Claude Code can now use the claude.ai sign-in passed over by the desktop app that started it. That lent sign-in works like CLAUDE_CODE_OAUTH_TOKEN, but plugins cannot use it. You can turn it off by setting CLAUDE_CODE_DISABLE_LAUNCHER_SIGN_IN in the environment or in managed settings. On native Windows, the new claude sandbox uninstall command removes the sandbox account, group, stored password and network filters. Programs using the SDK can now list cloud sessions, fetch one and read its transcript. In VS Code, Team and Enterprise members who hit their spend limit can get a "Request more" button that notifies their admins.
Several features are in the build but not switched on yet. A list of subagents that ran earlier in a session appears only when CLAUDE_CODE_SUBAGENT_HISTORY is set or it is switched on remotely. Resuming an interrupted remote turn with CLAUDE_CODE_RESUME_INTERRUPTED_TURN can now queue an urgent reminder for Claude when something was left unresolved. A check for whether the macOS sandbox allows local test servers exists, but nothing uses it yet. A few new remote switches are registered with no visible purpose so far.
Among the fixes, MCP tool calls are no longer retried after a session expires unless they surely did not run or are safe to repeat. Through an HTTPS proxy, Claude Code now checks the certificate of the site it is reaching, not the proxy. Sandbox setup without a terminal now gives up 150 seconds after Claude Code started instead of waiting forever. A resumed subagent that the main conversation is waiting on now shows its permission prompts. CLAUDE_CODE_ADOPT_UNDERIVABLE_PARKED_PERMISSION is removed and no longer has any effect.
Written by our agent from the shipped bundle, not by Anthropic.
[1m] handling was removedSessions & agentsSelf-hosted runners get a --diff-finds-nested-repository mode, --runner-declares, CLAUDE_CODE_IGNORE_PERSISTED_TRUST and options to update the binary they launch
New SDK requests list cloud sessions and fetch one session or its transcript, with clear refusals when they are not allowed
Sessions & agentsThe bundled Claude Test plugin adds an author agent with a claude_test_write tool, limits its explorer and adds new helper messages
With CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST, a supplied OAuth token now wins over host management, and a new path accepts a sign-in token from the desktop app
Permissions & safetyAuto mode gains a held variant of compact mode, chosen when CLAUDE_CODE_AUTO_MODE_THREAD_ASK_HELD is set or a server flag is on
Want the reasoning? Read walks the 31 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →10 more of these are in What probably matters to you, on page 1.
Disabling all plugins now leaves policy-enforced plugins alone and says when --settings keeps plugins on for this session
Bash and PowerShell results now say whether a command ran in the sandbox and list any sandbox violations
The sandbox's default list of excluded network addresses now also covers common private and carrier address ranges
Unclear Whether these addresses are now allowed to bypass the sandbox's network handling or are now blocked is not settled.
When an MCP server rejects Claude Code's automatic sign-in registration, Claude Code now suggests concrete next steps instead of a bare error
Unclear It is not clear whether this advice is shown to every user or only under certain conditions.
The reply to a host's request to change model now names the model the next turn will use, even when the change is refused
When Claude controls your computer, key combinations with too many keys or more than one non-modifier key are now refused
The sandbox setup check prints a note in a terminal, and when run without one it now gives up about 150 seconds after start
SDK sessions now wait for each MCP server separately before the first query, and wait briefly for a pending tool list refresh before later ones
When the command sandbox is turned off during a session, Claude now gets a message saying its earlier sandbox instructions no longer apply
Claude Code now raises an error when a file changes while it is being read, warning that the lines read may not be its current lines
When Claude asks to run a command outside the sandbox, a command that would have prompted you anyway now shows the "Run outside of the sandbox" prompt with its reason
-p in an untrusted folder now names settings that belong elsewhere#Under -p in an untrusted folder, Claude Code now first says which settings must move to user or managed settings
Unclear Which settings trigger the new error is not stated.
When a program changes Claude Code's model, the reply now names the model in use, and the wait message mentions the PreModelSwitch hook
Claude Code now cleans up the proxy address before connecting, uses extra security options for HTTPS proxies, and adjusts one sign-in refresh path
When the model sends a badly formed tool call, Claude Code now counts its retries instead of allowing just one
On Windows, Claude Code prints a notice that sandbox setup can take minutes, and another while it removes the session's file permissions on exit
Turning a plugin on or off now treats a plugin enabled through command-line flag settings as already on, and the disable message carries extra text
A status hint now says the sandbox is starting and that setting file permissions can take a few minutes, mostly the first time in a large project
Claude now knows that some Windows programs cannot use HTTPS in the sandbox, how to stop a pytest hang, and where PowerShell keeps temp files
Changing a plugin your organization's policy turns on is now refused, and a plugin kept on by --settings is shown as still enabled this session
In headless and SDK use, an interrupt without cancelQueued now puts the message being handled back in the queue instead of dropping it
ANTHROPIC_AUTH_TOKEN is sent to a custom address#Claude Code dropped one check that could stop ANTHROPIC_AUTH_TOKEN from being sent to a matching ANTHROPIC_BASE_URL
Unclear It is not stated which setups the removed check used to exclude.
