Claude Code can now download files with two new tools, FetchAttachment and DownloadTaskFile. Self-hosted runners get --hold-idle-file and --max-hold-min, which keep a session held while a file you update stays recent. Apps that embed Claude Code can pass a separate sign-in token for cloud sessions with CLAUDE_CODE_SESSIONS_OAUTH_TOKEN. Organizations can now list fingerprints of approved plugin releases in managed settings. A hooks plugin then loads only from a folder that matches one of them. Setting CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a quicker way to pass along plain streamed text when Claude Code runs without its interactive screen.
Some work in this build is not switched on yet. A built-in plugin that connects Claude to the Claude Platform developer docs is bundled but stays off. Background memory extraction can be made to run as a task you can stop, but this is off by default. Claude Code can also combine held-back pieces of a streamed reply into one update, and that is off unless switched on remotely. Several new server-controlled switches appear too, and what they control is not known.
Agent worktrees are no longer removed while another task is still working inside them. Attachments too big to hold in memory are now saved to the uploads folder instead of being rejected. Large images also get a smaller copy for Claude. Interrupting Claude Code while it reads an MCP resource or folder now cancels the read cleanly. Text with wide characters no longer overflows the terminal, because Claude Code now re-wraps such lines character by character. These are part of the fixes, and the full list is below.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognizes a --personal flag, and session start-up and cloud session creation gain persistentVolumeFromSessionId
InterfaceA new CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS variable appears, and some permission rules are now marked as not waivable in bypass mode
Remote sessions gain handlers that place downloaded files in a session folder, and plugins can paint text and decorations into the prompt box
ExtensionsNew environment variable CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a shortcut for streamed output in headless sessions
Managed settings can list pluginDigests on a marketplace, so plugins in prependPlugins or appendPlugins run at the organization tier
mcpMount settings layer and remembered security warningsSettings & configWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Sealed organization plugins are now checked by a sha256 digest of their folder and their manifest before they load, and are refused if anything does not match
Unclear It is not clear whether any organization's plugins are currently checked this way.
New chat:increaseEffort and chat:decreaseEffort keys (Shift+Up and Shift+Down) raise or lower effort, with a tip, a shortcut hint and a cache warning
Unclear Whether these shortcuts apply on every platform and build is not stated.
Claude is now told to pick the max review level only when you, CLAUDE.md or a skill explicitly asks, never on its own judgment
A prompt containing ultrathink now sets reasoning effort to xhigh for that request when the model you are using qualifies
Unclear Which models qualify, and what other conditions must hold, is not stated.
Subagents' long commands can be moved to the background sooner, and the messages Claude gets about backgrounded or stopped commands are clearer
Unclear Where the subagent cap's value comes from, and whether it always applies, is not known.
Claude Code now builds a list of bash/zsh candidates, accepts CLAUDE_CODE_SHELL only if it matches, and tells Claude about your login shell
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
16 more of these are in What probably matters to you, above.
The permission auto-deny timer can now deny non-safety-check prompts immediately, and the auto-mode denial card can show the auto-deny window
Unclear The condition that makes the refusal immediate is not stated, so it is unclear which prompts this affects.
Claude Code now compares MCP tool listings it was handed at start-up with the server's live listing and refuses calls that do not match, with an opt-out
Unclear It is not clear whether this check applies to every MCP server or only in a particular mode, or whether something switches it on.
Behind a flag, @-mentioned files share a size budget: files that do not fit are cut to their first lines, and over-limit files can become references
Behind a flag, attached-project texts are trimmed with the rest saved to a file, and project docs that cannot be saved now fail instead of being inlined
Unclear It is not clear whether project_info's saving to a file is also behind the server-controlled setting or always applies.
Claude Code now drops SessionEnd hooks that come from certain plugins, where before every plugin hook was kept
Unclear It is not clear which plugins have their SessionEnd hooks left out.
Processes Claude Code starts now get CLAUDE_CODE_TASK_LIST_ID and have CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS set to empty
A self-hosted code review session will not start when the launcher hooks sent by the service fail checks or cannot be registered
Loading a plugin's hook code now fails when it cannot be proved genuine or when a verified module would be reloaded from disk
For XAA MCP servers, Claude Code remembers the sign-in authorization server and errors if the server later points somewhere else
Claude in Chrome now refuses browser_batch in some cases, including auto mode with session allow rules, and tells Claude to make each action its own call
One rule that removed the [1m] suffix from a model name is gone, so the suffix is now added in those cases
Unclear Which accounts or setups met the conditions of the removed rule is not stated.
Before checking Trusted Devices enrollment, Remote Control now runs another check that can stop it with its own error message
Unclear It is not stated what the new check tests or what its error says.
