You can now set oidc.user_id_claim to choose which sign-in token field holds the user ID for the OIDC gateway. It defaults to sub. Among the other shipped changes, the prompt asking whether Claude may use a skill now shows the skill's description in a scrollable box. Usage messages now call your short-term limit the "5-hour limit". Programs that embed Claude Code can now mark a question as skipped, answered in chat or dismissed with the ask_user_question_unanswered_v1 capability. Remote control can now ask a session to start a shell command in the background, and the usual permission checks still apply.
Several features are in this build but are not switched on yet. Cloud sessions can enforce a policy on model and effort changes, but only when a worker policy is set to enforce. Auto mode gains a remote list that can turn off its extra safety checks. A tip about Claude Design shows only if a flag is switched on from Anthropic's servers. A note telling Claude that staged files are still being copied is also off by default.
Among the fixes, agent calls cut off by a container restart now resume, or Claude is told plainly why they cannot. Skills supplied by MCP servers can no longer be run through the Skill tool and now return an "Unknown skill" error. Plan mode is read-only again because its workshop and prototype offers are removed. Signed policy documents are no longer rejected for being older than one already accepted. Mantle is gone from the built-in list of model providers.
Written by our agent from the shipped bundle, not by Anthropic.
AskUserQuestion's instructions now say the user may see only the question dialog, and hosts can mark a question skipped, replied in chat or dismissed
ExtensionsWhen loading an MCP skill needs permission, Claude Code can now hold the request until a person answers it
Extensions
subA new oidc.user_id_claim setting picks which sign-in token field holds the user ID, defaulting to sub
/effort now reads 'default' and 'auto' from what you typed, its auto keyword comes from a helper, and sessions record the effort sent each turn
ElsewhereA queued message can now show a send-now hint, and in the fullscreen display you can click it to send the message straight away
Sessions & agentsWant the reasoning? Read walks the 24 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
A new start_shell_task remote request runs a background Bash command in a session through the normal permission checks; cloud-hosted sessions reject it
Unclear Which remote clients can send this request, and whether anything switches it on or off, is not known.
AskUserQuestion's instructions now say the user may see only the question dialog, and hosts can mark a question skipped, replied in chat or dismissed
Sessions run by Claude in Slack or Teams now skip server-managed settings, marked by a new claude_tag reason; policy limits are decided separately
The privacy dialog and the consumer terms dialog can now lock the data-sharing (Grove) choice for Claude Science accounts, showing it as not available
Unclear It is not clear exactly which options the locked terms dialog still shows.
Several startup tips, including the /memory tip, now read their text through a content-link table, and the Claude Design tip sits behind a flag
When loading an MCP skill needs permission, Claude Code can now hold the request until a person answers it
Unclear It is not clear whether the mcpSkillAsk setting is on by default or which kinds of session use this hold.
Workflow agents can return their final report through a handback tool, and that output is reviewed beyond auto mode when report review is set
Unclear It is not clear which permission modes give workflow agents the handback tool.
Claude Code rebuilt how it assembles its system prompt and can record each section's choice, but the prompt text itself is unchanged by it
Permission checks now honour and record server classifier input rewrites, can use a server arbiter when auto mode is off, and track missing server checks
Unclear It is not clear what condition lets the server check run with auto mode off, or what the announcement says.
sub#A new oidc.user_id_claim setting picks which sign-in token field holds the user ID, defaulting to sub
Unclear Whether tokens must still include a sub claim when oidc.user_id_claim names a different one is not settled.
Claude Code no longer offers its chart tool when a network proxy is configured
Cloud sessions gain handling for model and effort change requests that only takes effect when a worker policy is set to enforce
Unclear Where the policy comes from, and what a reader sees when it is enforced, is not stated.
claude-mythos-5 is no longer automatically excluded from the lean prompt#Claude Code no longer rules out the lean prompt for claude-mythos-5 up front and now checks it by model name like other models
Unclear Whether claude-mythos-5 now actually receives the lean prompt depends on the rest of the check, which is not known.
Claude Code's internal agent messaging format gained fields for refused messages, replies awaiting consent and resume position
Unclear It is not clear what feature these fields belong to or whether any of it can be reached by users yet.
The prompt asking whether Claude may use a skill now shows its description in a scrollable box and says when the terminal is too small to approve
Unclear It is unclear whether this dialog replaces any earlier skill prompt everywhere or only appears for some kinds of request.
