You can now load claude.ai connectors while signed in with an API key by setting CLAUDE_CODE_I_ACCEPT_CROSS_ORG_DATA_RISK. Claude Code shows a warning when you do this. On macOS, setting CLAUDE_CODE_NATIVE_APP_BUNDLE lets the native updater install Claude Code as a signed claude.app bundle. A new takesMcpToolHooksOnConnectors setting lets MCP tool hooks run on connector servers. In-process SDK MCP servers marked as modern now connect by skipping the setup handshake. This release has 480 entries, and 330 of them are usable today.
There are 13 entries in the build that are not switched on yet. Giving claude.ai connector tools a local file path, so Claude Code uploads the file itself, is off by default. A rewind for pending turns sits next to the Esc take-back handling, but its actions do nothing yet. Claude Code can tell the model which Claude app your message came from, such as iOS, Android, desktop or web. Reusing earlier messages to keep the prompt cache intact is controlled by CLAUDE_CODE_NORMALIZE_PREFIX_CACHE. Several new server-controlled switches arrive, including ones for Projects write warnings and Chrome tool recognition.
/autofix-pr now always starts a cloud session. Plugins that call ui.backdrop will break, because that method is gone. Many SDK session-control methods are removed, including the sign-in, MCP server and plugin reload ones. Claude in Chrome no longer offers shortcuts_list or shortcuts_execute for running browser shortcuts. Auto-compact now counts some failures separately, so it gives up less quickly. Refusals caused by an old credential no longer trigger retries.
Written by our agent from the shipped bundle, not by Anthropic.
The earlier-subagents list now falls back to on without a server value, and a new CLAUDE_CODE_CRYPTIC_HORIZON variable takes over one of its checks
Sessions & agentsCloud sessions can skip rereading the transcript on resume via CLAUDE_CODE_CCR_SKIP_HYDRATE_ON_CURRENT_TIP, plus four new stream timing switches
Sessions & agentsAdmins can set pooled_conflict_rule to priority_list with groups in pooled_priority_order, and a list without any group is now rejected
ElsewherePlugins now set and clear a backdrop through theme.set and theme.clear, and the old ui.backdrop method is removed
ExtensionsBehind tengu_mossy_melody, Windows splits Bash commands too long for one argument into pieces, and disableWindowsBashCommandSplit lets admins turn it off
Settings & config
/autofix-pr always starts a cloud sessionExtensionsWant the reasoning? Read walks the 57 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Admins can set pooled_conflict_rule to priority_list with groups in pooled_priority_order, and a list without any group is now rejected
Unclear What the change to the compacting check means for a user in practice is not stated.
Behind tengu_mossy_melody, Windows splits Bash commands too long for one argument into pieces, and disableWindowsBashCommandSplit lets admins turn it off
Unclear What turning on disableWindowsBashCommandSplit changes in how commands are handled is not known.
A new CLAUDE_CODE_DISABLE_FEATURE_FLAGS variable joins DISABLE_GROWTHBOOK, messages name whichever is set, and self-hosted runners pass it on
Unclear Whether setting CLAUDE_CODE_DISABLE_FEATURE_FLAGS actually stops the flag download, and whether DISABLE_GROWTHBOOK still works everywhere, is not confirmed.
Managed policies with no desktopHome get a new check and warnings that Cowork turns on and settings change from November 10, 2026
The CLAUDE_CODE_PLUGIN_ATTRIBUTION environment variable joins the allowlist and its entries can set givesWayToOfficialInstall
Unclear What Claude Code does differently when the field is set is not known.
The sandbox can now block SOCKS, plain TCP and non-TLS tunnels to hosts that need inspection, telling Claude to use HTTPS through its proxy instead
Unclear Where denyUninspectedTunnel is set and what it defaults to is not shown.
Gateway operators can now set a billing group tag so requests are logged by group, with the tags stripped before sending on
Claude Code has a new permission setting where any action that would ask for your approval is refused instead
Unclear It is not clear what turns this setting on, so a reader may not be able to choose it.
A new takesMcpToolHooksOnConnectors setting lets mcp_tool hooks target connector servers, and hook listings show more detail
Unclear Whether takesMcpToolHooksOnConnectors can be set in your own settings or only comes from a managed or remote source is unclear.
denyInsteadOfPrompting is carried through settings#Claude Code now passes along a permissions.denyInsteadOfPrompting setting when it is set to true, next to the read and write block settings
Unclear What this setting does once set, and which settings files it is read from, is not confirmed.
Setting CLAUDE_CODE_I_ACCEPT_CROSS_ORG_DATA_RISK now loads claude.ai connectors when Claude Code uses an API key, with a warning
With CLAUDE_CODE_PROXY_RESOLVES_HOSTS set, websocket connections to names that fail to look up locally are left to the proxy instead of failing
Enterprise gateways can send a login_notice of up to 500 characters, shown with the host name on Claude Code's device sign-in screen
Under HIPAA and ZDR policies, Claude Code now denies downloading files from claude.ai connectors, and denies it when the policy cannot be checked
Setting CLAUDE_GATEWAY_LOG_FORMAT to json turns Claude Code gateway messages into structured error logs
permissions.denyInsteadOfPrompting can only make Claude Code stricter#permissions.denyInsteadOfPrompting is now restrictive-only: project and local settings are ignored, and true in any allowed source wins
Claude Code now gives claude.ai connectors a name for deny and ask rules, and warns when a rule written that way cannot apply
Unclear Which situations make a rule written with a connector's claude.ai name fail to apply is not stated.
With permissions.denyInsteadOfPrompting, a run of refused actions now ends the turn with a denial instead of asking you
Unclear How many refusals, or what pattern of them, counts as a run that ends the turn is not known.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
14 more of these are in What probably matters to you, above.
