You can now send a session's work to a claude.ai Project with the new /send-to-project command. It drafts a brief of your session and sends it only after you confirm. A new setting, blockWritesOutsideWorkingDirectories, stops Claude's file tools from writing outside your working directories. It applies in every permission mode. Setting responseComparisonEnabled to false stops Claude Code from asking you to pick the better of two answers. Other shipped changes include CLAUDE_CODE_UPFRONT_TOOLS, which loads the tools you list at the start.
This build holds 18 things that are not switched on yet. Part of that work prepares a live preview of remote-controlled sessions. Remote sessions are also gaining a long-polling fallback for when a stream goes silent. Another change lets a remote session skip downloading a file it already has. Claude Code can fetch a model-sized copy of large uploaded images, behind a setting that is off by default.
Among the fixes, a resumed session that had already finished replying is no longer told to continue. Claude Code stops re-sending an MCP sign-in token the server already rejected. It can also recover from more 401 errors by reconnecting. If moving a session to the cloud fails, the text you had typed now comes back. A failed startup now shows a message beginning "Claude Code could not start:" instead of an unhandled error. Vim mode handles dw, cw and pasting over a selection more correctly.
Written by our agent from the shipped bundle, not by Anthropic.
/send-to-project drafts a brief of your session's work, or one message, and sends it to a new or existing claude.ai Project after you confirm
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
A new responseComparisonEnabled setting lets you stop Claude Code showing two answers to one message and asking which is better
Settings & configCLAUDE_CODE_STREAM_EVENT_HOLD_MS and CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES let stream-json output hold and join partial-reply lines
A new Bedrock guardrail_trace option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy
Want the reasoning? Read walks the 28 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Plugins gain a ui.place function and a Placed slot for adding rows to the interface, with a new ui_placed message to send them to other screens
Unclear What placing something does for a plugin author, and how it differs from the existing pane spot.
/send-to-project drafts a brief of your session's work, or one message, and sends it to a new or existing claude.ai Project after you confirm
Unclear It is not known whether the command is switched on, or what decides when it is available.
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
A new responseComparisonEnabled setting lets you stop Claude Code showing two answers to one message and asking which is better
Unclear It is not clear whether the comparison feature is shown to every account or only to some.
CLAUDE_CODE_STREAM_EVENT_HOLD_MS and CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES let stream-json output hold and join partial-reply lines
Unclear What each variable does and which values it accepts is only implied by its name.
A new Bedrock guardrail_trace option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy
Unclear Where guardrail_trace is set is not stated.
The remote-control connection can now start a live preview, and refuses for outbound-only or blocked sessions
Unclear Nothing shows how this live preview is started or whether any reader can reach it yet.
Claude Code now lists two tools for continuing work in projects, and its session report records whether converted skills were asked for
Unclear Whether the two continue-in-projects tools can be used yet is not shown.
Plugins can now place a row in the conversation as a system message, up to a fixed number of rows per plugin
Unclear Whether plugins can use this now or it is held behind a switch is not stated.
CLAUDE_CODE_UPFRONT_TOOLS variable picks tools to load at the start#Setting CLAUDE_CODE_UPFRONT_TOOLS to a list of tool names makes those tools load at the start instead of being held back until needed
Unclear How the tool names in CLAUDE_CODE_UPFRONT_TOOLS should be separated is not stated.
Claude Code now recognises CLAUDE_CODE_DISABLE_RESPONSE_COMPARISON, listed with other variables that turn off network traffic and telemetry
Unclear What response comparison does, and whether it is on unless this variable is set, is not stated.
In cloud sessions, Claude Code can stop running shell tasks if the sandbox uses 90% or more of its CPUs for a remotely set length of time
Creating files through the Google Drive connector is now controlled by a different remote switch and can take plain text content
Claude Code now shows that an organization's policy withholds easel and that every call to it will be refused
Unclear What easel is, and how it is reached, is not known.
In elevated-security sessions on a trusted device, Claude Code now signs peer messages it posts, and sends them unsigned otherwise
The effort slider can switch an auto effort level on and off through a keybinding action named effortSlider:adaptive
Unclear It is not clear what decides whether the auto level is offered, so it may not appear for you yet.
Setting CLAUDE_CODE_MEMORY_CONTEXT_NO_WAIT lets Claude Code's memory reminder go ahead in ccr mode without waiting for the memory check
Unclear Exactly which step is skipped when the variable is set is not settled.
Claude Code now sets up a new built-in skill for continuing in projects alongside its other bundled skills
Unclear What the skill does and whether it is available to you is not stated.