Auto mode gains a remote list that can switch off its extra safety checks, and a policy for verdicts on tool calls that were rewritten
The output style picker now marks itself as the non-redesigned version, which suggests a redesigned picker is in progress
/effort now reads 'default' and 'auto' from what you typed, its auto keyword comes from a helper, and sessions record the effort sent each turn
Unclear It is not known which extra values the command now accepts.
A queued message can now show a send-now hint, and in the fullscreen display you can click it to send the message straight away
Remote Control now shows a status line per helper and a long-running row, and pressing x twice disconnects cloud sessions from your folder
On the Remote Control QR code screen, pressing x starts a disconnect and pressing any other key cancels it
/model in agent view picks an exact name before a partial match#In agent view, /model now matches an exact model name first, ignoring case, before falling back to a unique partial match
Pressing Ctrl-D while in bash mode with nothing typed now returns the input box to normal prompt mode
Unclear Whether pressing Ctrl-D twice still exits Claude Code from an empty bash mode prompt is not known.
disableAutoMode is now listed directly among the permissions settings#The permissions settings now list disableAutoMode directly, with the value "disable" and the description "Disable auto mode"
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
8 more of these are in What probably matters to you, above.
A pre-warmed spare process started with --await-claim now refuses claim_session if an apply_flag_settings is unanswered, refused or not in force
5 more of these are in What probably matters to you, above.
When a permission prompt replaces the safety classifier, it now focuses reject, hides option numbers and allows only one-time answers
Oversized CLAUDE.md files can now be cut to their opening part and marked start-only, and a cut nested file is not announced again
An approval ticket returned with an allow decision is now stored and attached to the later MCP call as anthropic/approvalTicket
Remote sessions now ignore MCP skill permission requests they cannot answer and add a transcript warning when a question dialog is not shown
Remote sessions, remote-tool hosts and unreachable-peer messages now carry a 'left' state with a leftFor reason instead of a fixed off reason
One bundled model entry is now offered only on bedrock, not vertex, and mantle no longer appears among providers in the bundled lists
Unclear Which model is no longer listed for Vertex is not known.
Messages about your short-term usage limit now call it the "5-hour limit", and text appears for a once-a-week reset that uses your weekly limit
Unclear It is not clear whether the 5-hour limit reset is offered to every account or only some.
Claude Code now remembers files that were read only partly, and Write refuses to overwrite them; Read of a large file adds a note to continue with offset
A session served in control-only mode now releases itself after a set idle time with no work
A remote tool host can now be released after an idle time set remotely, and Claude Code reads status updates from it during a session
Unclear It is not clear what idle time is used when the server sends no value, or whether idle release happens at all in that case.
Session setup can now hold on to a pending question from a subagent and carry it through when a session is resumed
Unclear It is not clear which feature this belongs to or whether it does anything for users yet.
When a request is refused by the cybersecurity safeguard, the message can now say your Cyber Verification Program status and what to do next
The on/off row for Ultracode can now pass an optional hint into the keyboard shortcut it displays
The instruction that approval covers an agreed task end to end no longer waits on a separate feature check
Reports a subagent hands back are now reviewed by the safety check, which also records more about how the handoff was set up
Unclear Whether the report-delivery tool is available to subagents by default is not stated.
New permission messages cover commands whose opened files can't be identified, and "always allow" suggestions differ for MCP skills
Unclear Which hosts or commands lead to these new messages is not stated.
If a report tool call succeeds, its message becomes the final text, prefixed with a warning when auto mode's check flagged it
Unclear Which report tool this applies to and where the final text is shown is not stated.
The check for running a print-mode task in the cloud no longer always requires a non-empty prompt when a certain extra option is set
Unclear It is not clear which option lets a cloud print-mode task start without a prompt.
In VM mode with a copy, the host uses the copy's own tools, folder, platform and shell, and does not keep the project in sync
In a forwarded sandbox host environment, Claude Code no longer runs auto mode's check on an action and leaves the decision open
Unclear It is not clear when a session counts as a forwarded sandbox host, or what decides the action once the check is skipped.
Artifacts can run from a local server, CLAUDE_CODE_HOST_GUARDS_ARTIFACTS_MCP stops the desktop skip, and publishing obeys Read rules
Granting artifact publishing now adds more tools, and publishing now requires the design skill specifically rather than either of two skills
Unclear Which extra tools are allowed is not stated.
An unshown permission prompt can now resolve as an ask via resultWhenNotShown instead of cancelling, with related permission dialog changes
Skill use is now marked on messages with invokedSkill, and compaction reads those marks to restore skills used earlier in the conversation
When auto mode's safety classifier gives no verdict, a tool call is now denied or put to you instead of run, and classifier records gain tool-use IDs
Unclear It is not clear which sessions run without the safety check, because that depends on settings sent from the server.
