Claude can now upload a local file to Google Drive by naming it, up to 10 MB. Claude Code reads the file only after you approve the call. In remote sessions that support it, you can now run '!' shell commands, with a 10 minute timeout. Sonnet 4, Sonnet 4.6 and Opus 4.6 now list a 1 million token maximum context window. claude plugin validate now also checks a plugin's folder layout. A new environment variable, CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY, sets how a remote session sends out its events.
Several features are in this build but not switched on yet. /usage is getting a way to look through your recent sessions and suggest how to use less of your plan. It could then queue the fixes you pick, such as /compact or lower effort, as prompts. Groundwork is also present for --resume to pick up a cloud session. Cloud sessions may later check each MCP server's host against an allow or deny list. While waiting on a usage limit, Claude Code could send a test request to see whether the limit has lifted.
Shell commands sent to a session for one folder are now refused if the session is working in a different folder. Disallowed tools now stay blocked while a leftover permission request is handled. Team memory changes held back by a sync pause are now kept and retried instead of dropped. The hint to raise API_TIMEOUT_MS after a timeout now notices a value set in your settings. Worktrees made from origin's default branch now use the exact remote branch. The message saying auto mode works only inside the sandbox has been removed.
Written by our agent from the shipped bundle, not by Anthropic.
! shell commands get their own path in SDK input and are refused in the cloud-session viewExtensionsRemote (CCR) sessions gain new rules for batching transcript uploads: holding across model calls, merged status reports, viewer checkpoints and a launch policy
Sessions & agents! shell commands get their own path in SDK input and are refused in the cloud-session viewBash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
Permissions & safetyIn a remote session that supports it, a '!' shell command can now run, with limits on output and a 10 minute timeout
Sessions & agentsMCP elicitation dialogs now receive the plugin source, and CLAUDE_CODE_CONSENT_POINTERLESS can stop Accept being preselected
Extensions--resumeSessions & agentsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Behind tengu_wobbly_dewdrop, Drive's create_file can take a file reference that Claude Code reads after approval; HIPAA orgs are denied
! shell commands get their own path in SDK input and are refused in the cloud-session view#Bash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
Unclear It is not clear which clients send shell command input this way or whether you can use it.
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
The autonomous-mode instructions now tell Claude to ask only before irreversible steps and go ahead on anything reversible, including pushing an approved PR
all argument#The /claude-test skill's browser helper ignores risky project environment settings and explains missing Node.js, and the skill accepts all
Unclear Whether this test skill is available to users is not known.
axScreenReader is now ignored in project and local settings, with a message saying how to turn screen reader mode on instead
Unclear It is not confirmed that Claude Code ignores the setting in project and local settings, rather than only its description saying so.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
13 more of these are in What probably matters to you, above.
ant commands holding certain agent IDs#A safety guard now blocks Bash ant commands containing staging, Vertex, Bedrock or local agent, environment and vault IDs, with tailored messages
In agent teams, a teammate leaving plan mode is sent to the lead for approval based on its task, and no longer changes shared permissions
Claude Code now drops CA certificates that do not chain to a root, and the gateway uses an explicit CA list and refuses to start if none loads
Unclear It is not clear whether the pruning runs every time certificates are loaded or only in some cases.
'!' shell commands arriving from another client now pass a series of checks, and each refusal says why with a 'Not run:' message
Unclear Which ways of sending a '!' command to a session go through these checks is not clear.
A team lead no longer auto-approves every plan request, and skips ones whose sender fails a check against the task list
Unclear It is not clear what happens to a skipped request afterwards.
Claude Code refuses to load hooks modules when running as a tool server's daemon, which can hold your token and runs shell commands
When a plugin hooks module calls next(), Claude Code now checks the floors handed back and refuses ones the plugins cannot reach
allowManagedPermissionRulesOnly now limits host-delivered plugins more in Claude Desktop#When an organization sets allowManagedPermissionRulesOnly, a plugin-source trust check fails and Desktop --plugin-dir plugins lose their allowed-tools
Unclear Which plugins or plugin sources this check affects is not stated.
Turning a plugin on or off is refused with managed_settings_override when your organization's managed settings already decide it, unless recordOverManagedSettings is passed
Unclear It is not clear whether the refusal applies to turning plugins on, turning them off, or both.
Spawned commands gain a per-plugin bunOptionsFor hook, a clear disk-full error, and strict sandboxes now set allowNestedUserNamespaces to false
Claude Code now adds the [1m] long-context suffix to a model in more cases where a configured model already uses 1M context
Unclear Exactly which model names now get the 1M-context variant is not stated.
On Windows, sandbox setup now checks profile read access, loopback firewall rules and install state, and can stop with new errors
Unclear It is not clear whether this Windows sandbox setup runs in Claude Code by default.
allowedMcpServers description narrows which managed entries are exempt#The allowedMcpServers setting now says managed-mcp.json entries are exempt unless ${VAR} appears in their command, args, url or header values
Unclear Whether the allowlist is now enforced differently, or only its description changed, is not clear.
