You can now run claude ultrareview --trust-workspace to trust the current folder for one run, so reviews work in scripts and CI. Setting CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK skips the folder trust step when Claude Code cannot ask you. A new save_task_files tool saves files from a managed-agent task into your session folder. It asks for your approval every time. Uploading local files to MCP tools now defaults to on when Anthropic's servers send no setting. The hook settings disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars now sit on the managed-settings list next to allowManagedHooksOnly.
This release counts 14 entries that are in the build but not switched on yet. A Claude Test pane is taking shape that reads test runs from a .claude-test folder. Web search citations tied to parts of Claude's replies need CLAUDE_CODE_WEBSEARCH_CITATIONS and a remote switch. A CLAUDE_CODE_RESUME_SHOWS_CUT_OFF_CALLS setting is being added to show interrupted tool calls in a resumed session. Groundwork has also landed for listing connectors your organization provides.
Publishing an Artifact no longer checks pages against the PR review template. The pr_review and prReviewOn options are gone from the Artifact tool. Publishing a PR review page with extra files no longer stops with a single-file error. A tool that a setting used to switch on is now always off. Claude Code can also repair gaps in stored remote session history on load, when switched on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Feedback can now include survey follow-ups and a local bundle, and failed submissions say whether the org, the sign-in or the network was the cause
ExtensionsOrganisations can set an artifact_create_notice, defaulting to a message that a person must approve each new artifact
Settings & config--mcp-config file paths are now recorded and registered, and an MCP config can carry a pre-supplied tool listing so discovery can be skipped
ExtensionsThe mcp_status and mcp_authenticate requests gain a liveReply option that sends the answer only to clients attached right now, without saving it
ExtensionsIn stream-json and --sdk-url runs, result messages can carry model_usage_since_last_result, per-model usage and cost since the last result
ExtensionsWant the reasoning? Read walks the 35 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
The bundled Claude Test plugin adds tools to start apps and confirm runs, reads more run files for its pane, and keeps its explorer out of credential files
Unclear Whether the Claude Test pane is visible to users in this release, and what switches it on, is not known.
Feedback can now include survey follow-ups and a local bundle, and failed submissions say whether the org, the sign-in or the network was the cause
Unclear It is not clear whether these feedback options are switched on for anyone yet.
While a cloud session is created, the checklist now has a box to type your first message, held until the session opens
Unclear It is not clear what decides whether the text box is shown, so it may not appear for everyone.
Claude Code adds organization-provided MCP connectors with reserved org-connector names, new list and relay handlers and an orgConnectors scope
Unclear Nothing shows what calls these handlers, so it is unknown whether you can use organization connectors yet.
Organisations can set an artifact_create_notice, defaulting to a message that a person must approve each new artifact
Unclear Where and when this notice is shown is not stated.
--mcp-config file paths are now recorded and registered, and an MCP config can carry a pre-supplied tool listing so discovery can be skipped
Unclear Whether anything hands Claude Code such a list in this release is not shown.
When an MCP server takes over the built-in Artifact tools, unknown-tool errors point to it or suggest /mcp, and artifact links can be read through it
Unclear It is not stated when the Artifact tools are replaced by the MCP server.
Claude Code can set up an Artifacts MCP server itself and use its tools in place of the built-in artifact tool, with preset permissions
Unclear It is not known whether this is switched on for users or still held behind a further setting.
Claude Code now has a self-hosted mode named self_hosted_review_session, with its own startup safety checks
Unclear How the self_hosted_review_session mode is started or switched on is not stated.
A new CLAUDE_CODE_RESUME_SHOWS_CUT_OFF_CALLS setting lets a resumed session show tool calls that were interrupted mid-turn
Unclear Two further conditions it checks were not identified, so it is unclear whether setting the variable alone turns this on for a local user.
With CLAUDE_CODE_WEBSEARCH_CITATIONS set and a remote switch on, Claude Code splits replies into pieces tied to web search sources
A new save_task_files tool can download files a managed-agent task produced into the session folder, asking your approval every time
The mcp_status and mcp_authenticate requests gain a liveReply option that sends the answer only to clients attached right now, without saving it
Unclear It is not clear how the separate reply differs from the usual one.
