Claude can now upload a local file to Google Drive by naming it, up to 10 MB. Claude Code reads the file only after you approve the call. In remote sessions that support it, you can now run '!' shell commands, with a 10 minute timeout. Sonnet 4, Sonnet 4.6 and Opus 4.6 now list a 1 million token maximum context window. claude plugin validate now also checks a plugin's folder layout. A new environment variable, CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY, sets how a remote session sends out its events.
Several features are in this build but not switched on yet. /usage is getting a way to look through your recent sessions and suggest how to use less of your plan. It could then queue the fixes you pick, such as /compact or lower effort, as prompts. Groundwork is also present for --resume to pick up a cloud session. Cloud sessions may later check each MCP server's host against an allow or deny list. While waiting on a usage limit, Claude Code could send a test request to see whether the limit has lifted.
Shell commands sent to a session for one folder are now refused if the session is working in a different folder. Disallowed tools now stay blocked while a leftover permission request is handled. Team memory changes held back by a sync pause are now kept and retried instead of dropped. The hint to raise API_TIMEOUT_MS after a timeout now notices a value set in your settings. Worktrees made from origin's default branch now use the exact remote branch. The message saying auto mode works only inside the sandbox has been removed.
Written by our agent from the shipped bundle, not by Anthropic.
! shell commands get their own path in SDK input and are refused in the cloud-session viewExtensionsRemote (CCR) sessions gain new rules for batching transcript uploads: holding across model calls, merged status reports, viewer checkpoints and a launch policy
Sessions & agents! shell commands get their own path in SDK input and are refused in the cloud-session viewBash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
Permissions & safetyIn a remote session that supports it, a '!' shell command can now run, with limits on output and a 10 minute timeout
Sessions & agentsMCP elicitation dialogs now receive the plugin source, and CLAUDE_CODE_CONSENT_POINTERLESS can stop Accept being preselected
Extensions--resumeSessions & agentsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
/usage now ranks what is using your plan, offers savings suggestions such as lowering effort or compacting, and can queue a fix prompt
Unclear It is not clear whether these suggestions are switched on for you.
Remote (CCR) sessions gain new rules for batching transcript uploads: holding across model calls, merged status reports, viewer checkpoints and a launch policy
Unclear Which values the variable accepts is not stated.
A second mode lets cloud workers run a requested shell command through Claude's Bash tool, so Claude sees it and the folder carries over
Behind tengu_wobbly_dewdrop, Drive's create_file can take a file reference that Claude Code reads after approval; HIPAA orgs are denied
The login screen can now finish with a hybrid sign-in, and the sign-in flow accepts a settingsOnlyGrant option with an extra scope
While a request waits on a usage limit, Claude Code can now probe and resend it at once if the limit has already lifted
! shell commands get their own path in SDK input and are refused in the cloud-session view#Bash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
Unclear It is not clear which clients send shell command input this way or whether you can use it.
A one-time startup notice, "Fable is on us", tells eligible organisation users their admin opted them in to free credit for Fable usage
Unclear The switch that turns this notice on and its default are not known.
Claude Code adds internal pieces for remote sessions: a new email origin, tracking of when a person last wrote, queued wake-ups and more
--resume#Code that would let --resume pick up a cloud session alongside --cloud is present but cannot be reached in this build
In Anthropic cloud sessions a running MCP task stops holding the container up after 168 hours by default, set by tengu_curious_river
Unclear It is not clear whether either change can be reached yet.
A build constant HYBRID_SETTINGS_SCOPE_REGISTERED appears next to the plugin and project scope constants, groundwork for a new settings scope
Memory saves are now counted in tool-call summaries, can be shown quietly, are recorded in session stats, and cloud memory tool calls are tagged
Unclear How cloud memory calls look on screen, and what the quiet words change, is not stated.
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
Claude Code can now queue and run shell commands sent by the client in headless and SDK sessions, behind a remote switch that defaults to off
Claude Code's startup options now produce a value for resuming in the cloud
Unclear Which option sets this value, and what it does, is not stated.
The switch for treating skills as plugins moves from tengu_cached_pebble to tengu_steady_finch, and plugin sync now notes converted skills
In a remote session that supports it, a '!' shell command can now run, with limits on output and a 10 minute timeout
Unclear It is not clear which kinds of remote session support running '!' commands.
Model data gains maximum_window and clamp_long_context_without_beta, and the check for 1M context without opt-in now compares window sizes
Unclear It is not clear whether this changes the context limit or compaction point a user actually sees.
Auto mode's safety checker gains rules for messages sent by email, where only the sender's new words count as their request
Unclear It is not clear how a message comes to be delivered by email, so whether you can use this today is unknown.