A new daily-cap pause for organizations gets its own messages, stops extra-usage offers, and is exposed to SDK programs as dailyCapPaused
Unclear It is not clear whether anything is shown to you yet when a daily cap pause happens.
Self-hosted runners with --configure-git now check git --version at startup with a timeout, and send usesAgentProxyStandalone instead of agentProxyUrl
Plugin-provided MCP servers that your organization's connector settings block are removed, with a message saying an admin can change it
Claude Code now warns at startup when your claude.ai login has ended and usage will be billed to a Console organization instead
Sending feedback through the relay that CLAUDE_CODE_SEND_FEEDBACK turns on is now off when Claude Code runs through a gateway
Remote Control now handles an organization policy that requires trusted devices, and tells you to run /remote-control to start a new session
Claude Code's background daemon cleans up gateway-routed jobs, does not auto-upgrade workers held on a gateway, and clears stale gateway state
Unclear What the gateway is and how a job comes to be routed through it is not known.
Gateway desktop setup now disables a built-in tool when every upstream is Bedrock or Mantle and no managed web search server exists
Unclear Whether the tool turned off is the built-in web search tool.
Allow, deny and ask rules for shell commands now compare commands through a shared normalising step instead of simple lowercasing
Unclear Which commands are now matched or allowed differently is not known.
Under an organization isolation policy, web search, web fetch and browser tools are refused once connector downloads may be in reach
A new startup notice says your claude.ai login ended and usage now bills to an organization, and points to /login
Results reported through the SDK now have a field naming which of your own auto mode rules decided a tool call
Wildcard Bash permission rules now get an extra check, so a compound or unusual command no longer matches them
Unclear Which wildcard rules get the extra check is not stated.
Certain env keys in settings that name a use case are now dropped, and Claude Code logs a warning for each one
Unclear Which environment variable names fall into the ignored set is not stated.
Claude Code no longer restarts an out-of-date background session that is using an LLM gateway, so it is not cut off from that gateway
A crashed background session that runs through an LLM gateway is no longer restarted automatically, even when its saved state reads success
Claude Code's gateway logging can now write each line as JSON with a severity, a time and a message, instead of plain text
Unclear What switches the logs to JSON is not stated.
Sessions that may hold connector downloads now get reminders to keep connector data apart from web search and fetch
Claude Code's gateway now warns about guardrail headers, GovCloud mixing, base URL variables, pooled priority and model mappings
Claude Code can check MCP servers supplied by plugins against claude.ai connectors with permission limits, controlled by two remote switches
With CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST set, Claude Code says auto mode needs a safety check that isn't available there
For gateway users with no spending limit, /usage now shows a "Spend (UTC)" line instead of nothing
The rules for when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS sets the beta switch aside have changed, including when ANTHROPIC_UNIX_SOCKET matters
Unclear Which cases now apply, and so whether setting CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS behaves differently for you, is not clear.
When a plugin is renamed, Claude Code no longer rewrites settings sources that are held and records that case
Claude Code's cleanup no longer retires background workers held on their gateway just because their Claude Code build was deleted
When organisation policy blocks an MCP server, programs driving Claude Code now get the error code mcp_policy_blocked before any connection is attempted
In a cloud session, asking for permissions now says there is no permissions panel and that rules come from settings files
Unclear Whether the reply is triggered by /permissions or by some other command is not confirmed.
With a checkout hook, a repository whose folder name clashes with one already used in the session, ignoring case, now gets a -2 or -3 suffix
Signing in through a cloud gateway now shows any login notice the gateway supplies, labelled with the gateway's host name
With permissions.denyInsteadOfPrompting, Claude Code ends the turn after too many tool calls in a row are refused
Unclear How many refusals in a row end the turn is not stated.
The mode that avoids permission prompts now marks itself as avoiding them by nature, and denyInsteadOfPrompting now counts as a restrictive setting
Unclear What either change does to which actions are allowed, denied or asked about.
A self-hosted runner now posts a warning after 5 refused renewals of model access, and a notice when renewal works again
With an expired Cloud gateway sign-in, telemetry is not sent and you are told to run /login, and background settings checks are skipped
When the server refuses to refresh a self-hosted runner's token, the log now says how many refusals there have been since the last success
The /device approval page can now show a Notice from a named host when a sign-in notice is supplied
Unclear Where the sign-in notice comes from, and how an administrator sets it, is not clear.
Enabling a blocked MCP server still names enterprise policy when that is the cause, and other blocks now get a separately built error
Unclear Whether this changes the error message a reader sees, or is only an internal rename, is not clear.
After a failed poll, self-hosted runners now work out their wait before retrying without an extra limit that applied before
Unclear What the removed limit was based on is not settled, so how much retry timing changes is unclear.
4 more of these are in What probably matters to you, above.
Claude Code's usage reports now always include which tools were used, and its process samples now record a thread count
Claude Code changed which usage details it reports, dropping one field and adding fields for a reason and total output size
CLAUDE_CODE_COWORK_PLUGIN_SKILL and CLAUDE_RUNNER_OFFERS_NEW_MACHINE now appear on lists of variables Claude Code passes along
Unclear It is not clear what either variable does or whether setting one has any effect.
ANTHROPIC_CUSTOM_HEADERS and CLAUDE_CODE_EXTRA_BODY are now grouped together#Claude Code now keeps ANTHROPIC_CUSTOM_HEADERS and CLAUDE_CODE_EXTRA_BODY on a shared list of their own
Unclear What Claude Code does with the list, and whether it changes how these variables apply, is not stated.
Anthropic has not published official notes for v2.1.319 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
No change to the system prompt since v2.1.318.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
413 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 95 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?