Updating a bridge session now retries after a login failure and is refused for third-party providers; move-to-cloud also retries once with a fresh token
The folder list Claude Code gives MCP servers now uses a session's directory when one is set, and the working directory otherwise
Unclear When a session has its own directory, and so when the roots differ from the working directory, is not stated.
Shell safety checks are stricter for date formats, stat paths, zsh stat options and zsh module builtins, with new hints on how to pass
Unclear What switches this stricter mode on, and whether it is on for a given user, is not stated.
Claude Code now skips a workflow that is a link to something other than a readable regular file, or to a place it refuses
Commands that write, or may write, to Claude Code's own settings files are now flagged, and no allow rule is suggested for them
Unclear It is not clear whether, in auto mode, you are still stopped and asked before a flagged command runs.
A permission check that used only project and local settings now also reads your user settings, and warns if that file did not load
The sandbox's rules now include blocking git configuration lock files in nested repositories and a profile for granting access to symlinks
Some kinds of hook load failure now drop the plugin they came from, and hook modules are put in order before loading
Unclear Which kinds of load failure cause a plugin to be dropped is not stated.
For a compacted cloud session, a transcript request returns only the messages the last compaction kept, so summarized messages may be on no page
If proxyAuthHelper is set by your organization and the proxy in use is not the one it started for, Claude Code sends no credential
A session that keeps restarting with no new message can now be stopped from continuing by itself and will ask you to send a message
Commands set in managed settings, like apiKeyHelper, now run without environment variables from project settings or plugins, except some cloud ones
When you stop a turn, Claude Code now also stops the shells that had been moved off that turn
Unclear Exactly which background shells count as moved, and are therefore stopped, is not clear.
If the same command in the same folder is already running in the background, the Bash tool now refuses to start it again and says where it is
Unclear What the further check is, and so whether the refusal applies in a given session, is not clear.
Over-long hook output is now trimmed, and a too-long updatedToolOutput is dropped so Claude reads the tool's original result
Shell command checks cover more zsh, Ruby and PHP constructs, and the sandbox blocks more home-folder grants and git config.lock tampering
Unclear It is not clear whether the new checks are switched on by default.
Claude Code's Bash permission check now runs a second pass in some cases and can ask about variables or loops it cannot check in advance
Unclear It is not clear which parts of this check are new behaviour and which are existing checks reorganised, so it is unclear how often approval prompts change.
MCP connections now read the SSL_CERT_FILE certificate bundle only when a proxy applies, not whenever HTTPS_PROXY is set
Claude Code now skips a skill file that is not a regular file or that is refused because of where it leads
Unclear It is not stated which link targets are refused, so it is unclear whether skills you keep as symlinks will still load.
In remote sessions, WebFetch and WebSearch requests sent through a proxy now fail with a clear error if they pass a deadline
Unclear It is not stated how long the deadline is by default or whether it can be changed.
A Bash command is not run if its working directory changed between the permission check and running it; you are asked to retry
${CLAUDE_PROJECT_DIR} can now fail instead of using a fallback folder#When the project folder can't be found, ${CLAUDE_PROJECT_DIR} in a plugin is no longer replaced with another folder and an error is raised instead
When asked to, Claude Code's file search now reports an error if ripgrep timed out, was stopped or overflowed, instead of returning a partial list
Claude Code now refuses a shell command if its working folder points somewhere else, or is gone, since the command's permission check
In sessions with no project folder, plugin commands and skills lose any allowed-tools entry that names CLAUDE_PROJECT_DIR, and a warning is logged
Unclear Which kinds of session count as having no folder where tools run is not stated.
Claude Code now rejects file paths that name or link to network locations and asks you to copy the file locally first
Unclear Which file reads use the new network-path check is not clear.
Remote sessions no longer receive an extra set of environment variables, and the connection now records why data was held back
Unclear Which environment variables were in the removed group, and so which ones remote sessions no longer get, is not stated.
After an MCP tool call, Claude Code now runs a new check on the tool's structured result and raises an error naming the server and tool if it fails
Unclear It is not clear what the new check looks for in structuredContent, so which results now cause an error is unknown.
Shell command safety checks now validate read arguments and treat redirects that read variables set in the same command as too complex
Claude Code's shell command analysis caches parses, checks declare/export/readonly more strictly and treats fewer commands as simple
Claude Code's bash reader now treats more ambiguous array and bracket forms as unclear, so some commands may ask for permission
The shell command reader gains a new check that can mark some commands unreadable, which may mean more permission prompts
Unclear Which shell commands this new check affects is not clear.
-- in gcloud compute ssh#Claude Code now flags a gcloud compute ssh command with a short option other than -q or -h placed before --
Unclear Whether a flagged command asks for permission or is blocked outright is not clear.
Before a shell command runs, Claude Code now checks more of its redirects to files and can refuse it or ask you first
Unclear Which redirect targets the new pass covers is not known.