The autonomous-mode instructions now tell Claude to ask only before irreversible steps and go ahead on anything reversible, including pushing an approved PR
Before a mod is shared, Claude Code can now ask in the chat whether to check a folder and its subfolders for secret keys
Policies can now record an allow-loopback setting, and remote sessions gained a hook for checkpoint requests, with no visible effect yet
Unclear What the loopback setting, the checkpoint request callback and the new setting actually do is not known.
The fleet view now shows locally kept titles for remote sessions, while its rename action for them is still empty
Claude Code can now track whether a plugin it wrote in a session was safety-scanned and delivered, and has text for sharing it with an organisation
Unclear Nothing shows how or whether this plugin hand-over flow is reached in this release.
MCP elicitation dialogs now receive the plugin source, and CLAUDE_CODE_CONSENT_POINTERLESS can stop Accept being preselected
Unclear Which servers and plugins pass the extra check, so it is unclear whether setting the variable changes every MCP dialog.
The fullscreen renderer can now show images in iTerm2 3.5 or later using its inline image protocol, alongside the existing kitty support
CLAUDE_CODE_ENTRYPOINT_ON_REQUESTS sets the name requests go out under, but only when CLAUDE_CODE_ENTRYPOINT is claude-desktop-3p
A new switch, CLAUDE_CODE_CCR_EARLY_SYNC_AFTER_SETTINGS_REFUSAL, lets cloud sessions take the early sync path when the settings fetch is refused
Unclear It is not clear whether this switch is set as an environment variable or by the server, or what its default is.
A new message says to close every Claude Code session and run profile forget so sandboxed commands stop reading your user profile
claude plugin validate --profile directory checks a plugin against the plugin directory's rules#claude plugin validate gains --profile directory, which checks a plugin folder for the plugin directory's submission rules and can fail a CI run
A new background task checks your usage for a promotional offer and saves whether it is open and when it ends, without showing you anything yet
When no cloud session can run because you are not signed in, Claude Code blocks input, tells you to run /login, and restarts into the session afterwards
The usage view and the SDK get_usage reply now carry recommendations, plus a fix you can send with one key unless Remote Control is on
Unclear It is not stated whether recommendations and fixes are shown to everyone or only to some accounts.
all argument#The /claude-test skill's browser helper ignores risky project environment settings and explains missing Node.js, and the skill accepts all
Unclear Whether this test skill is available to users is not known.
axScreenReader is now ignored in project and local settings, with a message saying how to turn screen reader mode on instead
Unclear It is not confirmed that Claude Code ignores the setting in project and local settings, rather than only its description saying so.
If sign-in fails when starting a --cloud session, Claude Code can now show a sign-in screen and carry on instead of only printing an error
In headless runs, a list of tools the client blocks can now be kept and reused across turns instead of being read fresh every turn
Unclear It is not clear whether the block list now carries over to later turns by default or only when keepsDisallowedTools is set.
A new choice labelled "all" runs every test on your own machine instead of only the tests that cover what changed
Unclear It is not clear which command or menu shows this choice, or whether it is available to everyone.
If Claude Code cannot open its local sign-in listener, login now shows a URL and asks you to paste the code instead of failing
--tools exclusions now also produce short security warnings#A --tools exclusion that matches no built-in tool, or a bare prefix with no tool name, now also produces a short security warning
sandbox.allowNestedUserNamespaces now also applies on WSL, names more tools that need it, and stays off by default
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
13 more of these are in What probably matters to you, above.
New messages tell you when a missing or unusable sandbox affects cloud sessions, with hints pointing to /sandbox and claude apply-project-settings
ant commands holding certain agent IDs#A safety guard now blocks Bash ant commands containing staging, Vertex, Bedrock or local agent, environment and vault IDs, with tailored messages
In agent teams, a teammate leaving plan mode is sent to the lead for approval based on its task, and no longer changes shared permissions
Claude Code now drops CA certificates that do not chain to a root, and the gateway uses an explicit CA list and refuses to start if none loads
Unclear It is not clear whether the pruning runs every time certificates are loaded or only in some cases.
Claude Code gains a lookup against the plugin directory for switching, installing and updating plugins, and backs off after a failed read
Unclear It is not clear whether this lookup is reachable in released builds yet.
'!' shell commands arriving from another client now pass a series of checks, and each refusal says why with a 'Not run:' message
Unclear Which ways of sending a '!' command to a session go through these checks is not clear.
Workflow runs now track replaced journal entries, normalize saved results, and warn when an agent() result cannot be saved for resuming
Documents saved by the project_read tool can now go to a project-docs folder, falling back to the session's tool-results folder if that fails
A team lead no longer auto-approves every plan request, and skips ones whose sender fails a check against the task list
Unclear It is not clear what happens to a skipped request afterwards.
