Claude Code v2.1.305

Requests that get a 409 conflict response are now retried#

Claude Code now retries requests that get HTTP 409, as it already did for 408, 429 and server errors

Startup warnings for MCP servers now go to stderr only in non-interactive runs#

Warnings about invalid or blocked MCP servers now print to stderr in non-interactive runs and go to the log otherwise

Deny and ask rules that treat * literally now get a security notice#

Deny or ask permission rules that mix with : now carry a security notice saying the * is read literally, with a fix

Search box hides its label until you type, and the Usage tab in /config changes#

A search box now shows its "Search:" label only once you type, and the Usage tab in /config gets a new layout and can be closed

Deny and ask rules that can never match now get a security notice#

A permission rule that file checks can never match now gets a security notice, "never matches · use ...", unless it is an allow rule

Cancelling claude auth login now exits with code 130#

Cancelling the login flow now exits with code 130 instead of 1, and other errors still exit with 1

Unclear It is not clear exactly which errors count as a cancel and get code 130, such as pressing Ctrl-C.

Deleting an artifact now asks with Yes and No options#

Deleting an artifact now shows a Yes/No choice instead of waiting for the y or n key

Tool search stays off once the server has refused it#

If the server refuses tool search once, Claude Code now turns tool search off for the rest of that conversation

MCP server questions ignore answers sent by stray keystrokes#

When an MCP server asks you a question, answers that arrive too soon after the question appears or after a keypress are now ignored, except cancel

Agents cut off when a session ends are no longer marked as stopped by you#

A new marker says when an agent was cut off because the session ended, and that nobody asked it to stop

The plugin-authoring note after a command appears in one more case#

The note Claude Code can add after you run a command about plugin authoring now triggers on a third kind of content

Claude in Chrome guidance suggests adding task-specific browser tools together#

The Claude in Chrome skill text now tells Claude to add task-specific browser tools to the same call when a task clearly needs them

Unclear Whether the instructions Claude actually receives in a browser session changed is unclear.

Clearer message when a plugin's manifest is refused#

A plugin whose manifest is refused now shows "Plugin not loaded" with the reason, instead of "Invalid manifest"

A synced plugin that cannot be found now comes with a reason#

When a synced plugin is missing, the error now says why, and the manifest fix hint explains symlink and outside-folder refusals

The ignored --rc warning is now one line#

The warning that --rc or --project was ignored is now a single line starting with the reason

MCP tool names with only a server part now pass a validation check#

A check on MCP tool names now accepts mcp__server on its own, not only the full mcp__server__tool form

Unclear It is not clear which setting or field this name check applies to.

Errors from tools Claude Code serves now include their extra details#

When a tool Claude Code serves to another program fails with extra error details, the error now carries them in _meta

Blocked plugin hooks now say why they were refused#

When Claude Code refuses to load a plugin's hooks, the error now carries the reason it was refused

Review base branch is always treated as coming from the last fetch#

When Claude Code works out which branch to compare against for a review, it now always labels it as the last fetched commit

Unclear How this changes which commits a review compares against is not known.

Clearer error when sign-in input ends before you paste the code#

If input closes before you paste a sign-in code, Claude Code now tells you to sign in again and paste the code shown

Unclear It is not clear where the "fix this", "fix both" and "fix all N" labels are shown.

Clearer explanation when a plugin file path is skipped#

The message for a skipped plugin path now says it could not be confirmed inside the plugin and mentions permission errors and backslashes in names

Plainer advice when Claude stops unexpectedly#

When Claude stops unexpectedly, the hint now says to send a message to continue and start a new session if it keeps happening

Delete confirmation in the artifacts list changed#

Confirming a delete in the artifacts list now shows only an "Esc go back" hint; the y/n hints and click-to-cancel are gone

Unclear How a delete is now confirmed is not stated.

Approval prompt for rm on a command's output now checks more of the command#

The approval check for a recursive rm aimed at a command's output now also looks at extra parts of the command

Unclear Which extra parts of a command are now checked is not stated.

Spawn mode toggle now tells you the choice is saved for this folder#

After you switch spawn mode, the status line now says the choice is saved for this folder and that w switches back

Wildcard permission warning gets a short one-line version#

The warning about a * placed before the rest of a command in a permission rule now also comes as a short one-line notice

Windows sandbox reports an error when the local network setting doesn't match#

On Windows, Claude Code has a new sandbox error for when network.allowLocalBinding disagrees with the loopback mode set up at the start

Unclear It is not clear when Claude Code actually shows this error to a user.

