You can now send a session's work to a claude.ai Project with the new /send-to-project command. It drafts a brief of your session and sends it only after you confirm. A new setting, blockWritesOutsideWorkingDirectories, stops Claude's file tools from writing outside your working directories. It applies in every permission mode. Setting responseComparisonEnabled to false stops Claude Code from asking you to pick the better of two answers. Other shipped changes include CLAUDE_CODE_UPFRONT_TOOLS, which loads the tools you list at the start.
This build holds 18 things that are not switched on yet. Part of that work prepares a live preview of remote-controlled sessions. Remote sessions are also gaining a long-polling fallback for when a stream goes silent. Another change lets a remote session skip downloading a file it already has. Claude Code can fetch a model-sized copy of large uploaded images, behind a setting that is off by default.
Among the fixes, a resumed session that had already finished replying is no longer told to continue. Claude Code stops re-sending an MCP sign-in token the server already rejected. It can also recover from more 401 errors by reconnecting. If moving a session to the cloud fails, the text you had typed now comes back. A failed startup now shows a message beginning "Claude Code could not start:" instead of an unhandled error. Vim mode handles dw, cw and pasting over a selection more correctly.
Written by our agent from the shipped bundle, not by Anthropic.
/send-to-project drafts a brief of your session's work, or one message, and sends it to a new or existing claude.ai Project after you confirm
blockWritesOutsideWorkingDirectories stops Claude's file tools writing outside your working folders and protects settings files, but is not sent to remote runs
A new responseComparisonEnabled setting lets you stop Claude Code showing two answers to one message and asking which is better
Settings & configCLAUDE_CODE_STREAM_EVENT_HOLD_MS and CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES let stream-json output hold and join partial-reply lines
A new Bedrock guardrail_trace option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy
Want the reasoning? Read walks the 28 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →5 more of these are in What probably matters to you, on page 1.
Computer use text now says to look in the Computer use section of Settings, replacing the old Settings → This computer path
Resetting effort with /effort auto now confirms 'Effort level set to auto' instead of naming a computed level
Over SSH, a failed image paste now says to copy the file over and paste its path, and the message stays for five seconds
Claude Code now skips its unrecognized-model warning for more models, after one extra check on the model name
Claude Code now explains when it held back your claude.ai login because your administrator's API key helper is not in effect
Unclear What causes the API key helper to be out of effect, and so when this error appears, is not stated.
--tmux with --worktree is skipped in more cases#Claude Code's fast startup path for --tmux with --worktree now has an extra condition and reads a different argument list
Unclear What the new condition is and when it now skips the fast startup are not stated.
The cloud-session notice now reads "Cloud sessions ask you before most commands on…" and denied-tool messages are shown in a new way
Claude Code now passes diff.autoRefreshIndex=true to git when it compares files, alongside core.splitIndex=false
Claude Code adds a ui.place method, asks for more plugin details, knows a new sign-in error and handles locked files differently
When a file cannot be uploaded and reading files is blocked, the error no longer suggests sending the file's base64 instead
When auto mode cannot review an agent's prompt, Claude Code says retrying will not help and suggests running the workflow outside auto mode
When an asyncRewake hook exits with code 2, Claude Code can now use a separate missing-script check instead of reading the output
When signing in to an MCP server over the remote bridge, Claude Code now tries a custom redirect address only if an extra check passes first
Unclear It is not clear what the extra check tests, so it is unclear when the custom redirect address is now skipped.
Claude Code now also detects variable assignments at the start of a shell command when the value begins with /, ~ or $
Unclear It is not clear what the new check tests, so the effect on permission prompts is unknown.
The dialog Claude uses to ask you questions now sets aside extra rows for other content, so it may be shorter
Unclear It is not clear what the extra rows are kept for, so it is unclear how much shorter the dialog gets.
