You can now run claude ultrareview --trust-workspace to trust the current folder for one run, so reviews work in scripts and CI. Setting CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK skips the folder trust step when Claude Code cannot ask you. A new save_task_files tool saves files from a managed-agent task into your session folder. It asks for your approval every time. Uploading local files to MCP tools now defaults to on when Anthropic's servers send no setting. The hook settings disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars now sit on the managed-settings list next to allowManagedHooksOnly.
This release counts 14 entries that are in the build but not switched on yet. A Claude Test pane is taking shape that reads test runs from a .claude-test folder. Web search citations tied to parts of Claude's replies need CLAUDE_CODE_WEBSEARCH_CITATIONS and a remote switch. A CLAUDE_CODE_RESUME_SHOWS_CUT_OFF_CALLS setting is being added to show interrupted tool calls in a resumed session. Groundwork has also landed for listing connectors your organization provides.
Publishing an Artifact no longer checks pages against the PR review template. The pr_review and prReviewOn options are gone from the Artifact tool. Publishing a PR review page with extra files no longer stops with a single-file error. A tool that a setting used to switch on is now always off. Claude Code can also repair gaps in stored remote session history on load, when switched on remotely.
Written by our agent from the shipped bundle, not by Anthropic.
Feedback can now include survey follow-ups and a local bundle, and failed submissions say whether the org, the sign-in or the network was the cause
ExtensionsOrganisations can set an artifact_create_notice, defaulting to a message that a person must approve each new artifact
Settings & config--mcp-config file paths are now recorded and registered, and an MCP config can carry a pre-supplied tool listing so discovery can be skipped
ExtensionsThe mcp_status and mcp_authenticate requests gain a liveReply option that sends the answer only to clients attached right now, without saving it
ExtensionsIn stream-json and --sdk-url runs, result messages can carry model_usage_since_last_result, per-model usage and cost since the last result
ExtensionsWant the reasoning? Read walks the 35 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →8 more of these are in What probably matters to you, on page 1.
When a chat isn't linked to a computer, Claude now mentions a card that may appear under its reply and can offer to move made files there later
Claude is now always told that a remote background command's output file shows what it printed, not whether it is still running
Shell commands that could be read two ways are now checked both ways, and more of them ask for your approval
When Claude tries to read resources from the Artifacts MCP server, it now gets an error telling it to use that server's tools instead
Publishing an artifact is now refused with a specific reason when its permission check cannot finish and your organization requires approval for each new artifact
A self-hosted runner now refuses a code review session another worker has already taken, and its --startup-timeout-min help was reworded
On Windows, Claude Code now checks whether sandboxed commands can reach ~/.nuget/packages so dotnet builds can find restored packages
If an MCP server's last reply says it does not accept GET requests, Claude Code stops sending the GET that opens a listening stream and answers it itself
Unclear It is not stated what condition switches this behaviour on.
Bash commands that edit files with sed are now labelled Bash, or SandboxedBash when CLAUDE_CODE_BASH_SANDBOX_SHOW_INDICATOR is set and sandboxed
In --remote sessions, the re-enrolment prompt now waits for a pause in typing before appearing
On exit, Claude Code now waits for pending work to be flushed before the process ends
Claude Code has a new message warning that starting the sandbox and setting file permissions can take a few minutes
The ultrareview usage line now reads [target] [options], and dialog connections can be held across sessions
When two project skills would share a name, Claude Code now offers only one and logs that the other was withheld
An MCP tool result that arrives without its text now raises an error telling Claude the tool may already have run
The screen shown when you exit Claude Code now counts MCP connections, not only tasks, when it lists what is still in the background
When a file read comes back cut short, Claude Code adds a note with the lines that arrived whole and how to read the next part
If starting the sandbox takes over 15 seconds, the message now adds that setting file permissions can take a few minutes
MCP server status now includes how a server connects, whether it goes through the session, and its web address host
When Claude uses a tool, its name is shown in full or in a standard format instead of being cut off with an ellipsis
Commands now refuse to run if their working folder is gone or the Windows sandbox did nothing, and disk-full errors say more
The sandbox can now set a NuGet fallback folder in the environment of commands it runs
Unclear It is not clear where the fallback folder value comes from or whether a reader can set it.
Removing an MCP server now reports success sooner and only waits for cleanup when the server is cached or connected
Unclear It is not clear what condition controls the discovery-entry removal, so whether a removed server can still appear in discovery is unknown.