Markdown artifacts are now always rendered with the bundled plan template, and the separate handling for workshop pages has been removed
Unclear It is not clear whether workshop pages were removed entirely or only moved somewhere else.
Claude Code now warns at startup that sign-in environment variables in a project's settings files are ignored
In a folder you have not trusted, Claude Code now runs only hooks defined in your own settings and no longer skips all hooks
Unclear It is unclear how a reader turns on the option that lets their own hooks run in untrusted folders, or whether it is on by default.
After a restart, agent calls left waiting in an interrupted turn are run again so each picks up its agent, rather than redoing the whole turn
Unclear It is not clear what makes this resume path run, so it may not take effect in every session.
Waiting on a resumed subagent can now hand it off to the background, after about two minutes when CLAUDE_AUTO_BACKGROUND_TASKS is set
When a hook changes a tool call after auto mode reviewed it, Claude can be shown the new input and told to reissue it, or to stop and tell you
Fetches that use their own login now count as trusted even when you have not trusted the folder Claude Code is running in
Unclear Which downloads use their own credentials is not stated, so it is unclear what now runs before you trust a folder.
Remote Control approval requests for MCP skills now carry a label with the skill's display name, or its tool name if it has none
Unclear It is not clear whether anything in this release sends MCP skill approval requests.
Claude Code's cleanup of old files now removes some files beyond history.jsonl, deleting them a different way
Unclear It is not stated which file names or prefixes the extra list contains.
When a skill is not one of your own, Claude is now told the review card cannot update it and to propose a new skill instead
Claude Code now offers no fallback model after a refusal when one setting is off or a second, opposing setting is on
Unclear It is not clear how refusal_fallback and no_refusal_fallback are set for a given account, so who keeps the fallback is unknown.
Artifact tools now allow a routine's new private artifact and repeat publishes without asking, but ask first when another person's comment may be pending
Unclear It is not clear which setting or feature check controls these new cases, or which artifact tools they apply to.
Claude Code now checks the sign-in token on outgoing requests, and removes or replaces it unless the request goes to the main API address
The progress bar now has a shade style with its own fill characters, alongside the existing styles
Commands that come from an MCP server's skills are now handled the same way as commands that only display output locally
Unclear What display-only treatment changes for an MCP skill command in practice is not stated.
Permission prompts for MCP skills now show the skill's summary, offer no always-allow option, and are not relayed to the skill's own server
Unclear It is not clear whether any tool calls in this release are actually marked as coming from an MCP skill.
Permission prompts for MCP skills are no longer forced to hide the always-allow option, and one denial has its own MCP-skill version
Unclear It is not clear whether the always-allow option actually appears for MCP skills, since prompts for them passed on remotely still leave it out.
builtin -p, assignments and globs#Bash permission checks now look past export-style builtins, treat builtin -p as a lookup, and catch glob characters and assignments
Claude Code can now recognise permission rules ending in an @sha256 digest or ":*" and suggest one matching allow rule saved to your user settings
Unclear It is not clear where these suggestions are shown, or whether you will see them yet.
In auto mode, Claude Code can now discard a PreToolUse hook's change to a tool call's input and cancel that hook's approval
Unclear Which tool calls get this handling is not established.
Prompt and agent hooks now wait for a shared slot, and their time limit is the larger of their own and a minimum
Unclear How many model hooks can run at once, and what the minimum time limit is, are not known.
Auto mode now says when a hook or plugin changed a call after auto mode reviewed it, so auto mode could not check what would run
Unclear It is not clear whether the changed call is blocked or only produces a warning.
--permission-prompt-tool messages now take MCP skills into account#The message built for a --permission-prompt-tool now knows when the tool asking for permission is an MCP skill
Unclear How the message wording changes for MCP skills is not shown.
Prompts asking to allow network access from the sandbox gain an expiry option and can be answered by an early check before the safety classifier
Unclear It is not known what the expiry does to a network prompt or what the early check looks at.
Publishing an artifact no longer returns workshop details, and Claude Code now groups the Artifacts MCP actions, including a read-only set
Claude Code can now give a notice naming staged files whose copying has taken longer than expected
A remote session released for being idle now exits cleanly, and you are told when files are still being copied
The tool that hands an agent's report to its caller now refuses empty or repeat reports and only appears under specific conditions
Startup and spinner tips can now carry a link such as "Read the docs" on hooks, MCP, mods, /context, auto mode and team workflows
Unclear Whether the linked tips appear at all when the server sends no configuration is not settled.