The error saying environment-management endpoints need a claude login session, and that ANTHROPIC_API_KEY will not work, has been reworked
Messages Claude Code adds after a turn, like 'Permission granted for:', now carry an origin tag, and text input gains a maskWhole option
Permission decisions now carry which deny rule matched, where the rule came from, the grant scope, a reason code and more
When an MCP connection closes or expires mid-call, the error now says whether the tool may have run before suggesting mcp_reconnect
The sandbox now has its own diagnostic message for when recording the result of its after-command cleanup fails
When several file paths in a Bash command fail checks, Claude Code now reports the first safety-check problem instead of the first disallowed path
A Windows sandbox message now warns that programs started some other way may keep running without network blocks and says to restart
The warning about plugin skills that were loaded but never used now names each plugin by its key instead of where it came from
When an agent definition is not trusted, the error can now suggest moving it to your user or managed agents folder
Plugin lists show a fixed label for one marketplace, and the /plugin disable message now says which settings scope it wrote to
When copying a git repository nested inside your project to compare changes, Claude Code now checks the copy harder and refuses mismatched work trees
The startup announcement and organisation message boxes are now centred in some layouts, not always aligned left
The workspace diff now also looks for nested repositories without an interface, and stops with a warning if the working folder has moved
The error for trying to install a built-in plugin can now show a message specific to that plugin
Permission explanations now tell an ask from a host apart from an ask cap, and expand when a sandbox override caused the decision
Claude Code's shell command analysis now flags quoted text containing backticks, certain $ forms or escaped quotes, which zsh may read differently
NODE_USE_ENV_PROXY#In the sandbox, NODE_USE_ENV_PROXY is no longer hidden, and proxy variables are added unless it is set to something other than 1
Arguments passed to plugin hooks are now copied with toJSON methods kept, typed arrays cloned, and endless toJSON chains rejected
When a plugin is enabled for the whole project and you try to disable it, the explanation can now come from elsewhere in Claude Code
When the sandbox blocks a network host, Claude is now told to name that host to you rather than leave the sandbox, for Bash and PowerShell alike
Claude Code now inspects every entry in .git/objects and rejects symlinked or oversized ones, and its Git config allowlist varies by platform
Claude Code now filters the Java truststore, requires every needed certificate, and cleans up leftover files when setting it up for remote sessions
Oversized project uploads with no extracted text now get their own error, which tells Claude to say the file cannot be opened here
On Windows, each denyRead path and each credentials file path in sandbox settings is now also blocked under a second, alternate path form
The rate-limit message now shows its extra credits and limit line in more situations than the spend-limit case alone
In the compaction prompt, the Agent tool's description now tells Claude you pay for unneeded subagents and again for work redone after skipping one
In the command-init prompt, the Agent tool's description now warns that subagent mistakes sound as confident as their findings
The instructions telling Claude when to hand work to a helper agent were reworded in the security review prompt, including a warning about token cost
The instructions on when Claude hands work to a helper agent were reworded in the team onboarding prompt, noting you can only wait or cancel
Claude's instructions for when to use a helper agent were reworded in the blocked-tool reminder prompt, now mentioning side quests
Claude's helper-agent instructions were rewritten in the repeated-read reminder prompt, telling it to do small jobs itself and not spawn when in doubt
In the empty-file reminder prompt, Claude's helper-agent instructions now say to do short tasks and known lookups itself
In the file-offset reminder prompt, Claude's helper-agent instructions now say to delegate reviews only for an independent view, giving code, not conclusions
In the skill-run reminder prompt, Claude's helper-agent instructions now say to wait for delegated work instead of also doing it
In the to-do reminder prompt, Claude's helper-agent instructions now end with a default: when in doubt, don't start a helper
In the general-purpose subagent prompt, the Agent tool text now tells Claude how to brief a helper: goal, what's ruled out, files to read, narrow scope
On the recent tab of the Permissions dialog, the footer now reads "Esc to close" instead of "Esc to cancel"
With DISABLE_LOGIN_COMMAND set, the expired claude.ai sign-in message now builds its opening sentence instead of always saying "Run /exit"
Unclear What the opening sentence now says is not stated.
