You can now run claude ultrareview --trust-workspace to trust the current folder for one run, so reviews work in scripts and CI. Setting CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK skips the folder trust step when Claude Code cannot ask you. A new save_task_files tool saves files from a managed-agent task into your session folder. It asks for your approval every time. Uploading local files to MCP tools now defaults to on when Anthropic's servers send no setting. The hook settings disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars now sit on the managed-settings list next to allowManagedHooksOnly.
This release counts 14 entries that are in the build but not switched on yet. A Claude Test pane is taking shape that reads test runs from a .claude-test folder. Web search citations tied to parts of Claude's replies need CLAUDE_CODE_WEBSEARCH_CITATIONS and a remote switch. A CLAUDE_CODE_RESUME_SHOWS_CUT_OFF_CALLS setting is being added to show interrupted tool calls in a resumed session. Groundwork has also landed for listing connectors your organization provides.
Publishing an Artifact no longer checks pages against the PR review template. The pr_review and prReviewOn options are gone from the Artifact tool. Publishing a PR review page with extra files no longer stops with a single-file error. A tool that a setting used to switch on is now always off. Claude Code can also repair gaps in stored remote session history on load, when switched on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Feedback can now include survey follow-ups and a local bundle, and failed submissions say whether the org, the sign-in or the network was the cause
ExtensionsOrganisations can set an artifact_create_notice, defaulting to a message that a person must approve each new artifact
Settings & config--mcp-config file paths are now recorded and registered, and an MCP config can carry a pre-supplied tool listing so discovery can be skipped
ExtensionsThe mcp_status and mcp_authenticate requests gain a liveReply option that sends the answer only to clients attached right now, without saving it
ExtensionsIn stream-json and --sdk-url runs, result messages can carry model_usage_since_last_result, per-model usage and cost since the last result
ExtensionsWant the reasoning? Read walks the 35 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →5 more of these are in What probably matters to you, on page 1.
Creating an artifact from a type can now send a create-confirmed flag to the server, with new confirmation constants and an artifact tool list
The rules that decide how remote Claude Code sessions batch and send their events gain several new server-supplied settings, including receipts riding uploads
Code that runs slash commands can now pass a check that sees each command first and can return its own result instead
Cleaning up old Claude Test folders now also deletes old files in its consent folder
Claude Code now has a field marking repaired tool input and values for a host asking about each uploaded file
run perform an extra startup step#Every daemon subcommand except run now carries out an extra step at startup, controlled by a remote switch
Unclear What the new startup step actually does is not known.
The prompt input gains a typed-ahead option, and its idle timer can now start for text already in the box
Unclear It is not clear what typed-ahead mode changes for someone typing a prompt.
Claude Code can now work out how many files changed and how many lines were added and removed in each turn
Unclear Nothing shows where, or whether, these counts are displayed.
A document update can now carry max_replaced_content_bytes, a cap on how much existing content it may replace
Compaction's turn tracking now records the messages kept at the last boundary, and the terminal UI marks when the main request starts
MCP connections now record lapsed CCR sign-ins in lapsedCcrSignIns when a server answers 401, and the remote auto-connect check changed
Two Bedrock checks, the default-endpoint test and eager input streaming, no longer read ANTHROPIC_BEDROCK_BASE_URL directly but call a helper
Unclear It is not known what the helper checks, so it is unclear whether Bedrock users with no ANTHROPIC_BEDROCK_BASE_URL set see any change.
The pr_review_publish and pr_review_started names and the prReviewComposeLatch session field are gone, and chrome_phone_answer joins the same list
Unclear What the list is used for, and so whether any feature a user sees was removed or added, is not shown.
Reading the credential file, cleaning a settings cache and the sign-in check are now skipped in one more running mode
Unclear It is not stated which mode now skips these steps.
When sending feedback fails because your organization refused it, Claude Code now records that reason before showing the error
One of Claude Code's git lookups now returns an empty result when a new check on the git program and your environment variables flags a problem
Unclear It is not clear which git or environment conditions make Claude Code skip this lookup.
