You can now run claude ultrareview --trust-workspace to trust the current folder for one run, so reviews work in scripts and CI. Setting CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK skips the folder trust step when Claude Code cannot ask you. A new save_task_files tool saves files from a managed-agent task into your session folder. It asks for your approval every time. Uploading local files to MCP tools now defaults to on when Anthropic's servers send no setting. The hook settings disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars now sit on the managed-settings list next to allowManagedHooksOnly.
This release counts 14 entries that are in the build but not switched on yet. A Claude Test pane is taking shape that reads test runs from a .claude-test folder. Web search citations tied to parts of Claude's replies need CLAUDE_CODE_WEBSEARCH_CITATIONS and a remote switch. A CLAUDE_CODE_RESUME_SHOWS_CUT_OFF_CALLS setting is being added to show interrupted tool calls in a resumed session. Groundwork has also landed for listing connectors your organization provides.
Publishing an Artifact no longer checks pages against the PR review template. The pr_review and prReviewOn options are gone from the Artifact tool. Publishing a PR review page with extra files no longer stops with a single-file error. A tool that a setting used to switch on is now always off. Claude Code can also repair gaps in stored remote session history on load, when switched on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Feedback can now include survey follow-ups and a local bundle, and failed submissions say whether the org, the sign-in or the network was the cause
ExtensionsOrganisations can set an artifact_create_notice, defaulting to a message that a person must approve each new artifact
Settings & config--mcp-config file paths are now recorded and registered, and an MCP config can carry a pre-supplied tool listing so discovery can be skipped
ExtensionsThe mcp_status and mcp_authenticate requests gain a liveReply option that sends the answer only to clients attached right now, without saving it
ExtensionsIn stream-json and --sdk-url runs, result messages can carry model_usage_since_last_result, per-model usage and cost since the last result
ExtensionsWant the reasoning? Read walks the 35 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →5 more of these are in What probably matters to you, on page 1.
A new switch, on unless turned off remotely, guards a one-time step in the checklist shown while a cloud session is created
Unclear It is not clear what the one-time action on the checklist screen does.
When a remote session status update is rejected, its details are now put back in the queue to be sent again
In remote sessions, an empty checkpoint no longer holds back output after a model reply has started streaming
--ref and --cloud checks#The checks behind --ref and --cloud were reworked internally; they behave the same and show the same error messages
Claude Code's cost tracker can now add up usage since the last finished turn
Claude Code now reads a separate maximum age from the server for sessions with no turns, which otherwise matches the general age limit
Unclear What is removed or kept when this limit applies is not stated.
When subagent transcripts are loaded, their details can now be rebuilt from entries kept in the transcript itself
Unclear It is not stated what turns this on.
When an agent started from a stream is resumed, Claude Code now treats it as the built-in agent type
Unclear It is not clear what being treated as the built-in type changes for a resumed agent.
The built-in fallback for the screen-reader arrow-key navigation switch changed from a number to a text value
Unclear It is not clear whether the new fallback value leaves screen-reader arrow-key navigation on or off.
Claude Code now records when it is waiting for a reply to its main request and uses that to decide the request is under way
Unclear What, if anything, a user sees differently from this change is not clear.
A background helper can now take a testing option, and one data format gains an optional notes field with a length limit
MCP tools gain steps for saving task files and uploading files from a pane, and file-reference tools can now refuse when a file fill is not declared
Unclear It is not clear how these file steps are switched on or where a reader would see them.
Claude Code has a new internal label, remote_mcp_servers, next to other labels for remote features
A list Claude Code builds from its MCP connections now filters some connections out first
Unclear It is not clear which connections are left out or where this list is shown.
Claude Code now checks for mcp serve before reading the --transport http option when deciding whether to run the HTTP MCP server
Claude Code can now send some network requests without the proxy set in environment variables
Unclear It is not clear which requests skip the proxy, which matters if your network requires all traffic to go through one.
A server switch checked in many places now counts as on when no value can be read at all, not only when the server sends nothing
Unclear It is not clear which features this switch controls.