CLAUDE_CODE_REMOTE is set#Claude Code now reads a token from its well-known file only when the CLAUDE_CODE_REMOTE environment variable is set
Programs from Anthropic Directory plugins now run with Bun's automatic package install turned off, overriding the plugin's own setting
When a remote permission dialog returns changes, Claude Code now drops any mode switch and applies only the rule changes
Unclear It is not clear whether this path includes the SDK permission answers that can switch the mode.
Claude Code now refuses an action when sandbox.allowNestedUserNamespaces is on, because it lets commands get around file deny rules
Unclear It is not clear which action is refused when this setting is on.
Only a person can now accept a question from a built-in plugin's MCP server; hooks can only cancel, and headless sessions always cancel
Claude Code no longer treats models billed past 200K tokens as having a 1M window and uses new checks for long windows without opt-in
Unclear It is not clear which models get a different context size.
With CLAUDE_CODE_SYNC_SKILLS or CLAUDE_CODE_SYNC_SESSION_REFS set, a matching skill setting is now treated as off instead of left unset
Unclear It is not clear what feature reads this setting or what being off changes.
When the auto mode safety check is unavailable because it refused, Claude Code now always blocks with policy_refusal, with no extra condition
Sign-in limits that used to apply only inside a session can now apply outside one too, depending on a new check
Unclear What the new check looks at, so when the restrictions now apply outside a session.
On Windows, if sandbox.network.allowLocalBinding changed since the session started, sandboxed commands are refused with a message to restart Claude Code
Claude Code now refuses to load a plugin whose manifest, monitors or settings file links to a location outside the plugin's folder
Unclear It is not clear whether this check applies to plugins from every source or only some.
Warnings about invalid or blocked MCP servers now print to stderr in non-interactive runs and go to the log otherwise
Deleting an artifact now shows a Yes/No choice instead of waiting for the y or n key
Confirming a delete in the artifacts list now shows only an "Esc go back" hint; the y/n hints and click-to-cancel are gone
Unclear How a delete is now confirmed is not stated.
Published verbatim by Anthropic for v2.1.305. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 38 bullets, 11 name something an entry on this page also names, 10 name something no entry here does, and 17 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections
Probably device-tool-refusal-text-adds-sandboxallownestedusernamespa, sandbox-refuses-a-setting-that-lets-commands-bypass-file-den, new-sandbox-setting-allownestedusernamespaces CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notices a usage limit that was lifted before its reset
No entry names this --tools (a 2.1.304 regression): Claude Code now retries without it
Probably tools-typo-warnings-now-also-surface-as-securitywarnings /effort and /autocompact settings not applying when the model name differed from a modelOverrides value by letter case or a [1m] tag
Probably 1m-context-auto-suffix-extended-to-more-model-match-cases, usage-insight-schema-gains-recommendations-and-a-one-click-f ENOSPC file path: the error now says the disk is full and that nothing ran
No entry names this #89879[BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it Open
setMcpServers being replaced later in the session by a same-named server from your own settings
No entry names this pipeline() and parallel() agents instead of serving them from the run's journal
Probably workflow-parallel-and-pipeline-track-per-slot-state #95076Workflow resumeFromRunId re-runs every completed agent after the first parallel fan-out (40 redundant opus agents, 231M tokens) Open
#89784Workflow resumeFromRunId re-dispatches completed agent() calls despite unchanged (prompt, opts) Open
/resume after switching conversations with /resume
No entry names this #102431[BUG] Remote Control leaves bridge-session-only .jsonl stubs that show up in /resume as empty "(session)" entries Open
/usage rows being cut off in narrow terminals
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Resource temporarily unavailable when TERM is set (a 2.1.300 regression)
Probably terminal-capability-map-gains-a-separate-itermimages-check GIT_CONFIG
Probably git-env-git-config-only-cleared-conditionally-headless-liv /usage: each warning is now a one-line fix that names its source, and f applies the fixes; the same fixes appear in VS Code and /doctor
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Image to draw its picture in iTerm2 3.5 and later with fullscreen rendering, where it showed only its alt text
No entry names this w now says the new mode is saved for the folder, and a later claude remote-control start that uses the saved mode says where it came from
No entry names this allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off
Probably managed-mcp-allowlist-doc-var-rule-narrowed allowed-tools when your organization's managed settings set allowManagedPermissionRulesOnly
Probably managed-rules-setting-now-affects-plugin-trust-check, managed-allowmanagedpermissionrulesonly-docs-desktop-plug /artifacts delete confirmation to take 1 or Enter to keep, 2 to delete, and Esc to cancel; y and n no longer answer it
No entry names this spinnerVerbs setting replaces the built-in verbs with short ones
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.304.
Claude Code, interactive mode
1362 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 37 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?