Admins running the bundled gateway can now set one shared monthly spending limit for a whole access group. The new blockReadsExemptPaths setting lists folders Claude Code may still read when reads outside your working directories are blocked. Claude Code can now publish an artifact as a Claude doc. It also reports whether a lasting subscription to that doc's updates was set up. In Cowork, the loops Claude Code starts no longer receive your memory. A hidden --gateway-json option on claude auth login lets the VS Code extension handle Cloud gateway sign-in.
Several features are in the build but not switched on yet. Remote sessions can track and resend conversation lines they still owe after a restart, but only when this is switched on remotely. Files uploaded to a project can be attached as text context, behind a flag that defaults to off. Claude Code can list MCP server requests that are waiting for your input, also behind an off-by-default flag. Long Bash output previews can keep both the start and the end, with the full text saved to a file. Numbered menus can be set to wait for Enter instead of picking after a short pause.
File searches no longer hang when ripgrep fails to exit after a timeout. Stray connections can no longer knock you off a background session. Sending a message immediately no longer cuts off an automatic compaction that is in progress. Resuming a copied session no longer shows a stray cut-off tool call. When Claude Code runs as a tool server, a settings file that fails to load no longer drops its permission rules. Shell snapshots now save your aliases in a case where they used to save nothing.
Written by our agent from the shipped bundle, not by Anthropic.
A new held-message recognition feature can be turned off with CLAUDE_CODE_DISABLE_HELD_MESSAGE_RECOGNITION, which is also passed to remote sessions
CLAUDE_CODE_SORTED_OTTER can now override the remote tengu_sorted_otter switch, and one function moves from that switch to tengu_quiet_pike
claude auth login gains a hidden --gateway-json option that runs Cloud gateway sign-in as JSON lines for another program, such as the VS Code extension
Managed settings gain policy_mode: layered, which merges several matching policies instead of applying only the first one, with limits to protect deny rules
A background session's socket can now hold new connections until they send something, so a silent stray connection cannot kick off the attached viewer
Sessions & agentsWant the reasoning? Read walks the 37 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →5 more of these are in What probably matters to you, on page 1.
Errors about a missing GitHub remote in ultrareview and cloud agents now share one hint, which covers a GitHub repo that already exists
Claude Code now writes its detailed log lines about setting up an MCP server's web connection only when a debug check passes
When sessionStore is used with persistSession: false, the error now advises a new private CLAUDE_CONFIG_DIR deleted afterwards, not /tmp
Downloading task files now waits for the file service connection and stops as cancelled if you abort
The notice saying a session isn't eligible for auto mode now includes a separate help link
Claude Code now flags commands where a variable set to a relative value may name a file in the working directory
The survey prompt now shows "Opening the survey…" while loading and a hint to answer by typing 1 or 0
Claude Code now recognises sign-in failures where the token has no organization, has no account, or the account is not a member
Remote sessions get several small changes, including an extra connection check and a sturdier way to spot a failed move to the cloud
Messaging an archived cloud session now tells you it can take messages again once you unarchive it at claude.ai
Shell commands can now be refused for paths with tabs or line breaks, or for declaring special shell variables as integers
Claude Code now recognises several cloud provider error messages as meaning a model is unavailable
Errors about an unknown or unavailable model now clean up the model name you typed, and some add the server's own explanation
mcp_authenticate now checks organization policy again just before sign-in starts, and stops if your Claude account changed meanwhile
More account error codes now count as organization errors, and application_deactivated now counts as a credential error
Unclear Which additional error codes are now treated as organization errors is not known.
Claude Code now recognises more Bedrock and Vertex errors as a refusal to give you access to a model
An MCP server's authServerMetadataUrl, and other addresses, now fail validation if they are too long
Claude Code's check of shell commands handles heredocs inside substitutions by default and knows Gradle's -x and --exclude-task take a value
Claude Code now refuses to parse shell commands where a heredoc and a $( ... ) or <( ... ) substitution overlap on the same line
Claude Code now recognises more server error codes as meaning your account is not entitled to something, rather than a generic error
/login#When your sign-in expires, Claude Code's message now tells you to run /login to sign in again
Three internal checks now take the stricter or safer answer: address wildcards, certificate data and stray escape characters
sed -i, sshpass and set commands#Claude Code's automatic safety check for shell commands now catches more risky uses of sed -i on macOS and BSD, sshpass and set
Claude Code's import code now refuses symbolic links and stops if a file it checked has been swapped for another one
Unclear It is not stated which import feature this applies to or what triggers the new checks.
