You can now load claude.ai connectors while signed in with an API key by setting CLAUDE_CODE_I_ACCEPT_CROSS_ORG_DATA_RISK. Claude Code shows a warning when you do this. On macOS, setting CLAUDE_CODE_NATIVE_APP_BUNDLE lets the native updater install Claude Code as a signed claude.app bundle. A new takesMcpToolHooksOnConnectors setting lets MCP tool hooks run on connector servers. In-process SDK MCP servers marked as modern now connect by skipping the setup handshake. This release has 480 entries, and 330 of them are usable today.
There are 13 entries in the build that are not switched on yet. Giving claude.ai connector tools a local file path, so Claude Code uploads the file itself, is off by default. A rewind for pending turns sits next to the Esc take-back handling, but its actions do nothing yet. Claude Code can tell the model which Claude app your message came from, such as iOS, Android, desktop or web. Reusing earlier messages to keep the prompt cache intact is controlled by CLAUDE_CODE_NORMALIZE_PREFIX_CACHE. Several new server-controlled switches arrive, including ones for Projects write warnings and Chrome tool recognition.
/autofix-pr now always starts a cloud session. Plugins that call ui.backdrop will break, because that method is gone. Many SDK session-control methods are removed, including the sign-in, MCP server and plugin reload ones. Claude in Chrome no longer offers shortcuts_list or shortcuts_execute for running browser shortcuts. Auto-compact now counts some failures separately, so it gives up less quickly. Refusals caused by an old credential no longer trigger retries.
Written by our agent from the shipped bundle, not by Anthropic.
The earlier-subagents list now falls back to on without a server value, and a new CLAUDE_CODE_CRYPTIC_HORIZON variable takes over one of its checks
Sessions & agentsCloud sessions can skip rereading the transcript on resume via CLAUDE_CODE_CCR_SKIP_HYDRATE_ON_CURRENT_TIP, plus four new stream timing switches
Sessions & agentsAdmins can set pooled_conflict_rule to priority_list with groups in pooled_priority_order, and a list without any group is now rejected
ElsewherePlugins now set and clear a backdrop through theme.set and theme.clear, and the old ui.backdrop method is removed
ExtensionsBehind tengu_mossy_melody, Windows splits Bash commands too long for one argument into pieces, and disableWindowsBashCommandSplit lets admins turn it off
Settings & config
/autofix-pr always starts a cloud sessionExtensionsWant the reasoning? Read walks the 57 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
The earlier-subagents list now falls back to on without a server value, and a new CLAUDE_CODE_CRYPTIC_HORIZON variable takes over one of its checks
Unclear What CLAUDE_CODE_CRYPTIC_HORIZON turns on is not known.
Admins can set pooled_conflict_rule to priority_list with groups in pooled_priority_order, and a list without any group is now rejected
Unclear What the change to the compacting check means for a user in practice is not stated.
Plugins now set and clear a backdrop through theme.set and theme.clear, and the old ui.backdrop method is removed
Unclear Whether plugin function hooks are available to plugin authors in general is not stated.
The sandbox can now block SOCKS, plain TCP and non-TLS tunnels to hosts that need inspection, telling Claude to use HTTPS through its proxy instead
Unclear Where denyUninspectedTunnel is set and what it defaults to is not shown.
rename_session gains a names_chrome_tab_group option that sets or clears the Chrome tab group title, and only the service may set it
When auto mode cannot check actions in a session, Claude Code now asks whether to stay, switch to accept edits, or interrupt
Unclear What makes the dialog appear in a session is not stated.
SDK session control drops many methods, including sign-in, MCP server, plugin reload and session title ones
Unclear These methods may now be provided somewhere else, so it is not clear whether SDK callers actually lose them.
In VS Code, approvals can now go through a dialog shown by the editor, behind a switch that is on unless turned off remotely
Unclear What the new VS Code approval dialog looks like, and how the auto mode stop message now reaches you, is not stated.
Loop keepalive is now off unless the server or CLAUDE_CODE_LOOP_KEEPALIVE turns it on; it used to fall back to on
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
14 more of these are in What probably matters to you, above.
Auto mode now ends a turn after repeated refusals, flags Bash commands accept-edits cannot allow, and asks first about more rm and Windows-path commands
Unclear It is not clear how many refusals trigger the stop or whether it is switched on for everyone.