The explanations in the permission dialog now use up to 12 lines based on terminal height and are cut short only when they would overflow
The banner shown in the prompt area is now cut short to fit the terminal's width
The PermissionDenied hook is now described as running after auto mode denies a tool call, without the word classifier
When it records a diff, Claude Code now finds files with Windows-style line endings, converts them and reports which were converted
When auto mode's safety check cannot run, the stopped agent's message now says why, that its output is partial, and to tell you what is blocked
Claude Code checks more shell commands more strictly before running them without asking, so some will now ask for permission
When runner setup fails because a branch cannot be found, the error now says retrying will fail until you fix that branch
An error screen in cloud sessions now shows an extra line of guidance above its Environment and Session details
Unclear Which error screen this is and what the added guidance says are not known.
When a tool needs approval nobody can give, Claude is now told the action was NOT performed, and the message opens differently
Unclear The new opening wording of the message is not known.
In the fullscreen layout, dialogs can now show a footer below their scrollable content, separate from it
Setting CLAUDE_CONFIG_DIR now stops the home settings seed only in managed sessions; elsewhere the seed can now start and take everything
Unclear What the home settings seed copies, and which sessions count as managed, is not stated.
When auto mode blocks an action, Claude Code now records it without its description, timeout or switched-off options, and rebuilds the denial message
The empty auto mode list now reads 'No recent blocks. Commands auto mode blocks will appear here.' instead of talking about denials
When a combined shell command includes a write Claude Code cannot be sure about, an 'ask' result is no longer cut short early
Unclear Whether this leads to more or fewer permission prompts for commands that start with variable declarations is not clear.
The dialog for disconnecting Remote Control now renders an extra element tied to a QR code for opening the session on your phone
Unclear Exactly what the extra element shows inside the disconnect dialog is not confirmed.
Claude Code's git safety overrides now also set diff.autoRefreshIndex to false, so git diff no longer writes to the index
A tool call stopped by a permission rule now shows a dim 'Not run' and 'permission denied' line instead of the generic rejected display
The warning now says the desktop app or runner supplies the value and your settings value is not used
The excludedCommands description now says a call leaves the sandbox only if every command in it matches, and lists cases that stay inside
A refused request from a self-hosted environment runner now records when the cause was a revoked dispatch token
A blocked preview port is now reported as one "this tunnel may reach" not, and the message no longer mentions the --preview-port allowlist
The Bash safety check now refuses to auto-approve more commands, including unescaped * or ? patterns and pushd -n
Unclear It is not clear whether these stricter checks apply in every session or only under a particular shell mode.
When files are not attached automatically, Claude can now be told to open each PDF of up to a page limit with the Read tool
Auto mode's safety checker now sets aside a first-stage approval unless the reply ended cleanly and in the expected form
Unclear Whether this stricter check is switched on in released builds is not clear.
The decline option when asked about running commands unattended now reads "No - ask me first, as in Manual mode"
The check for whether a permission request needs your input now looks at the request itself as well as the tool
Unclear It is not clear which requests the extra check now sends to you.
In auto mode, Claude is told when an action was not run because Anthropic's server check gave no answer, and the screen shows it
Unclear It is not clear what makes the server check return no verdict, or whether this happens yet.
When an MCP server answers "not authorised", Claude Code now tries two extra steps before marking it as needing you to log in
Claude Code now always skips settings sources that fail its check when finding autoMemoryDirectory, with no remote switch to undo it
In vim mode, pasting whole lines now handles cursor placement and saved text differently
Unclear Exactly how pasting behaves differently from before is not stated.
The list of look-alike characters now treats U+16B2 (ᚲ) as "<"
When you change extra working directories, Claude Code now tells MCP servers immediately instead of after a short delay
Claude Code now counts some two-character pairs once when measuring text width, and no longer treats ESC O key codes as their own type
Unclear Whether any keys or characters behave differently in a given terminal is not stated.
Claude Code's shell command reader changes how it handles the end of a case statement
Unclear Nothing shows what the extra condition does to how these commands are judged.
A text cleanup step that replaced arrows, chevrons and private-use characters with ? now only trims a single leading or trailing space
Unclear Which text this cleanup applies to is not stated, so it is unclear where these characters may now appear.