Self-hosted runners can now renew an expiring runner token, and gain a fresh-machine-per-session option for single-session runners
Unclear It is not clear how freshMachinePerSession is turned on.
The fable and fable[1m] aliases now map to a model in more cases, and the 1M-context check adds an extra model-family test
A new /insights mode includes your current session and answers with a summary in the conversation instead of an HTML report
Unclear When Claude Code uses this mode instead of the usual HTML report is not shown.
auto effort level#SDK apps can now set the effort level to auto and read back whether it is on, where before only fixed levels were accepted
Unclear What decides whether auto is accepted for a given app or account is not known.
When CLAUDE_CODE_DISABLE_CFC_PROMPT is set, Claude Code now tells host apps like the VS Code extension, which then drop their own browser instructions
The /effort slider now has an auto choice, which runs /effort auto when you pick it
Bedrock configuration accepts a new guardrail_trace option, and a few internal usage-reporting fields were added
Unclear Where and how a user sets guardrail_trace is not stated.
With CLAUDE_CODE_MCP_SERVE_TOOL_OUTPUT on, a declined or withdrawn permission request now returns a result saying nothing was run
In agent view, /config now tells you to run it in a session and that /config defaultToAgentsView=false stops Claude Code opening in agent view
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
18 more of these are in What probably matters to you, above.
Claude Code includes a permission prompt and a Send or Cancel confirmation for sending a session's work to a Claude Project
Unclear It is not clear whether anything in Claude Code can show these prompts yet, or what controls them.
5 more of these are in What probably matters to you, above.
Project-settings hooks can be swapped for a vetted copy or dropped, and hook matchers can now match Bash calls through the Monitor name
Unclear Which Bash commands count as matching a Monitor matcher is not spelled out.
The remote session streaming connection gains a long-poll fallback for silent connections, controlled by CLAUDE_CODE_CCR_LONG_POLL or a gate
Unclear Nothing shows what makes a connection ask for a long poll, so this path may never run.
Behind a typedMarks switch, Claude Code can mark and hash which message text you typed, including typed copies of accepted suggestions
Unclear It is not clear what turns typedMarks on, or whether it is on for anyone.
A new backgroundWakesOwner field marks background commands whose subagent waits and is woken when they finish, and the model's notices change to match
update_settings can accept effortLevel "auto", and the effort command now shows "auto" when no effort level is set
Unclear What condition allows auto to be accepted is not stated.
In some sessions, the Monitor tool and backgrounded MCP calls now tell the model they are likely cut off a few minutes after its reply
Unclear Which sessions get the new description is not known.
On Bedrock, Vertex, Foundry and Mantle, cost figures now use a pricing field in each model's metadata instead of the tengu_tingly_pike server flag
Unclear It is not stated whether any model's details actually include prices, so the figures may not change at all.
Claude Code shows a warning that Opus 4.8 fast mode is deprecated and will be removed on a date set remotely
Managed settings that pass a signature and organisation check can now apply without the security approval prompt
Sign-in can now be refused by organization policy, including in claude setup-token, and organization settings are reloaded right after sign-in
Unclear It is not clear what turns this organisation check on or which accounts it applies to.
DesignSync approval prompts for creating projects and finalize_plan were rewritten, names that can't be shown in full are refused, and file writes run in batches
Claude Code stops re-sending a rejected MCP access token, reconnects without it or retries once, and reports failures when clearing saved tokens
Unclear It is not clear what the extra step does, so it is unknown when it saves you from signing in again.
In some cases Claude is now told a background task's result arrives between its tool calls, and to wait with one foreground shell command if it needs it
Unclear The condition that selects the new wording is not stated.
Shell commands can now move to the background at timeout, and Claude is told not to re-check running commands and when it may not hear back
ARCHITECTURE.md is now handled like CLAUDE.md as an instruction file, and project root detection accepts a wider list of file names
Unclear What Claude Code does with files on this list, such as reading them as instructions or protecting them from edits, is not stated.
When a model rejects an effort level, Claude Code can retry one level lower and tell you once, unless a remote switch turns this off
Unclear It is not clear which requests use this fallback.
After sign-in, Claude Code checks your organization's settings and may refuse the sign-in or warn you if they cannot be loaded
Claude Code has a prompt that asks you to approve uploading a file to a connected service, even when you have already allowed that tool
Unclear The setting that switches this prompt on is not named, so whether it applies to you is unclear.
