Short model names such as opus and sonnet now work beyond Anthropic's own API. Fable is now recognised as a short model name too. A new Claude Test panel in the terminal shows each test's pass, fail or blocked mark, with a progress bar and time left. It builds on the groundwork for that panel in v2.1.309. On Vertex and Bedrock, default models can now come from a published model document. Setting CLAUDE_CODE_RETRY_WATCHDOG_SCOPE=capacity limits the automatic retry waiting to capacity errors only.
Several features are in this build but not switched on yet. A /claude-api check that scans your project for retiring Claude model names is built and stays off. Sending a project's documents to Claude as plain text is also off unless switched on remotely. The tool that writes project documents gains a safety check that is off by default. When switched on, it refuses to replace a document whose text differs from what Claude last saw. Groundwork for picking up background agents left behind after a resume is present but hidden.
Starting a cloud session now recovers when this computer is not yet a trusted device. Claude Code re-enrolls the computer and retries, or tells you to run /login. Saving incoming attachments no longer overwrites files that have the same name. Inline images inside tmux now stay in place when the pane moves, resizes or regains focus. A NODE_EXTRA_CA_CERTS file with one blocked certificate no longer causes the whole file to be ignored. The bundled claude-code.d.ts type definitions file is removed.
Written by our agent from the shipped bundle, not by Anthropic.
Short model names such as opus and sonnet are no longer limited to Anthropic's own API, and fable is now recognised as one
Sessions & agentsMCP server settings accept a new connectorId field, stdio servers keep their original configuredCommand, and mcp_call refuses some servers' tools
ExtensionsIn proxied sessions, the built-in gh now refuses to run outside the session's proxy, and a new standalone-proxy mode sets up git and gh
Tools & outputOn Windows, strict sandbox mode now explains why a command was refused, and the CLAUDE_CODE_NANKEEN_KESTREL switch remembers it was on
Interface
CLAUDE_CODE_RETRY_WATCHDOG_SCOPE limits the retry watchdog to capacity waitsSet CLAUDE_CODE_RETRY_WATCHDOG_SCOPE=capacity to keep the retry watchdog waiting through capacity errors without its other retry changes
Want the reasoning? Read walks the 22 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Short model names such as opus and sonnet are no longer limited to Anthropic's own API, and fable is now recognised as one
Unclear Whether you can choose fable as a model is not stated.
MCP server settings accept a new connectorId field, stdio servers keep their original configuredCommand, and mcp_call refuses some servers' tools
Unclear It is not clear what Claude Code does with connectorId once it is set.
A session can now be messaged when someone comments on its artifact, and reading those comments can first need your approval
On Vertex and Bedrock, default models can now come from a published document per tier, falling back to models mapped in modelOverrides
Project settings files may set CLAUDE_CODE_MODEL_CATALOG only to "off"; any other value is ignored with a warning
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
9 more of these are in What probably matters to you, above.
The default model behind each family alias can now come from a document, with modelOverrides and Bedrock and Vertex checks adjusted to match
Unclear Which models have a published-document target is not stated.
Bash now steers Claude from sleep to the Monitor tool, and both Bash and Monitor refuse commands the sandbox policy forbids
Unclear The exact conditions under which either refusal happens are not known.
PowerShell hooks whose command is only quoted text now exit with a no-verdict code, and the Git Bash error explains exit code 127
Unclear What Claude Code does when a hook returns the no-verdict code, and which hook events check for it, is not stated.
Permission rules that deny or ask before the artifact REPL tool runs code now also match a second tool name
Unclear The second tool name the rules now cover is not stated.
Artifact publishing now refuses capabilities that cannot be confirmed as approved in the current Claude Code process
Unclear Whether this check is always on or controlled by a setting is not stated.
MCP tools that carry a standard key can now be left out of the tools Claude is offered when a new condition is not met
Unclear It is not clear which MCP tools carry a standard key or what condition decides whether they are kept.
Claude Code recognises a second, runner-hosted Artifacts MCP setup, extends its guards to it, checks comment reads per artifact, and marks refused servers not connected
Unclear Which additional configurations are now recognised is not known.
When sending OpenTelemetry data, Claude Code now builds its connection from your own certificate and proxy settings, not the shared setup
Unclear It is not clear which of your certificate and proxy settings now apply to the telemetry connection, or when the strict connection is chosen.
