You can now send a session's work to a claude.ai Project with the new /send-to-project command. It drafts a brief of your session and sends it only after you confirm. A new setting, blockWritesOutsideWorkingDirectories, stops Claude's file tools from writing outside your working directories. It applies in every permission mode. Setting responseComparisonEnabled to false stops Claude Code from asking you to pick the better of two answers. Other shipped changes include CLAUDE_CODE_UPFRONT_TOOLS, which loads the tools you list at the start.
This build holds 18 things that are not switched on yet. Part of that work prepares a live preview of remote-controlled sessions. Remote sessions are also gaining a long-polling fallback for when a stream goes silent. Another change lets a remote session skip downloading a file it already has. Claude Code can fetch a model-sized copy of large uploaded images, behind a setting that is off by default.
Among the fixes, a resumed session that had already finished replying is no longer told to continue. Claude Code stops re-sending an MCP sign-in token the server already rejected. It can also recover from more 401 errors by reconnecting. If moving a session to the cloud fails, the text you had typed now comes back. A failed startup now shows a message beginning "Claude Code could not start:" instead of an unhandled error. Vim mode handles dw, cw and pasting over a selection more correctly.
Written by our agent from the shipped bundle, not by Anthropic.
/send-to-project drafts a brief of your session's work, or one message, and sends it to a new or existing claude.ai Project after you confirm
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
A new responseComparisonEnabled setting lets you stop Claude Code showing two answers to one message and asking which is better
Settings & configCLAUDE_CODE_STREAM_EVENT_HOLD_MS and CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES let stream-json output hold and join partial-reply lines
A new Bedrock guardrail_trace option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy
Want the reasoning? Read walks the 28 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
5 more of these are in What probably matters to you, above.
Project-settings hooks can be swapped for a vetted copy or dropped, and hook matchers can now match Bash calls through the Monitor name
Unclear Which Bash commands count as matching a Monitor matcher is not spelled out.
Sign-in can now be refused by organization policy, including in claude setup-token, and organization settings are reloaded right after sign-in
Unclear It is not clear what turns this organisation check on or which accounts it applies to.
DesignSync approval prompts for creating projects and finalize_plan were rewritten, names that can't be shown in full are refused, and file writes run in batches
ARCHITECTURE.md is now handled like CLAUDE.md as an instruction file, and project root detection accepts a wider list of file names
Unclear What Claude Code does with files on this list, such as reading them as instructions or protecting them from edits, is not stated.
After sign-in, Claude Code checks your organization's settings and may refuse the sign-in or warn you if they cannot be loaded
Claude Code has a prompt that asks you to approve uploading a file to a connected service, even when you have already allowed that tool
Unclear The setting that switches this prompt on is not named, so whether it applies to you is unclear.
Under one condition, a policy limit that used to be off whenever unset now resolves to blocking everything
Unclear Nothing says which setting this is or what condition turns it into deny_all.
With an organization connection, project and repository settings can no longer set provider-managed environment variables
Unclear Nothing says which setups count as running beside an organization's connection.
Relayed messages that have a thread reference but no message IDs or rows are now treated as invisible, not shown as project relay messages
Auto-resume after a usage limit now stops after a set number of automatic continuations since your last prompt, instead of counting consecutive re-arms
The 'Claude proposes a goal' dialog now needs a second Ctrl+C or Esc to dismiss, ignores typed characters, and its result wording changed
Claude Code no longer swaps a host-supplied login for the one saved on the machine, and treats CLAUDE_CODE_OAUTH_TOKEN more carefully
In headless runs, a PermissionRequest hook's allow is ignored for actions that only a person can approve; a deny still works
Resuming into a worktree now refreshes the sandbox settings, and resume fails with a message suggesting --fork-session if that is not possible
claude auth login now checks a new sign-in against your organization's settings and exits with an error if it is refused
Unclear Nothing says what makes an organization refuse a sign-in, or whether it requires an organization policy to be set up.
Approving a permission request shown by an IDE or SDK host now also creates and saves an always-allow rule, with some exceptions
Unclear It is not clear which host apps show this dialog, so it is unclear whether your setup saves rules this way.
Each project document is checked with your PreToolUse hooks, and if a hook blocks, fails or rewrites, none of its text is sent
Unclear It is not clear whether this check applies in every mode or only in certain kinds of session.
When the sessions access token comes from an environment variable or file descriptor, Claude Code can refuse it with a 403 unless it matches the stored token
Unclear It is not clear when this check runs, so it is unknown which setups get the 403.
Allow and deny rules for MCP tools are now checked against an extra alternative name for each tool, so some deny rules may now apply where they did not
Unclear It is not stated when a server has a deny alias, so it is unclear how often this changes which rules match.