The model picker now adds or relabels models from a published list, and shows some model families only when an availability check passes
Unclear Where the published list comes from, and whether the fable models will appear for you, is not stated.
Claude Code no longer draws automatic charts from tool results when the session reports that it is regulated
Unclear What makes a session count as regulated is not stated.
When the Remote Control connection is rebuilt, it now keeps the long-polling mode it was using, and a live preview tunnel is stopped on failure
Unclear What the live preview tunnel is and what turns it on is not stated.
In remote sessions, a permission question only a person can answer can be turned into a refusal when no person is present
A new mode tells Claude that monitors are likely stopped a few minutes after its reply and to tell you what to check yourself
Unclear It is not clear which sessions get the new short-lived monitor wording.
Drive file references through MCP now handle several files at once, remember which uploads you approved, and refuse clearly when no one can approve
Unclear Which setting turns this on, and so whether it is available to you, is not stated.
Under one condition, a policy limit that used to be off whenever unset now resolves to blocking everything
Unclear Nothing says which setting this is or what condition turns it into deny_all.
With an organization connection, project and repository settings can no longer set provider-managed environment variables
Unclear Nothing says which setups count as running beside an organization's connection.
When a feature check passes, Claude is told work that must continue after its reply can run in a background agent
Unclear What turns this instruction on is not stated, so it is unclear whether it appears in your sessions.
Relayed messages that have a thread reference but no message IDs or rows are now treated as invisible, not shown as project relay messages
Idle compaction now follows a mode such as off or log, can be refused by the host program, and in log mode only records that it would compact
Unclear Which mode is used for your sessions is not stated.
In remote sessions with a small context window, a server value can now raise the CLAUDE_AUTOCOMPACT_PCT_OVERRIDE threshold, up to 100
Artifacts now record whether outsiders may have written to them, and lists and attachments warn that such titles are data, not instructions
Auto-resume after a usage limit now stops after a set number of automatic continuations since your last prompt, instead of counting consecutive re-arms
The 'Claude proposes a goal' dialog now needs a second Ctrl+C or Esc to dismiss, ignores typed characters, and its result wording changed
Claude Code no longer swaps a host-supplied login for the one saved on the machine, and treats CLAUDE_CODE_OAUTH_TOKEN more carefully
A new system prompt section, original_games_guidance, tells Claude to build original games rather than recreations of existing ones
Unclear It is not clear whether this section is always included or can be switched on and off.
When an MCP server offered no client registration, sign-in can now go through localhost instead of the host's custom redirect address
MCP permission prompts now warn when another server owns this server's name, and that 'Don't ask again' moves the name and its allow rules
Edit and Write now run an extra path check and leave file contents and diffs out of staged results for calls from another machine
Unclear Which paths or permissions the new check refuses is not stated.
When a summary request is refused for size, Claude Code now drops images and documents, then cuts text, and retries
Claude Code adds a startup refusal reason for when a sandbox is required but cannot run, such as bubblewrap missing
Unclear It is not clear whether Claude Code reports this reason yet or what triggers it.
In headless runs, a PermissionRequest hook's allow is ignored for actions that only a person can approve; a deny still works
Resuming into a worktree now refreshes the sandbox settings, and resume fails with a message suggesting --fork-session if that is not possible
A background command that stops producing output at what looks like a prompt is flagged as stalled, and Claude is told how to rerun it
claude auth login now checks a new sign-in against your organization's settings and exits with an error if it is refused
Unclear Nothing says what makes an organization refuse a sign-in, or whether it requires an organization policy to be set up.
Approving a permission request shown by an IDE or SDK host now also creates and saves an always-allow rule, with some exceptions
Unclear It is not clear which host apps show this dialog, so it is unclear whether your setup saves rules this way.
/btw now answers from the agent you are viewing#When you are focused on a named agent, /btw side questions now use that agent's conversation instead of the main session's
Each project document is checked with your PreToolUse hooks, and if a hook blocks, fails or rewrites, none of its text is sent
Unclear It is not clear whether this check applies in every mode or only in certain kinds of session.
The countdown on permission requests in unattended sessions now says the request will be blocked rather than denied
Unclear It is not clear whether the request is now handled differently or only the message changed.
Claude Code no longer allows writing workflow script files when a session blocks writes outside its allowed area
Unclear What sets the block on outside writes is not stated, so it is unclear which sessions this affects.
