Claude can now upload a local file to Google Drive by naming it, up to 10 MB. Claude Code reads the file only after you approve the call. In remote sessions that support it, you can now run '!' shell commands, with a 10 minute timeout. Sonnet 4, Sonnet 4.6 and Opus 4.6 now list a 1 million token maximum context window. claude plugin validate now also checks a plugin's folder layout. A new environment variable, CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY, sets how a remote session sends out its events.
Several features are in this build but not switched on yet. /usage is getting a way to look through your recent sessions and suggest how to use less of your plan. It could then queue the fixes you pick, such as /compact or lower effort, as prompts. Groundwork is also present for --resume to pick up a cloud session. Cloud sessions may later check each MCP server's host against an allow or deny list. While waiting on a usage limit, Claude Code could send a test request to see whether the limit has lifted.
Shell commands sent to a session for one folder are now refused if the session is working in a different folder. Disallowed tools now stay blocked while a leftover permission request is handled. Team memory changes held back by a sync pause are now kept and retried instead of dropped. The hint to raise API_TIMEOUT_MS after a timeout now notices a value set in your settings. Worktrees made from origin's default branch now use the exact remote branch. The message saying auto mode works only inside the sandbox has been removed.
Written by our agent from the shipped bundle, not by Anthropic.
! shell commands get their own path in SDK input and are refused in the cloud-session viewExtensionsRemote (CCR) sessions gain new rules for batching transcript uploads: holding across model calls, merged status reports, viewer checkpoints and a launch policy
Sessions & agents! shell commands get their own path in SDK input and are refused in the cloud-session viewBash-mode ! input now travels with inputMode and clientBashCommandCwd in SDK input, and is refused with a message in a remote cloud-session view
On Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it
Permissions & safetyIn a remote session that supports it, a '!' shell command can now run, with limits on output and a 10 minute timeout
Sessions & agentsMCP elicitation dialogs now receive the plugin source, and CLAUDE_CODE_CONSENT_POINTERLESS can stop Accept being preselected
Extensions--resumeSessions & agentsWant the reasoning? Read walks the 44 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →3 more of these are in What probably matters to you, on page 1.
One of Claude Code's streaming connections now records when it first connected and whether it has connected before
When Claude Code gets its remote feature settings from a non-default host, it no longer saves them to your global config
Unclear What makes Claude Code count a host as non-default is not stated.
When an API request fails, Claude Code's error handling now gets the response headers as well as the status and data
Unclear It is not clear whether any error message you see changes as a result.
When a web service answers with a 429 or 5xx error, Claude Code now keeps the server's requested wait time so a retry can honour it
Claude Code can now skip the next timed wait before a retry, once, and then goes back to waiting as usual
When Claude Code pulls text out of a tag pair, it now also recognises opening tags with attributes, such as a tag followed by a space and extra details
Metric parsing reads two more labels, retries record how long the service asked to wait, and one error helper now gets response headers
Unclear Whether any of these changes are visible to a person using Claude Code is not clear.
Claude Code adds mcp_drive_file_reference to a list of MCP feature names
Unclear It is not clear what this list is used for or whether anything reads the new name.
Claude Code now skips MCP status notifications for background tasks whose status is marked as hold-capped
Claude Code now checks whether MCP server settings outside the environment section contain something that looks like a variable
Unclear What Claude Code does when it finds a variable-like value outside the environment section is not stated.
A check on MCP server settings now goes by connection type alone, true for sse, http and ws servers, instead of reading commands and URLs
Unclear It is not clear what this check controls.
MCP servers started from a plugin now get the plugin's name, and the built-in Claude Test server is marked as for a person only
Unclear What being marked as for a person only restricts for the Claude Test server.
Before each prompt, Claude Code now lets built-in plugins prepare, waiting up to a time limit and running the prompt anyway if one fails
Commands a plugin runs now carry that plugin's storage identity, and a new check can refuse a plugin with manifest_containment_refused
Unclear It is not clear what the new manifest check looks for, so which plugins it refuses is unknown.
The command that supplies extra request headers can now be given a plugin's identity, so its environment can include plugin variables
Hooks, commands, servers and language servers started for a plugin now tell Claude Code which plugin they belong to when their environment is prepared
Unclear It is not stated what Claude Code does with the plugin's identity during setup: whether it checks, warns about or adds environment variables.
Claude Code's internal way of starting commands has a new abortEndsProcessGroup option, off by default
Unclear Nothing shows the option being turned on anywhere, so it is unclear whether it changes anything a user sees.
Changing a background task's permission mode to plan now also marks that the task is being held in plan mode
Unclear What the recorded mark and the follow-up step change for you is not known.
The check on whether a background process group is still running can now answer "unknown" for groups in a supplied list
The check that notes programs left running now reads process-group status once and uses it for each program
Claude Code now prepares a hook's environment before starting it, and reports blocked hooks in diskless sessions as a proper error
Unclear It is not clear what the new preparation step changes in the environment a hook receives.
The check that can refuse a prompt submit now receives whether a person pressed Enter and any pasted content
Unclear It is not stated what the refusal check does differently with this information.