Shorter note under the usage behaviours breakdown#

The note under the usage behaviours breakdown now reads "Approximate · sessions on this machine only · shares overlap"

Usage footer note is shorter#

The note under usage figures now reads "Approximate · sessions on this machine only"

Fleet view keeps track of remote sessions that change ID#

The fleet view now follows remote jobs by their stable ID, picks up a session under its new ID, and clears an old error when pinning

Session journal writes no longer overlap, and host-set MCP servers win name clashes#

Writes to the local session journal now happen one at a time, and a host-set MCP server is kept over a settings one with the same name

Shell commands sent from elsewhere will not run in the wrong folder#

Shell commands sent to a session for one folder are now refused with an error if the session is working in a different folder

Blocked tools stay blocked when a leftover permission request is handled#

Disallowed tools now stay blocked during a turn that handles a leftover permission request, and permission prompts can carry a grant-outside-sandbox flag

Resuming a session that ended on your own shell command no longer looks interrupted#

Resuming a session whose last entry is a shell command you ran yourself, or its output, is now handled as that case rather than an interrupted prompt

Timeout hint now notices API_TIMEOUT_MS set in settings#

The hint to raise API_TIMEOUT_MS after a timeout now uses the value from settings too, and only appears when it is above zero

A prompt only counts as unanswered if you have not written since it appeared#

When a prompt times out, Claude Code now treats it as unanswered only if you have not written anything since it was shown

Fewer false reports of a background command left running#

A finished background shell task is now reported as leaving processes running only if they are really alive and the task was not killed

Remote Control shutdown now works with the right list of sessions#

When Remote Control shuts down, it now counts, stops and waits for the active sessions it is meant to

Unclear It is unclear whether this is a real change in shutdown behaviour or only renaming inside the code.

Team memory changes held back by a pause are now kept for retry#

When team memory syncing is paused after a failure, unsent changes now stay pending and are retried instead of being dropped

Worktrees based on origin's default branch use the exact remote branch#

When creating a worktree from origin's default branch, Claude Code now looks up the exact remote branch and names the failing git command in errors

Handed-off permission prompts keep your blocked-tool list#

A turn handed off after its permission prompt was left unanswered now carries the session's disallowedTools list, replacing any other

Copied MCP server settings keep their built-in status#

When Claude Code copies an MCP server's settings, the copy is now recognised as built-in only if the original was

Permission rules are checked for file paths against the right values#

The check for whether a permission rule is a file path rule now looks at that rule's own text and where it came from

Unclear Which permission rules now behave differently is not known.

Plugin hook lookup for another machine retries when the plugin is missing#

When Claude Code looks up a plugin's hooks for another machine and the plugin is not found, it now repeats the same lookup

Unclear What the changed retry means for plugins that are missing or late to sync is not known.

Closing a Remote Control connection no longer records a missing session#

When a Remote Control connection closes, Claude Code now records the linked session only if one actually exists

Model fallback notices are matched more strictly#

Claude Code now reports a fallback-model switch only when the reply came from the fallback model and not the original

Login now fails properly when its local callback server cannot start#

If the local server that receives OAuth login results cannot start, Claude Code now reports a real error instead of carrying on

A timeout ignores override values of zero or less#

A timeout override is now used only if it is above zero; otherwise the default of 2 minutes in remote sessions or 5 minutes elsewhere applies

MCP tool timeouts can pause while a question waits for your answer#

An MCP tool call's timeout can now pause while it waits on a question to you, but only if this is switched on remotely

Claude in Chrome instructions are restructured and tool search knows a batch tool#

The long Claude in Chrome guidance on GIFs, console logs, alerts and tabs is gone from its old place, and tool search now mentions a batch browser tool

Memory extraction can skip passes on Extra Usage turns or after a quick check#

Memory extraction can now skip a pass when the turn was billed to Extra Usage, or when a quick model check expects nothing to save

Unclear Not settled whether the when_overage and first-look settings are supplied to any account.

Auto mode may send more file edits through its safety check#

A new remote switch can stop accepted edits from skipping the auto mode safety check; it is off by default

Claude Code advertises fewer MCP features to some servers#

For MCP servers whose host is flagged by the cloud host check, Claude Code now trims the features it says it supports when connecting

Unclear Which features are removed from the list is not known.