With ANTHROPIC_UNIX_SOCKET set, placeholder credentials are recognized and auth tokens are no longer passed to child processes
Unclear The placeholder value and what Claude Code does when it finds one are not known.
Slash commands from relay participants are now refused with a message saying they aren't available to a relay participant
Unclear Which slash commands are refused to relay participants is not stated.
Behind a server-controlled switch, messages can carry a note of the summary they belong to and whether a person started the turn
Unclear It is not clear whether this changes anything you see or how Claude responds.
project_write can now refuse a replace because the document is too large, and can send the server an extra value when a remote switch is on
Unclear It is not clear what the extra value sent to the server changes about a replace.
A settings object Claude Code reads now accepts an optional post_turn_instruction text, and ignores it if malformed
In stream-json and --sdk-url runs, result messages can carry model_usage_since_last_result, per-model usage and cost since the last result
mcp serve can run SessionEnd hooks sent by the program calling it#When Claude Code runs as an MCP server, the caller can now hand it SessionEnd hooks to run, up to 8 KiB, unless machine policy forbids it
A permission timeout setting group gains a denyOnHostCard option that defaults to on; what it denies is not traced
Unclear It is not known which permission prompt this option denies, or when.
CLAUDE_RUNNER_ALIVE_EVERY_MS is now passed through, and session and OAuth tokens can be applied while running in a certain mode
Unclear It is not stated which mode lets tokens be applied while running.
disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars now sit on the same settings list as allowManagedHooksOnly
Unclear It is not clear whether being on this list means these settings are now obeyed only when they come from managed settings.
claude ultrareview can trust the current folder for one run#claude ultrareview --trust-workspace trusts the current folder for that run only, without a prompt, so reviews can run in scripts and CI
claude ultrareview#Setting CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK stops claude ultrareview running its folder trust step when it cannot ask you
The skill for making a "mod" has a new description listing panels, bands, status lines, toasts, slash commands and tool-call hooks
Unclear It is not clear whether the mod-making skill is available to you or switched on.
In auto mode, some MCP server tools on the safe allowlist can now skip the safety check when extra conditions are met
Unclear Which MCP server's tools qualify, and what the extra conditions are, is not stated.
When the Chrome extension is not connected, Claude Code can give a different reply to remote sessions on a phone, behind a switch that is off by default
Unclear What the different message says, and which devices the platform check matches, is not stated.
Claude Code adds several new internal names, and a filter now leaves out some MCP servers it used to keep
Unclear Which MCP servers the filter now leaves out is not identified.
prompt.fill and the plugin text-injection hook now take an optional cursor value that sets where the caret lands after text is placed
In some remote sessions, command hooks can now be given CLAUDE_CODE_SESSION_ACCESS_TOKEN in their environment
Unclear It is not confirmed that the token actually reaches hooks' environment in practice.
CLAUDE_CODE_CCR_OWN_CONNECTION_POOL and CLAUDE_CODE_SYNC_PLUGINS_DOWNLOAD_CONCURRENCY are new environment variables used by remote sessions
Unclear What turning on CLAUDE_CODE_CCR_OWN_CONNECTION_POOL actually changes is not known.
In headless mode, a turn that starts before the startup message was sent now triggers an optional onTurnBeganBeforeInit callback
Uploading local files to MCP tools now defaults to on when Anthropic's servers send no setting, instead of off
A full disk or used-up quota now gives a clear error naming CLAUDE_CODE_TMPDIR, and shell output is checked for low disk space
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
8 more of these are in What probably matters to you, above.
Code-review sessions on self-hosted runners get no local settings or repository folder, and must receive their tokens on file descriptors 4 and 5
Unclear The new condition that clears the setting sources is not identified.
Creating or resuming a git worktree now checks for and fetches missing objects, re-checks state before resetting, and handles partial clones and sparse checkouts
Artifact change detection now tracks which connectors an artifact can reach, and a related connectors_mark setting was added
Unclear It is not known what switches this connector check on, so it may not be active for everyone.
