Claude Code can now download files with two new tools, FetchAttachment and DownloadTaskFile. Self-hosted runners get --hold-idle-file and --max-hold-min, which keep a session held while a file you update stays recent. Apps that embed Claude Code can pass a separate sign-in token for cloud sessions with CLAUDE_CODE_SESSIONS_OAUTH_TOKEN. Organizations can now list fingerprints of approved plugin releases in managed settings. A hooks plugin then loads only from a folder that matches one of them. Setting CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a quicker way to pass along plain streamed text when Claude Code runs without its interactive screen.
Some work in this build is not switched on yet. A built-in plugin that connects Claude to the Claude Platform developer docs is bundled but stays off. Background memory extraction can be made to run as a task you can stop, but this is off by default. Claude Code can also combine held-back pieces of a streamed reply into one update, and that is off unless switched on remotely. Several new server-controlled switches appear too, and what they control is not known.
Agent worktrees are no longer removed while another task is still working inside them. Attachments too big to hold in memory are now saved to the uploads folder instead of being rejected. Large images also get a smaller copy for Claude. Interrupting Claude Code while it reads an MCP resource or folder now cancels the read cleanly. Text with wide characters no longer overflows the terminal, because Claude Code now re-wraps such lines character by character. These are part of the fixes, and the full list is below.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognizes a --personal flag, and session start-up and cloud session creation gain persistentVolumeFromSessionId
InterfaceA new CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS variable appears, and some permission rules are now marked as not waivable in bypass mode
Remote sessions gain handlers that place downloaded files in a session folder, and plugins can paint text and decorations into the prompt box
ExtensionsNew environment variable CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a shortcut for streamed output in headless sessions
Managed settings can list pluginDigests on a marketplace, so plugins in prependPlugins or appendPlugins run at the organization tier
mcpMount settings layer and remembered security warningsSettings & configWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Managed settings can list pluginDigests on a marketplace, so plugins in prependPlugins or appendPlugins run at the organization tier
New --hold-idle-file and --max-hold-min runner flags stop idle release while a host-kept file stays fresh, with a startup line reporting the hold
Plugin hooks modules can now load from organization-provided texts instead of disk, and the check deciding whether a hooks module may load moved into one helper
Unclear How an organization supplies the code, and so when the sealed loading is used, is not established.
Sealed organization plugins are now checked by a sha256 digest of their folder and their manifest before they load, and are refused if anything does not match
Unclear It is not clear whether any organization's plugins are currently checked this way.
A built-in switch now turns on registration of a hybrid settings scope, which was turned off in the previous build
Unclear It is not clear what the hybrid settings scope holds or whether it changes which settings apply to you.
mcpMount settings layer and remembered security warnings#Claude Code's settings order gains an mcpMount layer, and it now saves a record of security warnings you have already seen
Unclear It is not clear whether MCP servers can actually supply settings through the new layer.
Claude Code now switches off its tether feature for zero data retention accounts when a server-side switch says so
Unclear What the tether feature does is not stated.
Teammates now respect DISABLE_COMPACT, and the settings environment filter treats DISABLE_COMPACT specially
Claude Code now skips building OpenTelemetry events when nothing would receive them; set CLAUDE_CODE_DISABLE_OTEL_EVENT_SKIP to stop this
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
16 more of these are in What probably matters to you, above.
A self-hosted code review session will not start when the launcher hooks sent by the service fail checks or cannot be registered
When every upstream fails, the gateway's 499 and 502 responses now carry an x-gateway-model header, and 502s copy some upstream headers
For XAA MCP servers, Claude Code remembers the sign-in authorization server and errors if the server later points somewhere else
Per-tool permission settings are now read for MCP servers connected over HTTP or SSE, as well as for claude.ai proxy servers
Before checking Trusted Devices enrollment, Remote Control now runs another check that can stop it with its own error message
Unclear It is not stated what the new check tests or what its error says.
Updating a bridge session now retries after a login failure and is refused for third-party providers; move-to-cloud also retries once with a fresh token
If proxyAuthHelper is set by your organization and the proxy in use is not the one it started for, Claude Code sends no credential
Commands set in managed settings, like apiKeyHelper, now run without environment variables from project settings or plugins, except some cloud ones
The message about passed-over plugin hooks now says organization-restricted events can be reopened to some plugins, and lists them
Unclear How an organization lets a plugin through on a restricted event is not described.
MCP connections now read the SSL_CERT_FILE certificate bundle only when a proxy applies, not whenever HTTPS_PROXY is set
A self-hosted session no longer fails when an extra context repository keeps asking it to wait; it starts without that repository and warns
Claude Code now uses a second source for the traceparent tracing header, so it can be sent in cases where it was not sent before
Unclear What the second traceparent source is, and so which requests now carry the header, is not stated.
NODE_EXTRA_CA_CERTS entries#Claude Code now explains when no usable CA certificate is found, and stops re-adding NODE_EXTRA_CA_CERTS certificates that are already trusted
After setting up the sandbox on Windows, Claude Code no longer sends you to /sandbox when policy-controlled settings stop it from helping
Claude Code now stops sending usage data to Datadog once network rules refuse that traffic
6 more of these are in What probably matters to you, above.
Claude Code now uses the label Remote Control server mount when naming where a policy for a mounted MCP server came from
Usage data gains fields on tools used, kinds of shell commands, reused request content and resuming agents in cloud sessions
Unclear What the new assigned-variable class changes about which commands need permission is not known.
