Claude can now upload a local file to Google Drive by naming it, up to 10 MB. Claude Code reads the file only after you approve the call. In remote sessions that support it, you can now run '!' shell commands, with a 10 minute timeout. Sonnet 4, Sonnet 4.6 and Opus 4.6 now list a 1 million token maximum context window. claude plugin validate now also checks a plugin's folder layout. A new environment variable, CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY, sets how a remote session sends out its events.
Several features are in this build but not switched on yet. /usage is getting a way to look through your recent sessions and suggest how to use less of your plan. It could then queue the fixes you pick, such as /compact or lower effort, as prompts. Groundwork is also present for --resume to pick up a cloud session. Cloud sessions may later check each MCP server's host against an allow or deny list. While waiting on a usage limit, Claude Code could send a test request to see whether the limit has lifted.
Shell commands sent to a session for one folder are now refused if the session is working in a different folder. Disallowed tools now stay blocked while a leftover permission request is handled. Team memory changes held back by a sync pause are now kept and retried instead of dropped. The hint to raise API_TIMEOUT_MS after a timeout now notices a value set in your settings. Worktrees made from origin's default branch now use the exact remote branch. The message saying auto mode works only inside the sandbox has been removed.
Written by our agent from the shipped bundle, not by Anthropic.
! shell commands get their own path in SDK input and are refused in the cloud-session viewExtensionsRemote (CCR) sessions gain new rules for batching transcript uploads: holding across model calls, merged status reports, viewer checkpoints and a launch policy
Sessions & agents! shell commands get their own path in SDK input and are refused in the cloud-session viewBash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
Permissions & safetyIn a remote session that supports it, a '!' shell command can now run, with limits on output and a 10 minute timeout
Sessions & agentsMCP elicitation dialogs now receive the plugin source, and CLAUDE_CODE_CONSENT_POINTERLESS can stop Accept being preselected
Extensions--resumeSessions & agentsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Behind tengu_wobbly_dewdrop, Drive's create_file can take a file reference that Claude Code reads after approval; HIPAA orgs are denied
A one-time startup notice, "Fable is on us", tells eligible organisation users their admin opted them in to free credit for Fable usage
Unclear The switch that turns this notice on and its default are not known.
A build constant HYBRID_SETTINGS_SCOPE_REGISTERED appears next to the plugin and project scope constants, groundwork for a new settings scope
New attributionProject and attributionProjectPolicy settings and CLAUDE_CODE_ATTRIBUTION_PROJECT name the claude.ai Project a session's usage is reported under
Unclear It is not stated what this list is for or whether attributionProjectPolicy does anything yet.
In Anthropic cloud sessions, Claude Code can check each MCP server's host against an allow or deny list sent by the server
Unclear It is not confirmed that the default lets every host through, or where a blocked result actually stops a connection.
The switch for treating skills as plugins moves from tengu_cached_pebble to tengu_steady_finch, and plugin sync now notes converted skills
Policies can now record an allow-loopback setting, and remote sessions gained a hook for checkpoint requests, with no visible effect yet
Unclear What the loopback setting, the checkpoint request callback and the new setting actually do is not known.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
13 more of these are in What probably matters to you, above.
Claude Code now drops CA certificates that do not chain to a root, and the gateway uses an explicit CA list and refuses to start if none loads
Unclear It is not clear whether the pruning runs every time certificates are loaded or only in some cases.
Claude Code gains a lookup against the plugin directory for switching, installing and updating plugins, and backs off after a failed read
Unclear It is not clear whether this lookup is reachable in released builds yet.
Team memory sync and some uploads now honor the server's retry-after signal, skip work while it lasts, and retry once the wait is over
allowManagedPermissionRulesOnly now limits host-delivered plugins more in Claude Desktop#When an organization sets allowManagedPermissionRulesOnly, a plugin-source trust check fails and Desktop --plugin-dir plugins lose their allowed-tools
Unclear Which plugins or plugin sources this check affects is not stated.
Turning a plugin on or off is refused with managed_settings_override when your organization's managed settings already decide it, unless recordOverManagedSettings is passed
Unclear It is not clear whether the refusal applies to turning plugins on, turning them off, or both.
:* in the middle now get a security warning#An allow rule with : anywhere but the end now gets a security warning saying : is read as a wildcard
allowedMcpServers description narrows which managed entries are exempt#The allowedMcpServers setting now says managed-mcp.json entries are exempt unless ${VAR} appears in their command, args, url or header values
Unclear Whether the allowlist is now enforced differently, or only its description changed, is not clear.