The /rewind list now works out each message's file changes newest first, with a time limit and a way to stop part-way, instead of all at once
Claude Code now drops certificates in a CA bundle file that do not chain to a root certificate in that file, and logs how many it dropped
Claude is now told to write a bare @name in GitHub text only for a real person it means to notify, and to put other @ words in backticks
When a message is rejected and Claude Code exits, it now prints "Your message was not sent:" followed by the text you typed
The Bash tool instructions now tell Claude that GitHub notifies anyone @mentioned, so it should only @mention real logins it means to notify
Nested skills now carry an allowlistedByFullNameOnly mark when only their full name is allowlisted, and such commands are filtered like MCP prompts
Unclear Whether a nested skill listed in an allowlist by its plain name is still covered is not clear.
Connector tool text now says enabledInChat false means the connector's tools are not loaded, and connected null means unknown
[ glued to the next word are now flagged#Claude Code now flags a shell test written as [ with no space after it, since that names a different command
touch commands#In acceptEdits mode, touch commands with odd or option-like arguments now go through the normal permission check instead of running unasked
The worktree guard now treats variable assignments placed before a git command differently, which appears to tighten what it allows
Unclear Exactly which commands are now refused is not clear.
!( inside [[ ]] now ask for permission#Claude Code now treats !( inside a [[ ]] test as too complex to judge, so such commands are no longer approved automatically
Paths such as /proc/self/environ, /proc/self/cwd, /dev/fd and /dev/stdin are now treated as blocked reads
Unclear It is not stated which kinds of file read this blocking applies to.
Calling GetTask now returns an error telling Claude that background command results arrive on their own
The built-in commit and pull request skills now include one more instruction after the line on keeping PR titles short
Unclear What the added instruction says is not stated.
Claude Code's shell command reader now treats $'...' as a quoted string and handles $$ specially when checking commands
Unclear It is not clear whether seeing $$ makes a command more or less likely to need permission.
When checking whether a file sits inside a folder, Claude Code now also checks the folder through its alternate route
The doctor check now explains that leftover sandbox mask files come from killed sessions or ones that exited mid-command
sed -i is now recognised as a command that edits files in place#Claude Code now recognises sed -i and gsed -i as in-place file edits, alongside commands using --fix, --in-place or --auto-correct
Unclear It is not clear what Claude Code does differently with a command once it is recognised as an in-place edit.
The warning about MCP servers blocked by policy no longer lists the built-in Chrome server when Claude Code handles it separately
Claude Code now marks more commands with $'...' strings, escaped line breaks or odd $[ and ${ forms as ones it could not parse
Unclear Whether a command that cannot be parsed always leads to a permission prompt is not confirmed.
Claude Code no longer replaces certain Bash commands with just a file path when displaying them; they are shown as their full text
Unclear Which commands used to be shown as a file path is not stated.
When syncing skills and plugins, folders whose marker can't be read are now logged as warnings and listed separately instead of counted as strays
A plugin file whose code or imports nest too deeply now fails with a plain explanation instead of a raw engine error
Claude Code now reads expansions inside Bash heredocs as if in double quotes and keeps unparseable parts when checking permissions
Unclear Whether this makes more or fewer heredoc commands need approval is not stated.
On macOS, sandbox deny rules that use wildcards can now also be applied to the real path behind a symlink
Unclear It is not clear when the option that turns this on is set, so it may not apply to every wildcard deny rule.
Claude Code now refuses to auto-approve Bash commands that use shell-filled variables like history or odd $ forms such as $"..."
Empty tokens inside [[ ]] tests no longer block analysis, and an assignment next to an expansion that can fail is now treated as too complex
Unclear It is not clear what condition switches the new assignment check off.
When sending feedback that Claude drafted fails, the hint can now read 'review or discard' instead of always 'review & retry'
Claude Code's shell command checker now gives up on a variable whose value contains a particular marker
Unclear Which marker makes a variable's value count as unknown is not stated.
$'...' strings pass the shell permission check#Claude Code no longer rejects some [[ ]] test commands as too complex to check, and reads $'...' strings differently
Claude Code's automatic allow for actions that are not reads now skips more cases, so some may ask for permission
Unclear Which actions this automatic allow covers, and which feature the switched-on-but-not-running case refers to, is not stated.
Some background requests now skip the login token refresh on certain sign-in errors, and the log message for a failed refresh reports the right details
Unclear Which sign-in errors now skip the token refresh is not stated.
The note telling Claude where a command ran can now say "[on …]" instead of "[ran on …]" and drop part of the label
The "Publishing is unavailable" message from ultrareview now also covers organizations that require someone to approve each new artifact
print -P are now always flagged#Claude Code now flags every print -P command, not just ones containing command substitution
When a required sandbox fails to start, the error now says dangerouslyDisableSandbox is not allowed either
A PowerShell Set-Location command can now be allowed when a safety check passes, before the working-folder check runs
Unclear It is not clear what the safety check tests, so which Set-Location commands now skip the prompt is unknown.