All tool progress updates are now dropped in the remote and SDK message handler, not only heartbeats and retries
Unclear Whether tool progress is now shown some other way is not stated.
Scheduled runs with nobody present now refuse artifact writes and uploads from linked, oddly named or uploads-folder files instead of asking
Unclear One further check runs before the refusal, and it is not clear whether it is a feature switch that could be off for some accounts.
A deny or ask permission rule matched against an MCP tool now also checks your other deny and ask rules and a related parent rule, so it can cover more tools
Unclear Exactly which additional MCP tools a given deny or ask rule now covers is not spelled out.
Under remote control, Claude Code now applies all your local permission rules only when the request is marked as here; otherwise only your deny rules apply
Unclear What location counts as "here" is not spelled out.
The check for reading comments can now call for your approval without a deny or ask rule, through a setting that is on unless turned off remotely
Unclear Which condition decides whether the new setting is consulted is not stated.
Claude Code now filters which plugins get their monitors started, and in some modes only plugins from a source that passes a check are started
Unclear It is not clear which plugin entries are skipped or which modes apply the source check.
Unless the mode is full, Claude Code now passes on only the soft_deny and hard_deny auto mode settings instead of all of them
Attaching or reading a file whose path resolves to a different real path, such as through a link, is now refused with the reason resolves_elsewhere
Claude Code now refuses to read paths that name a device or process file, or that it cannot resolve well enough to rule that out
If another MCP server already uses a server's name, its allow rules are ignored and a warning now tells you how to fix it
On Linux and WSL, rewind now refuses to delete a file if its folder moved or was replaced by a link since the checkpoint
Unclear The default of the server-controlled setting behind this check is not known, so it is unclear whether the check is active.
Bash permission checks treat git init, {} and ~ in arguments, and several more git config keys as needing approval
Unclear The new checks depend on an internal switch whose default is not stated, so it is unclear whether they apply for every reader.
A path that climbs out of its folder through a link's target is now refused unless the check explicitly allows it
Claude Code now also removes GIT_TEMPLATE_DIR and ARGV0 from the environment it hands to git, under a specific condition
For some kinds of configuration, the allow and deny lists for MCP servers now match against a second worked-out form of the command or URL
Unclear It is not clear which kinds of server configuration get the second check or how the second form differs from the first.
Claude Code rejects NAME=value command prefixes whose value looks like a path, and refuses prefix matches for Bash commands with wildcards, ~, = or !
Claude Code's git write protection now refuses a command that sets ARGV0 and explains that it changes the name git is started under
The Read tool now checks a path before reading and stops with 'Read refused by the device guard' if it points at a device file
When a Bash command starts with VAR=value, permission matching now checks the value as well as the variable name
Unclear It is not clear which values are now accepted or refused, so it is unclear whether commands that used to match a rule might now ask for permission.
read_file now refuses a path through a symlink whose target goes up a folder after its leading "../" parts
The guard keeping git commands inside a worktree now catches risky git init options, find -exec with git, and bare git variable assignments
Unclear Whether the new checks are switched on depends on two server switches whose defaults are not known.
The claude-code.d.ts type definitions file is no longer bundled inside Claude Code, and another bundled file was replaced
Published verbatim by Anthropic for v2.1.310. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 26 bullets, 1 name something an entry on this page also names, 6 name something no entry here does, and 19 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
effort-2025-11-24 beta value or mid-conversation system messages; Claude Code now retries without them
No entry names this cleanupPeriodDays is set to a very large value
No entry names this -p, Agent SDK) during compaction when the transcript file is very large
Nothing to match on Image to draw inside tmux with allow-passthrough and focus-events on, in kitty, Ghostty, and iTerm2 3.5+ with fullscreen rendering, where it showed only its alt text
Probably tmux-image-support-diagnostics-module-no-caller-seen /sandbox and the sandbox startup warning to name Ubuntu's AppArmor restriction on user namespaces, and how to lift it, when it keeps bubblewrap from starting the sandbox
No entry names this ! commands such as !restart and !help as ordinary messages when sent in bold, italic or strikethrough
Nothing to match on 3 of 30 tool descriptions changed. 1 of 28 tool schemas changed. The appended system-reminder blocks moved: 1 line added.
Claude Code, interactive mode
15 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
691 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 29 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?