You can now move a session on your computer into a new cloud session. Claude Code copies the newest turns after checking the move is safe. A new /project command names the claude.ai Project for usage reports, and --save keeps that choice. Admins can set disableReplyCheck in managed settings to stop Claude being re-prompted when a turn ends without a reply. Setting CLAUDE_CODE_ULTRAREVIEW_LAUNCH_RECORD to a file path makes each successful ultrareview launch write its session id there. This release has 425 entries, and 240 of them are usable today.
26 entries are in the build but not switched on yet. The biggest is an experimental REPL mode, where Claude writes JavaScript that calls its tools. It comes with an opt-in dialog and limits on resuming and moving sessions. More pieces of a code-running mode landed this time, including script tracking and a tool that waits while idle. A check that can skip compacting a long conversation is also here, but it stays off unless switched on remotely. Session-long "always allow" choices for MCP connector tools, which link Claude to outside services, are recorded only when a remote switch is on.
Some of this release's fixes make broken config files safer to deal with. If the config file is corrupt or empty, Claude Code looks for the best backup and tells you what it did. A global config file that cannot be read is now left alone instead of being overwritten. A failed message send in a remote session no longer leaves it stuck sending. Cloud sessions that fail during setup now wait for the refusal message, so you can see why the launch failed. Saving over a file mounted into a container now works when the file is busy.
Written by our agent from the shipped bundle, not by Anthropic.
A new path moves a local session to a cloud session by copying its recent turns, via /teleport and claude --cloud, with many safety checks
Sessions & agentsSelf-hosted runner reply-check behaviour can now be turned off with a managed disableReplyCheck setting or shaped by a CLAUDE_CODE_REPLY_GATE_POLICY variable
ElsewhereSetting CLAUDE_CODE_EXPERIMENTAL_CODE_MODE asks Claude Code to switch on an experimental Code Mode, which it can refuse for several reasons
A new /project command, gated by tengu_gentle_cupcake, sets attributionProject for usage reports; IDs may start with chan_ and --settings is a source
ExtensionsCLAUDE_CODE_MEMORY_PUSH_DELETE_MODE now accepts recorded, and Claude is told how to delete a shared-memory file with a plain rm command
Sessions & agentsWant the reasoning? Read walks the 46 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →9 more of these are in What probably matters to you, on page 1.
The Delete auto mode rule? prompt now uses Claude Code's shared dialog, and its old bordered box and footer hint are gone
When a read requires a file to have a single name, Claude Code now refuses files with more than one hard link
Before a stored approval runs, the shell moves to its folder only if that move passes the permission check
Unclear When stored approvals are used, and what you see when the folder change is refused, is not clear.
The dialog for asking your admin for usage credits now always shows the same text instead of text sent from the server
The messages asking you to trust what is attached to a cloud session are rewritten to be shorter and more direct
If an image is already the model's copy of a file attached through a remote connection, Claude Code now passes it on without resizing it again
In some environments, Claude Code's status now shows an IDE line saying it is not connected and where to install the extension
The hook that runs when instruction files load no longer lists load_reason as the field its matcher checks
Unclear It is not clear whether a matcher that filters on the load reason still works.
When the permission check can't decide, an action is now also flagged as touching settings if it matches a settings-file check
Claude Code can now remove citation tags from the text of an error message
Claude Code now tells you that connector search covers only part of the directory, and that the full directory is on claude.ai
When you are not logged in, the sign-in status output can now show an extra line above the 'Not logged in' message
Unclear What the extra line says is not known.
--disallowed-tools check drops its warning about claude.ai connector wildcards#Claude Code no longer warns that a * in a claude.ai connector name in --disallowed-tools blocks nothing in a cloud session
Unclear Whether this warning now appears somewhere else is not known.
When the output format is json or stream-json, Claude Code now skips one step it otherwise runs at startup
Unclear Which startup step is skipped, and what it would have done in a JSON run, is not known.
Messages that resume interrupted work are no longer merged with others in the queue, and the dimmed pending-input timing changed
Messages for dropped remote tasks are reworded, with a new reason for when a different connector now holds the task's name
A session that has been moved to the cloud now has the status text "Cloud session ready"
cleanupPeriodDays description says cleanup only deletes local data#The description of cleanupPeriodDays now states that cleanup deletes data only on your computer, not anything Anthropic stores
When mods fail to load, the message now just says "Couldn't load:" and no longer says the earlier versions are still running
Unclear It is not clear whether earlier mod versions still keep running after a failed reload, or whether the new message appears in a different situation.
