Claude can now upload a local file to Google Drive by naming it, up to 10 MB. Claude Code reads the file only after you approve the call. In remote sessions that support it, you can now run '!' shell commands, with a 10 minute timeout. Sonnet 4, Sonnet 4.6 and Opus 4.6 now list a 1 million token maximum context window. claude plugin validate now also checks a plugin's folder layout. A new environment variable, CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY, sets how a remote session sends out its events.
Several features are in this build but not switched on yet. /usage is getting a way to look through your recent sessions and suggest how to use less of your plan. It could then queue the fixes you pick, such as /compact or lower effort, as prompts. Groundwork is also present for --resume to pick up a cloud session. Cloud sessions may later check each MCP server's host against an allow or deny list. While waiting on a usage limit, Claude Code could send a test request to see whether the limit has lifted.
Shell commands sent to a session for one folder are now refused if the session is working in a different folder. Disallowed tools now stay blocked while a leftover permission request is handled. Team memory changes held back by a sync pause are now kept and retried instead of dropped. The hint to raise API_TIMEOUT_MS after a timeout now notices a value set in your settings. Worktrees made from origin's default branch now use the exact remote branch. The message saying auto mode works only inside the sandbox has been removed.
Written by our agent from the shipped bundle, not by Anthropic.
! shell commands get their own path in SDK input and are refused in the cloud-session viewExtensionsRemote (CCR) sessions gain new rules for batching transcript uploads: holding across model calls, merged status reports, viewer checkpoints and a launch policy
Sessions & agents! shell commands get their own path in SDK input and are refused in the cloud-session viewBash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
Permissions & safetyIn a remote session that supports it, a '!' shell command can now run, with limits on output and a 10 minute timeout
Sessions & agentsMCP elicitation dialogs now receive the plugin source, and CLAUDE_CODE_CONSENT_POINTERLESS can stop Accept being preselected
Extensions--resumeSessions & agentsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →13 more of these are in What probably matters to you, on page 1.
Text telling Claude about your machine now says your files and tools are on this machine, not in the session's environment
A subagent's instructions now say to report suspected bugs only on strong evidence and to read files listed on a "Changed lately:" line
Unclear It is not clear which subagent uses these instructions or whether they are in use.
Messages explaining why Claude Code is not serving tools remotely now cover Windows, which is still not supported yet
Claude Code now has a message saying a listed plugin cannot be installed by this version of Claude Code
Headless Claude Code now waits up to 30 seconds for the session to end and up to 5 minutes for a pending get_context_usage request before exiting
Claude Code now refuses to load a plugin whose manifest, monitors or settings file links to a location outside the plugin's folder
Unclear It is not clear whether this check applies to plugins from every source or only some.
Claude Code now retries requests that get HTTP 409, as it already did for 408, 429 and server errors
Warnings about invalid or blocked MCP servers now print to stderr in non-interactive runs and go to the log otherwise
* literally now get a security notice#Deny or ask permission rules that mix with : now carry a security notice saying the * is read literally, with a fix
A permission rule that file checks can never match now gets a security notice, "never matches · use ...", unless it is an allow rule
claude auth login now exits with code 130#Cancelling the login flow now exits with code 130 instead of 1, and other errors still exit with 1
Unclear It is not clear exactly which errors count as a cancel and get code 130, such as pressing Ctrl-C.
Deleting an artifact now shows a Yes/No choice instead of waiting for the y or n key
If the server refuses tool search once, Claude Code now turns tool search off for the rest of that conversation
When an MCP server asks you a question, answers that arrive too soon after the question appears or after a keypress are now ignored, except cancel
A new marker says when an agent was cut off because the session ended, and that nobody asked it to stop
The note Claude Code can add after you run a command about plugin authoring now triggers on a third kind of content
The Claude in Chrome skill text now tells Claude to add task-specific browser tools to the same call when a task clearly needs them
Unclear Whether the instructions Claude actually receives in a browser session changed is unclear.
A plugin whose manifest is refused now shows "Plugin not loaded" with the reason, instead of "Invalid manifest"
When a synced plugin is missing, the error now says why, and the manifest fix hint explains symlink and outside-folder refusals
--rc warning is now one line#The warning that --rc or --project was ignored is now a single line starting with the reason
A check on MCP tool names now accepts mcp__server on its own, not only the full mcp__server__tool form
Unclear It is not clear which setting or field this name check applies to.