Through an HTTPS proxy, Claude Code checks the certificate against the site it is reaching, not against the proxy
A resumed subagent that the main conversation is waiting on no longer counts as a background agent, so its permission prompts are shown
If you interrupt Claude shortly after it picks up a message you queued, the message goes back to the front of the queue
Timeouts when connecting to MCP servers now use a clock that keeps track of time the computer spends awake, not plain wall-clock time
Sandbox setup shows a start notice in a terminal, and when run without one it now gives up 150 seconds after Claude Code started
When measuring how wide text is in the terminal, Claude Code now skips hidden marks that the kitty and iTerm terminals use for inline images
For MCP servers supplied by the SDK, Claude Code now falls back on a tool-list refresh when its usual lookup returns nothing
Unclear What this changes for a user of SDK-provided MCP servers is not clear.
A read of artifacts that fails because the server already closed an old connection is now retried once on a fresh connection; writes are not retried
Session titles drawn from a first line now drop leading spaces and the hidden marks the Kitty terminal uses to place images
Claude Code now sets up its error handling for an MCP server connection only once, instead of adding it again each time
Leaving a named worktree session still asks you to keep the worktree to resume later or remove it, with the code behind it rebuilt
When Claude reads a file of the document kind, Claude Code now handles it as a document only if its content is not empty
Unclear It is not stated what Claude receives when it reads an empty document.
1 more of these is in What probably matters to you, on page 1.
Claude Code has a remotely switched check that is true only when the latest turn is a plain prompt from you or an SDK program
Unclear What this check turns on or off is not known.
Claude Code registers a new remote switch whose purpose is not yet visible
Unclear What this switch controls is not known.
Two new feature switch names were added to an existing list of switch names
Claude Code now checks a new remotely controlled switch that is off by default, and it is not yet clear what it controls
Unclear Nothing shows what this switch turns on or off.
The "Keep worktree and tmux session" option still shows the worktree path; a variant without it is built in but switched off
2 more of these are in What probably matters to you, on page 1.
Two new host-controlled environment variables, CLAUDE_CODE_DIFF_COPY_ROOT and CLAUDE_CODE_FOUND_REPOSITORY_GIT, are added to Claude Code's protected set
Unclear Whether setting these variables yourself is blocked, allowed or passed through is not clear.
Conversation compaction now passes a new keepNoRound option and checks the tengu_sleepy_ripple flag before one compaction call
Unclear What the step before compaction does, and so what the switch changes for a user, is not established.
The server-sent policy that decides when a remote session's events and delivery receipts are held or sent gains many new settings and hold rules
Claude Code now registers a ReadChromeUpload handler next to the one for uploading task files
Unclear Nothing says how this handler is reached or whether it is available to anyone.
Auto mode now trims MCP tool allow rules, removes duplicates and caps the list before sending it to the permission classifier
Unclear How many allow rules are kept before the cap applies is not known.
Background tasks Claude Code starts on its own now take the same path as ones you started, with their source and output file passed along
Unclear It is not clear what this handling does for you, such as whether it shows a notice.
/update is now listed as an action command#Claude Code's grouping of slash commands now files /update under the "action" category
Unclear It is not clear whether a working /update command exists or is available to use in this release.
CLAUDE_CODE_DISABLE_ARTIFACT dropped from the Artifact tool's setting entry#The Artifact tool's setting entry no longer names CLAUDE_CODE_DISABLE_ARTIFACT, though the variable name still appears elsewhere in Claude Code
Unclear Whether setting CLAUDE_CODE_DISABLE_ARTIFACT still turns off the Artifact tool is not clear.
An MCP tool call that fails with a certain error is now treated as cancelled when it may not have run or the tool is read-only
When Claude reads a whole file, the usage data Claude Code records no longer includes how the file was rendered or how many pages were drawn
Claude Code now keeps the CLAUDE_CODE_ARTIFACT* variables in one list with several other server-address override variables
Unclear It is not clear what Claude Code does with the new combined list, for example whether it blocks or removes these overrides.
The notice saying sign-in isn't available in a cloud session started with a Console sign-in now builds its "run /exit" step at runtime
Unclear It is not known what the instruction now says in place of the fixed "run /exit" wording, or whether it differs between clients.
Claude Code's control channel gains a way to ask for cloud session data, though nothing appears to use it yet
Unclear Nothing has been seen calling this request, so it may not be usable yet.
Claude Code can now offer a read_file as_written capability, but never to HIPAA organizations or before usage policy is known, and only when switched on
Unclear It is not clear what the read_file as_written capability lets a connected client do.