When Claude calls a deferred tool without its input format loaded, the error now shows the format or explains how to load it
If a session's instruction files are too long together to send whole, Claude Code now says so instead of pointing at a file to read
The prompt asking to allow a network request can now read "Allow network request", and MCP form scroll hints carry labels for screen readers
When an attribution project is set, settings from that source are labelled "set with /project" instead of "--settings"
Unclear Whether a /project command is available to type in this release is not confirmed.
When Claude Code cannot tell whether a shell command names a settings file, it now treats it as naming one in more cases
Unclear It is not clear which commands fall into the new cases.
The border colour of the plan approval box is now worked out rather than fixed, and more tools are recognised when grouping tool calls
The memory removal limit message now says to wait about a minute for memory sync to catch up
A message about pressing 2 now says a dialog is open and must be answered or closed, not that the prompt box has text
Unclear Which action pressing 2 triggers is not stated.
A layout step that walks down through stacked boxes in the terminal display now ignores their vertical padding and only checks for borders
Unclear What this layout step is used for, and so what changes on screen, is not clear.
In some cases a blocked action now reads just "Blocked by auto mode" instead of naming the tool that was blocked
If the server says your design consent is already gone, Claude Code now clears it locally too but still shows an error
When a cloud session's runner exits during setup, Claude Code now waits for the refusal message so it can tell you why the launch failed
When a message fails to send in a remote session, Claude Code now resets its sending state and its response timer
If the config file is corrupt or empty, Claude Code looks for the best backup and tells you what it did or what to fix
If saving over a file mounted into a container fails because it is busy, Claude Code can now write it in place
When an API error ends a step, Claude Code now closes the streamed output and marks that step as failed
When Claude Code cleans up old files, it now skips any file that a live process may still be using
When Claude Code clears an old tool result that has images or documents, it now keeps the leading text in the placeholder
When a message to a remote session carries file attachments, Claude Code now sends them along with it
In a session forked from another, turns from before the fork point now take their effort level from the original session
If you press Esc before a session moved to the cloud starts its first turn, Claude Code now sends the interrupt again for those messages
The logout screen now shows a failure message for any error, not only when your settings could not be saved
If saving your login fails, Claude Code cleans up its temporary file or tells you the path of the file holding the new login
If a remote session's worker never sends a readable start-up message in time, Claude Code stops waiting and sends your queued messages
A queued message whose priority was raised to now is merged with the message before it instead of being sent separately
Removing a user-scope MCP server now saves the config file only while holding a lock, so edits from other sessions are less likely to be lost
Forked session titles now get one numbered "(fork N)" label instead of piling up repeated " (fork)" suffixes
While waiting on a background task's output, Claude Code now skips a progress check if the previous file read has not finished
Claude Code checks its lock folder before deleting old installed versions and skips cleanup entirely if it cannot read it
Unclear It is not clear on which operating systems the per-process lock is written.
Before deleting an old lock file, Claude Code now reads it, and keeps any it cannot read
The summary line counting shell commands and other tools now shows the actual count instead of an out-of-date number
An error shown in place of Claude's reply is no longer counted as an unfinished turn or one waiting on a tool
The key hint reading "key to toggle" is now assembled in separate pieces, fixing a mistake where it was cached in the wrong place
9 more of these are in What probably matters to you, on page 1.
A sleep notice for remote session connections, and a Bash prompt line about attached files, both sit behind remote switches that fall back to off
Documents read from a Project can now be handed to Claude in document form, behind a remote switch that is off by default
A switch lets project documents reach Claude as a plain message instead of a pretend tool call, and PDFs from messages get their own handling
Code that presents MCP tools as callable inside a REPL environment gains further branches, all limited to a build check
Unclear It is not clear what the build check tests, so it is unknown whether any user can reach this.
Claude Code can record a session-long "always allow" choice for an MCP connector tool, but only when a remotely controlled switch is on
Unclear It is not clear where these recorded choices are used, or whether they change what you are asked to approve.
Claude Code has a new helper behind a server-controlled switch and a way to record the folder a session started in
Unclear It is not clear what this helper does or when it runs.
Claude Code now lists claude-security-plugin and claude-security-review-closing alongside claude-design-command, with no visible effect yet
Unclear It is not known what this list controls, so it is unclear whether these names ever appear to you.