If the command sandbox can't be checked for unattended serving, Claude Code now logs a warning and reports sandbox_failed_to_start
Messages now cover plugin publishing from a cloud session, agents cut off when a session ends, and sessions started by email
Claude Code refuses to load hooks modules when running as a tool server's daemon, which can hold your token and runs shell commands
When a plugin hooks module calls next(), Claude Code now checks the floors handed back and refuses ones the plugins cannot reach
Tool calls that save to memory can now show as their own memory-save rows and in tool summaries, and a security warnings list joins the status area
Claude Code now has lists of accepted field names for privacy policy, support, terms and documentation links in a plugin's manifest
Unclear It is not clear whether Claude Code shows these links anywhere yet.
Team memory sync and some uploads now honor the server's retry-after signal, skip work while it lasts, and retry once the wait is over
Turning a plugin on or off is refused with managed_settings_override when your organization's managed settings already decide it, unless recordOverManagedSettings is passed
Unclear It is not clear whether the refusal applies to turning plugins on, turning them off, or both.
Spawned commands gain a per-plugin bunOptionsFor hook, a clear disk-full error, and strict sandboxes now set allowNestedUserNamespaces to false
When a spawn mode saved for the current folder is used, Claude Code prints which one, and in an interactive terminal says to press w to change it
Claude Code now adds the [1m] long-context suffix to a model in more cases where a configured model already uses 1M context
Unclear Exactly which model names now get the 1M-context variant is not stated.
:* in the middle now get a security warning#An allow rule with : anywhere but the end now gets a security warning saying : is read as a wildcard
In streaming input mode, Claude Code now accepts a shell command when the client marks it as a client shell command
Some shell commands too complex to analyse can now be allowed by your existing permission rules instead of always prompting
On Windows, sandbox setup now checks profile read access, loopback firewall rules and install state, and can stop with new errors
Unclear It is not clear whether this Windows sandbox setup runs in Claude Code by default.
The code that picks where to split the conversation during compaction is reorganised, with a separate split rule for a new reactive path
Unclear Whether the messages kept after compaction actually differ, and when the reactive path is used, is not stated.
The error returned when a model switch is still pending now includes error_code: "verdict_pending"
Two of Claude Code's network request paths now work out their time limit from the request body, and clear the right timer afterwards
Unclear How the time limit varies with the request body is not stated.
Claude Code now works out and records the cost of its side requests, and logs a note when it cannot price one
CLAUDE_CODE_REMOTE is set#Claude Code now reads a token from its well-known file only when the CLAUDE_CODE_REMOTE environment variable is set
Programs from Anthropic Directory plugins now run with Bun's automatic package install turned off, overriding the plugin's own setting
When a controlling program's request to change the model fails, Claude Code now reports a finer reason, such as rate limit or failed sign-in
When a remote permission dialog returns changes, Claude Code now drops any mode switch and applies only the rule changes
Unclear It is not clear whether this path includes the SDK permission answers that can switch the mode.
When a subagent had to switch to a backup model because its first model could not be used, its result now starts with a warning saying so
Claude Code now refuses an action when sandbox.allowNestedUserNamespaces is on, because it lets commands get around file deny rules
Unclear It is not clear which action is refused when this setting is on.
Only a person can now accept a question from a built-in plugin's MCP server; hooks can only cancel, and headless sessions always cancel
A comment that wakes a watched artifact is now queued and reported when its turn begins, and dropped if that turn is cancelled or refused
Unclear It is not clear whether the artifact comment feature is switched on for ordinary users.
Claude Code now skips listing tools and prompts up front for some plain HTTP MCP servers, as it already did for claude.ai proxy servers
Unclear It is not clear which HTTP servers are affected or whether this is active for ordinary users.
Claude Code no longer treats models billed past 200K tokens as having a 1M window and uses new checks for long windows without opt-in
Unclear It is not clear which models get a different context size.
With CLAUDE_CODE_SYNC_SKILLS or CLAUDE_CODE_SYNC_SESSION_REFS set, a matching skill setting is now treated as off instead of left unset
Unclear It is not clear what feature reads this setting or what being off changes.
The Claude Code Doctor cleanup question can now cover checks 0-4, 7 and 10, where check 10 may edit files in your repository
Unclear It is not clear what decides whether check 10 is included, or what check 10 does.
