Claude Code can now use the claude.ai sign-in passed over by the desktop app that started it. That lent sign-in works like CLAUDE_CODE_OAUTH_TOKEN, but plugins cannot use it. You can turn it off by setting CLAUDE_CODE_DISABLE_LAUNCHER_SIGN_IN in the environment or in managed settings. On native Windows, the new claude sandbox uninstall command removes the sandbox account, group, stored password and network filters. Programs using the SDK can now list cloud sessions, fetch one and read its transcript. In VS Code, Team and Enterprise members who hit their spend limit can get a "Request more" button that notifies their admins.
Several features are in the build but not switched on yet. A list of subagents that ran earlier in a session appears only when CLAUDE_CODE_SUBAGENT_HISTORY is set or it is switched on remotely. Resuming an interrupted remote turn with CLAUDE_CODE_RESUME_INTERRUPTED_TURN can now queue an urgent reminder for Claude when something was left unresolved. A check for whether the macOS sandbox allows local test servers exists, but nothing uses it yet. A few new remote switches are registered with no visible purpose so far.
Among the fixes, MCP tool calls are no longer retried after a session expires unless they surely did not run or are safe to repeat. Through an HTTPS proxy, Claude Code now checks the certificate of the site it is reaching, not the proxy. Sandbox setup without a terminal now gives up 150 seconds after Claude Code started instead of waiting forever. A resumed subagent that the main conversation is waiting on now shows its permission prompts. CLAUDE_CODE_ADOPT_UNDERIVABLE_PARKED_PERMISSION is removed and no longer has any effect.
Written by our agent from the shipped bundle, not by Anthropic.
[1m] handling was removedSessions & agentsSelf-hosted runners get a --diff-finds-nested-repository mode, --runner-declares, CLAUDE_CODE_IGNORE_PERSISTED_TRUST and options to update the binary they launch
New SDK requests list cloud sessions and fetch one session or its transcript, with clear refusals when they are not allowed
Sessions & agentsThe bundled Claude Test plugin adds an author agent with a claude_test_write tool, limits its explorer and adds new helper messages
With CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST, a supplied OAuth token now wins over host management, and a new path accepts a sign-in token from the desktop app
Permissions & safetyAuto mode gains a held variant of compact mode, chosen when CLAUDE_CODE_AUTO_MODE_THREAD_ASK_HELD is set or a server flag is on
Want the reasoning? Read walks the 31 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
New code lets you browse finished subagents from the Background dialog, switched on by the CLAUDE_CODE_SUBAGENT_HISTORY environment variable or a server flag
Unclear Where in Claude Code's interface this list appears is not known.
Self-hosted runners get a --diff-finds-nested-repository mode, --runner-declares, CLAUDE_CODE_IGNORE_PERSISTED_TRUST and options to update the binary they launch
A new adminRequestOffer lets Team/Enterprise members hitting their own spend limit send a 'Request more' ask to their admin from VS Code
New SDK requests list cloud sessions and fetch one session or its transcript, with clear refusals when they are not allowed
Claude Code has a new notice stating your dollar amount of Fable usage for each of two periods, and that unused credit doesn't carry over
A new finishExposedWork auto-mode option asks Claude to run checks and fix what the task exposed, and denied commands are now recorded
Unclear It is not known what turns this block of instructions on, or for whom.
With CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST, a supplied OAuth token now wins over host management, and a new path accepts a sign-in token from the desktop app
With approvalSeesContent, MCP file-reference tools read the file up front so your approval and the auto-classifier see what is being sent
Auto mode gains a held variant of compact mode, chosen when CLAUDE_CODE_AUTO_MODE_THREAD_ASK_HELD is set or a server flag is on
Unclear What the "compact-held" mode does differently from "compact" is not settled.