A resumed remote session can refuse to start if its saved conversation cannot be read or restored, instead of continuing empty
Unclear Whether the refusal is switched on for a given account is decided on Anthropic's servers and has not been read.
With CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS set on a direct Anthropic connection, auto mode now treats its classifier as switched off
Unclear What auto mode does differently for you once its classifier counts as switched off is not stated.
Sharing now refuses approvals that did not come from the share card, and refuses org-wide shares that also name specific people
In headless and remote runs, the scheduler for timed tasks no longer starts when a new check passes
Unclear What the new check tests is not known, so it is unclear which sessions lose their scheduled tasks.
In SDK and headless use, sign-in now stops with one of three explicit messages when your organization's managed settings are unavailable
The description of the idle compaction setting now says it defaults to true, where it used to say setting true does not turn it on
Unclear Whether idle compaction now actually runs by default, or only its description changed, is not settled.
A set_model request now waits for the switch to finish with no deadline, and the 'still pending' error and later 'applied' notice are gone
Claude Code now leaves out a project's SessionEnd hooks when you have not accepted workspace trust for that project
/ultrareview refuses to start in a folder that was never confirmed as trusted#/ultrareview now checks folder trust first and stops if the session could not ask whether the folder is trusted
The tmux session for teammate agents now gets a filtered copy of environment variables instead of all of them
Unclear It is not clear which environment variables the filter removes.
Edits to any ARCHITECTURE.md file are now covered by the same edit rule as CLAUDE.md, AGENTS.md and .mcp.json
Unclear It is not clear whether edits to ARCHITECTURE.md are now blocked, need your approval, or are only marked as protected.
When the CI environment variable is set, Claude Code no longer treats the run as interactive, even if a terminal is attached
When a PreCompact hook succeeds and prints more than a set number of characters, Claude Code cuts the output and adds a note saying so
In the list of blocked commands, rows with hidden or unreadable input now refuse approval, and approving a command covers only that exact command
A file passed for upload is now refused with an error when permissions.blockReadsOutsideWorkingDirectories blocks reading it
Before editing or writing a file, Claude Code now runs a second permission check that can refuse the change with a message
Unclear It is not stated which paths the new check refuses.
Shell command safety checks gain a runsTextHeld option, stricter Python -P/-I checks and parsing fixes for run, foreach, -x, --exec and -s
Unclear Nothing says when the stricter check is switched on.
case patterns now ask for approval#Claude Code now treats more ambiguous case statements in shell commands as unreadable, so they ask for your approval instead of running
Claude Code checks more shell commands more strictly before running them without asking, so some will now ask for permission
The Bash safety check now refuses to auto-approve more commands, including unescaped * or ? patterns and pushd -n
Unclear It is not clear whether these stricter checks apply in every session or only under a particular shell mode.
The check for whether a permission request needs your input now looks at the request itself as well as the tool
Unclear It is not clear which requests the extra check now sends to you.
Published verbatim by Anthropic for v2.1.314. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 119 bullets, 22 name something an entry on this page also names, 34 name something no entry here does, and 63 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
permissions.blockWritesOutsideWorkingDirectories: Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode
Probably settings-can-block-writes-outside-the-working-directories groups list to Claude apps gateway upstreams: only developers in the listed IdP groups are sent to that upstream, on failover too
Nothing to match on guardrail_trace to Claude apps gateway Bedrock upstreams, to log which Amazon Bedrock guardrail filter fired on a request, without the matched text
Probably telemetry-additions, bedrock-gateway-can-send-trace-header, gateway-config-upstream-groups-and-bedrock-guardrail-trace claude -p exiting with code 0 and no output when startup failed; it now prints the error and exits 1
No entry names this /compact with "400 Input is too long." instead of removing older images and compacting
Probably auto-mode-new-denyask-messages-and-fallback-reason-when-lo #99859[BUG] Bedrock "400 Input is too long." (oversized image payload) isn't treated as request_too_large, so the session is stuck for good Open
tool_reference blocks: the request is sent again once without tool search, and the session remembers
No entry names this UNABLE_TO_GET_ISSUER_CERT when the system certificate store holds a renewed root certificate that is cross-signed with its predecessor
No entry names this #103684[BUG] [Windows] UNABLE_TO_GET_ISSUER_CERT with system cert store behind TLS inspection, while identical setup works on another machine Open
claude mcp logout reporting success when the MCP sign-in was not removed, for example while the macOS keychain is locked over SSH
No entry names this claude ultrareview and claude remote-control asking the workspace trust question in a CI job that has a terminal; with CI set they now refuse an untrusted folder at once
No entry names this --plugin-dir or --plugin-url plugins had a broken manifest or failed to download
