Claude Code can now download files with two new tools, FetchAttachment and DownloadTaskFile. Self-hosted runners get --hold-idle-file and --max-hold-min, which keep a session held while a file you update stays recent. Apps that embed Claude Code can pass a separate sign-in token for cloud sessions with CLAUDE_CODE_SESSIONS_OAUTH_TOKEN. Organizations can now list fingerprints of approved plugin releases in managed settings. A hooks plugin then loads only from a folder that matches one of them. Setting CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a quicker way to pass along plain streamed text when Claude Code runs without its interactive screen.
Some work in this build is not switched on yet. A built-in plugin that connects Claude to the Claude Platform developer docs is bundled but stays off. Background memory extraction can be made to run as a task you can stop, but this is off by default. Claude Code can also combine held-back pieces of a streamed reply into one update, and that is off unless switched on remotely. Several new server-controlled switches appear too, and what they control is not known.
Agent worktrees are no longer removed while another task is still working inside them. Attachments too big to hold in memory are now saved to the uploads folder instead of being rejected. Large images also get a smaller copy for Claude. Interrupting Claude Code while it reads an MCP resource or folder now cancels the read cleanly. Text with wide characters no longer overflows the terminal, because Claude Code now re-wraps such lines character by character. These are part of the fixes, and the full list is below.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognizes a --personal flag, and session start-up and cloud session creation gain persistentVolumeFromSessionId
InterfaceA new CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS variable appears, and some permission rules are now marked as not waivable in bypass mode
Remote sessions gain handlers that place downloaded files in a session folder, and plugins can paint text and decorations into the prompt box
ExtensionsNew environment variable CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a shortcut for streamed output in headless sessions
Managed settings can list pluginDigests on a marketplace, so plugins in prependPlugins or appendPlugins run at the organization tier
mcpMount settings layer and remembered security warningsSettings & configWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →16 more of these are in What probably matters to you, on page 1.
When a program asks Claude Code for its status, the reply can now include the name of the remote session
Results now include a list of the tools used when there were any, and saved sessions keep a record of tool usage
When you resume a team session, Claude Code now restores the team details and teammate colours as it starts
Attachment downloads over a remote connection can fetch a high-resolution copy, save large files to disk, and say when the disk is full
When Claude Code matches what to improve or add as a skill, it now looks at skills from plugins as well as your account's skills
Unclear It is not stated whether the skill-learning feature is switched on for users.
Turn results can now carry internal figures on CPU time, elapsed time and stream counts while replies stream in, sent only by certain workers
The queue that holds messages you type while Claude is busy can now release held-back input and report input that was dropped
Unclear It is not clear when queued input is held back or discarded, or whether you will see a notice about it.
New messages tell you a background session was not restarted because it was idle, stopped, or had no saved conversation
Servers loaded with --mcp-config are now recorded as written, and messages about missing environment variables change with where the config came from
When a background session restarts and has no transcript to resume, Claude Code now drops the setting that resumes an interrupted turn
Updating a bridge session now retries after a login failure and is refused for third-party providers; move-to-cloud also retries once with a fresh token
The folder list Claude Code gives MCP servers now uses a session's directory when one is set, and the working directory otherwise
Unclear When a session has its own directory, and so when the roots differ from the working directory, is not stated.
Shell safety checks are stricter for date formats, stat paths, zsh stat options and zsh module builtins, with new hints on how to pass
Unclear What switches this stricter mode on, and whether it is on for a given user, is not stated.
The Bash tool description in this version says a cd carries to the next call only in the main session and only in some cases
Before searching for tools, Claude Code now tries to reconnect failed MCP servers whose names appear in the search, waiting only a limited time
The tool that lists a project's commands now returns results page by page, so long lists are no longer truncated
Claude Code now skips a workflow that is a link to something other than a readable regular file, or to a place it refuses
--permission-mode with --dangerously-skip-permissions differently#When starting a child session, Claude Code can now drop or reorder --dangerously-skip-permissions relative to --permission-mode
Unclear It is not known which kinds of spawned sessions these argument changes apply to.
Commands that write, or may write, to Claude Code's own settings files are now flagged, and no allow rule is suggested for them
Unclear It is not clear whether, in auto mode, you are still stopped and asked before a flagged command runs.
MCP servers and tools blocked by Claude Code itself are now marked byClaudeCode and shown as "disabled by Claude Code"
Unclear It is not known whether the message you see about a blocked server changes.
A permission check that used only project and local settings now also reads your user settings, and warns if that file did not load
The background tasks list gains a post-turn memory group, and status line scripts can receive a remote session name
The sandbox's rules now include blocking git configuration lock files in nested repositories and a profile for granting access to symlinks
Some kinds of hook load failure now drop the plugin they came from, and hook modules are put in order before loading
Unclear Which kinds of load failure cause a plugin to be dropped is not stated.
