You can now send a session's work to a claude.ai Project with the new /send-to-project command. It drafts a brief of your session and sends it only after you confirm. A new setting, blockWritesOutsideWorkingDirectories, stops Claude's file tools from writing outside your working directories. It applies in every permission mode. Setting responseComparisonEnabled to false stops Claude Code from asking you to pick the better of two answers. Other shipped changes include CLAUDE_CODE_UPFRONT_TOOLS, which loads the tools you list at the start.
This build holds 18 things that are not switched on yet. Part of that work prepares a live preview of remote-controlled sessions. Remote sessions are also gaining a long-polling fallback for when a stream goes silent. Another change lets a remote session skip downloading a file it already has. Claude Code can fetch a model-sized copy of large uploaded images, behind a setting that is off by default.
Among the fixes, a resumed session that had already finished replying is no longer told to continue. Claude Code stops re-sending an MCP sign-in token the server already rejected. It can also recover from more 401 errors by reconnecting. If moving a session to the cloud fails, the text you had typed now comes back. A failed startup now shows a message beginning "Claude Code could not start:" instead of an unhandled error. Vim mode handles dw, cw and pasting over a selection more correctly.
Written by our agent from the shipped bundle, not by Anthropic.
/send-to-project drafts a brief of your session's work, or one message, and sends it to a new or existing claude.ai Project after you confirm
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
A new responseComparisonEnabled setting lets you stop Claude Code showing two answers to one message and asking which is better
Settings & configCLAUDE_CODE_STREAM_EVENT_HOLD_MS and CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES let stream-json output hold and join partial-reply lines
A new Bedrock guardrail_trace option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy
Want the reasoning? Read walks the 28 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
A new responseComparisonEnabled setting lets you stop Claude Code showing two answers to one message and asking which is better
Unclear It is not clear whether the comparison feature is shown to every account or only to some.
A new Bedrock guardrail_trace option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy
Unclear Where guardrail_trace is set is not stated.
Claude Code now recognises CLAUDE_CODE_DISABLE_RESPONSE_COMPARISON, listed with other variables that turn off network traffic and telemetry
Unclear What response comparison does, and whether it is on unless this variable is set, is not stated.
Claude Code now shows that an organization's policy withholds easel and that every call to it will be refused
Unclear What easel is, and how it is reached, is not known.
Self-hosted runners can now renew an expiring runner token, and gain a fresh-machine-per-session option for single-session runners
Unclear It is not clear how freshMachinePerSession is turned on.
Bedrock configuration accepts a new guardrail_trace option, and a few internal usage-reporting fields were added
Unclear Where and how a user sets guardrail_trace is not stated.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
5 more of these are in What probably matters to you, above.
Project-settings hooks can be swapped for a vetted copy or dropped, and hook matchers can now match Bash calls through the Monitor name
Unclear Which Bash commands count as matching a Monitor matcher is not spelled out.
On Bedrock, Vertex, Foundry and Mantle, cost figures now use a pricing field in each model's metadata instead of the tengu_tingly_pike server flag
Unclear It is not stated whether any model's details actually include prices, so the figures may not change at all.
Managed settings that pass a signature and organisation check can now apply without the security approval prompt
Sign-in can now be refused by organization policy, including in claude setup-token, and organization settings are reloaded right after sign-in
Unclear It is not clear what turns this organisation check on or which accounts it applies to.
After sign-in, Claude Code checks your organization's settings and may refuse the sign-in or warn you if they cannot be loaded
Claude Code no longer draws automatic charts from tool results when the session reports that it is regulated
Unclear What makes a session count as regulated is not stated.
Under one condition, a policy limit that used to be off whenever unset now resolves to blocking everything
Unclear Nothing says which setting this is or what condition turns it into deny_all.
With an organization connection, project and repository settings can no longer set provider-managed environment variables
Unclear Nothing says which setups count as running beside an organization's connection.
