save settings with an error
In some sessions the sandbox check now fails straight away with "The sandbox is unavailable in this session"
Unclear Which sessions are affected, and so who cannot use the sandbox, is not known.
New messages explain when this machine's Bash is not offered to a cloud session and when attaching files fails
Unclear It is not clear whether these messages can appear yet or only exist in the code for now.
If a machine name matches both this computer and an attached machine, Claude Code now refuses the call instead of picking one
A plugin that claude.ai did not security-scan now shows a notice saying so in its details
When a session gets its managed settings from its organization, Claude Code may skip the local managed folder of agents and skills
Unclear Which mode is exempt from this skip, and so which sessions still read the managed folder, is not stated.
When attaching files is no longer allowed in a session, Claude now gets a clear message to tell you and not to retry
Unclear What causes attachments to be switched off during a session is not known.
The sandbox now blocks changes to a .git file, as used in git worktrees, not only to a .git folder
When images returned by a tool don't fit in the output limit, Claude Code now puts a short note in their place
One type of permission rule now ignores upper and lower case when it matches, and compares names in a normalized form
Unclear It is not clear which type of permission rule this applies to, possibly rules for web domains.
More remote permission prompts are now treated as handed over, so they get the short delay that ignores accidental input
Claude Code can keep the terminal's full-screen mode between one screen and the next, and passes the tools used into compaction summaries
Claude Code's dangerous rm and rmdir check now recognises mounted drive paths such as /mnt, /Volumes, /media and /run/media
Unclear Whether a flagged command is blocked outright or only needs your approval is not stated.
When Claude Code compacts a session's history file, it now checks the file size and any rows added meanwhile, and fails safely if they don't match
Validating a plugin now reports an error for each command it registers under a name Claude Code already ships
A path check gains a new reason for refusing paths on a mounted drive, and a refused dialog answer now passes through unchanged
On Linux, the sandbox now follows symlinks to see where a write would land, and blocks the link when it cannot tell
Logging in with CLAUDE_CODE_OAUTH_REFRESH_TOKEN now fetches your profile and saves your subscription type and rate-limit tier
Ctrl/Cmd+C on selected text now decides between copying and clearing in a new way, and passes the copied text on when it copies
Unclear It is not clear what counts as being held, so it is unclear when Ctrl/Cmd+C now clears the selection instead of copying it.
The artifacts list now shows a confirmation step for deleting, with delete, keep and cancel choices
The sandbox now also blocks reading paths taken from credentials, and the warning about an old bubblewrap no longer mentions leftover mount points
Unclear It is not clear whether the oldest bubblewrap version that triggers the warning has actually changed.
When a new sign-in fails your organization's check, Claude Code now tries to restore the login you had before and says whether it worked
The matcher for file patterns such as * and ** has been rewritten, so unusual patterns may now match differently
When an app's sign-in is refused because of provider or organisation rules, Claude Code now tries to restore the previous login
Claude Code now recognises the error a server returns when it refuses the context_management field in a request
Unclear What Claude Code does after recognising this error, such as retrying without the field, is not stated.
The filter deciding which environment variables reach sandboxed commands now has an extra condition
Unclear It is not clear which variable names the new condition matches, so which variables are now passed or held back is unknown.
The "Make auto mode your default permission mode?" dialog now builds its footer separately, and its "press again to exit" hint is switched off
ExitWorktree now separates commits on a worktree's current branch from commits on a kept branch, and can refuse removal until you confirm
When a session ends, Claude Code now extends its forced-exit timer at two points so slow end-of-session work is less likely to be cut off
--tools help now says "default" picks the default set of tools#The help text for --tools now describes "default" as using the default set of tools rather than all tools
Unclear It is not clear whether what --tools default does also changed, or only the wording of its help text.