When a workflow script finishes, its result now includes a toolsUsed list of the tools it called, if there were any
With the Slack MCP server, Claude is now told to read a channel's topic and description before posting to a channel you did not name
The instructions for summarising a fetched web page can now include a word limit between 50 and 5000 words
Unclear What sets the word limit is not stated, so it is unclear whether a user can choose it.
The background step that saves memories from a conversation can now be stopped on its own, and a stopped run counts as unfinished
For a compacted cloud session, a transcript request returns only the messages the last compaction kept, so summarized messages may be on no page
If proxyAuthHelper is set by your organization and the proxy in use is not the one it started for, Claude Code sends no credential
The rewind confirmation now says the message and everything after it will be removed, rather than that the conversation will be forked
Unclear Whether rewinding now removes messages, or only the dialog wording changed, is not stated.
After resuming a session through teleport, Claude Code now adds a warning if summarized parts of the history are missing
A session that keeps restarting with no new message can now be stopped from continuing by itself and will ask you to send a message
On resume, Claude Code now ignores interrupted turns older than an age limit and treats several API errors, not just rate limits, as the cause
Claude is now told when earlier-loaded tools have lost their input details, and to load them again with a select:<name> query before using them
Before confirming a change of effort level, Claude Code now also weighs the permission mode and whether the prompt cache may still be warm
Commands set in managed settings, like apiKeyHelper, now run without environment variables from project settings or plugins, except some cloud ones
Before restarting a stalled background session, Claude Code now looks up its saved state and reports why it is restarting
Claude Code now picks which shared task list to use from session settings, preferring a session list id over the team name for team members
Unclear It is not stated whether taskList.sessionListId is something you set yourself or something Claude Code fills in.
When images are left out of a request, Claude Code can now add a note pointing to a saved copy instead of only a count
Unclear It is not stated when saving left-out images is available, so it may not happen in every session.
The AskUserQuestion dialog has a new one-line view listing each question, with "(answered)" beside the ones you have already answered
Unclear It is not clear when the dialog switches to the one-line view, for example after every question is answered or only when the dialog is collapsed.
In cloud sessions, messages you send while the session is loading are held and added once it connects, and the session's name appears in the status view
Unclear It is not clear what decides whether messages are held, so it may not apply to every cloud session.
In cloud sessions, a message typed while Claude is working is shown as waiting until the server confirms it was delivered or the turn ends
Unclear It is not clear which remote machines support delivery reports, so it is unknown who sees this.
When you stop a turn, Claude Code now also stops the shells that had been moved off that turn
Unclear Exactly which background shells count as moved, and are therefore stopped, is not clear.
If the same command in the same folder is already running in the background, the Bash tool now refuses to start it again and says where it is
Unclear What the further check is, and so whether the refusal applies in a given session, is not clear.
Over-long hook output is now trimmed, and a too-long updatedToolOutput is dropped so Claude reads the tool's original result
In /mcp, Clear authentication now confirms stored OAuth sign-in data is really gone and reconnects, and server details read stored tokens
Shell command checks cover more zsh, Ruby and PHP constructs, and the sandbox blocks more home-folder grants and git config.lock tampering
Unclear It is not clear whether the new checks are switched on by default.
In print mode, waiting on background shells now sleeps until something changes instead of checking every 100ms, with a new env var to restore polling
Claude Code's Bash permission check now runs a second pass in some cases and can ask about variables or loops it cannot check in advance
Unclear It is not clear which parts of this check are new behaviour and which are existing checks reorganised, so it is unclear how often approval prompts change.
The 1, 2 and 0 review, send and dismiss keys are only shown when usable; otherwise the hint says to clear the text first
The CLAUDE_PROJECT_DIR fallback warning now says the process has no folder where tools run, and the lookup prefers a session's folder
Calls to a cached MCP server the host listed are now refused if the tool was not offered, as for connected servers
The dialog that asks your permission before Claude uses a tool can now show an optional note above the choices
Artifact instructions now limit link anchors to letters, digits and hyphens, warn against secrets in them and reserve comment-*
A hint about cloud sessions now says to delete a setting and then start a new claude --cloud session
Unclear Which setting the hint tells you to delete, and when the hint appears, is not stated.
When Artifacts is blocked, the error now says a rule, policy or expired token is the cause, or points to /login, /permissions and /config in a terminal
If the Files API rejects your claude.ai sign-in while saving, Claude Code now says so and asks you to sign in again and save again
When auto mode blocks an action, the message it builds now takes into account whether the caller has file-reading tools
Unclear It is not known what the refusal text now says in each case.
When a tool that Claude Code itself provides must always be approved, the prompt now says "Claude Code asks before every use of this tool."
The instruction telling Claude where to save a task's files can now point to a folder in this chat's container
Unclear It is not known which feature makes a task run in a chat's container.