In vim mode, the w, e and W motions now treat an empty line as a stop instead of skipping across it
Claude Code now converts several more Unicode characters that look like < or > into the plain symbols when it cleans up text
Markdown quoted blocks now pass through an extra step before display, and the permission prompt sizes its rows by terminal width
Registering a remote session now retries with growing, randomised waits, and only for errors that are likely temporary
Image file IDs (imageFileUuids) are now kept when a turn is interrupted, when a prompt is sent and when a turn is handed off
When a resumed session had already finished replying, Claude Code no longer adds a prompt telling the model to continue
Choosing a task in the footer that is folded into a group now does nothing instead of acting on another task
In vim mode, dw and cw handle empty lines differently, and pasting over a selection now respects whole-line copies
When Claude asks you a multiple-choice question, the free-text "Other" box now accepts a paste in more situations
Restoring after a model swap now goes back to the model in use before the swap, not to the one the session started with
After compacting, Claude Code only reuses the last reply if no newer request was sent while compaction ran
The dialog Claude uses to ask you a question now handles pasted input
Unclear What the dialog does with pasted text is not stated.
A settings filter that used to drop fastMode and fastModePerSessionOptIn now keeps fastMode when off and fastModePerSessionOptIn when on
Unclear It is not stated which settings source or mode this filter applies to, so it is unclear which setups are affected.
If a gateway sign-in fails or is replaced by another, Claude Code puts back the previous credential and removes the undone one
Claude Code's diff of files changed by Bash now ignores Windows-style line-ending differences and drops files with no real change
When moving a session to the cloud does not succeed, Claude Code now restores the text you had typed
If a helper agent fails to wake up, its waiting notifications now go to the main agent rather than being thrown away
Claude Code keeps the names of MCP tools it has already sent to the model instead of renaming them, and sorts out clashing names between servers
When decoding a page's text runs out of memory, Claude Code now stops reading and reports "out of memory while decoding a page"
In vim mode, whole-line delete and yank now go through their own handling, which may change where the cursor ends up
Unclear It is not clear what now behaves differently for whole-line delete and yank.
When finding a session's first prompt for the list, Claude Code now skips compaction summaries and can read a preview from a cut-off last line
A setup step now handles Foundry, setting an environment variable from the provider's details and marking that step done
The NotebookEdit tool now runs a permission check first and stops with that check's error before reading or writing the notebook
If Claude Code fails while starting up, it now exits with a message beginning 'Claude Code could not start:' instead of an unhandled error
Claude Code now checks images and files returned by MCP tasks and skips saving any that arrive damaged, with a message saying so
If Claude Code cannot delete a team's folder during cleanup, the cleanup now reports an error instead of only logging it
Claude Code now checks models with Amazon Bedrock or Google Vertex only when you use one of them, instead of guessing from the model name
When looking up a session's file, Claude Code now checks the disk again and treats a missing file as gone, unless it has not been written yet
On resume, Claude Code now drops withdrawn messages recorded on user and assistant messages, not only on one kind of system message
When Claude Code copies your shell's functions, it now takes just the function name from each line instead of the whole line
Quote blocks shown in italics no longer always have their leading blank lines removed
Claude Code now ignores paste events that carry no text, avoiding a crash or odd cursor movement
Line counts for each changed file now stay correct when renamed or copied files make Git's two change lists differ in length
While a reply streams in, Claude Code now clears its record of an open markdown table in one case before showing the rest of the text
In vim mode, an empty delete no longer overwrites the register, so what you yanked or deleted before is kept
The 'Reloaded skills' message now works out its count and added or removed skills from the list it has just loaded
3 more of these are in What probably matters to you, on page 1.
Remote file staging gains a check that compares a local file's size and md5 with the filestore and, in mode on, skips the download if they match
Unclear Whether the comparison changes what Claude Code does or is only recorded, and how "count" differs from "on", is not shown.
Claude Code now discards a held-back response and closes more dialogs when outside loading begins or a session is resumed
Unclear What the held-response feature is, and whether it is switched on for anyone, is not known.