For one kind of dialog, the prompt asking you to respond now uses the dialog's own title instead of generic wording
The message for a folder that can't be bound to cloud sessions now covers home folders, hidden folders and repositories rooted there
--json-schema help now says it only works with --print#The help text for --json-schema now notes that it only works together with --print
The skipped-settings warning now says the rest of each file still applies, and sandbox network notes cover 403 refusals and strictAllowlist
Claude Code now says when a folder is left out because its repository is never offered, and words the not-a-git-checkout reason more precisely
Unclear Which Claude Code feature shows these reasons is not clear.
The message shown when Claude Code won't start from your home folder now says why and suggests a folder such as ~/code/my-app
When a watched plugin folder changes, newly appearing plugins that Claude Code has not loaded are now reported as "not-loaded"
The helper that serves a folder to cloud sessions now says when it was started in a hidden folder or a repository it never serves
--disable-slash-commands now mentions commands too#--disable-slash-commands is now described as disabling all skills and commands, and plugin publishing no longer promises a scan
claude update help now says package-manager installs update elsewhere#The help for claude update now notes that installs from a package manager are updated through that package manager
allowAllUnixSockets description warns it also opens VM sockets on Linux#The allowAllUnixSockets sandbox setting is now described as also unblocking VM sockets (AF_VSOCK) on Linux
Oversized images now get a clear message saying the session cannot shrink images, instead of a resize failure
The skill reload message drops its closing line about Claude getting the full skill list with your next message
When a remote host is offline, Claude is now told when it was last heard from, whether it was busy, asleep or silent, and what brings it back
The privacy settings dialog now closes without a message if the second of its two loads fails, instead of opening with that part empty
A 204 or 404 response now says a network intermediary, not Anthropic, answered, and suggests checking your proxy
The line showing how long a turn took can now expand when verbose output or the transcript view is on
Claude Code now declines to resolve a path when a backslash in it would be read as a folder separator
Sending a message to an archived cloud session now explains that it was archived and links to where you can view it
The login command and startup banner can now show a refused notice with its cause, instead of one fixed reason
When another machine in a session does not answer, the message Claude receives now says its Claude is not connected and to open Claude there
The task panel now clears a finished task only when it is not running, pending or paused, and covers more kinds of background task
A sign-in refused because managed settings could not be satisfied now says whether it was revoked or must be revoked by an admin
When a remote computer can't be reached, Claude now learns whether it is asleep, signed off, busy or silent
If a login fails its check, Claude Code tries to restore your previous sign-in and prints a warning if that does not work
Messages that stop a session over a settings error can now show another hint instead of "Fix the file, then start a new session."
--resume help text now mentions resuming by session name#The help text for --resume now says you can pass a session ID or a session name, or open the picker with a search term
A dialog option once labelled "Enable for this session" now reads "Turn them on", and --settings errors name inline JSON
Published verbatim by Anthropic for v2.1.304. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 76 bullets, 13 name something an entry on this page also names, 24 name something no entry here does, and 39 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
decider: "person" to a mod's tool.check answer: only the permission dialog or a host's callback can approve the ask, and it is refused with the mod's reason where nobody can be asked
No entry names this e.isReadOnly to a mod's tool.check event, set when the tool call is read-only
No entry names this /auto-mode-setup: a guided setup that reads your project and recent sessions to teach auto mode about your environment, now also available on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions
No entry names this /claude-api managed-agents-secure, which compares a Managed Agents agent's settings with Anthropic's published security guide, without changing anything
Probably claude-api-managed-agents-secure-guard-on-ant-commands ANTHROPIC_API_KEY at startup or switching "Use custom API key" in /config
Probably policy-limits-re-fetch-after-an-api-refusal-anthropic-api-k, auto-compact-window-dialog-shows-an-extra-warning-line sandbox.filesystem.denyRead glob contains brackets that are not a character class, such as a [user-id] route folder