Claude Code adds a startup refusal reason for when a sandbox is required but cannot run, such as bubblewrap missing
Unclear It is not clear whether Claude Code reports this reason yet or what triggers it.
In headless runs, a PermissionRequest hook's allow is ignored for actions that only a person can approve; a deny still works
claude auth login now checks a new sign-in against your organization's settings and exits with an error if it is refused
Unclear Nothing says what makes an organization refuse a sign-in, or whether it requires an organization policy to be set up.
Each project document is checked with your PreToolUse hooks, and if a hook blocks, fails or rewrites, none of its text is sent
Unclear It is not clear whether this check applies in every mode or only in certain kinds of session.
Claude Code no longer allows writing workflow script files when a session blocks writes outside its allowed area
Unclear What sets the block on outside writes is not stated, so it is unclear which sessions this affects.
Allow and deny rules for MCP tools are now checked against an extra alternative name for each tool, so some deny rules may now apply where they did not
Unclear It is not stated when a server has a deny alias, so it is unclear how often this changes which rules match.
After you sign in, Claude Code reloads organisation-managed settings and policy limits before you continue
A hook sent from another machine is not run until this machine has read its organization's managed settings
Unclear It is unclear in which setups hooks are sent from another machine, so it is unclear who will see this.
A screen reading "Loading your organization's managed settings…" now appears while those settings reload, and moves to a blocked screen if needed
With the foundry provider, Claude Code can now recognize a model refusal instead of always marking the outcome as unknown
Unclear It is not clear where this result is used, so it is unclear what a Foundry user would notice.
managedHooksOnly is set#Before running hooks, Claude Code now waits on another step that may ask a question, unless managedHooksOnly is set
Unclear It is not clear what the new step asks or when it shows anything to you.
In SDK and headless use, sign-in now stops with one of three explicit messages when your organization's managed settings are unavailable
Claude Code now adjusts the input it forwards to device hooks using the hook's matcher and the tools' alternate names
Claude Code now explains that self-hosted runner tools need your claude.ai login, which it does not send when an admin has set an API key helper
Turning a model alias into a specific model now checks your availableModels and modelOverrides settings in one shared place
Unclear Whether this new check is switched on in this release is not shown.
Claude Code now recognizes more 'Input tag' errors as a sign that an optional API feature was rejected, at HTTP 400 or 422
If you are not in any group allowed to use the gateway, your request is now refused with a message telling you to ask your administrator
A file passed for upload is now refused with an error when permissions.blockReadsOutsideWorkingDirectories blocks reading it
The "Run tasks in the cloud while you keep coding locally" tip now shows only when a policy check passes as well
Claude Code now shows "Loading your organization's managed settings…" while those settings are loading
The gateway logs an info message suggesting oidc.userinfo_fallback: true when a refreshed login carries no groups but some upstreams need them
Claude Code now explains when it held back your claude.ai login because your administrator's API key helper is not in effect
Unclear What causes the API key helper to be out of effect, and so when this error appears, is not stated.
When runner setup fails because a branch cannot be found, the error now says retrying will fail until you fix that branch
A refused request from a self-hosted environment runner now records when the cause was a revoked dispatch token
If a gateway sign-in fails or is replaced by another, Claude Code puts back the previous credential and removes the undone one
A setup step now handles Foundry, setting an environment variable from the provider's details and marking that step done
Claude Code now checks models with Amazon Bedrock or Google Vertex only when you use one of them, instead of guessing from the model name
2 more of these are in What probably matters to you, above.
The home settings pack sent to cloud sessions can now include a part for the remote runner, through a new withRunnerPack option
Claude Code's sign-in code now tracks extra details about gateways and providers set by an organization, with no visible change
On Vertex and Bedrock, the value that turns on eager input streaming is now read from a different spot in Claude Code's configuration
An internal list of named switches gained one about refusing stored logins under managed settings and lost one about holding API replies
Connections that use mTLS or a custom certificate authority now set an explicit timing for keeping idle connections alive
Claude Code now checks whether an account has HIPAA or zero data retention settings, next to its server-controlled batch waiting setting
Unclear What the new regulated-account check changes for HIPAA or ZDR accounts is not known.