Sign-in limits that used to apply only inside a session can now apply outside one too, depending on a new check
Unclear What the new check looks at, so when the restrictions now apply outside a session.
Claude is now told what to do when a plugin can only be published from claude.ai or when an earlier submission still awaits review
Unclear Whether the plugin publishing tool is available to every user is not stated.
* literally now get a security notice#Deny or ask permission rules that mix with : now carry a security notice saying the * is read literally, with a fix
A permission rule that file checks can never match now gets a security notice, "never matches · use ...", unless it is an allow rule
Plugin publish refusals now explain how to withdraw a pending submission and when a plugin can only be published from claude.ai
The warning about a * placed before the rest of a command in a permission rule now also comes as a short one-line notice
In runner mode, the spawn-runner hook's last partial lines are kept and output from processes it left running is still logged, up to a limit
When team memory syncing is paused after a failure, unsent changes now stay pending and are retried instead of being dropped
3 more of these are in What probably matters to you, above.
profileFlagHost hook#Feature-flag client setups gain a profileFlagHost hook, and a Google sign-in token exchange client gets its own transporter
The runner's log writer can now write its output on a thread of its own, falling back to direct writes with a warning
When connecting through Google Vertex AI, Claude Code now passes extra client options alongside the key file during sign-in
Unclear It is not stated what the new client options contain or what they change.
Claude Code now checks whether MCP server settings outside the environment section contain something that looks like a variable
Unclear What Claude Code does when it finds a variable-like value outside the environment section is not stated.
The warning shown when company policy blocks an MCP server named in an agent's settings now adds its "Warning: " label separately
Claude Code now records which organization plugin lists have been applied, alongside the ones it has already asked about
The error saying a plugin is managed by your organization is now defined once and shared wherever it is shown
Unclear It is not stated whether the wording of the message changed.
Published verbatim by Anthropic for v2.1.305. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 38 bullets, 11 name something an entry on this page also names, 10 name something no entry here does, and 17 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections
Probably device-tool-refusal-text-adds-sandboxallownestedusernamespa, sandbox-refuses-a-setting-that-lets-commands-bypass-file-den, new-sandbox-setting-allownestedusernamespaces CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notices a usage limit that was lifted before its reset
No entry names this --tools (a 2.1.304 regression): Claude Code now retries without it
Probably tools-typo-warnings-now-also-surface-as-securitywarnings /effort and /autocompact settings not applying when the model name differed from a modelOverrides value by letter case or a [1m] tag
Probably 1m-context-auto-suffix-extended-to-more-model-match-cases, usage-insight-schema-gains-recommendations-and-a-one-click-f ENOSPC file path: the error now says the disk is full and that nothing ran
No entry names this #89879[BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it Open
setMcpServers being replaced later in the session by a same-named server from your own settings
No entry names this pipeline() and parallel() agents instead of serving them from the run's journal
Probably workflow-parallel-and-pipeline-track-per-slot-state #95076Workflow resumeFromRunId re-runs every completed agent after the first parallel fan-out (40 redundant opus agents, 231M tokens) Open
#89784Workflow resumeFromRunId re-dispatches completed agent() calls despite unchanged (prompt, opts) Open
/resume after switching conversations with /resume
No entry names this #102431[BUG] Remote Control leaves bridge-session-only .jsonl stubs that show up in /resume as empty "(session)" entries Open
/usage rows being cut off in narrow terminals
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Resource temporarily unavailable when TERM is set (a 2.1.300 regression)
Probably terminal-capability-map-gains-a-separate-itermimages-check GIT_CONFIG
Probably git-env-git-config-only-cleared-conditionally-headless-liv /usage: each warning is now a one-line fix that names its source, and f applies the fixes; the same fixes appear in VS Code and /doctor
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Image to draw its picture in iTerm2 3.5 and later with fullscreen rendering, where it showed only its alt text
No entry names this w now says the new mode is saved for the folder, and a later claude remote-control start that uses the saved mode says where it came from
No entry names this allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off
Probably managed-mcp-allowlist-doc-var-rule-narrowed allowed-tools when your organization's managed settings set allowManagedPermissionRulesOnly
Probably managed-rules-setting-now-affects-plugin-trust-check, managed-allowmanagedpermissionrulesonly-docs-desktop-plug /artifacts delete confirmation to take 1 or Enter to keep, 2 to delete, and Esc to cancel; y and n no longer answer it
No entry names this spinnerVerbs setting replaces the built-in verbs with short ones
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.304.
Claude Code, interactive mode
1362 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 37 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?