When a tool Claude Code serves to another program fails with extra error details, the error now carries them in _meta
When Claude Code refuses to load a plugin's hooks, the error now carries the reason it was refused
When Claude Code works out which branch to compare against for a review, it now always labels it as the last fetched commit
Unclear How this changes which commits a review compares against is not known.
If input closes before you paste a sign-in code, Claude Code now tells you to sign in again and paste the code shown
Unclear It is not clear where the "fix this", "fix both" and "fix all N" labels are shown.
Plugin publish refusals now explain how to withdraw a pending submission and when a plugin can only be published from claude.ai
The message for a skipped plugin path now says it could not be confirmed inside the plugin and mentions permission errors and backslashes in names
When Claude stops unexpectedly, the hint now says to send a message to continue and start a new session if it keeps happening
Confirming a delete in the artifacts list now shows only an "Esc go back" hint; the y/n hints and click-to-cancel are gone
Unclear How a delete is now confirmed is not stated.
rm on a command's output now checks more of the command#The approval check for a recursive rm aimed at a command's output now also looks at extra parts of the command
Unclear Which extra parts of a command are now checked is not stated.
After you switch spawn mode, the status line now says the choice is saved for this folder and that w switches back
The warning about a * placed before the rest of a command in a permission rule now also comes as a short one-line notice
On Windows, Claude Code has a new sandbox error for when network.allowLocalBinding disagrees with the loopback mode set up at the start
Unclear It is not clear when Claude Code actually shows this error to a user.
The note under the usage behaviours breakdown now reads "Approximate · sessions on this machine only · shares overlap"
The note under usage figures now reads "Approximate · sessions on this machine only"
The fleet view now follows remote jobs by their stable ID, picks up a session under its new ID, and clears an old error when pinning
Writes to the local session journal now happen one at a time, and a host-set MCP server is kept over a settings one with the same name
Shell commands sent to a session for one folder are now refused with an error if the session is working in a different folder
Disallowed tools now stay blocked during a turn that handles a leftover permission request, and permission prompts can carry a grant-outside-sandbox flag
Resuming a session whose last entry is a shell command you ran yourself, or its output, is now handled as that case rather than an interrupted prompt
API_TIMEOUT_MS set in settings#The hint to raise API_TIMEOUT_MS after a timeout now uses the value from settings too, and only appears when it is above zero
When a prompt times out, Claude Code now treats it as unanswered only if you have not written anything since it was shown
In runner mode, the spawn-runner hook's last partial lines are kept and output from processes it left running is still logged, up to a limit
A finished background shell task is now reported as leaving processes running only if they are really alive and the task was not killed
When Remote Control shuts down, it now counts, stops and waits for the active sessions it is meant to
Unclear It is unclear whether this is a real change in shutdown behaviour or only renaming inside the code.
When team memory syncing is paused after a failure, unsent changes now stay pending and are retried instead of being dropped
When creating a worktree from origin's default branch, Claude Code now looks up the exact remote branch and names the failing git command in errors
A turn handed off after its permission prompt was left unanswered now carries the session's disallowedTools list, replacing any other
When Claude Code copies an MCP server's settings, the copy is now recognised as built-in only if the original was
The check for whether a permission rule is a file path rule now looks at that rule's own text and where it came from
Unclear Which permission rules now behave differently is not known.
When Claude Code looks up a plugin's hooks for another machine and the plugin is not found, it now repeats the same lookup
Unclear What the changed retry means for plugins that are missing or late to sync is not known.
When a Remote Control connection closes, Claude Code now records the linked session only if one actually exists
Claude Code now reports a fallback-model switch only when the reply came from the fallback model and not the original
If the local server that receives OAuth login results cannot start, Claude Code now reports a real error instead of carrying on
A timeout override is now used only if it is above zero; otherwise the default of 2 minutes in remote sessions or 5 minutes elsewhere applies
15 more of these are in What probably matters to you, on page 1.