Claude Code registers several new server-controlled switches for features that are not yet visible
Unclear What any of these switches controls is not known.
Claude Code defines a new remote switch, tengu_starry_crescent, but this release does not show what it controls
Unclear What tengu_starry_crescent controls, and what it falls back to when the server sends nothing, is not known.
Claude Code can read a timeout in seconds from remote settings, and uses none when the server sends nothing
Unclear What operation this timeout applies to.
A new remote feature switch exists in this build, with nothing yet showing what it turns on
Unclear What this switch controls is not known.
The check that skips saving memories when a conversation already wrote to memory gains a new option, off unless switched on remotely
Unclear It is not clear what the new option changes about when memory saving is skipped.
Claude Code now checks a remote experiment switch when sending some requests that include images; it is off unless switched on remotely
Unclear It is not known what the experiment changes about image requests when it is on.
A new remotely controlled switch feeds into how WebFetch's instructions are built and is recorded in its usage data; it defaults off
Unclear It is not clear what the switch changes in WebFetch's instructions when it is on.
A message saying a remote target refused a tool request and nothing ran is now built, but nothing uses it yet
Claude Code now reads a new on or off switch from the server, which stays off when no value is sent
Unclear It does not say what this switch controls.
Behind a remote switch that is off by default, Claude Code can run a start-up command scan only after MCP settings finish loading
Unclear What the start-up command scan does is not shown.
A remote switch that already skipped HIPAA organisations is now also skipped under one more condition
5 more of these are in What probably matters to you, on page 1.
Whether a turn keeps your disallowedTools list now depends on where the message came from; headless sessions also clean up withdrawn files
Permission prompts for REPL script calls gain one-time answers, an async lane and a timed denial-limit fallback via replAsyncAsk
Unclear The further condition that decides whether the timed fallback is used is not stated.
Remote (CCR) sessions can post a lone keep-alive while event uploads fail, with new heartbeat, goodbye, flush-timing and withholding behaviour
Unclear When whole files are held back from remote viewers is not stated.
Behind a gate, poll-event messages now reach agents and can carry agent, display and REPL fields, with checks on settle-only fields
Tools from MCP servers and their output are now marked as unverified, MCP-owned content when sent to the model, with the server address where safe
Unclear Which setting turns this on, and whether it is on by default, is not clear.
Remote tool calls now fail with a clear error when a shared request cannot be read, and refusals of shared requests get their own reason
Memory stores that report retryWrites now arm the delete-confirm timer and are no longer counted toward permanent-failure suppression
Behind an unresolved ae() check, interrupting a running tool waits briefly so an arriving result can be kept instead of replaced by an interruption error
Unclear It is not clear whether the feature check behind this is switched on for anyone.
Claude Code now logs a one-time diagnostic warning when a session's writer information is missing, in certain set-ups
The self-hosted runner now starts a tool host for tool-server processes and passes per-session checkouts and a session folder to them
Unclear What this changes for someone running a self-hosted runner is not clear.
When Claude Code works out how hard the model should think, it now also takes into account an effort value supplied by a hook
Unclear It is unclear how a hook supplies this value and whether it overrides the other effort settings.
Remote tool calls now record which request form was used and refuse invalid or unsupported shared requests before the size check
When a saved copy is set to be enveloped, the Read tool now wraps the file's text in framing and neutralizes any lookalike tags inside it
Unclear It is unclear when saved copies are set to be enveloped, so when users will see this framing is not known.
Claude Code gains internal names for a startup step and an ultrareview evaluation, plus an evaluation tool loaded only when an internal check passes
A feature switch can now report no device policy and stay off when the sending side doesn't enforce a device policy
Unclear It does not say which feature this switch controls.
tengu_marble_heron is now read as a settings object whose enabled and autoArm parts default to true; what it controls is still unknown
Unclear It is not clear what feature this switch controls or what a reader would notice when it is on.
Behind an unresolved ae() check, the remote bridge ignores script-call rows, skips virtual messages, and can show virtual messages marked for remote clients
Unclear It is not clear what a script call is or when the condition that switches this on holds.
The /insights model request, including its facet extraction, now sets sendSideQueryBeta, and the insights run uses a new running-flag mechanism
Two artifact tool actions are now marked as giving stored text, and the conversation-summary request passes a new project-docs option
Claude Code can now check your usage-limit status outside an interactive session when an option allows it, and it now tracks PDF reads separately
Unclear It is unclear whether anything turns on the usage-limit check in non-interactive sessions, so scripted or automated runs may or may not behave differently.