Probably plugin-and-agents-flags-startup-failure-handling-and-migrat forceRemoteSettingsRefresh set only in remote managed settings no longer applying once the stored copy had expired, which let sessions start without policy when the server could not be reached
No entry names this /btw answering from the main conversation when asked from a subagent's open transcript
Probably btw-side-questions-can-target-a-named-agents-transcript #105307[FEATURE] /btw while viewing a subagent silently answers from the main conversation (no notice, unlike /model, /compact) Open
claude remote-control sessions that failed to start when the session service was slow for a moment: the worker's registration is now retried with growing waits
No entry names this sandbox.excludedCommands setting description saying listed commands always run outside the sandbox; it now says every command in a call must match an entry
No entry names this #105115update-config: say that sandbox.excludedCommands matches only a single plain command Open
claude -p --resume or --continue
No entry names this --setting-sources still supplying some settings, such as auto mode rules and saved permission consents
No entry names this /permissions, when its safety check gave no verdict
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /upgrade opening the browser and starting a new login for plans billed through the App Store or Google Play; it now says where to change the plan
Probably subscription-billing-via-app-store-google-play-upgrade-n --resume, and rewinding past a switch to another model after a refusal, moving a session on a model name Claude Code doesn't recognize to a different model
No entry names this claude-opus-4.8, being treated as an older model with the wrong context window, output limit, effort, thinking mode and cost
No entry names this ⎿ rows in the transcript view (Ctrl+O)
Nothing to match on dw, dW, yw and yW carrying on past the end of the line, and made w and W stop on empty lines
Nothing to match on p over a character selection ignoring whether the yanked text was whole lines
Nothing to match on aw and iw taking the line break at the end of a line
Nothing to match on /btw, also interrupting the subagent whose transcript is open
Probably btw-side-questions-can-target-a-named-agents-transcript #100603[BUG] Pressing "Esc" in a subgents's /btw call also cancels the subagent itself Open
<bash-stdout> or <local-command-stdout> not being acknowledged to a local stream-json host
No entry names this ~/.claude/skills/.trash, which added file system load that grew with each removal
No entry names this /config are hidden or your organization has turned off Remote Control
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview ~/.claude/skills/.trash and ~/.claude/plugins/.trash growing without limit: each now holds about 1024 entries, whatever cleanupPeriodDays says
No entry names this [Pasted text] pills
No entry names this /design-sync upload prompt to show the folder, the project and the files it will upload or delete
No entry names this /permissions review tab, now called Recently blocked: the footer says what Esc will do with marked rows
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /permissions to review
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an claude auth login
Probably login-now-checks-the-organizations-config-before-saving-a-s apiKeyHelper
No entry names this /config in agent view to say how to stop agent view opening by default
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview /security-review now gets a title from it instead of staying untitled
No entry names this --resume speed and memory use on damaged transcripts
No entry names this /context speed in sessions with ten thousand or more MCP tools
No entry names this /claude-api skill: its Datadog setup for API tracing now sends the dd-llmobs-enabled: true header, as the Console does, and its ant install instructions drop the outdated macOS xattr step
No entry names this /ultrareview to check workspace trust before it runs git, as claude ultrareview does
Probably ultrareview-refuses-to-start-in-untrusted-workspace-it-canno which alias or function and to stop passing exported which/unsetenv functions to commands, so which is the system command or zsh builtin
Nothing to match on /permissions Recently blocked to refuse approving a call you can't read in full, including one the terminal is too short to show
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an if conditions such as Monitor(tail ) to match the Monitor tool's shell commands as Bash(tail ) matches Bash's
No entry names this claude-api skill to ask to read a Managed Agents workflow run's workflow before changing the agent to improve that run
No entry names this ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels or deniedModels leaves only an older Opus model, or none
Probably opus-availability-check-exempts-the-current-model, model-alias-and-override-resolution-reworked-with-model-ove FORCE_HYPERLINK=false (also no and off) to turn hyperlinks off instead of on
No entry names this git grep in most commands that Claude runs to use the C locale, to avoid a reported memory leak in macOS's regex library on files that aren't valid UTF-8
Probably macos-only-shell-shim-reroutes-git-grep-to-run-with-lc-al CLAUDE_CODE_DISABLE_CFC_PROMPT to also stop the extension adding the Claude in Chrome instructions to a session's messages; the browser tools stay available
Probably claude-code-disable-cfc-prompt-is-reported-to-hosts @Claude !restart giving up after one failed workspace check in channels shared across Enterprise Grid workspaces; it now retries, then asks you to run it again
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 prompt changed.
Claude Code, interactive mode
13 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
645 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 64 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?