Admins running the bundled gateway can now set one shared monthly spending limit for a whole access group. The new blockReadsExemptPaths setting lists folders Claude Code may still read when reads outside your working directories are blocked. Claude Code can now publish an artifact as a Claude doc. It also reports whether a lasting subscription to that doc's updates was set up. In Cowork, the loops Claude Code starts no longer receive your memory. A hidden --gateway-json option on claude auth login lets the VS Code extension handle Cloud gateway sign-in.
Several features are in the build but not switched on yet. Remote sessions can track and resend conversation lines they still owe after a restart, but only when this is switched on remotely. Files uploaded to a project can be attached as text context, behind a flag that defaults to off. Claude Code can list MCP server requests that are waiting for your input, also behind an off-by-default flag. Long Bash output previews can keep both the start and the end, with the full text saved to a file. Numbered menus can be set to wait for Enter instead of picking after a short pause.
File searches no longer hang when ripgrep fails to exit after a timeout. Stray connections can no longer knock you off a background session. Sending a message immediately no longer cuts off an automatic compaction that is in progress. Resuming a copied session no longer shows a stray cut-off tool call. When Claude Code runs as a tool server, a settings file that fails to load no longer drops its permission rules. Shell snapshots now save your aliases in a case where they used to save nothing.
Written by our agent from the shipped bundle, not by Anthropic.
A new held-message recognition feature can be turned off with CLAUDE_CODE_DISABLE_HELD_MESSAGE_RECOGNITION, which is also passed to remote sessions
CLAUDE_CODE_SORTED_OTTER can now override the remote tengu_sorted_otter switch, and one function moves from that switch to tengu_quiet_pike
claude auth login gains a hidden --gateway-json option that runs Cloud gateway sign-in as JSON lines for another program, such as the VS Code extension
Managed settings gain policy_mode: layered, which merges several matching policies instead of applying only the first one, with limits to protect deny rules
A background session's socket can now hold new connections until they send something, so a silent stray connection cannot kick off the attached viewer
Sessions & agentsWant the reasoning? Read walks the 37 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Managed settings gain policy_mode: layered, which merges several matching policies instead of applying only the first one, with limits to protect deny rules
Restricted mode now blocks reads outside the working directories, searches and Chrome uploads are fenced too, and blockReadsExemptPaths lets chosen paths through
Unclear Under some conditions the exempt list is treated as empty, and it is not clear what those conditions are.
Unverifiable self-named and looped cross-signed CA certificates are now dropped, two env vars keep them, and certificate errors explain missing issuers
Unclear Which certificates are dropped, and whether dropping happens by default, is not settled.
In Cowork, Claude Code now sends empty memory to the loops it starts, and a new emergency check can turn memory off on the laptop side
The bundled gateway supports input_tagging for Bedrock guardrails, requires it to match across upstreams, and checks every model named in a request
Unclear Which values input_tagging accepts is not stated.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
5 more of these are in What probably matters to you, above.
On Linux, Claude Code now finds processes left behind by tasks when a session shuts down, asks them to stop, then force-stops any still running
In the expanded permission prompt, one approval option can now show a fixed label and refuse to be selected when a condition is not met
Unclear Which conditions disable the option, and what label replaces it, are not stated.
Preview tunnels gain an option to refuse other sessions, require strict TLS and stop if the session changes, plus a report on unlisted ports
Claude Code now only prepares a compacted conversation ahead of time while idle when the prompt cache is the one-hour kind and still warm
Auto mode now checks a remote switch, off unless switched on remotely, before approving two particular tools without asking
Unclear Which two tools are affected, and whether they are still approved automatically while the switch is off, is not settled.
On exit, Claude Code now force-stops shell commands and process trees still running after a grace period, except on Windows
Unclear Apart from never running on Windows, what decides whether this cleanup is switched on is not clear.
A subagent with no valid effort level of its own now gets one worked out from its permission settings instead of none
Unclear Which effort level the permission settings produce is not known.
Auto mode allow rules are now gathered per settings source, and command-line allow rules are merged with managed policy
Unclear It is not stated how command-line allow rules and policy allow rules are merged.
The tool that lists directories from an MCP server now asks for permission or refuses, instead of only erroring when unavailable
Unclear What decides whether directory listing is switched on or off is not stated.
Remote Control now refuses to start a session if the account behind its credentials changed or could not be confirmed
Claude Code now adds git ignore rules for its own files under .claude/ so they stop showing as untracked
In a hosted worker, an MCP request whose trusted CA certificates share none with Claude Code's current list is now refused with an error
Claude Code now chooses a Haiku model itself only when no small-model variable is set, the provider is Anthropic's own, and the main model is the default
Unclear It is not clear which tasks use the model this rule chooses.
After a sandboxed command, Claude Code now renames planted git-repository files with a .claude-sandbox-quarantine- prefix rather than deleting them
The timer pause for open MCP questions is now skipped for apps on a list
Unclear Which apps are on the list is not stated.
Whether Claude Code adds its exit code 2 check to a PowerShell hook now depends on whether the script uses begin, process, end, clean or dynamicparam blocks
Unclear Whether scripts with these blocks now get the added exit code check or now skip it is not clear.
Gateway configs now require the same guardrail.input_tagging on every Bedrock upstream, and remote-session messages wait for admission
The Bash safety check now follows variables in relative-path checks, reads heredocs inside substitutions and flags commands naming zsh histchars
Claude Code now flags commands where a variable set to a relative value may name a file in the working directory
Shell commands can now be refused for paths with tabs or line breaks, or for declaring special shell variables as integers
An MCP server's authServerMetadataUrl, and other addresses, now fail validation if they are too long
Claude Code's check of shell commands handles heredocs inside substitutions by default and knows Gradle's -x and --exclude-task take a value
Claude Code now refuses to parse shell commands where a heredoc and a $( ... ) or <( ... ) substitution overlap on the same line
Three internal checks now take the stricter or safer answer: address wildcards, certificate data and stray escape characters
sed -i, sshpass and set commands#Claude Code's automatic safety check for shell commands now catches more risky uses of sed -i on macOS and BSD, sshpass and set
Claude Code's import code now refuses symbolic links and stops if a file it checked has been swapped for another one
Unclear It is not stated which import feature this applies to or what triggers the new checks.
Anthropic has not published official notes for v2.1.315 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
4 prompts changed.
Claude Code, interactive mode
12 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
653 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 44 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?