Claude Code now checks cd, chdir and pushd commands for allowed flags, at most one folder, and no stack-rotation arguments
Unclear It is not clear what Claude Code does with a command this check rejects.
Claude Code's check for switched-off security certificate checking now looks at a list of variables, not only NODE_TLS_REJECT_UNAUTHORIZED
Unclear It is not known which variables are in the list or what Claude Code does when the check trips.
rm command is blocked by a safety check#When an rm command is blocked, the message to Claude now says the prompt timed out or none was shown
Shell declarations whose value comes from an expansion that can fail at runtime are now treated as too complex and need your approval
When the Read tool refuses a special file, it now says the path is a device or process file it does not read
Unclear It is not clear whether more paths, such as process files, are now refused or only the message wording changed.
When a plugin's hook fails, Claude Code now runs an extra step first and shows its usual warning only under one condition
Unclear What decides whether the warning is still shown is not stated.
print commands are no longer treated as safe read-only commands#Claude Code's Bash safety check now has rules for print, and certain argument shapes make it ask for permission instead of running automatically
Unclear It is unclear whether print counted as read-only at all before, so plain print commands may be newly allowed or simply unchanged.
Claude Code's Bash safety check now rejects more shell forms, including some patterns, some here-documents and some locale settings, so more commands prompt
Claude Code now recognises one more git error line as the missing Xcode tools error on macOS
Publishing an artifact no longer validates PR-review pages against their template or refuses extra files, and the Artifact tool loses prReviewOn
Unclear It is not stated whether supporting files are now published alongside a review page or handled somewhere else.
Claude Code can relink messages whose earlier message is missing when it loads a stored remote session, if switched on remotely
A PowerShell hook that ends with exit code 2 now blocks the action, the same as a bash hook
A tool call that ends in an error is now reported as failed instead of completed
Claude Code now hides the leftover part of a signed key that stayed visible after the start of the key was hidden
Claude Code now waits for the hooks worker to come online before checking it, and reports a separate error if it never starts
A file copy now carries on when the filesystem refuses to set file permissions for certain errors, instead of stopping
On Linux, Claude Code no longer removes sandbox folder links when it exits if sandboxes are still running
When a background command fails, Claude Code now reads its saved output and shows it together with any error messages
When looking back for the last user turn, Claude Code now falls back to details saved in the most recent compaction summary
Unclear It is not clear what Claude Code then does with the recovered turn start, so the visible effect is unknown.
/privacy-settings shows fresh settings each time it opens#The /privacy-settings dialog now clears its saved copy of your settings before loading them, so it shows current values
Claude Code now takes the part of a skill's folder path before .claude as the project folder instead of working out a relative path
Unclear It is not clear where this resolved folder is used, so the effect on how skills behave is unknown.
A failed tool-list refresh from an MCP server you have not signed in to no longer replaces its placeholder tools
A new isDispatchingForModel state lets send-now tell a message about to reach the model from an idle session, and queue instead
The list of sandbox settings now keeps every sandbox entry instead of dropping one excluded path
Unclear Which setting used to be left out, and where this list is shown or used, is not clear.
Sandbox path patterns now escape more special characters, such as brackets, quotes and backslashes, in file names
Claude Code now labels a tool whose name cannot be read as unreadable in its usage statistics, instead of failing
A timer that runs before a remote worker finishes starting up is now stopped when the worker closes
A hook stopped because it ran past its time limit is now reported as timed out even when it was also cancelled
The notice listing revoked MCP servers now leaves out servers that were replaced
When teleport fails in print mode, the error message now reports the error that actually occurred, and a resume lookup in print mode was fixed
On exit, Claude Code now always settles its held replay records, even if saving the project's data fails
Unclear What the held replay records are, and whether a user ever saw them lost, is not stated.
When running headless, Claude Code no longer reports a git command as sandboxed if the sandbox left the command unchanged
Unclear What Claude Code then does with a git command that could not be sandboxed is not stated.
If a session being started printed nothing and is already being released, the runner now leaves that release alone instead of starting another
8 more of these are in What probably matters to you, on page 1.
Remote sessions gain an unfinished display for messages that are sent right away, and /btw resubmits now leave your IDE selection alone
Unclear It is not clear what the new display shows or whether it is switched on for anyone yet.
When files attached to your message did not arrive, Claude Code can fetch them again and tell Claude which ones are still missing
Claude Code changes how it confirms and sends waiting messages, which affects delivery of queued and remote messages
Unclear What this changes for someone using Claude Code is not clear.