An MCP tool call's timeout can now pause while it waits on a question to you, but only if this is switched on remotely
The long Claude in Chrome guidance on GIFs, console logs, alerts and tabs is gone from its old place, and tool search now mentions a batch browser tool
Memory extraction can now skip a pass when the turn was billed to Extra Usage, or when a quick model check expects nothing to save
Unclear Not settled whether the when_overage and first-look settings are supplied to any account.
A new remote switch can stop accepted edits from skipping the auto mode safety check; it is off by default
For MCP servers whose host is flagged by the cloud host check, Claude Code now trims the features it says it supports when connecting
Unclear Which features are removed from the list is not known.
A sync process can now skip deleting items in some cases, and Claude Code tracks extra sandbox start-up state on Windows
Unclear It is not clear what makes the sync skip deletes or what it is syncing.
How Claude Code prompts the model to continue after hitting its output limit, and when it gives up, can now be set by a server switch
A server-sent list can now turn off Tasks for named MCP servers, whose tool calls then run without Tasks; the list is empty by default
Claude Code has a new placeholder for updating a remote session's title that always reports failure and does nothing
In certain modes, Claude Code checks whether a tool is named on a list the server sends, and with no list no tool is selected
Unclear What happens to a tool that is on the list is not known.
The parser that checks Bash commands now flags a shell keyword after command words with keywordAfterPrefix, and the prefix check splits and tests those commands
When you resume, a turn that ended right after a tool result with Claude choosing to stop is now treated as complete instead of interrupted
Claude Code reads a new remotely controlled switch that is off unless switched on remotely, and what it controls is unknown
Unclear What this switch controls is not stated.
A new remote switch was added to a list, and a condition behind another switched-off feature now needs an extra test
Unclear It is not clear what tengu_kind_dewdrop controls.
The prompt footer has new groundwork for shell mode that is hard-wired off in this release and shows nothing
The part of Claude Code that plans how attached files are handled takes a new naming option, which is off by default
Unclear Whether anything in Claude Code turns the new option on, and what it changes for attached files when it does.
3 more of these are in What probably matters to you, on page 1.
Before extracting memories, a small model now checks whether a memory write is likely and can skip the full extraction pass
Unclear Not settled whether anything runs this quick check in this release.
The usage report's analysis now calculates the most sessions running at the same time, adds per-day and per-week detail, and blanks some recommendations
Unclear Where the peak number of parallel sessions appears in the report is not clear.
The internal evaluation runner can now receive an API key, not only an OAuth or gateway sign-in
Claude Code's startup now carries a list of security warnings and reads a resume-in-cloud option, with no visible effect described yet
Unclear It is not clear whether the security warnings are shown, or whether the resume-in-cloud option can be used yet.
Saved details about a subagent can now also be sent as an event on the session's event stream, not only written to a file
Unclear It is not stated what decides whether subagent details are sent to the event stream.
Conversation compaction now records retries on too-long prompts, dropped history and whether the summary reply was complete
A new opensslBackend option makes Claude Code pass http.sslBackend=openssl to git, aimed at Windows setups
Unclear Nothing says how the opensslBackend option is switched on.
profileFlagHost hook#Feature-flag client setups gain a profileFlagHost hook, and a Google sign-in token exchange client gets its own transporter
Saving memories now takes billing into account, MCP tools can be marked as taking files, and a tool helper now runs on Windows
Unclear It is not clear which of these changes are behind the server switch.
Claude Code's handling of a refused tool search, with the message "tool search refused", and of grants outside the sandbox has changed
Unclear What a user sees when a tool search is refused, and how an outside-sandbox grant is given, is not stated.
Behind a server-controlled switch, the auto mode startup dialog now changes some state before it shows and restores it after
Unclear It is not stated what state is changed around the dialog.
The check that decides which tools go with a compaction request now also looks at beta features fixed for the session's main model
Unclear It is not clear what this extra check changes in practice for a compaction request.
! shell commands#In headless runs, Claude Code now sends out waiting messages before a turn starts when the input is a ! shell command
Unclear It is not clear whether this changes the order of messages a reader would see.
Claude Code now handles quota limit information on a message through different steps than before
Unclear It is not clear what the new handling does differently for you.