If the server's upload policy asks for it, a remote session's first turn holds uploads per tool call instead of for the whole turn
In remote cloud sessions, Claude Code can fetch a signed copy of the client's IP address and keep it ready for later requests
Unclear It is not clear when the two conditions are met or whether the stored headers are ever sent with a request.
Cloud sessions can now attach delivery receipts to event uploads and drop repeated rate-limit notices, when the server's settings allow
In remote sessions, the first "idle" status can now wait, up to a time limit, while incoming messages are still queued
Claude Code now reads CLAUDE_CODE_REMOTE_SESSION_ORIGIN from a session's environment variables on all platforms instead of only on Windows
The part of Claude Code that carries remote session messages now records which messages are being processed and how receipts are sent
Unclear Whether this changes anything a user of remote sessions can see is not shown.
A new switch, on unless turned off remotely, guards a one-time step in the checklist shown while a cloud session is created
Unclear It is not clear what the one-time action on the checklist screen does.
When a remote session status update is rejected, its details are now put back in the queue to be sent again
In remote sessions, an empty checkpoint no longer holds back output after a model reply has started streaming
--ref and --cloud checks#The checks behind --ref and --cloud were reworked internally; they behave the same and show the same error messages
Claude Code's cost tracker can now add up usage since the last finished turn
Claude Code now reads a separate maximum age from the server for sessions with no turns, which otherwise matches the general age limit
Unclear What is removed or kept when this limit applies is not stated.
When subagent transcripts are loaded, their details can now be rebuilt from entries kept in the transcript itself
Unclear It is not stated what turns this on.
When an agent started from a stream is resumed, Claude Code now treats it as the built-in agent type
Unclear It is not clear what being treated as the built-in type changes for a resumed agent.
The built-in fallback for the screen-reader arrow-key navigation switch changed from a number to a text value
Unclear It is not clear whether the new fallback value leaves screen-reader arrow-key navigation on or off.
Claude Code now records when it is waiting for a reply to its main request and uses that to decide the request is under way
Unclear What, if anything, a user sees differently from this change is not clear.
A background helper can now take a testing option, and one data format gains an optional notes field with a length limit
MCP tools gain steps for saving task files and uploading files from a pane, and file-reference tools can now refuse when a file fill is not declared
Unclear It is not clear how these file steps are switched on or where a reader would see them.
Claude Code has a new internal label, remote_mcp_servers, next to other labels for remote features
A list Claude Code builds from its MCP connections now filters some connections out first
Unclear It is not clear which connections are left out or where this list is shown.
Claude Code now checks for mcp serve before reading the --transport http option when deciding whether to run the HTTP MCP server
Claude Code can now send some network requests without the proxy set in environment variables
Unclear It is not clear which requests skip the proxy, which matters if your network requires all traffic to go through one.
A server switch checked in many places now counts as on when no value can be read at all, not only when the server sends nothing
Unclear It is not clear which features this switch controls.
A string conversion in Claude Code now runs on every string that has its marker and is under its size limit, including ones it used to skip
Unclear It is not clear what this conversion does or which text a reader would see it affect.
Claude Code no longer relies on /proc paths to tell whether a subprocess's input or output is redirected
For some requests, Claude Code now adds an extra marker to its replies over the bridge that connects the interactive session to another client
Claude Code now skips its bridge sync step when no session, project thread or project files connection is attached
Remote control now handles git repository detection separately from the worktree hook check, and its tool host accepts a test VM option
The claude remote-control options behave as before, and --enable-live-preview and --preview-port still report they are not available
Claude Code records a few new details about follow-up messages, organisation connector servers and setup failures
Claude Code's usage data now separates tool errors where the tool never started in this process from other errors
When fixing up a tool's streamed input fails, Claude Code now logs which step failed instead of the error text
Claude Code now records ultrareview's workspace trust step under its own source name
Claude Code's stored sign-in details can now include a separate token for model requests, apart from the session token
Under certain conditions Claude Code now skips reading its standard-location token file and treats it as missing
Unclear The conditions under which Claude Code now skips the token file are not known.