The message about passed-over plugin hooks now says organization-restricted events can be reopened to some plugins, and lists them
Unclear How an organization lets a plugin through on a restricted event is not described.
Clicking an empty part of a scrollbar now jumps once to that spot, and small pointer wobble on release is ignored
MCP connections now read the SSL_CERT_FILE certificate bundle only when a proxy applies, not whenever HTTPS_PROXY is set
Files that a .ignore file brings back into view now appear when you type @ to mention a file
Claude Code no longer asks about the Consumer Terms again when the server has recently confirmed your answer for that account
Claude Code now skips a skill file that is not a regular file or that is refused because of where it leads
Unclear It is not stated which link targets are refused, so it is unclear whether skills you keep as symlinks will still load.
In remote sessions, WebFetch and WebSearch requests sent through a proxy now fail with a clear error if they pass a deadline
Unclear It is not stated how long the deadline is by default or whether it can be changed.
Claude Code now says 'can't use subscription - pay or renew, or use API key' in one case instead of blaming the organisation
A self-hosted session no longer fails when an extra context repository keeps asking it to wait; it starts without that repository and warns
When Claude calls a skill by a name that cannot be invoked directly, it is told the full name to use instead
A new tip asks "Want Claude to teach as it works?" and points to /config with outputStyle=explanatory
A Bash command is not run if its working directory changed between the permission check and running it; you are asked to retry
${CLAUDE_PROJECT_DIR} can now fail instead of using a fallback folder#When the project folder can't be found, ${CLAUDE_PROJECT_DIR} in a plugin is no longer replaced with another folder and an error is raised instead
When fetching a web page through a proxy runs out of time, Claude Code now reports it as its own kind of error
Claude Code now uses a second source for the traceparent tracing header, so it can be sent in cases where it was not sent before
Unclear What the second traceparent source is, and so which requests now carry the header, is not stated.
After a worker crashes, Claude Code now tries to restart it at once, and the crash notice no longer says it is respawning
When asked to, Claude Code's file search now reports an error if ripgrep timed out, was stopped or overflowed, instead of returning a partial list
If you keep asking Claude to explain things, a tip now suggests an explanatory output style through /config, at most three times ever
When Claude Code cannot reach Anthropic's API, the error now points to your proxy, your ANTHROPIC_BASE_URL gateway, or a VPN or firewall
Claude Code now refuses a shell command if its working folder points somewhere else, or is gone, since the command's permission check
In sessions with no project folder, plugin commands and skills lose any allowed-tools entry that names CLAUDE_PROJECT_DIR, and a warning is logged
Unclear Which kinds of session count as having no folder where tools run is not stated.
When a Bash command times out and is moved to the background, Claude now gets the output read back from that background task
NODE_EXTRA_CA_CERTS entries#Claude Code now explains when no usable CA certificate is found, and stops re-adding NODE_EXTRA_CA_CERTS certificates that are already trusted
Claude Code now rejects file paths that name or link to network locations and asks you to copy the file locally first
Unclear Which file reads use the new network-path check is not clear.
Remote sessions no longer receive an extra set of environment variables, and the connection now records why data was held back
Unclear Which environment variables were in the removed group, and so which ones remote sessions no longer get, is not stated.
Clickable slash-command links can now show arguments and a colour, and a failed GitHub pull request sign-in is now reported
The message_stop event Claude Code produces when a turn is interrupted can now say which partial content blocks to discard
Background monitor commands now save their output to disk and return its location instead of only the last lines of errors
Unclear It is unclear whether you can see or open the saved output yourself.
A notice now says when a transcript was loaded from the session's last compaction, so the older messages it summarized are missing
An empty .mcp.json is left out of a config-file check, and a CLAUDE.md path that names a device or process file is skipped with a log message
After an MCP tool call, Claude Code now runs a new check on the tool's structured result and raises an error naming the server and tool if it fails
Unclear It is not clear what the new check looks for in structuredContent, so which results now cause an error is unknown.
The preview shown after Claude writes a file now trims by wrapped screen rows and says how many characters are hidden, not just how many lines
When you delete a permission rule, Claude Code now writes a line saying the rule was deleted or that it could not be and is unchanged
In fullscreen mode, dialogs scroll into view and keypresses that would answer them are held back while they are not fully visible
Unclear It is not clear whether this applies only in fullscreen mode or whether it is behind a setting.
The agents list now responds to Ctrl-D when the search is empty or in simple view, and handles Ctrl-C the same way
Unclear It is not stated whether Ctrl-D here closes only the agents list or exits Claude Code altogether.