No entry names this rm -r of a mounted drive or a folder at its top level (/Volumes, /media, WSL's /mnt/c) not getting the safety prompt that rm -rf /Applications gets
Probably dangerous-rm-detection-for-mounted-drive-paths CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping messages from the saved transcript when the disk filled up while the file was being trimmed
No entry names this --max-turns, Stop, or ended input by spawning subagents or re-running a finished one
No entry names this key were redrawn unchanged
Nothing to match on plugin-authoring skill stopping at the secret scan on machines with managed settings and on Team and Enterprise plans
No entry names this ../../…; they now show ~/… or the full path
No entry names this context_management: Extra inputs are not permitted errors behind LLM gateways; Claude Code now resends the request without that field
No entry names this /privacy-settings offering choices that may not apply to you after a network or server error
No entry names this claude --help text for --tools, --resume, --debug, --json-schema, --disable-slash-commands, --system-prompt-snapshot and claude update to match actual behavior
Probably usage-rate-limit-message-shows-hold-time, tools-help-text-default-now-means-the-default-set, json-schema-help-says-it-only-works-with-print, sandbox-runtime-probes-bwrap-style-binary-for-disable-user, misc-ui-custom-api-key-prompt-disable-slash-commands-tex, claude-update-description-mentions-package-manager-installs, await-claim-now-rejected-with-sdk-url, resume-help-text-now-says-session-id-or-name, system-prompt-snapshot-now-defaults-off-under-bare-outside claude --worktree removing the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits
No entry names this /effort status, /effort ultracode and the prompt's effort indicator showing a guessed effort level when CLAUDE_CODE_EFFORT_LEVEL is auto or unset and no level is sent
No entry names this /loop wakeups scheduled at the 1-hour maximum firing just after the 1-hour prompt cache expired, so those wakeups no longer re-read the conversation uncached
Probably dynamic-loop-wakeups-carry-an-owner-and-plugin, schedulewakeup-and-loop-plugin-aware-scheduling-and-missed once hook also removing another skill's identical hook after it ran
Nothing to match on { and } landing the prompt on an inconsistent row, or off screen, instead of the transcript's first row
Nothing to match on CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently setting a 100K window: the variable now accepts k and M suffixes like --autocompact, and warns when a value is out of range or ignored
Probably auto-compact-window-setting-shows-a-note-about-the-env-var, claude-code-auto-compact-window-parsing-with-km-shorthand-a /usage to say when a rate limit on usage data ends instead of "try again in a moment"
Probably usage-rate-limit-message-shows-hold-time, usage-credit-purchase-flow-gains-offers-discount-tiers-and, usage-credit-promo-offer-starry-waterfall-read alwaysLoad: true
No entry names this claude -p invalid-settings warning: a file that did not load lists only what stopped it, and long lists are capped per file
Probably claude-test-plugin-checks-agents-and-renders-a-pane settings.read hooks to receive each settings layer and rewrite the merged settings, so a managed mod can make an organization's setting a ceiling, including the cleanupPeriodDays the retention sweep uses
Probably remote-settings-unknowable-pause-for-retention-cleanup-disk, hooks-module-settingsread-merge-is-re-raised-when-plugins-o, new-settingsread-plugin-event-mods-runtime, queue-and-plugin-input-hold-refactor-with-a-plugin-settings /artifacts delete confirmation to show numbered choices: 1 or Enter keeps the artifact, 2 deletes it, and y, n and Esc still work
No entry names this ANTHROPIC_BASE_URL; a 400 or 422 from the gateway is retried without it
Probably tool-search-refusal-by-a-custom-anthropic-base-url-endpoint /reload-skills now sends only new or changed skills
No entry names this allowed-tools
No entry names this ant CLI on Claude Platform on AWS instead of falling back to the SDK or curl
Probably claude-api-managed-agents-secure-guard-on-ant-commands claude plugin validate that predicted where a mod's hooks would run
No entry names this /fast dialog title on Opus 5.5
Probably fast-mode-label-drops-research-preview-conditionally claudeCode.claudeProcessWrapper is set
No entry names this @Claude !fork typed outside a thread getting no visible reply; Claude now shows you a private note saying to run it from inside a thread
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
4 of 29 tool descriptions changed. 2 of 27 tool schemas changed. The appended system-reminder blocks moved: 14 lines added, 1 line removed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
570 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 47 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?