Permission rules now look through time and nohup wrappers more carefully, and unusual shell commands are treated with more suspicion
The sandbox adds write blocks for claude ssh binaries and for write-deny patterns reached through symlinks, and rebuilds when those remote values change
Unclear What the two new block rules stop, and when they apply, is not stated.
For one particular MCP server, the suggested 'always allow' rule can now apply to the current session instead of being saved to local settings
Unclear Which MCP server this applies to, and under what condition, is not known.
Screenshot, page snapshot and wait calls on the built-in browser server can be judged by auto mode, and remote sessions track permission card answers
The managed settings Claude Code builds from your organization's policy now carry its hooks and enabledPlugins entries
Unclear It is not clear where in Claude Code these managed hooks and plugin entries take effect.
Automatic session names are now marked as automatic, a name given at launch can be kept, and auto names no longer overwrite a name that changed
Unclear It is not clear when Claude Code gives a session an automatic name.
If your organization needs a person to approve each new artifact, Claude Code refuses to create one when no one can be asked
Loading CLAUDE.md memory files now follows read rules sent with the request, and loads none if those rules cannot be read
Spawned teammates now receive permission rules, and registering a folder outside the workspace root or inside a dot-folder is rejected
In host-embedded sessions, the app running Claude Code can fill in a file for a Google Drive upload, so the model does not have to write out the file's contents
Unclear It is not stated which host apps advertise support for this, so it is unclear where a reader will actually get it.
When an MCP server's tools are replaced by another server's mid-session, Claude is now told which server to use instead
Unclear It is not stated what causes one MCP server's tools to be replaced by another's.
A hook that says to allow a call to the cloud browser no longer counts; the normal permission check decides instead
Claude Code now has a warning that a task's files were written by its agent and must be treated as untrusted
Plugins can now only make cloud browser calls stricter, and some MCP tool asks keep their safety prompt and default to No
Unclear When the host-card denial in bypassPermissions mode applies is not clear.
Instructions about an attached machine now name it, and tell Claude to read a background command's output there because it never reports finishing
If Claude can't reach Claude in Chrome and you wrote from the mobile app, Claude now says so briefly instead of giving setup steps
Claude Code now has specific explanations for four ways a dev server can fail to start, such as a port in use or packages not installed
When a plugin dev mod's hook is skipped or fails, Claude is now told once per distinct failure and asked to fix the mod
Artifact publishing now expects root with every typed publish, reports served paths and unchanged files, and no longer builds PR review pages
--permission-prompt-tool can no longer approve tools from an MCP server whose name starts like a claude.ai connector's; the server needs another name
Unclear The exact name pattern that counts as looking like a claude.ai connector is not stated.
When a self-hosted runner or remote session fails to set up, the error now carries a failure kind such as filesystem error or repo settings rejected
Cloud and remote-control refusals are reworded, and file attachments and project_write now refuse when a repo's permission rules can't be read
/rate-limit-options and /artifacts opened by a shortcut or automatically now run as prompts, not bash input, and /clear keeps your IDE selection rules
With CLAUDE_CODE_EVAL_CONFINED set, tool calls must match the run's grants, the OS username lookup is skipped and the auto-mode repo-visibility check is off
Unclear Whether CLAUDE_CODE_EVAL_CONFINED is exactly the switch that turns this check on is not confirmed.
MCP tools from servers named like claude.ai connectors, and other newly flagged tools, can no longer be approved by stored grants or hook shortcuts
Unclear Which MCP tools, in which state, get the new marker is not identified.
The workspace-trust prompt and its error now name whichever command triggered them, and the prompt can give up with 'No answer in time.'
Unclear Which commands, if any, actually set the time limit is not stated.
At startup, Claude Code skips a saved Cloud gateway connection whose sign-in has ended and tells you to run /login
When a claude.ai connector's sign-in has expired in a remote session, Claude now gets a tool that retries and asks you to sign in again
Unclear It is not known whether the remote switch for this is on for anyone.