Short summaries of background agents can now come from a different writer model, set by the server, when the agent runs on fable or opus
Unclear Which writer model, if any, the server names is not known.
sshHostCommands setting is for Claude Desktop only#The new sshHostCommands setting defines SSH connections whose host comes from a command, for Claude Desktop; Claude Code itself ignores it
Setting CLAUDE_CODE_DISABLE_LAUNCHER_SIGN_IN, in the environment or in managed settings, turns off the launcher sign-in
Unclear What the launcher sign-in does, and whether it runs by default, is not established.
The claude-api skill that ships with Claude Code now includes a document called shared/api-version-migration.md
A reference document built into Claude Code changed from a managed agents API reference to one called live sources
If OAuth to an MCP server fails, both /mcp and claude mcp login can now send you to claude.ai to connect it there instead
Unclear It is unclear which sign-in failures make this option appear.
Programs hosting Claude Code can now ask to read a file by the exact path Claude wrote, with refusals reported as read_denied
/subtask and a new writer setting#Plugin refresh now marks fresh loads, /subtask was reorganised, and settings gain a writer entry with fable and opus values
Unclear What the new writer setting controls is not settled.
A new internal option asks Claude Code to put a prompt back in its queue if an interrupt arrives just as the prompt is being picked up
The SDK protocol gains three control request types, three new session flags and a new unsupported_runtime reason
Unclear What the new control requests and flags do is not stated.
A sign-in lent by the desktop app now counts like CLAUDE_CODE_OAUTH_TOKEN, though plugins cannot use it
claude sandbox uninstall command removes the Windows sandbox#On native Windows, claude sandbox uninstall removes the sandbox account, group, stored password and network filters, then lists what remains
On start, the device bridge now sets up a place to run its tools and says whether the sandbox is currently required
Unclear It is not clear whether device bridge tools actually run in the sandbox yet.
Hook and plugin permission decisions now go through tool.check, can allow a hook's own ask, turn a plugin deny into an ask, and attach a refusal
Unclear Exactly which hook-raised asks a PermissionRequest hook is now allowed to approve is not established.
Command start messages to SDK hosts now say when a run was woken by /loop or a schedule, and interrupt replies list prompts put back in the queue
With CLAUDE_CODE_REMOTE_SEND_KEEPALIVES set, remote sessions send a keep-alive signal during long turns, and the WebSocket link now skips heartbeats too
Unclear A second condition besides the environment variable is also required, and what it checks is not known.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
10 more of these are in What probably matters to you, above.
Claude in Chrome's file_upload can now work through a hosted session with a byte limit, and MCP retries skip calls that may already have run
Unclear Which setups count as hosted is not stated, so it is unclear in which remote sessions file uploads are now allowed.
A new not_ready reason lets cloud sessions tell Claude it cannot reach your computer yet, instead of saying forwarding is off
Remote resumes of interrupted turns stop adopting unmatched permission requests and can add a critical reminder when something is left unresolved
Skills whose plugin repository matches a check are now treated and reported as syncedSkills, and /context drops their plugin name
MCP server connections now recognise a sleep or clock change during connecting and retry, and report when stored credentials cannot be read
Unclear It is unclear whether the message and the retry are switched on for everyone or only where a remotely controlled setting allows them.
If a resumed session's saved copy on the container is missing recent tool calls, Claude is told files may be stale and to tell you about lost work
When a tool call runs, its result now records who permitted it, or "unasked" when no permission was asked for
[1m] handling was removed#A model's context window is now the smaller of its stated window and a per-model value, and model names ending in [1m] are no longer handled
Unclear Whether a model name ending in [1m] still gives a larger window is not settled.
When Claude Code serves its tools to another app over MCP, it can apply the repository's permission rules and refuse calls if they cannot be read
Unclear It is not clear which apps send the request that turns on this check.
WebFetch results now carry when a page was retrieved, warn when a stored copy is old, and return a Not Fetched answer when the site fails
Claude Code adds notices that tell a forked subagent it is the fork and that the parent's tool call is not its own
A pre-warmed Claude Code process started by an organization's launcher now refuses CLAUDE_CODE_OAUTH_TOKEN when claimed, and asks its host instead
Idle compaction now covers two cache types, one-hour and keepalive, each with its own setting, and its notice no longer says "after an hour idle"
Claude Code now refuses some changes to environment values, keeping them unless they came from its starting environment or from itself
Unclear Which environment variables this applies to, and what triggers the message, is not clear.