A single pending approval in a remote session now shows "waiting for approval" when auto mode's checker can decide it
The send_now interrupt now lets an automatic compaction finish and keep its summary before it moves or stops the turn
The chart tool now refuses to continue when fetching its data returns nothing, instead of carrying on
Resume now keeps an interrupted tool call only if it belongs to the session that was copied
If ripgrep does not exit after being killed for timing out, the search now ends with an error instead of waiting forever
When Claude Code runs as a tool server, a settings file that fails to load no longer silently drops all its permission rules
With client or custom CA certificates, Claude Code now closes a reused connection when certain connection settings have changed since it opened
Checking whether a remote session is archived now gets a fresh credential and retries once if the sign-in was rejected
Claude Code now records when closing a switched-off MCP server times out and stops reconnecting servers you switched off
When moving a session to another folder fails partway, Claude Code now switches back to the previous folder
When Claude Code snapshots your shell setup, it now saves your aliases in a case where it used to save nothing
Unclear Which shells take this new branch is not settled.
The check for whether a remote session was archived now refreshes your login first and retries once after an authentication error
Claude Code's own analytics events now carry a principal stamp, and events recorded under a different account are no longer sent
The "hold to speak" voice hint now only appears when there is a key to show, and the organisation survey layout is adjusted
Claude Code now ignores a locale setting that is too long, as it already did for empty, C and POSIX values
Resetting the watcher that tracks your git branch now also stops its timers and any checks still in progress
Claude Code now reads the auto memory file repeatedly and uses it only once two reads in a row match, instead of reading it once
Claude Code now recognises a subagent that never finished because the process running the conversation stopped
- or + now survive the shell snapshot#Claude Code's copy of your shell setup now handles functions whose names begin with a minus or plus sign
8 more of these are in What probably matters to you, on page 1.
When long Bash output is cut, the preview can now keep both its start and its end, with the full text saved to a file
Menus that let you type a number to pick an option can now require Enter to confirm instead of choosing after a short pause
Unclear It is not stated which menus switch off the automatic pick.
Claude Code can now list waiting MCP elicitation requests, but only when a remote flag that defaults to off is on
When an answer settles a request for user input, Claude Code can now also send a cancel for that request, a change that falls back to off
On resume, Claude Code no longer automatically continues an interrupted turn that came from a different session
Behind a server-controlled switch, Claude Code can keep the text of pkill, pgrep and pidwait commands off the shell's own command line
The check that lets some shell commands run without asking now refuses more risky patterns, including file patterns that may match nothing
Unclear It is not stated whether a command refused by this check is put to you for approval or blocked outright.
Claude Code swaps one server-controlled switch for a new one in an internal list; what the list controls is not known
Claude Code now checks a remote list of platforms, which is empty by default, but what it controls is not known
Unclear What this check controls, and whether anything uses it yet, is not known.
{ ... } after for ((...)) are flagged#Claude Code's shell command reader now flags a { ... } body after for ((...)) and suggests do ...; done
Unclear What turns the internal check on is not known, so this may not apply to every user.
Claude Code can look up a sender address earlier at startup, but only when remote switches turn it on; both default to off
4 more of these are in What probably matters to you, on page 1.
Claude Code's Bash tool can now carry the command text into the shell separately in one no-sandbox case, and falls back if the shell rejects it
Unclear It is not clear what triggers the new path or what it changes in how a command behaves.
The sandbox adds a feature-flag-controlled write block on the staged mcp_call folder, plus caching for parent-folder scrubbing
Unclear It is not clear whether sandboxed commands can now no longer write to plugin tool staging folders.
A command that opens a dialog can now reuse a different command's dialog instead of needing its own
Claude Code's handler for remote tool announcements now loads on demand and returns a remote_tools_disabled error when a session is not admitted
Unclear How a session is admitted to use remote tools is not stated.
Old usage-limit checkpoints are now removed from git in one batch, inside the sandbox when it is on, and a failure is retried next time
When a session starts, Claude Code now starts an optional watch for an Artifacts MCP entry and reports it if that watch fails
Unclear Whether the part of Claude Code that runs this watch is included in this build is not known.
In some cases the auto mode safety check now runs without your ask rules, extra directories or full allow-rule list, and Claude Code records which part was left out
Unclear It is not clear which situations cause the permission rules to be left out of the auto mode check.
A helper that works with skill listings returns nothing in all three places Claude Code uses it
Unclear Whether the empty result changes which skills Claude Code lists or uses is not stated.
In one message mode, Claude Code can now strip a kind of automatic reminder from your messages and avoids adding a notice twice
Unclear It is not clear which kind of reminder is removed or when the new condition holds.