With CLAUDE_CODE_CERT_STORE=system, an empty or unreadable system store now stops startup instead of quietly using bundled certificates
A teammate started by Claude Code now gets the same --disallowed-tools and --tools limits you gave the lead, or it is not started
A CLAUDE.md file in a subfolder that is over a size limit is now cut at a line break, with a note telling Claude how to read the rest
Errors about blocked certificates in oidc.ca_cert_pem now ask for the provider's intermediates and self-signed root, with no cross-signed ones
Plugin sync from claude.ai now refuses its plugins folder when the folder's marker can't be read, and installs only a set number at once
In Claude Desktop, file_upload calls now get their own path check first, and Claude in Chrome uploads can weigh extra tool details for approval
A self-hosted runner now stops with an error if two /remote replies disagree about whether the session is a code review
Claude Code now notes when seeded or held settings turn the sandbox on, and pauses automatic approval of sandboxed commands in that case
Unclear It is not stated what a held file is or how it turns the sandbox on.
On Windows, the sandbox guidance tells Claude not to init, clone or add worktrees with git there, and that sandboxed git cannot use your saved sign-in
The inline /mcp command now skips some additional servers in its counts and in reconnect, enable and disable, as it already did for the IDE
Unclear Which servers are now left out is not stated.
Signing in through an allowlisted Cloud gateway now uses a pinned connection at each step and refuses redirects when looking up the sign-in server
The self-hosted runner now detects a turn that begins before a session has initialized; CLAUDE_RUNNER_DISABLE_TURN_BEGAN_BEFORE_INIT turns it off
The Artifact tool's live-edit no longer refuses pages used for pull request reviews
In print and SDK sessions, MCP setup now also runs when the host program hands Claude Code its MCP listings
While a remote turn is loading, Claude Code now knows whether the remote machine supports sending a message straight away
Uploading files through the browser pane now takes one file per call and refuses files Claude is not allowed to read
Claude Code's memory step now reads only the exchanges since it last looked and skips itself when there is nothing new
openWorldHint that MCP tools declare#Claude Code now passes along the openWorldHint an MCP server sets on a tool, as well as its read-only and destructive hints
Unclear What Claude Code does with openWorldHint once it reads it is not stated.
Gateway certificate allowlist entries now need valid dates and strong root certificates, and the hostname must match exactly
Unclear Which gateway setups use this allowlist, and so who is affected, is not stated.
Commands that name RSYNC_CONNECT_PROG, even disguised, are refused by the isolated-worktree git guard and noted by a separate Bash scan
If an MCP server's name starts like a claude.ai connector's, allow rules do not apply to it and Claude Code now says so
Unclear It is not clear exactly which server names count as starting like a claude.ai connector's.
For MCP servers that Claude Code's cloud supplies, sign-in now shows a message pointing to claude.ai instead of starting a login
When a skill runs, Claude Code first searches recently changed files for nested skills, then checks for folder-specific versions of that skill
Unclear It is not clear which skills the changed-file search applies to, since a further condition decides when it runs.
Claude Code's check for git now also looks at your environment, so git can be treated as unavailable even when it is installed
Unclear It is not clear what in the environment makes git count as unavailable.
In remote sessions, the remote worker's permission mode is now passed through in its reported state, like the last model it used
When WebFetch hits a claude.ai artifact link, the message now names an available artifact-reading tool and checks your permission rules for it
An mcp_tool hook aimed at the Artifacts MCP server or the session's cloud browser is now refused, and permission hooks cannot approve cloud browser calls
Unclear It is not clear exactly which setups of the Artifacts server are covered by the refusal.
For a tool it does not know, Claude Code can now ask approval for each call, with no option to always allow it
Unclear It is not shown where this prompt is used or whether it is live.
disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars are no longer dropped while Claude Code's server policy tier is unconfirmed
A new userLocale option lets git status, worktree lookups and a few other git calls run in your own locale instead of a forced one
When a hook decides 'ask', the permission check now gets hookAsked and no longer auto-allows the tool from the hook's updated input
When the network drops and no response arrives, Claude Code now retries from its own reconnect budget, limited by maxReconnects
Hook error messages now explain how to split a command into "command" and "args", or mark it as PowerShell, including when Git Bash is missing
Claude Code's internal git calls now use a shared, cleaned environment, and the old forced LC_ALL=C setting is replaced
Unclear Whether Claude Code still sets LC_ALL for git commands somewhere else.