Claude Code now treats another kind of misread shell command, involving $ values, as unreadable instead of trusting its reading
do not after ; or a new line can no longer be checked as safe#Claude Code now refuses to verify loops, functions and coproc commands whose do is not preceded by ; or a line break
Published verbatim by Anthropic for v2.1.311. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 92 bullets, 18 name something an entry on this page also names, 22 name something no entry here does, and 52 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
--hold-idle-file and --max-hold-min to self-hosted-runner, to keep an idle session while your host reports processes it left running
Probably self-hosted-runner-holds-idle-release-while-a-left-running-p, self-hosted-runner-logs-a-leftover-hold-line-in-its-watchdog, self-hosted-runner-can-hold-sessions-while-a-host-file-stays claude -p and SDK sessions saving transcript messages out of order or keeping messages that were taken back
No entry names this SubagentStop hooks running about twice a minute for each running subagent instead of once when it finishes
No entry names this .ignore/.rgignore negation rules that re-include git-ignored files
Nothing to match on claude mcp add, claude mcp remove and /mcp naming the current folder instead of the project entry in ~/.claude.json that holds a local-scope server when run below a repository root
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t claude mcp list and claude mcp get showing the error code twice on failed-connection lines (for example ENOENT: ENOENT: …)
No entry names this claude daemon restart; it now suggests claude daemon stop --any and says it ends background sessions
No entry names this claude respawn <id> starting the background service before reporting that no background session matches the id
No entry names this /effort not warning about a prompt cache miss in plan mode when the plan model differs from the session model
Probably effort-line-can-say-it-may-wait-for-your-next-message, effort-step-keybinding-with-cache-miss-confirmation, shiftupdown-bound-to-effort-increasedecrease-in-chat-keyb /ide saying the VS Code extension was installed before the install finished or when it failed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui agent; Cowork cloud sessions now ignore that setting
Nothing to match on --resume, --continue, /resume or --session-id, including after /clear or a crash, and /branch writing to the original session's list
Probably team-lead-process-recorded-clear-keeps-task-list-link, resume-restores-prompt-waits ! open /tmp/shot.png or /review look at /tmp/shot.png, attaching the image and dropping its path from the prompt
Probably review-ultra-help-text-clarified #101693Option to disable automatic conversion of image file paths into [Image #N] attachments in the prompt input Open
"\" or (\), disappearing from Claude's responses
No entry names this DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp /code-review, or another skill that runs in a sub-agent, running a second time when a cloud or background session restarts
Probably review-ultra-help-text-clarified /ide saying it had installed the JetBrains plugin when nothing was installed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui /mcp showing a remote server as failed after "Clear authentication" when the server works without sign-in
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t /mcp showing "authenticated" for a remote server that Claude Code sends no credentials to
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t #98942[BUG] Claude Code marks an anonymous MCP server authenticated when it lists a tool Open
--plugin-dir folder of plugins loading as one plugin when an empty .mcp.json was at its top
Probably empty-mcpjson-is-skipped-claudemd-files-naming-devices-a /usage never showing large prompt-cache misses under "What's contributing to your limits usage?"
No entry names this CLAUDE_CODE_RETRY_WATCHDOG), indefinitely
No entry names this bwrap: Can't create file when a --plugin-dir folder was also an added directory and permissions.blockReadsOutsideWorkingDirectories was on
No entry names this /teleport and claude --teleport to warn when a compacted cloud session loads from its last compaction, so the messages it summarized aren't in the local copy
No entry names this #name and no longer says the address bar stays the same as you switch views
Nothing to match on claude --model opus
No entry names this ultrathink in the interactive terminal to run its turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API; typed while Claude is working, it raises the rest of that turn
Nothing to match on ultrathink rainbow to appear only where the keyword can raise effort, and not when the word is quoted or part of a file path
Nothing to match on --output-format json and stream-json output to write DEL, C1 control and Unicode format characters inside strings as \uXXXX escapes; parsed values are unchanged
No entry names this [1m] suffix and its label on models where the suffix has no effect; the suffix is still accepted
Probably model-name-resolution-no-longer-special-cases-the-1m-suffix /code-review to tell Claude to put the effort level first and use max only when asked
Probably review-ultra-help-text-clarified DISABLE_COMPACT in settings files and in a mod's $.env.set so they can only turn compaction off, not back on
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp CLAUDE_CODE_SYNC_SKILLS with feature-flag fetching off to reuse a claude.ai skills list up to 10 minutes old that another session on the machine fetched
No entry names this claude purge to say it deletes data only on this computer, not anything stored by Anthropic
No entry names this DISABLE_TELEMETRY set while VS Code's telemetry setting is off, so they send no usage metrics or error reports and fetch no feature flags
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 30 tool descriptions changed. The appended system-reminder blocks moved: 4 lines added, 5 lines removed.
Claude Code, interactive mode
12 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
437 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 79 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?