The bridge now sends keep-alive signals only for sessions that are due one, rather than for all sessions at once
Claude Code's sign-in and credential requests can now set their own retry limit instead of always using the fixed default
An internal value no longer goes into tool descriptions, and the prompt the model sees is unchanged
In remote sessions, notifications that were waiting in a queue now pass their IDs on when they are delivered, not only to the log
Claude Code now accepts a checkpoint request sent by the server over its live event connection
Unclear It is not stated what a checkpoint saves or when the server asks for one.
In remote sessions, when the hold on client events ends for any reason other than a round trip, a hold covering the whole turn now ends too
Several small pieces were added for remote sessions, plugin checks and MCP input requests, with no visible feature behind them yet
The check that keeps a background session waiting now looks at swept sessions, unswept sessions and pending wakeups separately
Unclear It is not clear whether background or headless sessions now stay running longer or stop sooner.
Files attached from a remote client can now be named from their whole file id instead of its first 8 characters
When rebuilding its index from a transcript, Claude Code now reacts to malformed user or assistant lines and unreadable files
Unclear What starting a successor index changes for someone resuming a session is not clear.
The step that saves fetched attachment files gained an option that names them differently, based on the file's ID
Unclear It is not clear when the new naming option is used.
The request that updates a session's title can now be cancelled, so it no longer holds things up on exit
In remote sessions, a "processing" notice for a held turn now waits until buffered transcript lines are written before it is sent
When a session closes, Claude Code now shuts down its worker state before saying goodbye and stops a pending checkpoint timer
Published verbatim by Anthropic for v2.1.305. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 38 bullets, 11 name something an entry on this page also names, 10 name something no entry here does, and 17 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections
Probably device-tool-refusal-text-adds-sandboxallownestedusernamespa, sandbox-refuses-a-setting-that-lets-commands-bypass-file-den, new-sandbox-setting-allownestedusernamespaces CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notices a usage limit that was lifted before its reset
No entry names this --tools (a 2.1.304 regression): Claude Code now retries without it
Probably tools-typo-warnings-now-also-surface-as-securitywarnings /effort and /autocompact settings not applying when the model name differed from a modelOverrides value by letter case or a [1m] tag
Probably 1m-context-auto-suffix-extended-to-more-model-match-cases, usage-insight-schema-gains-recommendations-and-a-one-click-f ENOSPC file path: the error now says the disk is full and that nothing ran
No entry names this #89879[BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it Open
setMcpServers being replaced later in the session by a same-named server from your own settings
No entry names this pipeline() and parallel() agents instead of serving them from the run's journal
Probably workflow-parallel-and-pipeline-track-per-slot-state #95076Workflow resumeFromRunId re-runs every completed agent after the first parallel fan-out (40 redundant opus agents, 231M tokens) Open
#89784Workflow resumeFromRunId re-dispatches completed agent() calls despite unchanged (prompt, opts) Open
/resume after switching conversations with /resume
No entry names this #102431[BUG] Remote Control leaves bridge-session-only .jsonl stubs that show up in /resume as empty "(session)" entries Open
/usage rows being cut off in narrow terminals
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Resource temporarily unavailable when TERM is set (a 2.1.300 regression)
Probably terminal-capability-map-gains-a-separate-itermimages-check GIT_CONFIG
Probably git-env-git-config-only-cleared-conditionally-headless-liv /usage: each warning is now a one-line fix that names its source, and f applies the fixes; the same fixes appear in VS Code and /doctor
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Image to draw its picture in iTerm2 3.5 and later with fullscreen rendering, where it showed only its alt text
No entry names this w now says the new mode is saved for the folder, and a later claude remote-control start that uses the saved mode says where it came from
No entry names this allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off
Probably managed-mcp-allowlist-doc-var-rule-narrowed allowed-tools when your organization's managed settings set allowManagedPermissionRulesOnly
Probably managed-rules-setting-now-affects-plugin-trust-check, managed-allowmanagedpermissionrulesonly-docs-desktop-plug /artifacts delete confirmation to take 1 or Enter to keep, 2 to delete, and Esc to cancel; y and n no longer answer it
No entry names this spinnerVerbs setting replaces the built-in verbs with short ones
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.304.
Claude Code, interactive mode
1447 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 37 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?