The policy limiting how many asks are allowed now has a separate limit for asks after Claude's own task, alongside person and other triggers
Unclear It is unclear which feature this policy belongs to and whether it is active for users.
In internal builds only, the background task list can show local script tasks, with a matching list of allowed built-in tool names
Claude Code now tracks held-back main replies separately while streaming, and releases one early when a block starts arriving
Unclear It is not clear whether the separate main-reply handling is ever active, so the visible effect is unknown.
A new cutOffMidWork flag records whether an interrupted turn stopped mid-work, and resume sorts API-error interruptions differently
Claude Code now counts edit-diff watcher events and relay connections, dials and bytes for each session
Two message formats gain optional fields, own_session_author (defaults to true) and tool_host, and malformed values in them are ignored
Claude Code now signals when a stopped turn's input is accepted, records the directory a permission was asked in, and tracks more auto mode details
When a plugin's backdrop is rewritten, colorScheme must now also stay the same, like plugin, id and glass
Claude Code now regularly renews the lock on the version it is running, so another install or update is less likely to remove it
When Claude Code cannot read its config file from disk, it now also notes it cannot be sure the file is missing
Published verbatim by Anthropic for v2.1.318. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 84 bullets, 26 name something an entry on this page also names, 22 name something no entry here does, and 36 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
assume_role on mantle upstreams of the Claude apps gateway, for a role in another AWS account and for per-developer AWS cost attribution
Probably bedrock-style-assume-rolebearer-token-check-extended-to-ma, mantlebedrock-gateway-attribution-warning-reworded-and-made effort option to a mod's $.model.fork, so a quick side job can run at low whatever effort the session uses; the result reports the effort sent
Probably hook-matchers-mcp-tool-name-matching-and-modelfork-effort claude auth status (loginExpiresAt) and to claude -p JSON results (credential_expires_at)
Probably stop-message-uuid-description-extended-to-claude-p, result-messages-gain-credential-expires-at claude -p text output, starting 10 days before a stored claude.ai sign-in ends
Probably stop-message-uuid-description-extended-to-claude-p --continue sometimes losing the earlier conversation after a malformed tool call's retries ran out (regression in 2.1.314)
No entry names this #96628[BUG] After a tool call fails to parse, the retry notice can point `parentUuid` at a row that is never written, so `--resume` loses everything before it Open
/logout, claude auth logout and claude mcp remove reporting success, and changes to trust, consent or MCP settings being dropped with no word, when the config file could not be updated on a shared network home directory
No entry names this Not logged in when another terminal or host signs in again to the same account and organization on the same home
Probably auth-status-output-gains-an-extra-line claude mcp add and remove writing the config without its lock: they now wait for it or exit 1, though another job's save can still replace a saved server
Probably claude-mcp-add-web-add-a-claudeai-connector-from-the-cli claude plugin commands exiting before a slow token refresh was saved, which could sign you out on the next run
No entry names this #102265[BUG] Short-lived subcommand (claude plugin validate) exits mid OAuth refresh: the rotated refresh token is never saved, the next process gets invalid_grant and blanks the login Open
claude plugin validate passing a custom-named marketplace file that claude plugin marketplace add rejects
No entry names this allowedProviders list that another login on the same machine had stored
No entry names this claude -p and SDK sessions
Probably stop-message-uuid-description-extended-to-claude-p claude -p and Agent SDK sessions reporting success when an API error cut off a reply while a mod hooked turn.step
Probably stop-message-uuid-description-extended-to-claude-p claude remote-control hosts, the background daemon and self-hosted runners failing to start new sessions (spawn ENOENT) after an update or version cleanup removed the binary of a still-running process
No entry names this sudo claude) being treated as dead by version cleanup, which could delete its binary
No entry names this /remote-control showing a session as available after a failed connection
Probably remote-control-failure-messages-tell-the-user-how-to-recover, remote-control-callout-flow-refactored-remote-control-dial /design revoke reporting success when the request failed with a 404
No entry names this Setup hook writes to CLAUDE_ENV_FILE not reaching the Bash tool in some cloud sessions