The usage data Claude Code sends about Bash commands now lists the kinds of commands used, worked out by a new parser
The check that decides whether installed plugins' hooks load now starts with a new condition and drops an old special case
Unclear What the new condition checks is not known, so it is unclear whether installed plugins' hooks now load in more or fewer cases.
The five settings that run your own command for a credential or header now all start that command through one shared runner
Unclear It is not known whether the shared runner changes how or when these helper commands actually run.
Startup checks of permission rules were reorganised; the warning for a rule that names no known tool reads the same
Unclear It is not clear whether the reorganisation changes which warnings appear or when.
A failed reply to an artifact comment that fails because it is outside your organisation is now logged under its own outcome
claude gateway under provider restrictions was rewritten#The check that stops claude gateway when managed settings restrict API providers was rewritten; its message is unchanged
Unclear It is not clear whether the rewritten check blocks claude gateway in the same cases as the old one.
The gateway now captures the upstream apim-request-id header, logs it, and strips it and the existing request ID from responses
Unclear Whether this gateway runs for ordinary Claude Code users is not stated.
Published verbatim by Anthropic for v2.1.311. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 92 bullets, 18 name something an entry on this page also names, 22 name something no entry here does, and 52 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
--hold-idle-file and --max-hold-min to self-hosted-runner, to keep an idle session while your host reports processes it left running
Probably self-hosted-runner-holds-idle-release-while-a-left-running-p, self-hosted-runner-logs-a-leftover-hold-line-in-its-watchdog, self-hosted-runner-can-hold-sessions-while-a-host-file-stays claude -p and SDK sessions saving transcript messages out of order or keeping messages that were taken back
No entry names this SubagentStop hooks running about twice a minute for each running subagent instead of once when it finishes
No entry names this .ignore/.rgignore negation rules that re-include git-ignored files
Nothing to match on claude mcp add, claude mcp remove and /mcp naming the current folder instead of the project entry in ~/.claude.json that holds a local-scope server when run below a repository root
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t claude mcp list and claude mcp get showing the error code twice on failed-connection lines (for example ENOENT: ENOENT: …)
No entry names this claude daemon restart; it now suggests claude daemon stop --any and says it ends background sessions
No entry names this claude respawn <id> starting the background service before reporting that no background session matches the id
No entry names this /effort not warning about a prompt cache miss in plan mode when the plan model differs from the session model
Probably effort-line-can-say-it-may-wait-for-your-next-message, effort-step-keybinding-with-cache-miss-confirmation, shiftupdown-bound-to-effort-increasedecrease-in-chat-keyb /ide saying the VS Code extension was installed before the install finished or when it failed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui agent; Cowork cloud sessions now ignore that setting
Nothing to match on --resume, --continue, /resume or --session-id, including after /clear or a crash, and /branch writing to the original session's list
Probably team-lead-process-recorded-clear-keeps-task-list-link, resume-restores-prompt-waits ! open /tmp/shot.png or /review look at /tmp/shot.png, attaching the image and dropping its path from the prompt
Probably review-ultra-help-text-clarified #101693Option to disable automatic conversion of image file paths into [Image #N] attachments in the prompt input Open
"\" or (\), disappearing from Claude's responses
No entry names this DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp /code-review, or another skill that runs in a sub-agent, running a second time when a cloud or background session restarts
Probably review-ultra-help-text-clarified /ide saying it had installed the JetBrains plugin when nothing was installed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui /mcp showing a remote server as failed after "Clear authentication" when the server works without sign-in
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t /mcp showing "authenticated" for a remote server that Claude Code sends no credentials to
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t #98942[BUG] Claude Code marks an anonymous MCP server authenticated when it lists a tool Open
--plugin-dir folder of plugins loading as one plugin when an empty .mcp.json was at its top
Probably empty-mcpjson-is-skipped-claudemd-files-naming-devices-a /usage never showing large prompt-cache misses under "What's contributing to your limits usage?"
No entry names this CLAUDE_CODE_RETRY_WATCHDOG), indefinitely
No entry names this bwrap: Can't create file when a --plugin-dir folder was also an added directory and permissions.blockReadsOutsideWorkingDirectories was on
No entry names this /teleport and claude --teleport to warn when a compacted cloud session loads from its last compaction, so the messages it summarized aren't in the local copy
No entry names this #name and no longer says the address bar stays the same as you switch views
Nothing to match on claude --model opus
No entry names this ultrathink in the interactive terminal to run its turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API; typed while Claude is working, it raises the rest of that turn
Nothing to match on ultrathink rainbow to appear only where the keyword can raise effort, and not when the word is quoted or part of a file path
Nothing to match on --output-format json and stream-json output to write DEL, C1 control and Unicode format characters inside strings as \uXXXX escapes; parsed values are unchanged
No entry names this [1m] suffix and its label on models where the suffix has no effect; the suffix is still accepted
Probably model-name-resolution-no-longer-special-cases-the-1m-suffix /code-review to tell Claude to put the effort level first and use max only when asked
Probably review-ultra-help-text-clarified DISABLE_COMPACT in settings files and in a mod's $.env.set so they can only turn compaction off, not back on
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp CLAUDE_CODE_SYNC_SKILLS with feature-flag fetching off to reuse a claude.ai skills list up to 10 minutes old that another session on the machine fetched
No entry names this claude purge to say it deletes data only on this computer, not anything stored by Anthropic
No entry names this DISABLE_TELEMETRY set while VS Code's telemetry setting is off, so they send no usage metrics or error reports and fetch no feature flags
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 30 tool descriptions changed. The appended system-reminder blocks moved: 4 lines added, 5 lines removed.
Claude Code, interactive mode
12 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
437 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 79 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?