When Claude Code can't read its credentials because of a permission error, a different check now decides whether to try a fallback
Unclear It is not clear whether the new check gives the same answer as the old one, especially in remote sessions.
$(...)#The part of Claude Code that reads quoted text inside $(...) in Bash commands now uses one shared routine
Claude Code's reading of Bash commands now tracks variable assignments, including the REPLY set by read, in a new way
Unclear It is not clear whether this changes which Bash commands are allowed or prompted for.
The way Claude Code reads quoted text in shell commands was reorganised, with no change in behaviour visible
Claude Code can now ignore permission settings from your user settings file, and from some other sources, when a new check is true
Unclear When the new check is true, and so when user settings are ignored, is not known.
A list of permission rules now drops some rules depending on the rule and where it was set
Unclear Which rules are now left out, and whether this changes what is allowed or only what is shown, is not stated.
Finding the real folder behind a permission rule's path no longer logs an error when it fails
Unclear Whether symlinked paths still match permission rules exactly as before is not known.
Claude Code now holds saved request details until your first message is written to the session file
The resume report in the diagnostics file can now record when a resumed conversation ended with interrupted tool calls
Resuming a session in print mode now runs an extra step at the same time as the conversation history is loaded
Unclear What the extra step restores or does is not stated.
Updates about Artifact frame addresses now apply one rule to Artifacts published here through MCP and another to the rest
Unclear The two rules that decide which Artifacts are kept or dropped are not known.
Claude Code now reuses recent artifact share-status checks, and CLAUDE_CODE_ARTIFACT_SHARE_PROBE_REUSE_MS sets how long a check is reused
When CLAUDE_CODE_REMOTE_SESSION_ORIGIN is review, Claude Code now runs a token safeguard before handling its other start-up arguments
Unclear What the token safeguard does is not described.
Claude Code runs an extra step at startup when three environment variables mark the session as a self-hosted code review
Uploading a referenced file to a connector can now have the host machine read the file, after checks on where the file lives
Unclear It is not clear which sessions have the host machine read files for them.
Connector tool lookup now works for SDK-type MCP servers by tool markings and reports a conflict when a tool carries both markings
Unclear It is not clear what the desktop connector feature does for a reader or where it appears.
Claude Code reworked how it checks a hook's tool-specific output; when the hook runs elsewhere, the tool input passes through and a refusal is ignored
Unclear Which setups count as a hook running somewhere else is not stated.
When reading hook settings, Claude Code now keeps a list of the hook types it could not use, not just a note that some were skipped
Claude Code now treats an empty, read-only file as a placeholder only when no other hard link points to it
Unclear It is not clear what Claude Code does with files it treats as placeholders, so the effect on your files is unknown.
For sandboxed commands, the cleanup that runs after a command now happens earlier, and its failures are no longer logged separately
Runner sessions now print a notice when a turn starts before the session's start-up message, with optional heartbeats via CLAUDE_RUNNER_ALIVE_EVERY_MS
Claude Code adds a release reason for child processes that go silent and now records when a model turn has ended
Unclear It is not clear what a reader sees differently when these new states occur.
When its reference files are missing, the Claude API skill now says to fetch the matching URL instead of naming WebFetch
When the list of skills is trimmed to fit a size limit, Claude Code now sends Anthropic a usage report about the trimming
A tool that was previously switched on by a setting is now always off in this build
Unclear Which tool was switched off is not stated.
Publishing several files as an Artifact no longer stops when one of them contains the artifact PR review machinery
Two pull request review checks were removed, a settings shape gains an optional added-directories field, and a session-end hooks key appears
Unclear Which feature reads the added-directories field and the session-end hooks key, and what it changes for users, is not stated.
Bash commands that edit files with sed now show the standard Bash permission prompt instead of a file-edit preview
Unclear The sed edit preview may now be shown somewhere else instead of being removed outright.