The Agent tool's guidance against starting helper agents no longer depends on being on the Pro plan, and its 'when to use' text is reorganised
Unclear What the new check tests, and so which users now see the guidance, is not known.
A standing request in a Project thread can now be carried across compaction, and the auto mode check handles more message patterns around replies
Unclear It is not clear which accounts have Project threads or what switches this behaviour on.
When auto mode's reviewer expects no review but one is needed, Claude is told to retry once then stop; the permission flow also gains a fast-path edit flag
A gated change lets a plugin's MCP server stay when its only duplicate is a claude.ai connector that fails an eligibility check
A new repository-trust message says a yes typed in this terminal would not count and points you to a trusted device to answer
In Claude Code Remote sessions, switching Artifacts off in settings now leaves out MCP servers that connect to the Artifacts server
The first time the Windows sandbox starts, Claude Code runs a setup check that may show an administrator prompt and can take a few minutes
Unclear It is unclear whether this setup runs for every Windows user who uses the sandbox or only in some setups.
Claude Code removed the rule that ended the turn when a tool was denied, so only an interrupt or a rewind now ends a cut-off turn
Unclear It is unclear what Claude does after a tool is denied now that the turn does not end.
Out-of-credits messages carry a reason, exit hints match your setup, the run skill gains a script, and CLAUDE_CODE_DISABLE_ARTIFACT is wired in
Unclear Which part of the Artifact feature CLAUDE_CODE_DISABLE_ARTIFACT now turns off is not stated.
When a prompt is too long, Claude Code's emergency compaction gains a mode that summarizes every turn and keeps none word for word
Unclear It is not clear when Claude Code switches to this mode.
If the model gives a blank reply to your prompt twice in a row, the turn now ends with an empty_completion error
After an admin grants a request for usage credits, the consent dialog checks the credit status again and continues without a manual retry
Unclear It is not clear whether the server currently sends the granted outcome that this flow depends on.
If your admin's request for more usage comes back pre-approved, Claude Code shows your new limit and lets your next message go through
Unclear Whether the server ever sends back a pre-approved grant is not known.
When a fetched page came from a stored copy, Claude is told to give that copy's date and not to fetch the page again for a newer one
Unclear It is unclear when a fetched page is served from a stored copy instead of the live site.
When a cancel is handled, the reply now includes a put_back list naming queued commands that run on their own and were put back, if any exist
If a plugin asks for a permission and nobody is available to approve it, Claude Code now refuses the request
Unclear It is unclear exactly when Claude Code treats nobody as available to approve.
When a cloud session cannot pass a folder trust question on, it now gives a specific reason and can tell you to answer it elsewhere
When workflows are off because the runtime is unsupported, Claude Code now says so with its own error instead of a general one
The check for reusing cached conversation before compaction no longer requires a one-hour cache lifetime and still stops when the cache has lapsed
Unclear It is not clear what the earlier-computed reason checks, so whether reuse now happens with shorter cache lifetimes is unsettled.
Tool results now include whether the action ran in the sandbox and any sandbox rule it broke
The footer shown while Claude Code waits to resume after a usage limit now combines the credits text with another value
Unclear What the extra value in the footer shows is not stated; it may be the reset time.
Claude Code now refuses to upload earlier session history when a transcript has too many lines since its last compaction
When Claude searches for a tool that is on its way into the conversation, it is now told the tool is being added and where to find how to call it
/clear withdraws the resume point in the conversation it leaves#After /clear, Claude Code removes any resume checkpoint from the old conversation so it no longer resumes to that point
A late heartbeat reply on the worker connection now counts as success, and a refreshed sign-in token now renews that connection
Claude Code now uses CLAUDE_CODE_ORGANIZATION_UUID to spot an organisation change when sign-in is managed for it
Unclear Exactly which managed sign-in setups trigger this check is not settled.