When the auto mode safety check is unavailable because it refused, Claude Code now always blocks with policy_refusal, with no extra condition
Failed plugin directory fetches now record time, reason and service delay, say whether retrying may help, and flag plugins that cannot be installed
A tool can now reject its input with an ordinary result and a suggested fix instead of a tool error
claude -p keeps waiting for background shells a built-in plugin holds#A built-in plugin can now make claude -p wait for a background shell before it exits
Unclear It is not stated whether any built-in plugin holds background shells.
If you move an agent out of plan mode while it waits for plan approval, its pending approval is cleared and it is told to continue
Images Claude Code draws in the terminal can now use iTerm's inline image format, and are left out of text selection
On Windows, if sandbox.network.allowLocalBinding changed since the session started, sandboxed commands are refused with a message to restart Claude Code
claude plugin eval can now use your session's API key#Plugin eval runs now prefer an available API key, fall back to it if login fails, and pass it to test runs by file descriptor except on Windows
The message about device tools being withheld now lists sandbox.allowNestedUserNamespaces among the settings that weaken isolation
Unclear Whether turning on the setting now actually withholds device tools, or only the message text changed, is not clear.
The focus view tip now stays hidden when spinnerTipsEnabled is false and is shown according to a remote experiment
Claude Code now skips its reminder about using tool search in an extra case that depends on the model and the session's enabled beta features
Text telling Claude about your machine now says your files and tools are on this machine, not in the session's environment
A subagent's instructions now say to report suspected bugs only on strong evidence and to read files listed on a "Changed lately:" line
Unclear It is not clear which subagent uses these instructions or whether they are in use.
Messages explaining why Claude Code is not serving tools remotely now cover Windows, which is still not supported yet
Claude Code now has a message saying a listed plugin cannot be installed by this version of Claude Code
Headless Claude Code now waits up to 30 seconds for the session to end and up to 5 minutes for a pending get_context_usage request before exiting
Claude Code now refuses to load a plugin whose manifest, monitors or settings file links to a location outside the plugin's folder
Unclear It is not clear whether this check applies to plugins from every source or only some.
Published verbatim by Anthropic for v2.1.305. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 38 bullets, 11 name something an entry on this page also names, 10 name something no entry here does, and 17 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections
Probably device-tool-refusal-text-adds-sandboxallownestedusernamespa, sandbox-refuses-a-setting-that-lets-commands-bypass-file-den, new-sandbox-setting-allownestedusernamespaces CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notices a usage limit that was lifted before its reset
No entry names this --tools (a 2.1.304 regression): Claude Code now retries without it
Probably tools-typo-warnings-now-also-surface-as-securitywarnings /effort and /autocompact settings not applying when the model name differed from a modelOverrides value by letter case or a [1m] tag
Probably 1m-context-auto-suffix-extended-to-more-model-match-cases, usage-insight-schema-gains-recommendations-and-a-one-click-f ENOSPC file path: the error now says the disk is full and that nothing ran
No entry names this #89879[BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it Open
setMcpServers being replaced later in the session by a same-named server from your own settings
No entry names this pipeline() and parallel() agents instead of serving them from the run's journal
Probably workflow-parallel-and-pipeline-track-per-slot-state #95076Workflow resumeFromRunId re-runs every completed agent after the first parallel fan-out (40 redundant opus agents, 231M tokens) Open
#89784Workflow resumeFromRunId re-dispatches completed agent() calls despite unchanged (prompt, opts) Open
/resume after switching conversations with /resume
No entry names this #102431[BUG] Remote Control leaves bridge-session-only .jsonl stubs that show up in /resume as empty "(session)" entries Open
/usage rows being cut off in narrow terminals
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Resource temporarily unavailable when TERM is set (a 2.1.300 regression)
Probably terminal-capability-map-gains-a-separate-itermimages-check GIT_CONFIG
Probably git-env-git-config-only-cleared-conditionally-headless-liv /usage: each warning is now a one-line fix that names its source, and f applies the fixes; the same fixes appear in VS Code and /doctor
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Image to draw its picture in iTerm2 3.5 and later with fullscreen rendering, where it showed only its alt text
No entry names this w now says the new mode is saved for the folder, and a later claude remote-control start that uses the saved mode says where it came from
No entry names this allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off
Probably managed-mcp-allowlist-doc-var-rule-narrowed allowed-tools when your organization's managed settings set allowManagedPermissionRulesOnly
Probably managed-rules-setting-now-affects-plugin-trust-check, managed-allowmanagedpermissionrulesonly-docs-desktop-plug /artifacts delete confirmation to take 1 or Enter to keep, 2 to delete, and Esc to cancel; y and n no longer answer it
No entry names this spinnerVerbs setting replaces the built-in verbs with short ones
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.304.
Claude Code, interactive mode
1362 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 37 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?