Claude Code now singles out six kinds of host control request, and certain replies now finish a command early
Unclear It is not shown where this filter applies or what it changes for hosts.
Claude Code now attaches a hidden marker to input it reads in stream-json format from standard input
Unclear What the marker changes in how Claude Code handles piped input is not known.
--await-claim still refuses to run with CLAUDE_CODE_SUBPROCESS_ENV_SCRUB#The refusal of --await-claim alongside CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is unchanged, with the same error text as before
Claude Code gains a switch that counts as on unless the server turns it off while Claude Code points at a non-default host
Unclear What this switch turns on or off is not stated.
Claude Code now reads a new remotely controlled switch, and what it controls is not yet known
Unclear Which feature this switch controls is not known.
The value Claude Code uses for one server-controlled switch when the server sends nothing changed from a text label to the number 8
Unclear Nothing shows what this switch controls, so what the new fallback changes is unknown.
An internal feature switch was renamed in this release, and nothing about how Claude Code behaves changes
The name lucky_cerf no longer appears in a list of names inside Claude Code
Unclear It is not clear what the list is used for, so the effect on users is unknown.
Published verbatim by Anthropic for v2.1.307. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 43 bullets, 7 name something an entry on this page also names, 17 name something no entry here does, and 19 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
/claude-api api-version to move Claude API code to API version 2026-10-21
No entry names this claude_code.safety_event OpenTelemetry event for each tool call a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back
No entry names this CLAUDE_CODE_DISABLE_1M_CONTEXT is set and the model is an alias with the [1m] suffix, such as opus[1m]
Probably model-context-window-logic-reworked-removing-the-1m-beta-as prompt-caching-scope beta header being sent behind custom ANTHROPIC_BASE_URL gateways and on Foundry, where it has no effect
Probably auth-token-forwarding-to-custom-anthropic-base-url-simplifie claude -p on macOS while the login keychain was locked; they now say why, and the next run after an unlock connects without a new sign-in
No entry names this /autocompact in cloud sessions going back to the default window after the session restarted
No entry names this /clear sometimes coming back when a cloud or self-hosted runner session restarted
Probably clear-can-withdraw-a-resume-checkpoint-from-the-transcript #100474[BUG] Self-hosted runner: resumed session comes back in plan mode although the session wrapper passes --permission-mode auto Open
CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS being ignored in Claude apps gateway sessions
No entry names this OTEL_EXPORTER_OTLP_HEADERS is set
Probably otlp-exporters-can-strip-header-env-vars-during-construction #98873[BUG] Claude Desktop Code-tab sessions send an invalid bearer on OTLP exports to the Claude apps gateway (invalid_token), while Cowork from the same Desktop succeeds Closed
/permissions > Recently denied not showing the denied shell command, and auto mode's local classifier ignoring an approval from there when it checks a retried command; approving a row now names the command, not its description
No entry names this #101912[BUG] Read-only Bash search denied as Self-Modification again after native /permissions retry approval Open
#98834[Bug] Permission approval not applied: migration remains denied despite explicit approval Open
/help and the / command menu showing long model-facing descriptions for bundled skills such as /claude-api instead of their short descriptions
No entry names this setModel(), and apps built on it, being refused when the API took more than 5 seconds to confirm the model; Claude Code now waits up to 15 seconds
No entry names this --use-anthropic-git-proxy committing a .claude/settings.local.json left in the clone by an earlier session
Probably plugin-ui-labels-a-built-in-marketplace-and-plugin-disable, runner-git-proxy-sanitize-writes-an-ignore-rule-for-settings axScreenReader setting and CLAUDE_AX_SCREEN_READER in a settings env block to apply only from user, managed or --settings settings (since 2.1.305)
Probably plugin-disable-all-now-accounts-for-policy-managed-plugins-a, plugins-policy-enabled-plugins-dependency-closure-and-se --checkout-hook-timeout-min or set it to 0
Probably self-hosted-runner-gains-diff-finds-nested-repository-supp, checkout-hook-runner-process-tree-stop-timeout-and-pipe-ho [runner:warn] line gives the number left out
No entry names this NODE_EXTRA_CA_CERTS is set only in ~/.claude/settings.json; it now also follows CLAUDE_CODE_CERT_STORE
No entry names this NODE_EXTRA_CA_CERTS file named in the environment or in user settings
No entry names this @claude review stop (also off and pause) to Code Review, ending an @claude review always subscription on a pull request without starting a new review
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 29 tool descriptions changed.
Claude Code, interactive mode
1999 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 52 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?