Published verbatim by Anthropic for v2.1.309. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 79 bullets, 13 name something an entry on this page also names, 22 name something no entry here does, and 44 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
No entry names this --mcp-config
Probably state-holder-gains-flagmcpconfigfilepaths, mcp-config-file-paths-are-checked-against-the-confine-scan cd is wrapped or prefixed, as they do for a plain cd
Nothing to match on Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
No entry names this ! mode
Nothing to match on jq could not parse
Nothing to match on /proc
Probably read-block-hardening-for-proc-and-devfd-paths, stdio-handling-for-subprocess-no-longer-assumes-proc #102816Read tool reports 'File does not exist' for images/PDFs inside a PID namespace: hardened read re-opens via /proc/${process.pid}/fd instead of /proc/self/fd (2.1.284–2.1.301) Closed
#99853[BUG] Linux: PID namespace/procfs mismatch breaks PDF/.ipynb Read and single-file Grep, and can return another file's content Open
claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository
Probably cloud-session-messages-reworded-and-a-new-file-attach-refusa, remote-control-session-id-continue-parsing-refactor-no, remote-control-unattended-command-hint-text-rewritten --tools rules given on the leader's command line
Probably teammate-spawn-replays-cli-deny-rules-and-typed-tools-flag /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume
No entry names this #98981[BUG] VS Code: ListAgents name reverts to an auto-generated name after resuming a renamed session Open
#95807[BUG] A renamed session reverts to its derived <dir>-<nn> name after any restart, so ListAgents and SendMessage can no longer reach it Closed
/rewind list showing "No code changes" for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command
Probably sed-i-treated-as-an-in-place-formatterfixer-command, rewind-selector-computes-per-message-diff-stats-incrementall /privacy-settings showing an out-of-date "Help improve our AI models" value; it now also says when the setting can't be fetched
Probably privacy-settings-dialog-clears-cache-and-uses-a-shared-error --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>
Probably self-hosted-runner-treats-code-review-sessions-specially-to /verify and /code-review not finding a nested package's own skill when its files were changed from the shell
No entry names this ant beta:worker poll --on-work passes trace context to the command
No entry names this PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed
Probably permission-hook-paths-now-also-treat-tools-flagged-by-a-new, powershell-hooks-propagate-exit-code-2, hook-asked-tools-skip-the-interactive-permission-path, hooks-of-type-mcp-tool-refused-for-the-artifacts-mcp-server #90077[BUG] Hooks with `shell: "powershell"` spawn `pwsh` with no `powershell.exe` fallback, so hooks silently never run on a stock Windows box Open
turn.step hook that names a model by alias, such as haiku, failing every request with a model error: the alias now resolves to its model
No entry names this ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint
Probably bedrock-base-url-check-delegated-to-a-helper, bedrock-eager-input-streaming-no-longer-keyed-on-anthropic-b Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval
Probably powershell-set-location-allowed-when-safe --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped
Probably runner-detects-turns-that-begin-before-init-with-a-stall-wa, self-hosted-runner-code-review-sessions-start-only-once-ne apca(text, background) function to its palette validator scripts, and say whether a label inside a colored chart fill should be white or near-black
No entry names this sed -i to get the standard Bash prompt and run as written, not a simulated file-edit preview; like other Bash edits, it is no longer restored by /rewind
Probably sed-i-treated-as-an-in-place-formatterfixer-command, sed-edit-permission-dialog-special-case-removed, rewind-selector-computes-per-message-diff-stats-incrementall claude ultrareview to require workspace trust: it asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1
Probably new-env-var-claude-code-disable-ultrareview-trust-check-skip, claude-ultrareview-gains-a-trust-workspace-flag rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code to deny the command at once with a rewrite hint, so unattended sessions keep going
Nothing to match on /claude-api skill to build Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator
No entry names this /goal filling the chat panel; they now fold behind Show more like other prompts (anthropics/claude-code#97469)
No entry names this @claude review stop; its check now closes and says why
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 29 tool descriptions changed.
Claude Code, interactive mode
16 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
1141 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 46 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?