When fetching file contents, Claude Code now refuses to send your saved login to a destination that fails a check
SessionStart hooks can now be held back until something else finishes, and are skipped if the session is cancelled meanwhile
In remote and web sessions, a permission request the server refuses for size is now resent slimmed down instead of being lost
After a container restart, Claude is now told processes left running are likely stopped soon after each reply, and to run key commands in the foreground
The model's prompt no longer includes a remaining-token reminder, and a Design tool action now shows as 'Design: Create design system project'
When auto mode cannot check actions, Claude Code now gives a specific reason and fix, including when CLAUDE_CODE_AUTO_MODE_SERVER turns the check off
Auto mode now says an action was "blocked", folds repeated blocks into one notice, and blanks out reasons that look sensitive
Claude Code now uses a shared watcher to notice background shell commands that are waiting for input, in place of a separate check per command
When the sessions access token comes from an environment variable or file descriptor, Claude Code can refuse it with a 403 unless it matches the stored token
Unclear It is not clear when this check runs, so it is unknown which setups get the 403.
Claude Code now has a short description for each kind of auto mode rule: allow, soft deny, hard deny and environment
Unclear It is not clear where these descriptions are shown to users.
The check that hides Opus when its alias is set to never now has an exception for the model currently in use
Unclear The further condition that allows the exception is not known, so it is unclear who keeps Opus available.
When an agent finishes a pull request and the next step is your merge or review, its status is reported as done rather than blocked
Auto mode now gives a specific message for each reason it cannot check an action, including script calls, headless runs, long conversations and a switched-off check
Unclear What switches the local check off, and whether that can happen for your account, is not stated.
Allow and deny rules for MCP tools are now checked against an extra alternative name for each tool, so some deny rules may now apply where they did not
Unclear It is not stated when a server has a deny alias, so it is unclear how often this changes which rules match.
A new instruction tells Claude to build original games and games from your own designs, but not recreations of a specific existing game
Unclear It is not known whether this instruction is shown to every user or only when a remote setting turns it on.
When the sandbox blocks a command, Claude is now told that rerunning will fail the same way and to report the block to you
A resumed remote session can refuse to start if its saved conversation cannot be read or restored, instead of continuing empty
Unclear Whether the refusal is switched on for a given account is decided on Anthropic's servers and has not been read.
In bridge sessions, images can be pulled from the transcript, and Claude is told when a late upload was not saved or was moved
Edit results marked staged now show no diff and no longer count as completed file changes
After you sign in, Claude Code reloads organisation-managed settings and policy limits before you continue
When a sandboxed Bash command fails, Claude Code now classifies the cause and notes which blocked file paths the command touched
With CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS set on a direct Anthropic connection, auto mode now treats its classifier as switched off
Unclear What auto mode does differently for you once its classifier counts as switched off is not stated.
Published verbatim by Anthropic for v2.1.314. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 119 bullets, 22 name something an entry on this page also names, 34 name something no entry here does, and 63 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
permissions.blockWritesOutsideWorkingDirectories: Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode
Probably settings-can-block-writes-outside-the-working-directories groups list to Claude apps gateway upstreams: only developers in the listed IdP groups are sent to that upstream, on failover too
Nothing to match on guardrail_trace to Claude apps gateway Bedrock upstreams, to log which Amazon Bedrock guardrail filter fired on a request, without the matched text
Probably telemetry-additions, bedrock-gateway-can-send-trace-header, gateway-config-upstream-groups-and-bedrock-guardrail-trace claude -p exiting with code 0 and no output when startup failed; it now prints the error and exits 1
No entry names this /compact with "400 Input is too long." instead of removing older images and compacting
Probably auto-mode-new-denyask-messages-and-fallback-reason-when-lo #99859[BUG] Bedrock "400 Input is too long." (oversized image payload) isn't treated as request_too_large, so the session is stuck for good Open
tool_reference blocks: the request is sent again once without tool search, and the session remembers
No entry names this UNABLE_TO_GET_ISSUER_CERT when the system certificate store holds a renewed root certificate that is cross-signed with its predecessor
No entry names this #103684[BUG] [Windows] UNABLE_TO_GET_ISSUER_CERT with system cert store behind TLS inspection, while identical setup works on another machine Open
claude mcp logout reporting success when the MCP sign-in was not removed, for example while the macOS keychain is locked over SSH
No entry names this claude ultrareview and claude remote-control asking the workspace trust question in a CI job that has a terminal; with CI set they now refuse an untrusted folder at once
No entry names this --plugin-dir or --plugin-url plugins had a broken manifest or failed to download