Claude Code can fetch a model-sized copy of large uploaded images and now picks between copies by size, behind a setting that is off by default
Remote sessions started through a bridge get a new off-by-default option for shell task rows, replacing an older switch
The check that writes status cards for background sessions can add extra hand-off instructions, off unless switched on remotely
A switched-off option makes Claude send any local file it linked in a reply but did not send, or end its turn
Unclear It is not clear which kinds of session this reminder applies to.
Project file reads gained a remotely set hint that the offloaded local_file is read-only and a size budget, both off unless the server sends settings
Claude Code registers a dialog named for an automatic effort nudge, but nothing has been found that shows it
Unclear Whether this dialog is ever shown to anyone is not known.
Two new remotely controlled switches exist, both off unless switched on remotely, and their purpose is not yet known
Unclear What either switch controls is not known.
2 more of these are in What probably matters to you, on page 1.
The home settings pack sent to cloud sessions can now include a part for the remote runner, through a new withRunnerPack option
When a tool is given a path inside a remote memory folder, Claude Code now looks that path up before checking the tool's input
Claude Code's sign-in code now tracks extra details about gateways and providers set by an organization, with no visible change
The setup for a stored account copy can now be told that a dialog may be hidden
Unclear It is not clear which dialog this is or when it would be hidden.
Under a new condition, the model list adds an extra option when the Sonnet model is not available
Unclear Which model is added and the condition that triggers it are not known.
Published verbatim by Anthropic for v2.1.314. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 119 bullets, 22 name something an entry on this page also names, 34 name something no entry here does, and 63 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
permissions.blockWritesOutsideWorkingDirectories: Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode
Probably settings-can-block-writes-outside-the-working-directories groups list to Claude apps gateway upstreams: only developers in the listed IdP groups are sent to that upstream, on failover too
Nothing to match on guardrail_trace to Claude apps gateway Bedrock upstreams, to log which Amazon Bedrock guardrail filter fired on a request, without the matched text
Probably telemetry-additions, bedrock-gateway-can-send-trace-header, gateway-config-upstream-groups-and-bedrock-guardrail-trace claude -p exiting with code 0 and no output when startup failed; it now prints the error and exits 1
No entry names this /compact with "400 Input is too long." instead of removing older images and compacting
Probably auto-mode-new-denyask-messages-and-fallback-reason-when-lo #99859[BUG] Bedrock "400 Input is too long." (oversized image payload) isn't treated as request_too_large, so the session is stuck for good Open
tool_reference blocks: the request is sent again once without tool search, and the session remembers
No entry names this UNABLE_TO_GET_ISSUER_CERT when the system certificate store holds a renewed root certificate that is cross-signed with its predecessor
No entry names this #103684[BUG] [Windows] UNABLE_TO_GET_ISSUER_CERT with system cert store behind TLS inspection, while identical setup works on another machine Open
claude mcp logout reporting success when the MCP sign-in was not removed, for example while the macOS keychain is locked over SSH
No entry names this claude ultrareview and claude remote-control asking the workspace trust question in a CI job that has a terminal; with CI set they now refuse an untrusted folder at once
No entry names this --plugin-dir or --plugin-url plugins had a broken manifest or failed to download
Probably plugin-and-agents-flags-startup-failure-handling-and-migrat forceRemoteSettingsRefresh set only in remote managed settings no longer applying once the stored copy had expired, which let sessions start without policy when the server could not be reached
No entry names this /btw answering from the main conversation when asked from a subagent's open transcript
Probably btw-side-questions-can-target-a-named-agents-transcript #105307[FEATURE] /btw while viewing a subagent silently answers from the main conversation (no notice, unlike /model, /compact) Open
claude remote-control sessions that failed to start when the session service was slow for a moment: the worker's registration is now retried with growing waits
No entry names this sandbox.excludedCommands setting description saying listed commands always run outside the sandbox; it now says every command in a call must match an entry
No entry names this #105115update-config: say that sandbox.excludedCommands matches only a single plain command Open
claude -p --resume or --continue