Claude Code now looks up its logs host in DNS before sending usage logs, and pauses and warns when the host cannot be found
Three messages now explain that another session is waiting on a permission question this terminal cannot display, and that esc stops the turn
Unclear It is not clear when these messages appear or which sessions show them.
The description Claude reads for its connector lookup tool was rewritten, and the wording about reconnecting connectors is gone
Unclear Whether the guidance about reconnecting connectors moved somewhere else or was dropped is not stated.
If your organization's managed settings were judged unavailable before your latest login, Claude Code now checks again once
CLAUDE_CODE_AUTO_COMPACT_WINDOW is now capped like other auto-compact settings#A window set with CLAUDE_CODE_AUTO_COMPACT_WINDOW above the configured ceiling is now reduced to that ceiling instead of used as is
Unclear It is not clear where the ceiling comes from or who sets it, so it is unclear whose values are affected.
Claude Code now skips skill folders outside the current working tree unless it confirms they are not ignored by git
Fetching session logs can now refuse redirects, and a failed fetch raises an error based on the response instead of returning nothing
If Claude Code's permission check on a shell command fails partway, it now asks you rather than reusing an earlier decision
In cloud sessions, a WebFetch address that cannot be found now tells Claude it may be blocked and to stop and tell you
Claude Code now skips commands with a missing or invalid name, and MCP commands with overlong names, when listing slash commands
~ are flagged as too complex less often#Claude Code's shell command check no longer always treats a ~ as making a command too complex to analyse
Unclear Which commands containing ~ are no longer flagged is not known.
When a session runs in a git worktree, Claude Code now scans for file changes using both the folder and the worktree instead of the folder alone
Unclear Which Claude Code feature this file scanning serves is not known.
Instructions for publishing artifacts now say Claude must load the artifact skill before writing the file, even a .md file a skill asked for
Unclear It is not clear whether this text is part of the Artifact tool's live instructions or only stored in the program.
Text about usage limits now says "5-hour limit" instead of "session limit", including the reset command and its label
The warning shown as you near a usage limit now also takes overage state into account when choosing its text
Side requests Claude Code sends to the API now include a traceparent header when one is available
Without an exact usage figure, the limit warning can now read "Over N% of your … used" instead of just "Approaching …"
If Claude tries to overwrite a file it saw only the start of, a message tells it to edit the file or read all of it first
When auto mode's safety check is unavailable, Claude Code says why, asks you to approve actions, and refuses them if nobody can be asked
When Claude Code assumes UTC, the date it gives Claude is marked as UTC and Claude is told your local date may differ
Unclear It is not known when Claude Code assumes UTC, so it is unclear which users see the new wording.
Published verbatim by Anthropic for v2.1.312. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 39 bullets, 5 name something an entry on this page also names, 8 name something no entry here does, and 26 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
oidc.user_id_claim to the Claude apps gateway, to identify people by an id_token claim other than sub, such as Microsoft Entra ID's oid
Probably oidc-proxy-gains-oidcuser-id-claim paths: skills not being found after a Bash cd deeper into a git repository
Nothing to match on #105250[BUG] Skill paths: globs match against the Bash tool's current directory, so a persisted cd hides path-scoped skills (rules unaffected) Open
claude -p with no output
No entry names this effort values and transcripts naming a newly picked effort level during a task before the model applied it; they now show the level in force
Nothing to match on /model and /effort cache warning saying the re-read waits for your next message; a change made while Claude is working can trigger it sooner
Probably effort-usage-text-uses-a-function-provided-label-instead-of, effort-reset-message-names-the-effective-default-instead-of, effort-auto-keyword-now-produced-by-a-helper, effort-command-accepts-more-default-values, agent-view-model-matching-fix-scroll-speed-ui-rework ! input
Nothing to match on d, c and y with a gj or gk count larger than the lines left deleting or copying text; like Vim, they now only move the cursor
Nothing to match on /verify showing a long description meant for Claude in /help and the / command menu instead of a short one
No entry names this CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT=0 to keep the full prompt
No entry names this CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK=1 to turn them off
No entry names this timeout under 1 second now counts as 1 second
Nothing to match on autoCompactWindow to lower the window set by CLAUDE_CODE_AUTO_COMPACT_WINDOW, where it had no effect before; it still never raises that window
Probably auto-compact-window-env-override-no-longer-bypasses-the-ceil mcp_server.name to report the real name of fixed-URL remote MCP servers declared by plugins from the official Anthropic marketplace, instead of custom
No entry names this claude_code.safety_event OpenTelemetry event
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 30 tool descriptions changed.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
473 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 25 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?