The check for whether something sits in a managed folder now tries several folders instead of one
Unclear What managed means here and which folders are now checked.
A policy check no longer gives diskless or hipaa as reasons, and a separate feature now also requires HIPAA and zdr to be unset
Unclear Which feature the second check controls, and so what HIPAA or zdr accounts lose, is not stated.
Claude Code has a check that contacts its settings address and reports the status, content type and whether a request ID came back
Unclear When this check runs, and whether you ever see its result, is not known.
Claude Code now checks for an organization login in a different way when it chooses which credentials to use
Unclear Whether this changes which credentials Claude Code picks for anyone is not known.
When organization policy blocks Remote Control, starting with --remote-control now uses a dedicated check for the refusal message
When a self-hosted runner checks in for work, Claude Code no longer sends whether warmup is complete, and still sends what woke it
A self-hosted runner now releases an idle session through a helper that reports status and can be stopped, instead of in a single direct call
Unclear It is not certain that the warm-up report was really removed.
Refreshing a runner's access token and writing its debug token file now happen in one place, with no expected change in behaviour
Published verbatim by Anthropic for v2.1.314. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 119 bullets, 22 name something an entry on this page also names, 34 name something no entry here does, and 63 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
permissions.blockWritesOutsideWorkingDirectories: Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode
Probably settings-can-block-writes-outside-the-working-directories groups list to Claude apps gateway upstreams: only developers in the listed IdP groups are sent to that upstream, on failover too
Nothing to match on guardrail_trace to Claude apps gateway Bedrock upstreams, to log which Amazon Bedrock guardrail filter fired on a request, without the matched text
Probably telemetry-additions, bedrock-gateway-can-send-trace-header, gateway-config-upstream-groups-and-bedrock-guardrail-trace claude -p exiting with code 0 and no output when startup failed; it now prints the error and exits 1
No entry names this /compact with "400 Input is too long." instead of removing older images and compacting
Probably auto-mode-new-denyask-messages-and-fallback-reason-when-lo #99859[BUG] Bedrock "400 Input is too long." (oversized image payload) isn't treated as request_too_large, so the session is stuck for good Open
tool_reference blocks: the request is sent again once without tool search, and the session remembers
No entry names this UNABLE_TO_GET_ISSUER_CERT when the system certificate store holds a renewed root certificate that is cross-signed with its predecessor
No entry names this #103684[BUG] [Windows] UNABLE_TO_GET_ISSUER_CERT with system cert store behind TLS inspection, while identical setup works on another machine Open
claude mcp logout reporting success when the MCP sign-in was not removed, for example while the macOS keychain is locked over SSH
No entry names this claude ultrareview and claude remote-control asking the workspace trust question in a CI job that has a terminal; with CI set they now refuse an untrusted folder at once
No entry names this --plugin-dir or --plugin-url plugins had a broken manifest or failed to download
Probably plugin-and-agents-flags-startup-failure-handling-and-migrat forceRemoteSettingsRefresh set only in remote managed settings no longer applying once the stored copy had expired, which let sessions start without policy when the server could not be reached
No entry names this /btw answering from the main conversation when asked from a subagent's open transcript
Probably btw-side-questions-can-target-a-named-agents-transcript #105307[FEATURE] /btw while viewing a subagent silently answers from the main conversation (no notice, unlike /model, /compact) Open
claude remote-control sessions that failed to start when the session service was slow for a moment: the worker's registration is now retried with growing waits
No entry names this sandbox.excludedCommands setting description saying listed commands always run outside the sandbox; it now says every command in a call must match an entry
No entry names this #105115update-config: say that sandbox.excludedCommands matches only a single plain command Open
claude -p --resume or --continue
No entry names this --setting-sources still supplying some settings, such as auto mode rules and saved permission consents
No entry names this /permissions, when its safety check gave no verdict