No entry names this --setting-sources still supplying some settings, such as auto mode rules and saved permission consents
No entry names this /permissions, when its safety check gave no verdict
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /upgrade opening the browser and starting a new login for plans billed through the App Store or Google Play; it now says where to change the plan
Probably subscription-billing-via-app-store-google-play-upgrade-n --resume, and rewinding past a switch to another model after a refusal, moving a session on a model name Claude Code doesn't recognize to a different model
No entry names this claude-opus-4.8, being treated as an older model with the wrong context window, output limit, effort, thinking mode and cost
No entry names this ⎿ rows in the transcript view (Ctrl+O)
Nothing to match on dw, dW, yw and yW carrying on past the end of the line, and made w and W stop on empty lines
Nothing to match on p over a character selection ignoring whether the yanked text was whole lines
Nothing to match on aw and iw taking the line break at the end of a line
Nothing to match on /btw, also interrupting the subagent whose transcript is open
Probably btw-side-questions-can-target-a-named-agents-transcript #100603[BUG] Pressing "Esc" in a subgents's /btw call also cancels the subagent itself Open
<bash-stdout> or <local-command-stdout> not being acknowledged to a local stream-json host
No entry names this ~/.claude/skills/.trash, which added file system load that grew with each removal
No entry names this /config are hidden or your organization has turned off Remote Control
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview ~/.claude/skills/.trash and ~/.claude/plugins/.trash growing without limit: each now holds about 1024 entries, whatever cleanupPeriodDays says
No entry names this [Pasted text] pills
No entry names this /design-sync upload prompt to show the folder, the project and the files it will upload or delete
No entry names this /permissions review tab, now called Recently blocked: the footer says what Esc will do with marked rows
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an /permissions to review
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an claude auth login
Probably login-now-checks-the-organizations-config-before-saving-a-s apiKeyHelper
No entry names this /config in agent view to say how to stop agent view opening by default
Probably unattended-commands-hint-reworded-for-auto-mode-and-sandbox, config-in-agent-view-gives-a-hint-about-defaulttoagentsview /security-review now gets a title from it instead of staying untitled
No entry names this --resume speed and memory use on damaged transcripts
No entry names this /context speed in sessions with ten thousand or more MCP tools
No entry names this /claude-api skill: its Datadog setup for API tracing now sends the dd-llmobs-enabled: true header, as the Console does, and its ant install instructions drop the outdated macOS xattr step
No entry names this /ultrareview to check workspace trust before it runs git, as claude ultrareview does
Probably ultrareview-refuses-to-start-in-untrusted-workspace-it-canno which alias or function and to stop passing exported which/unsetenv functions to commands, so which is the system command or zsh builtin
Nothing to match on /permissions Recently blocked to refuse approving a call you can't read in full, including one the terminal is too short to show
Probably auto-mode-denial-notification-reworked-counts-repeated-bloc, permissions-dialog-recently-blocked-tab-handles-mid-turn-an if conditions such as Monitor(tail ) to match the Monitor tool's shell commands as Bash(tail ) matches Bash's
No entry names this claude-api skill to ask to read a Managed Agents workflow run's workflow before changing the agent to improve that run
No entry names this ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels or deniedModels leaves only an older Opus model, or none
Probably opus-availability-check-exempts-the-current-model, model-alias-and-override-resolution-reworked-with-model-ove FORCE_HYPERLINK=false (also no and off) to turn hyperlinks off instead of on
No entry names this git grep in most commands that Claude runs to use the C locale, to avoid a reported memory leak in macOS's regex library on files that aren't valid UTF-8
Probably macos-only-shell-shim-reroutes-git-grep-to-run-with-lc-al CLAUDE_CODE_DISABLE_CFC_PROMPT to also stop the extension adding the Claude in Chrome instructions to a session's messages; the browser tools stay available
Probably claude-code-disable-cfc-prompt-is-reported-to-hosts @Claude !restart giving up after one failed workspace check in channels shared across Enterprise Grid workspaces; it now retries, then asks you to run it again
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 prompt changed.
Claude Code, interactive mode
13 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
645 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 64 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?