A string conversion in Claude Code now runs on every string that has its marker and is under its size limit, including ones it used to skip
Unclear It is not clear what this conversion does or which text a reader would see it affect.
Claude Code no longer relies on /proc paths to tell whether a subprocess's input or output is redirected
For some requests, Claude Code now adds an extra marker to its replies over the bridge that connects the interactive session to another client
Claude Code now skips its bridge sync step when no session, project thread or project files connection is attached
Remote control now handles git repository detection separately from the worktree hook check, and its tool host accepts a test VM option
The claude remote-control options behave as before, and --enable-live-preview and --preview-port still report they are not available
Claude Code records a few new details about follow-up messages, organisation connector servers and setup failures
Claude Code now records ultrareview's workspace trust step under its own source name
Claude Code's stored sign-in details can now include a separate token for model requests, apart from the session token
Under certain conditions Claude Code now skips reading its standard-location token file and treats it as missing
Unclear The conditions under which Claude Code now skips the token file are not known.
When Claude Code can't read its credentials because of a permission error, a different check now decides whether to try a fallback
Unclear It is not clear whether the new check gives the same answer as the old one, especially in remote sessions.
$(...)#The part of Claude Code that reads quoted text inside $(...) in Bash commands now uses one shared routine
Claude Code's reading of Bash commands now tracks variable assignments, including the REPLY set by read, in a new way
Unclear It is not clear whether this changes which Bash commands are allowed or prompted for.
The way Claude Code reads quoted text in shell commands was reorganised, with no change in behaviour visible
Claude Code can now ignore permission settings from your user settings file, and from some other sources, when a new check is true
Unclear When the new check is true, and so when user settings are ignored, is not known.
A list of permission rules now drops some rules depending on the rule and where it was set
Unclear Which rules are now left out, and whether this changes what is allowed or only what is shown, is not stated.
Finding the real folder behind a permission rule's path no longer logs an error when it fails
Unclear Whether symlinked paths still match permission rules exactly as before is not known.
Claude Code now holds saved request details until your first message is written to the session file
The resume report in the diagnostics file can now record when a resumed conversation ended with interrupted tool calls
Resuming a session in print mode now runs an extra step at the same time as the conversation history is loaded
Unclear What the extra step restores or does is not stated.
Updates about Artifact frame addresses now apply one rule to Artifacts published here through MCP and another to the rest
Unclear The two rules that decide which Artifacts are kept or dropped are not known.
Claude Code now reuses recent artifact share-status checks, and CLAUDE_CODE_ARTIFACT_SHARE_PROBE_REUSE_MS sets how long a check is reused
Uploading a referenced file to a connector can now have the host machine read the file, after checks on where the file lives
Unclear It is not clear which sessions have the host machine read files for them.
Connector tool lookup now works for SDK-type MCP servers by tool markings and reports a conflict when a tool carries both markings
Unclear It is not clear what the desktop connector feature does for a reader or where it appears.
Claude Code reworked how it checks a hook's tool-specific output; when the hook runs elsewhere, the tool input passes through and a refusal is ignored
Unclear Which setups count as a hook running somewhere else is not stated.
When reading hook settings, Claude Code now keeps a list of the hook types it could not use, not just a note that some were skipped
Claude Code now treats an empty, read-only file as a placeholder only when no other hard link points to it
Unclear It is not clear what Claude Code does with files it treats as placeholders, so the effect on your files is unknown.
For sandboxed commands, the cleanup that runs after a command now happens earlier, and its failures are no longer logged separately
When its reference files are missing, the Claude API skill now says to fetch the matching URL instead of naming WebFetch
A tool that was previously switched on by a setting is now always off in this build
Unclear Which tool was switched off is not stated.
Publishing several files as an Artifact no longer stops when one of them contains the artifact PR review machinery
Two pull request review checks were removed, a settings shape gains an optional added-directories field, and a session-end hooks key appears
Unclear Which feature reads the added-directories field and the session-end hooks key, and what it changes for users, is not stated.
Bash commands that edit files with sed now show the standard Bash permission prompt instead of a file-edit preview
Unclear The sed edit preview may now be shown somewhere else instead of being removed outright.