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /upgrade opening the browser and starting a new login for plans billed through the App Store or Google Play; it now says where to change the plan
Probably subscription-billing-via-app-store-google-play-upgrade-n --resume, and rewinding past a switch to another model after a refusal, moving a session on a model name Claude Code doesn't recognize to a different model
No entry names this claude-opus-4.8, being treated as an older model with the wrong context window, output limit, effort, thinking mode and cost
No entry names this ⎿ rows in the transcript view (Ctrl+O)
Nothing to match on dw, dW, yw and yW carrying on past the end of the line, and made w and W stop on empty lines
Nothing to match on p over a character selection ignoring whether the yanked text was whole lines
Nothing to match on aw and iw taking the line break at the end of a line
Nothing to match on /btw, also interrupting the subagent whose transcript is open
Probably btw-side-questions-can-target-a-named-agents-transcript #100603[BUG] Pressing "Esc" in a subgents's /btw call also cancels the subagent itself Open
<bash-stdout> or <local-command-stdout> not being acknowledged to a local stream-json host
No entry names this ~/.claude/skills/.trash, which added file system load that grew with each removal
No entry names this /config are hidden or your organization has turned off Remote Control
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview ~/.claude/skills/.trash and ~/.claude/plugins/.trash growing without limit: each now holds about 1024 entries, whatever cleanupPeriodDays says
No entry names this [Pasted text] pills
No entry names this /design-sync upload prompt to show the folder, the project and the files it will upload or delete
No entry names this /permissions review tab, now called Recently blocked: the footer says what Esc will do with marked rows
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /permissions to review
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an claude auth login
Probably login-now-checks-the-organizations-config-before-saving-a-s apiKeyHelper
No entry names this /config in agent view to say how to stop agent view opening by default
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview /security-review now gets a title from it instead of staying untitled
No entry names this --resume speed and memory use on damaged transcripts
No entry names this /context speed in sessions with ten thousand or more MCP tools
No entry names this /claude-api skill: its Datadog setup for API tracing now sends the dd-llmobs-enabled: true header, as the Console does, and its ant install instructions drop the outdated macOS xattr step
No entry names this /ultrareview to check workspace trust before it runs git, as claude ultrareview does
Probably ultrareview-refuses-to-start-in-untrusted-workspace-it-canno which alias or function and to stop passing exported which/unsetenv functions to commands, so which is the system command or zsh builtin
Nothing to match on /permissions Recently blocked to refuse approving a call you can't read in full, including one the terminal is too short to show
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an if conditions such as Monitor(tail ) to match the Monitor tool's shell commands as Bash(tail ) matches Bash's
No entry names this claude-api skill to ask to read a Managed Agents workflow run's workflow before changing the agent to improve that run
No entry names this ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels or deniedModels leaves only an older Opus model, or none
Probably opus-availability-check-exempts-the-current-model, model-alias-and-override-resolution-reworked-with-model-ove FORCE_HYPERLINK=false (also no and off) to turn hyperlinks off instead of on
No entry names this git grep in most commands that Claude runs to use the C locale, to avoid a reported memory leak in macOS's regex library on files that aren't valid UTF-8
Probably macos-only-shell-shim-reroutes-git-grep-to-run-with-lc-al CLAUDE_CODE_DISABLE_CFC_PROMPT to also stop the extension adding the Claude in Chrome instructions to a session's messages; the browser tools stay available
Probably claude-code-disable-cfc-prompt-is-reported-to-hosts @Claude !restart giving up after one failed workspace check in channels shared across Enterprise Grid workspaces; it now retries, then asks you to run it again
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 prompt changed.
Claude Code, interactive mode
13 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
645 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 64 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?