Claude Code now tells the model how blocked connections appear and where to put temp files when the sandbox runs as a separate account
Looking up a model's context window no longer falls back to one million tokens when the model is not recognised
Unclear Whether an unrecognised model still gets a default context window from somewhere else is not established.
In some state, the message picker now shows a row where Esc means "stop waiting" instead of the usual list of choices
Unclear What puts the picker into this waiting state is not stated.
With CLAUDE_CODE_MCP_APPS_HOST set to true, Claude Code sends an X-MCP-Features header to the GitHub Copilot MCP server unless you already set one
Unclear It is not fully settled that CLAUDE_CODE_MCP_APPS_HOST is the setting that controls whether the header is sent.
Some out-of-credits errors that carry no HTTP status code are now recorded as a usage limit, not treated as a generic error
Unclear It is not clear exactly which errors and which accounts this new check applies to.
After you publish a plugin, Claude Code gives you a link to send colleagues and explains how they add your organization's library under /plugin
A hook's $.env.set is now refused for variables that only the starting environment or Claude Code itself may set
Unclear It is not stated which variables count as ones only the starting environment or Claude Code may set.
In the agent-claude prompt, the Agent tool's description now warns that detail is lost both when Claude briefs a subagent and when it reports back
Each model's auto-compact window is now saved with the session and restored on resume, and the default window for a model has changed
Unclear The size limits and cap behind the new default window are not known, so it is unclear when compaction now starts for a given model.
NO_PROXY is filtered out of the proxy-derived passthrough names and now appears in a separate list alongside SHELL and TRACEPARENT
Unclear It is not clear which programs this proxy variable list is passed to.
When startup is blocked because the sign-in token is still refreshing, Claude Code now retries once and explains the cause in non-interactive mode
When a task is stopped, Claude is now told it was stopped by the user or by the connected app, and where its output was saved
When a tool call on your own device was never sent, Claude now receives a fixed error message instead of one supplied by the host
A new check for remote file reads skips folders and unsupported files, and fails when it cannot tell whether a path is a file
Once web searches run out, Claude is now also told not to use a browser or computer-use tool to query search engines
dd separately#When checking a shell command before running it, Claude Code now handles assignment-style arguments to dd under a separate rule
Unclear Which commands besides dd are covered, and whether the new path check makes prompts more or less frequent, is not settled.
Two new server-controlled checks change how git command names are matched and add a stricter test for sed commands
Unclear Whether these checks are active, and whether they change which commands run without asking, is not established.
When a teammate's agent definition is skipped in an untrusted folder, the message now says it cannot be restored if CLAUDE_CODE_IGNORE_PERSISTED_TRUST is set
Claude Code now refuses to take a heap dump when the session was started by a launcher, and returns an error instead
/output-style gets an extra condition for being shown and available#/output-style now has an extra condition that decides whether it is available and shown, and a setting for thin clients
Unclear It is not stated what the added condition checks, so it is unclear when the command is available or hidden.
When you answer a form from an MCP server, fields treated as sensitive are now shown as "[masked]" in the debug log, but the server still gets the real answer
Unclear It is unclear which fields count as sensitive.
While an MCP server is waiting for you to sign in, Claude Code now re-reads saved credentials and picks up a login made in another process
The plugin disable dialog can replace its 'disable for me' option with a message, and some text is now rejected in Markdown images
Claude Code now asks for approval when it cannot fully check nested parts of a command for a dangerous rm
An "ask" permission decision now counts as asking a person when it comes from a plugin, not when it is marked as made by a person
When Claude Code cannot read stored MCP credentials, the error now says the login keychain may be locked
On Windows, /sandbox install waits up to 150 seconds for the sandbox user to sign in and reports logon problems
In some cases a 403 sign-in failure now shows a shortened explanation from the server instead of a fixed message
Unclear Which setups get the detailed message is not known, though it may be gateway sign-in.