Claude Code can now get an extra retry allowance from the server for main-conversation requests, unless you set a retry variable
Claude Code registers two new switches that Anthropic's servers control; what they turn on is not visible yet
Unclear What either switch controls is not known.
A new remote switch, off by default, appears where a bundled SDK upgrade guide used to be
Unclear What the new switch controls is not known.
On Windows, git commands with path-like arguments may no longer be auto-approved as read-only when a gated check is on
Unclear The check is behind an unnamed switch, so whether it is on for anyone is not known.
Published verbatim by Anthropic for v2.1.309. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 79 bullets, 13 name something an entry on this page also names, 22 name something no entry here does, and 44 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
No entry names this --mcp-config
Probably state-holder-gains-flagmcpconfigfilepaths, mcp-config-file-paths-are-checked-against-the-confine-scan cd is wrapped or prefixed, as they do for a plain cd
Nothing to match on Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
No entry names this ! mode
Nothing to match on jq could not parse
Nothing to match on /proc
Probably read-block-hardening-for-proc-and-devfd-paths, stdio-handling-for-subprocess-no-longer-assumes-proc #102816Read tool reports 'File does not exist' for images/PDFs inside a PID namespace: hardened read re-opens via /proc/${process.pid}/fd instead of /proc/self/fd (2.1.284–2.1.301) Closed
#99853[BUG] Linux: PID namespace/procfs mismatch breaks PDF/.ipynb Read and single-file Grep, and can return another file's content Open
claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository
Probably cloud-session-messages-reworded-and-a-new-file-attach-refusa, remote-control-session-id-continue-parsing-refactor-no, remote-control-unattended-command-hint-text-rewritten --tools rules given on the leader's command line
Probably teammate-spawn-replays-cli-deny-rules-and-typed-tools-flag /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume
No entry names this #98981[BUG] VS Code: ListAgents name reverts to an auto-generated name after resuming a renamed session Open
#95807[BUG] A renamed session reverts to its derived <dir>-<nn> name after any restart, so ListAgents and SendMessage can no longer reach it Closed
/rewind list showing "No code changes" for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command
Probably sed-i-treated-as-an-in-place-formatterfixer-command, rewind-selector-computes-per-message-diff-stats-incrementall /privacy-settings showing an out-of-date "Help improve our AI models" value; it now also says when the setting can't be fetched
Probably privacy-settings-dialog-clears-cache-and-uses-a-shared-error --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>
Probably self-hosted-runner-treats-code-review-sessions-specially-to /verify and /code-review not finding a nested package's own skill when its files were changed from the shell
No entry names this ant beta:worker poll --on-work passes trace context to the command
No entry names this PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed
Probably permission-hook-paths-now-also-treat-tools-flagged-by-a-new, powershell-hooks-propagate-exit-code-2, hook-asked-tools-skip-the-interactive-permission-path, hooks-of-type-mcp-tool-refused-for-the-artifacts-mcp-server #90077[BUG] Hooks with `shell: "powershell"` spawn `pwsh` with no `powershell.exe` fallback, so hooks silently never run on a stock Windows box Open
turn.step hook that names a model by alias, such as haiku, failing every request with a model error: the alias now resolves to its model
No entry names this ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint
Probably bedrock-base-url-check-delegated-to-a-helper, bedrock-eager-input-streaming-no-longer-keyed-on-anthropic-b Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval
Probably powershell-set-location-allowed-when-safe --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped
Probably runner-detects-turns-that-begin-before-init-with-a-stall-wa, self-hosted-runner-code-review-sessions-start-only-once-ne apca(text, background) function to its palette validator scripts, and say whether a label inside a colored chart fill should be white or near-black
No entry names this sed -i to get the standard Bash prompt and run as written, not a simulated file-edit preview; like other Bash edits, it is no longer restored by /rewind
Probably sed-i-treated-as-an-in-place-formatterfixer-command, sed-edit-permission-dialog-special-case-removed, rewind-selector-computes-per-message-diff-stats-incrementall claude ultrareview to require workspace trust: it asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1
Probably new-env-var-claude-code-disable-ultrareview-trust-check-skip, claude-ultrareview-gains-a-trust-workspace-flag rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code to deny the command at once with a rewrite hint, so unattended sessions keep going
Nothing to match on /claude-api skill to build Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator
No entry names this /goal filling the chat panel; they now fold behind Show more like other prompts (anthropics/claude-code#97469)
No entry names this @claude review stop; its check now closes and says why
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 29 tool descriptions changed.
Claude Code, interactive mode
16 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
1306 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 46 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?