With --continue or --resume in print mode, Claude Code now restores prompts that were waiting for an answer when the session stopped
In fullscreen mode, a dialog now scrolls into view, and your earlier scroll position or the bottom comes back when it closes
/ide uses one install screen however many IDEs are running#/ide now shows the same install screen whenever any IDE is running, and shows install dialogs one at a time for each IDE
Shell command safety checks now validate read arguments and treat redirects that read variables set in the same command as too complex
Published verbatim by Anthropic for v2.1.311. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 92 bullets, 18 name something an entry on this page also names, 22 name something no entry here does, and 52 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
--hold-idle-file and --max-hold-min to self-hosted-runner, to keep an idle session while your host reports processes it left running
Probably self-hosted-runner-holds-idle-release-while-a-left-running-p, self-hosted-runner-logs-a-leftover-hold-line-in-its-watchdog, self-hosted-runner-can-hold-sessions-while-a-host-file-stays claude -p and SDK sessions saving transcript messages out of order or keeping messages that were taken back
No entry names this SubagentStop hooks running about twice a minute for each running subagent instead of once when it finishes
No entry names this .ignore/.rgignore negation rules that re-include git-ignored files
Nothing to match on claude mcp add, claude mcp remove and /mcp naming the current folder instead of the project entry in ~/.claude.json that holds a local-scope server when run below a repository root
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t claude mcp list and claude mcp get showing the error code twice on failed-connection lines (for example ENOENT: ENOENT: …)
No entry names this claude daemon restart; it now suggests claude daemon stop --any and says it ends background sessions
No entry names this claude respawn <id> starting the background service before reporting that no background session matches the id
No entry names this /effort not warning about a prompt cache miss in plan mode when the plan model differs from the session model
Probably effort-line-can-say-it-may-wait-for-your-next-message, effort-step-keybinding-with-cache-miss-confirmation, shiftupdown-bound-to-effort-increasedecrease-in-chat-keyb /ide saying the VS Code extension was installed before the install finished or when it failed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui agent; Cowork cloud sessions now ignore that setting
Nothing to match on --resume, --continue, /resume or --session-id, including after /clear or a crash, and /branch writing to the original session's list
Probably team-lead-process-recorded-clear-keeps-task-list-link, resume-restores-prompt-waits ! open /tmp/shot.png or /review look at /tmp/shot.png, attaching the image and dropping its path from the prompt
Probably review-ultra-help-text-clarified #101693Option to disable automatic conversion of image file paths into [Image #N] attachments in the prompt input Open
"\" or (\), disappearing from Claude's responses
No entry names this DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp /code-review, or another skill that runs in a sub-agent, running a second time when a cloud or background session restarts
Probably review-ultra-help-text-clarified /ide saying it had installed the JetBrains plugin when nothing was installed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui /mcp showing a remote server as failed after "Clear authentication" when the server works without sign-in
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t /mcp showing "authenticated" for a remote server that Claude Code sends no credentials to
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t #98942[BUG] Claude Code marks an anonymous MCP server authenticated when it lists a tool Open
--plugin-dir folder of plugins loading as one plugin when an empty .mcp.json was at its top
Probably empty-mcpjson-is-skipped-claudemd-files-naming-devices-a /usage never showing large prompt-cache misses under "What's contributing to your limits usage?"
No entry names this CLAUDE_CODE_RETRY_WATCHDOG), indefinitely
No entry names this bwrap: Can't create file when a --plugin-dir folder was also an added directory and permissions.blockReadsOutsideWorkingDirectories was on
No entry names this /teleport and claude --teleport to warn when a compacted cloud session loads from its last compaction, so the messages it summarized aren't in the local copy
No entry names this #name and no longer says the address bar stays the same as you switch views
Nothing to match on claude --model opus
No entry names this ultrathink in the interactive terminal to run its turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API; typed while Claude is working, it raises the rest of that turn
Nothing to match on ultrathink rainbow to appear only where the keyword can raise effort, and not when the word is quoted or part of a file path
Nothing to match on --output-format json and stream-json output to write DEL, C1 control and Unicode format characters inside strings as \uXXXX escapes; parsed values are unchanged
No entry names this [1m] suffix and its label on models where the suffix has no effect; the suffix is still accepted
Probably model-name-resolution-no-longer-special-cases-the-1m-suffix /code-review to tell Claude to put the effort level first and use max only when asked
Probably review-ultra-help-text-clarified DISABLE_COMPACT in settings files and in a mod's $.env.set so they can only turn compaction off, not back on
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp CLAUDE_CODE_SYNC_SKILLS with feature-flag fetching off to reuse a claude.ai skills list up to 10 minutes old that another session on the machine fetched
No entry names this claude purge to say it deletes data only on this computer, not anything stored by Anthropic
No entry names this DISABLE_TELEMETRY set while VS Code's telemetry setting is off, so they send no usage metrics or error reports and fetch no feature flags
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 30 tool descriptions changed. The appended system-reminder blocks moved: 4 lines added, 5 lines removed.
Claude Code, interactive mode
12 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
437 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 79 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?