Claude Code's internal logger now only writes a message when its level is accepted and debug mode is on or the build is internal
When a tool call is interrupted, Claude Code can now give certain tools a different error message instead of the same one for every tool
The shell snapshot file now has a "# Aliases" marker line before the aliases it records
Behind a remote switch, Claude Code can lock a git worktree by writing git's lock file itself instead of running git worktree lock
MessageDisplay hooks now report whether they changed the displayed text#Claude Code now keeps track of whether a MessageDisplay hook actually changed the text of a message it shows
Claude Code now recognizes coworker mode only from a local-agent entrypoint or a claude-coworker prefix, with one other check removed
Unclear It is not stated which environments relied on the removed check and are no longer treated as coworker mode.
Importing memory files, skills, commands and settings into a project can now use safer file writing, and reports links and permissions not copied
Unclear It is not stated what condition switches the safer writing on, so whether it applies to a given import is unknown.
A remotely controlled summary setting now only chooses between "full" and "short", with refresh, token and per-model limits removed
Unclear Which feature this summary setting controls is not stated.
Claude Code's regular expression parser now handles counted repeats, lookahead and named groups, and gives a reason when it refuses a pattern
Unclear Where Claude Code uses this parser, and so which patterns a user writes are affected, is not stated.
In print mode, the stop notice shown on an execution error is now kept with each result instead of read from one shared place
Claude Code's internal cache reset now runs one expensive step only when it is doing a full clear
When a run ends with an error during execution, Claude Code now works out an auto mode stop notice and keeps it with that result
Unclear It is not clear whether, or where, these stop notices are shown to you.
The note Claude gets in scheduled or triggered runs, and the result it sees for an interrupted subagent call, have both changed
Unclear Where these two messages are used, and how their wording differs from before, is not clear.
The two browser messages on the Cloud gateway sign-in screen are now kept as shared text instead of being written into the screen
Claude Code now leaves text containing no ${ untouched instead of fully parsing it for environment variable references
Unclear It is not clear whether the full parsing step ever changed text that has no ${ in it, which this shortcut would now skip.
Claude Code's command-preview step now picks either the stored or the shown version of a command's text
Unclear It is not clear how the stored and shown modes differ, so the visible effect on summaries is unknown.
Claude Code changed a pattern that spots runs of 32 or more stacked Unicode combining marks, including halfwidth katakana voicing marks
Unclear It is not clear which text this pattern is applied to.
Claude Code's breakdown of time spent before a turn's first request now names four more phases that used to be counted as other
New internal counters track how reply text is streamed, including gaps over 500 ms, late timers and whole turns held back
Claude Code now records when Claude repeats a Bash command it already ran, and whether anything changed in between
Reports of permanent preview connection failures now tell apart Claude Code's own refusals from policy refusals
Claude Code's usage data now records finer timings for preparing attachments and for streaming text in remote sessions
Claude Code now counts tsgo, rspack, tsdown, maturin, configure and protoc as build commands
Unclear It is not stated what Claude Code does differently with a command once it counts it as a build.
Commands using ava, jasmine, karma, tap, nyc, c8, behave, pest, gotestsum or ginkgo are now recognised as test runs
Unclear What a reader sees differently when a command is recognised as a test run is not stated.
Claude Code's internal prompt cache diagnostics now store fingerprints of instructions and tools separately for each source
Two lists of command names Claude Code recognises in shell commands now include tools such as tsgo, oxlint, just, zig, flutter and swiftlint
Unclear It is not clear what the lists control, so it is unknown whether recognising these tools changes anything a user sees, such as permission prompts.
The WebFetch tool now sends usage data when it reads a long web page only in part
Claude Code's list of Python tools now includes ty, basedpyright, dmypy, behave, django-admin, fastapi and maturin
Unclear It is not clear whether being on this list changes when these commands run without asking for permission.
A keepalive report Claude Code sends while waiting after a turn now also includes how much processor time it has used
Remote sessions gain two internal ways to ask how many uploads are held back or queued
Remote workers now pass a setting about shell commands, and in non-interactive mode a send-now message can be delivered during a turn
Unclear What the new shell setting changes in practice is not known.
In remote sessions, a follow-up message sent to a turn that was stopped can now be closed, and SDK startup time is now measured for a sample of starts
When a remote session starts, Claude Code now checks for outstanding uploads and logs when it gives up after several tries
Remote sessions gain a few small fields, including a "self" permission scope and a voice hint counter
Remote sessions now record closed follow-ups, classifier eligibility and live-preview changes, and a prompt-trim message gains a label
Claude Code now counts when it holds a whole turn's transcript upload and when that hold ends early, and one explicit early release was removed
Unclear It is not confirmed whether removing the early release changes when transcript uploads are actually sent.
Remote sessions can now mark a 403 refusal from the session service as refused by a proxy, and label turns in one of two ways
Anthropic has not published official notes for v2.1.315 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
4 prompts changed.
Claude Code, interactive mode
12 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
653 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 44 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?