Probably plugin-and-agents-flags-startup-failure-handling-and-migrat forceRemoteSettingsRefresh set only in remote managed settings no longer applying once the stored copy had expired, which let sessions start without policy when the server could not be reached
No entry names this /btw answering from the main conversation when asked from a subagent's open transcript
Probably btw-side-questions-can-target-a-named-agents-transcript #105307[FEATURE] /btw while viewing a subagent silently answers from the main conversation (no notice, unlike /model, /compact) Open
claude remote-control sessions that failed to start when the session service was slow for a moment: the worker's registration is now retried with growing waits
No entry names this sandbox.excludedCommands setting description saying listed commands always run outside the sandbox; it now says every command in a call must match an entry
No entry names this #105115update-config: say that sandbox.excludedCommands matches only a single plain command Open
claude -p --resume or --continue
No entry names this --setting-sources still supplying some settings, such as auto mode rules and saved permission consents
No entry names this /permissions, when its safety check gave no verdict
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /upgrade opening the browser and starting a new login for plans billed through the App Store or Google Play; it now says where to change the plan
Probably subscription-billing-via-app-store-google-play-upgrade-n --resume, and rewinding past a switch to another model after a refusal, moving a session on a model name Claude Code doesn't recognize to a different model
No entry names this claude-opus-4.8, being treated as an older model with the wrong context window, output limit, effort, thinking mode and cost
No entry names this ⎿ rows in the transcript view (Ctrl+O)
Nothing to match on dw, dW, yw and yW carrying on past the end of the line, and made w and W stop on empty lines
Nothing to match on p over a character selection ignoring whether the yanked text was whole lines
Nothing to match on aw and iw taking the line break at the end of a line
Nothing to match on /btw, also interrupting the subagent whose transcript is open
Probably btw-side-questions-can-target-a-named-agents-transcript #100603[BUG] Pressing "Esc" in a subgents's /btw call also cancels the subagent itself Open
<bash-stdout> or <local-command-stdout> not being acknowledged to a local stream-json host
No entry names this ~/.claude/skills/.trash, which added file system load that grew with each removal
No entry names this /config are hidden or your organization has turned off Remote Control
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview ~/.claude/skills/.trash and ~/.claude/plugins/.trash growing without limit: each now holds about 1024 entries, whatever cleanupPeriodDays says
No entry names this [Pasted text] pills
No entry names this /design-sync upload prompt to show the folder, the project and the files it will upload or delete
No entry names this /permissions review tab, now called Recently blocked: the footer says what Esc will do with marked rows
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /permissions to review
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an claude auth login
Probably login-now-checks-the-organizations-config-before-saving-a-s apiKeyHelper
No entry names this /config in agent view to say how to stop agent view opening by default
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview /security-review now gets a title from it instead of staying untitled
No entry names this --resume speed and memory use on damaged transcripts
No entry names this /context speed in sessions with ten thousand or more MCP tools
No entry names this /claude-api skill: its Datadog setup for API tracing now sends the dd-llmobs-enabled: true header, as the Console does, and its ant install instructions drop the outdated macOS xattr step
No entry names this /ultrareview to check workspace trust before it runs git, as claude ultrareview does
Probably ultrareview-refuses-to-start-in-untrusted-workspace-it-canno which alias or function and to stop passing exported which/unsetenv functions to commands, so which is the system command or zsh builtin
Nothing to match on /permissions Recently blocked to refuse approving a call you can't read in full, including one the terminal is too short to show
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an if conditions such as Monitor(tail ) to match the Monitor tool's shell commands as Bash(tail ) matches Bash's
No entry names this claude-api skill to ask to read a Managed Agents workflow run's workflow before changing the agent to improve that run
No entry names this ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels or deniedModels leaves only an older Opus model, or none
Probably opus-availability-check-exempts-the-current-model, model-alias-and-override-resolution-reworked-with-model-ove FORCE_HYPERLINK=false (also no and off) to turn hyperlinks off instead of on
No entry names this git grep in most commands that Claude runs to use the C locale, to avoid a reported memory leak in macOS's regex library on files that aren't valid UTF-8
Probably macos-only-shell-shim-reroutes-git-grep-to-run-with-lc-al CLAUDE_CODE_DISABLE_CFC_PROMPT to also stop the extension adding the Claude in Chrome instructions to a session's messages; the browser tools stay available
Probably claude-code-disable-cfc-prompt-is-reported-to-hosts @Claude !restart giving up after one failed workspace check in channels shared across Enterprise Grid workspaces; it now retries, then asks you to run it again
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 prompt changed.
Claude Code, interactive mode
13 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
645 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 64 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?