Groundwork for skipping deletes during sync and sandbox restarts on Windows#

A sync process can now skip deleting items in some cases, and Claude Code tracks extra sandbox start-up state on Windows

Unclear It is not clear what makes the sync skip deletes or what it is syncing.

Recovery after hitting the output limit can now be adjusted from the server#

How Claude Code prompts the model to continue after hitting its output limit, and when it gives up, can now be set by a server switch

Tasks can be turned off for named MCP servers by a remote list#

A server-sent list can now turn off Tasks for named MCP servers, whose tool calls then run without Tasks; the list is empty by default

Placeholder for renaming remote sessions that does nothing yet#

Claude Code has a new placeholder for updating a remote session's title that always reports failure and does nothing

A list sent from the server can single out individual tools, empty by default#

In certain modes, Claude Code checks whether a tool is named on a list the server sends, and with no list no tool is selected

Unclear What happens to a tool that is on the list is not known.

Resuming no longer treats a quietly finished turn as interrupted#

When you resume, a turn that ended right after a tool result with Claude choosing to stop is now treated as complete instead of interrupted

A new remotely controlled switch with no known purpose#

Claude Code reads a new remotely controlled switch that is off unless switched on remotely, and what it controls is unknown

Unclear What this switch controls is not stated.

Changes to some features that are switched off by default#

A new remote switch was added to a list, and a condition behind another switched-off feature now needs an extra test

Unclear It is not clear what tengu_kind_dewdrop controls.

Groundwork for a shell-mode footer that cannot switch on yet#

The prompt footer has new groundwork for shell mode that is hard-wired off in this release and shows nothing

Attached-file handling gains a naming option that is off by default#

The part of Claude Code that plans how attached files are handled takes a new naming option, which is off by default

Unclear Whether anything in Claude Code turns the new option on, and what it changes for attached files when it does.

Usage report works out how many sessions ran at once#

The usage report's analysis now calculates the most sessions running at the same time, adds per-day and per-week detail, and blanks some recommendations

Unclear Where the peak number of parallel sessions appears in the report is not clear.

Evaluation runs can now be given an API key#

The internal evaluation runner can now receive an API key, not only an OAuth or gateway sign-in

Startup gains a slot for security warnings and a resume-in-cloud option#

Claude Code's startup now carries a list of security warnings and reads a resume-in-cloud option, with no visible effect described yet

Unclear It is not clear whether the security warnings are shown, or whether the resume-in-cloud option can be used yet.

Subagent details can also be sent to a session's event stream#

Saved details about a subagent can now also be sent as an event on the session's event stream, not only written to a file

Unclear It is not stated what decides whether subagent details are sent to the event stream.

Git can be set to use OpenSSL for secure connections#

A new opensslBackend option makes Claude Code pass http.sslBackend=openssl to git, aimed at Windows setups

Unclear Nothing says how the opensslBackend option is switched on.

Memory saving, MCP file inputs and a Windows helper change slightly#

Saving memories now takes billing into account, MCP tools can be marked as taking files, and a tool helper now runs on Windows

Unclear It is not clear which of these changes are behind the server switch.

Tool search refusals and outside-sandbox grants are handled differently#

Claude Code's handling of a refused tool search, with the message "tool search refused", and of grants outside the sandbox has changed

Unclear What a user sees when a tool search is refused, and how an outside-sandbox grant is given, is not stated.

Auto mode startup dialog sets and restores a setting around itself#

Behind a server-controlled switch, the auto mode startup dialog now changes some state before it shows and restores it after

Unclear It is not stated what state is changed around the dialog.

Compaction checks the session's fixed beta features before picking its tools#

The check that decides which tools go with a compaction request now also looks at beta features fixed for the session's main model

Unclear It is not clear what this extra check changes in practice for a compaction request.

Headless runs send out pending messages early for ! shell commands#

In headless runs, Claude Code now sends out waiting messages before a turn starts when the input is a ! shell command

Unclear It is not clear whether this changes the order of messages a reader would see.

Usage-limit handling changes when a message carries quota limits#

Claude Code now handles quota limit information on a message through different steps than before

Unclear It is not clear what the new handling does differently for you.

Bridge connection sends keep-alive signals only for sessions that are due#

The bridge now sends keep-alive signals only for sessions that are due one, rather than for all sessions at once

Sign-in retries can use a different limit for each request#

Claude Code's sign-in and credential requests can now set their own retry limit instead of always using the fixed default

An unused value was dropped from tool descriptions#

An internal value no longer goes into tool descriptions, and the prompt the model sees is unchanged