The word "Canoodling" no longer appears among the words shown beside the spinner while Claude Code works
Published verbatim by Anthropic for v2.1.309. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 79 bullets, 13 name something an entry on this page also names, 22 name something no entry here does, and 44 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
No entry names this --mcp-config
Probably state-holder-gains-flagmcpconfigfilepaths, mcp-config-file-paths-are-checked-against-the-confine-scan cd is wrapped or prefixed, as they do for a plain cd
Nothing to match on Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
No entry names this ! mode
Nothing to match on jq could not parse
Nothing to match on /proc
Probably read-block-hardening-for-proc-and-devfd-paths, stdio-handling-for-subprocess-no-longer-assumes-proc #102816Read tool reports 'File does not exist' for images/PDFs inside a PID namespace: hardened read re-opens via /proc/${process.pid}/fd instead of /proc/self/fd (2.1.284–2.1.301) Closed
#99853[BUG] Linux: PID namespace/procfs mismatch breaks PDF/.ipynb Read and single-file Grep, and can return another file's content Open
claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository
Probably cloud-session-messages-reworded-and-a-new-file-attach-refusa, remote-control-session-id-continue-parsing-refactor-no, remote-control-unattended-command-hint-text-rewritten --tools rules given on the leader's command line
Probably teammate-spawn-replays-cli-deny-rules-and-typed-tools-flag /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume
No entry names this #98981[BUG] VS Code: ListAgents name reverts to an auto-generated name after resuming a renamed session Open
#95807[BUG] A renamed session reverts to its derived <dir>-<nn> name after any restart, so ListAgents and SendMessage can no longer reach it Closed
/rewind list showing "No code changes" for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command
Probably sed-i-treated-as-an-in-place-formatterfixer-command, rewind-selector-computes-per-message-diff-stats-incrementall /privacy-settings showing an out-of-date "Help improve our AI models" value; it now also says when the setting can't be fetched
Probably privacy-settings-dialog-clears-cache-and-uses-a-shared-error --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>
Probably self-hosted-runner-treats-code-review-sessions-specially-to /verify and /code-review not finding a nested package's own skill when its files were changed from the shell
No entry names this ant beta:worker poll --on-work passes trace context to the command
No entry names this PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed
Probably permission-hook-paths-now-also-treat-tools-flagged-by-a-new, powershell-hooks-propagate-exit-code-2, hook-asked-tools-skip-the-interactive-permission-path, hooks-of-type-mcp-tool-refused-for-the-artifacts-mcp-server #90077[BUG] Hooks with `shell: "powershell"` spawn `pwsh` with no `powershell.exe` fallback, so hooks silently never run on a stock Windows box Open
turn.step hook that names a model by alias, such as haiku, failing every request with a model error: the alias now resolves to its model
No entry names this ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint
Probably bedrock-base-url-check-delegated-to-a-helper, bedrock-eager-input-streaming-no-longer-keyed-on-anthropic-b Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval
Probably powershell-set-location-allowed-when-safe --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped
Probably runner-detects-turns-that-begin-before-init-with-a-stall-wa, self-hosted-runner-code-review-sessions-start-only-once-ne apca(text, background) function to its palette validator scripts, and say whether a label inside a colored chart fill should be white or near-black
No entry names this sed -i to get the standard Bash prompt and run as written, not a simulated file-edit preview; like other Bash edits, it is no longer restored by /rewind
Probably sed-i-treated-as-an-in-place-formatterfixer-command, sed-edit-permission-dialog-special-case-removed, rewind-selector-computes-per-message-diff-stats-incrementall claude ultrareview to require workspace trust: it asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1
Probably new-env-var-claude-code-disable-ultrareview-trust-check-skip, claude-ultrareview-gains-a-trust-workspace-flag rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code to deny the command at once with a rewrite hint, so unattended sessions keep going
Nothing to match on /claude-api skill to build Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator
No entry names this /goal filling the chat panel; they now fold behind Show more like other prompts (anthropics/claude-code#97469)
No entry names this @claude review stop; its check now closes and says why
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 29 tool descriptions changed.
Claude Code, interactive mode
16 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
1702 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 46 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?