No entry names this NODE_EXTRA_CA_CERTS file is empty, not PEM, or starts with a damaged certificate: readable certificates are now used, with a warning on stderr
Probably much-longer-node-extra-ca-certs-diagnostics-two-new-cases, node-extra-ca-certs-partial-load-of-unparseable-ca-files, ca-cert-drop-message-expanded /mcp in cloud sessions counting tools the model can't use; a server's row now shows how many of its tools are available
Probably mcp-listing-and-ultrareview-credits-refactor-forked-slash turn.step hook making a stopped reply finish as a success in headless runs
No entry names this claude -p with no ~/.claude.json backup: it now takes a fresh backup before deleting the last good one
Probably config-lock-only-saves-and-lock-wait-env-var, stop-message-uuid-description-extended-to-claude-p, config-file-backup-and-empty-file-recovery setup-token being refused at start on machines with forceLoginOrgUUID, when the token belongs to a permitted organization
Probably warning-when-the-oauth-sign-in-is-near-its-end, expired-login-messages-login-reached-its-time-limit #106324[BUG] forceLoginOrgUUID is incompatible with setup-token OAuth tokens Open
~/.claude.json that isn't valid JSON with defaults; the start now fails, says how to restore the file, and leaves it as is (anthropics/claude-code#87551)
Probably config-lock-only-saves-and-lock-wait-env-var, config-file-backup-and-empty-file-recovery ~/.claude.json with no backup being reported as corrupted; Claude Code now starts as it does when the file is missing
Probably config-lock-only-saves-and-lock-wait-env-var, config-file-backup-and-empty-file-recovery ~/.claude.json naming an empty or cut-off backup, or failing on a read-only file
Probably config-lock-only-saves-and-lock-wait-env-var, config-file-backup-and-empty-file-recovery claude -p names claude auth login and claude setup-token
Probably warning-when-the-oauth-sign-in-is-near-its-end, stop-message-uuid-description-extended-to-claude-p, expired-login-messages-login-reached-its-time-limit ~/.claude.json, settings files and the stored login survive saves on shared network home directories: they are less often deleted, briefly emptied or replaced by a near-empty or older copy
Probably config-lock-only-saves-and-lock-wait-env-var, config-file-backup-and-empty-file-recovery /bin/bash
Probably bash-heredoc-on-stdin-teaching-macos-binbash-only-flag-d claude -p, SDK apps) to stop rewriting ~/.claude.json on every run when nothing in it changed
Probably config-lock-only-saves-and-lock-wait-env-var, stop-message-uuid-description-extended-to-claude-p, config-file-backup-and-empty-file-recovery /ide from an outside terminal or your editor's extensions view
Probably awayidle-jetbrains-plugin-not-found-message-now-tells-user prompt.submit to stay in the user's turn rather than go out as a system message
No entry names this deniedMcpServers URL entries to also block Anthropic-provided servers whose upstream URL matches, and connectors in cloud sessions and on self-hosted runners, where the session is given the connector's own URL; otherwise deny a connector by name
Probably mcp-deniedmcpservers-matches-mcp-url-parameter-addresses /permissions rule details, built-in rules and delete confirmation views to use the standard dialog; pressing Ctrl+C twice there now goes back or cancels instead of quitting
No entry names this /claude-api managed-agents-onboard to give a new agent's built-in tools, and a quickstart template's MCP tools, the auto permission policy ("Judge risky actions") by default, matching the Claude Console; say "run without asking" to opt out
No entry names this external_account) credentials file is about to expire
No entry names this listen.trusted_proxies: they now say to list only a proxy that adds the connecting address to X-Forwarded-For itself
Probably gateway-guidance-on-x-forwarded-for-and-trusted-proxies-rewo CLAUDE_RUNNER_SPAWN_REASON to the orchestrator's spawn-runner hook environment: why Anthropic sent the request (e.g. runner_lost, resumed); unset when none was sent
Probably cloud-sessions-and-spawn-reason-in-the-runner --release-idle-session-min is the last argument with no value (still ignored) or has a value of only spaces (still read as 0)
Probably self-hosted-runner-server-sent-idle-session-release, self-hosted-runner-idle-limit-from-anthropics-control-plan ok session=… now prints at every log level on stdout (was debug only, stderr) with reason=… after jti=…, and nack session=… ends its fields with reason=… after retryable=…; update scripts that match retryable=true: or retryable=false:
No entry names this gh run view --log and gh api log requests now get the log in most environments, not an unreachable redirect
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
No change to the system prompt since v2.1.317.
Claude Code, interactive mode
No prompt capture for v2.1.318, so this release's prompt surface is unknown.
482 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 62 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?