The word "Canoodling" no longer appears among the words shown beside the spinner while Claude Code works
Published verbatim by Anthropic for v2.1.309. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 79 bullets, 13 name something an entry on this page also names, 22 name something no entry here does, and 44 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
No entry names this --mcp-config
Probably state-holder-gains-flagmcpconfigfilepaths, mcp-config-file-paths-are-checked-against-the-confine-scan cd is wrapped or prefixed, as they do for a plain cd
Nothing to match on Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
No entry names this ! mode
Nothing to match on jq could not parse
Nothing to match on /proc
Probably read-block-hardening-for-proc-and-devfd-paths, stdio-handling-for-subprocess-no-longer-assumes-proc #102816Read tool reports 'File does not exist' for images/PDFs inside a PID namespace: hardened read re-opens via /proc/${process.pid}/fd instead of /proc/self/fd (2.1.284–2.1.301) Closed
#99853[BUG] Linux: PID namespace/procfs mismatch breaks PDF/.ipynb Read and single-file Grep, and can return another file's content Open
claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository
Probably cloud-session-messages-reworded-and-a-new-file-attach-refusa, remote-control-session-id-continue-parsing-refactor-no, remote-control-unattended-command-hint-text-rewritten --tools rules given on the leader's command line
Probably teammate-spawn-replays-cli-deny-rules-and-typed-tools-flag /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume
No entry names this #98981[BUG] VS Code: ListAgents name reverts to an auto-generated name after resuming a renamed session Open
#95807[BUG] A renamed session reverts to its derived <dir>-<nn> name after any restart, so ListAgents and SendMessage can no longer reach it Closed
/rewind list showing "No code changes" for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command
Probably sed-i-treated-as-an-in-place-formatterfixer-command, rewind-selector-computes-per-message-diff-stats-incrementall /privacy-settings showing an out-of-date "Help improve our AI models" value; it now also says when the setting can't be fetched
Probably privacy-settings-dialog-clears-cache-and-uses-a-shared-error --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>
Probably self-hosted-runner-treats-code-review-sessions-specially-to /verify and /code-review not finding a nested package's own skill when its files were changed from the shell
No entry names this ant beta:worker poll --on-work passes trace context to the command
No entry names this PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed
Probably permission-hook-paths-now-also-treat-tools-flagged-by-a-new, powershell-hooks-propagate-exit-code-2, hook-asked-tools-skip-the-interactive-permission-path, hooks-of-type-mcp-tool-refused-for-the-artifacts-mcp-server #90077[BUG] Hooks with `shell: "powershell"` spawn `pwsh` with no `powershell.exe` fallback, so hooks silently never run on a stock Windows box Open
turn.step hook that names a model by alias, such as haiku, failing every request with a model error: the alias now resolves to its model
No entry names this ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint
Probably bedrock-base-url-check-delegated-to-a-helper, bedrock-eager-input-streaming-no-longer-keyed-on-anthropic-b Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval
Probably powershell-set-location-allowed-when-safe --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped
Probably runner-detects-turns-that-begin-before-init-with-a-stall-wa, self-hosted-runner-code-review-sessions-start-only-once-ne apca(text, background) function to its palette validator scripts, and say whether a label inside a colored chart fill should be white or near-black
No entry names this sed -i to get the standard Bash prompt and run as written, not a simulated file-edit preview; like other Bash edits, it is no longer restored by /rewind
Probably sed-i-treated-as-an-in-place-formatterfixer-command, sed-edit-permission-dialog-special-case-removed, rewind-selector-computes-per-message-diff-stats-incrementall claude ultrareview to require workspace trust: it asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1
Probably new-env-var-claude-code-disable-ultrareview-trust-check-skip, claude-ultrareview-gains-a-trust-workspace-flag rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code to deny the command at once with a rewrite hint, so unattended sessions keep going
Nothing to match on /claude-api skill to build Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator
No entry names this /goal filling the chat panel; they now fold behind Show more like other prompts (anthropics/claude-code#97469)
No entry names this @claude review stop; its check now closes and says why
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 29 tool descriptions changed.
Claude Code, interactive mode
16 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
1306 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 46 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?