If Claude Code is running on Node or Deno, workflow scripts are not started and a message says to use the native binary
BUN_OPTIONS value is now passed on to child processes from more places#Processes Claude Code starts now keep your BUN_OPTIONS value from the process, settings or system environment, still after --install=disable
Unclear Which value wins when BUN_OPTIONS is set in more than one of these places is not known.
The step that sets up the sandbox user on Windows now waits up to 5 minutes instead of 1 minute before giving up
A tool you approved for the session now reports the same as one that ran, and shell commands' variables and extglob are checked more strictly
On Windows, Claude Code now tells you when the sandbox can't start because the Secondary Logon service is disabled or missing
Published verbatim by Anthropic for v2.1.307. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 43 bullets, 7 name something an entry on this page also names, 17 name something no entry here does, and 19 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
/claude-api api-version to move Claude API code to API version 2026-10-21
No entry names this claude_code.safety_event OpenTelemetry event for each tool call a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back
No entry names this CLAUDE_CODE_DISABLE_1M_CONTEXT is set and the model is an alias with the [1m] suffix, such as opus[1m]
Probably model-context-window-logic-reworked-removing-the-1m-beta-as prompt-caching-scope beta header being sent behind custom ANTHROPIC_BASE_URL gateways and on Foundry, where it has no effect
Probably auth-token-forwarding-to-custom-anthropic-base-url-simplifie claude -p on macOS while the login keychain was locked; they now say why, and the next run after an unlock connects without a new sign-in
No entry names this /autocompact in cloud sessions going back to the default window after the session restarted
No entry names this /clear sometimes coming back when a cloud or self-hosted runner session restarted
Probably clear-can-withdraw-a-resume-checkpoint-from-the-transcript #100474[BUG] Self-hosted runner: resumed session comes back in plan mode although the session wrapper passes --permission-mode auto Open
CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS being ignored in Claude apps gateway sessions
No entry names this OTEL_EXPORTER_OTLP_HEADERS is set
Probably otlp-exporters-can-strip-header-env-vars-during-construction #98873[BUG] Claude Desktop Code-tab sessions send an invalid bearer on OTLP exports to the Claude apps gateway (invalid_token), while Cowork from the same Desktop succeeds Closed
/permissions > Recently denied not showing the denied shell command, and auto mode's local classifier ignoring an approval from there when it checks a retried command; approving a row now names the command, not its description
No entry names this #101912[BUG] Read-only Bash search denied as Self-Modification again after native /permissions retry approval Open
#98834[Bug] Permission approval not applied: migration remains denied despite explicit approval Open
/help and the / command menu showing long model-facing descriptions for bundled skills such as /claude-api instead of their short descriptions
No entry names this setModel(), and apps built on it, being refused when the API took more than 5 seconds to confirm the model; Claude Code now waits up to 15 seconds
No entry names this --use-anthropic-git-proxy committing a .claude/settings.local.json left in the clone by an earlier session
Probably plugin-ui-labels-a-built-in-marketplace-and-plugin-disable, runner-git-proxy-sanitize-writes-an-ignore-rule-for-settings axScreenReader setting and CLAUDE_AX_SCREEN_READER in a settings env block to apply only from user, managed or --settings settings (since 2.1.305)
Probably plugin-disable-all-now-accounts-for-policy-managed-plugins-a, plugins-policy-enabled-plugins-dependency-closure-and-se --checkout-hook-timeout-min or set it to 0
Probably self-hosted-runner-gains-diff-finds-nested-repository-supp, checkout-hook-runner-process-tree-stop-timeout-and-pipe-ho [runner:warn] line gives the number left out
No entry names this NODE_EXTRA_CA_CERTS is set only in ~/.claude/settings.json; it now also follows CLAUDE_CODE_CERT_STORE
No entry names this NODE_EXTRA_CA_CERTS file named in the environment or in user settings
No entry names this @claude review stop (also off and pause) to Code Review, ending an @claude review always subscription on a pull request without starting a new review
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 29 tool descriptions changed.
Claude Code, interactive mode
1999 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 52 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?