When a hook saves a permission, Claude Code now applies the update directly instead of first rebuilding its permission settings
Unclear Whether this changes which permissions are saved, or only how they are passed along, is not settled.
Claude is only told a plugin hook was skipped if the plugin and event names are plain identifiers
Claude Code's list of allowed usage events gains three names, for email-sender bridge turns, refused headless turns and usage fixes
Events for shell commands now copy their creation and processing times into the data they send, including when the session stream started
Claude Code now records usage data on whether images it processes exceed size, byte or side-length limits
Sessions now keep a count of tool uses in each turn, and a new metric name for waiting on message files was added
The sandbox on Windows can now report whether it reads the user profile, along with related warnings
Unclear It is not clear whether these warnings are shown to Windows users in this release.
The check for reading files now tracks host permission separately and marks a read that is granted but not allowed by the host
Unclear It is not clear whether this changes which file reads are allowed in practice.
The sandbox now has functions for warnings about needing a restart, setting the sandbox up again, and profiles being readable
Unclear It is not clear whether or where these warnings are shown to you.
The footer now receives whether the shell is running on a cloud machine
Unclear Not settled what the footer shows differently when the shell runs on a cloud machine.
When a fullscreen frame clears or erases the screen, Claude Code now uses that to decide whether to redraw iTerm2 images
The rule deciding when a menu item appears was rewritten in an equivalent form, so the item shows in exactly the same situations as before
Claude Code now edits the instruction that tells Claude how to load the Claude in Chrome tools through tool search, instead of checking past refusals
Unclear What the reworked instruction now says, and whether it changes when the Chrome tools become available.
The instructions Claude Code gives the model for Claude in Chrome are stored differently, and the text the model receives is unchanged
parallel() and pipeline() keep separate state for each item#Each item run by the workflow parallel() and pipeline() helpers now keeps its own state, which is merged back afterwards
Unclear It is not clear what this changes in how workflows behave.
A workflow's record now notes results that a re-run step superseded, and drops a result when the same step later fails
Unclear What resuming or replaying a workflow does differently with these tracked results is not stated.
The message saying auto mode works only inside the sandbox, and to pick a mode in /sandbox, has been removed
Unclear It is not stated whether auto mode still requires the sandbox in the cases this message used to cover.
Published verbatim by Anthropic for v2.1.305. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 38 bullets, 11 name something an entry on this page also names, 10 name something no entry here does, and 17 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections
Probably device-tool-refusal-text-adds-sandboxallownestedusernamespa, sandbox-refuses-a-setting-that-lets-commands-bypass-file-den, new-sandbox-setting-allownestedusernamespaces CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notices a usage limit that was lifted before its reset
No entry names this --tools (a 2.1.304 regression): Claude Code now retries without it
Probably tools-typo-warnings-now-also-surface-as-securitywarnings /effort and /autocompact settings not applying when the model name differed from a modelOverrides value by letter case or a [1m] tag
Probably 1m-context-auto-suffix-extended-to-more-model-match-cases, usage-insight-schema-gains-recommendations-and-a-one-click-f ENOSPC file path: the error now says the disk is full and that nothing ran
No entry names this #89879[BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it Open
setMcpServers being replaced later in the session by a same-named server from your own settings
No entry names this pipeline() and parallel() agents instead of serving them from the run's journal
Probably workflow-parallel-and-pipeline-track-per-slot-state #95076Workflow resumeFromRunId re-runs every completed agent after the first parallel fan-out (40 redundant opus agents, 231M tokens) Open
#89784Workflow resumeFromRunId re-dispatches completed agent() calls despite unchanged (prompt, opts) Open
/resume after switching conversations with /resume
No entry names this #102431[BUG] Remote Control leaves bridge-session-only .jsonl stubs that show up in /resume as empty "(session)" entries Open
/usage rows being cut off in narrow terminals
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Resource temporarily unavailable when TERM is set (a 2.1.300 regression)
Probably terminal-capability-map-gains-a-separate-itermimages-check GIT_CONFIG
Probably git-env-git-config-only-cleared-conditionally-headless-liv /usage: each warning is now a one-line fix that names its source, and f applies the fixes; the same fixes appear in VS Code and /doctor
Probably usage-flagged-findings-added-to-a-review-check-check-10, usage-gains-actionable-savings-suggestions-with-one-click-f, usage-recommendations-run-through-tengu-tidy-abacus-defaul Image to draw its picture in iTerm2 3.5 and later with fullscreen rendering, where it showed only its alt text
No entry names this w now says the new mode is saved for the folder, and a later claude remote-control start that uses the saved mode says where it came from
No entry names this allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off
Probably managed-mcp-allowlist-doc-var-rule-narrowed allowed-tools when your organization's managed settings set allowManagedPermissionRulesOnly
Probably managed-rules-setting-now-affects-plugin-trust-check, managed-allowmanagedpermissionrulesonly-docs-desktop-plug /artifacts delete confirmation to take 1 or Enter to keep, 2 to delete, and Esc to cancel; y and n no longer answer it
No entry names this spinnerVerbs setting replaces the built-in verbs with short ones
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.304.
Claude Code, interactive mode
1554 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 37 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?