Claude Code's own commands are refused instead of turning the sandbox off when it fails to start, and the shell parser handles more syntax
Files from claude.ai connectors no longer load as skills, CLAUDE.md or MCP config, and added folders and connector file sends get stricter rules
project_write now refuses to replace a doc unless Claude has seen its whole text, and version is returned only by whole-doc reads and writes
Self-hosted runners with --configure-git now check git --version at startup with a timeout, and send usesAgentProxyStandalone instead of agentProxyUrl
Claude Code now refuses to read connector-downloaded files in some cases, ignores settings files in connector-downloads folders, and blocks cloud sessions from them
Plugin-provided MCP servers that your organization's connector settings block are removed, with a message saying an admin can change it
Project .claude/skills plugins are now skipped after entering a worktree with the Bash sandbox on, and the hint now covers trusted workspaces
claude --cloud moves now hand off a conversation summary instead of the conversation file, and explain when a move is refused
Unclear It is not stated whether every cloud move works this way or only moves where a server-side switch turns it on.
Saving or deleting a project doc now asks a person to approve it when other people's text may have reached the model in that turn
Unclear Which permission modes skip this approval is not stated.
Moving a session to the cloud now carries over its permission mode and drops the Remote Control fallback, and conversations Claude ended can't move
Unclear It is not clear whether the Remote Control fallback is gone in every way a move can be started.
The Bash edit-diff feature, and keeping full Bash output in remote sessions, now also need an extra status check to pass
Unclear What the extra status check tests is not stated.
/share can now produce a session bundle when feedback is turned off, or when a share switch is set, not only with CLAUDE_CODE_ENABLE_SHARE_BUNDLE
Unclear Whether /share now sends a bundle by default, without the environment variable or a setting.
In plan mode sessions that cannot show prompts, more Artifacts actions are now refused until the plan is approved, with a reworded reason
Unclear Which extra Artifacts actions are now refused is not stated.
In auto mode, code run through the REPL can no longer send tasks or messages to other agents, because auto mode cannot check that text
Gateway desktop setup now disables a built-in tool when every upstream is Bedrock or Mantle and no managed web search server exists
Unclear Whether the tool turned off is the built-in web search tool.
If the Bun runtime cannot recognise an isolated code context, Claude Code now stops rather than risk bypassing sandbox checks
The built-in fallback for the server-controlled switch tengu_merry_thunder changed from on to off
Unclear It is not stated whether this switch still controls the Wrap up box in this release.
The SDK set_permission_mode request now re-checks auto mode when applied, can be queued or overtaken, and returns error codes such as invalid_mode
A claude -p run in auto mode now prints an error and exits with code 1 if auto mode could not check some actions, so they did not run
When you leave a worktree, Claude Code now keeps it if its connector-downloads folder holds files, and tells you to move them first
Text from WebFetch no longer includes the paragraph telling the model to treat fetched pages as untrusted data
Unclear The warning may have moved into the "Fetched" line rather than been removed.
Allow, deny and ask rules for shell commands now compare commands through a shared normalising step instead of simple lowercasing
Unclear Which commands are now matched or allowed differently is not known.
Under an organization isolation policy, web search, web fetch and browser tools are refused once connector downloads may be in reach
Moving a local session to the cloud now prepares a summary first, and you can type your next prompt while it finishes
Wildcard Bash permission rules now get an extra check, so a compound or unusual command no longer matches them
Unclear Which wildcard rules get the extra check is not stated.
Certain env keys in settings that name a use case are now dropped, and Claude Code logs a warning for each one
Unclear Which environment variable names fall into the ignored set is not stated.
A PermissionRequest hook's allow is now honoured where no prompt can be shown, and a hook-rewritten call that cannot be re-prompted is denied with a reason
Unclear It is not clear whether other checks still stop hooks from approving calls meant for a person only.
Claude Code no longer restarts an out-of-date background session that is using an LLM gateway, so it is not cut off from that gateway
Cowork's refusal now says an action doesn't run where no one can answer an approval card, and more actions skip the target check
A crashed background session that runs through an LLM gateway is no longer restarted automatically, even when its saved state reads success
If approving a remote tool call comes back with edited input, Claude Code now refuses the call instead of running the edited version
Claude Code now closes its Chrome connection if it was opened for another account, and will not connect when nobody is signed in
Claude Code now refuses to send files to a connector unless a person approves the request at Claude Code's own terminal prompt
Unclear It is not stated which tools count as sending files to a connector.
For some sessions, the fleet view's reply box no longer acts on a non-empty draft, unless the draft is the /stop command
Unclear Which sessions this applies to is not clear.
When saving documents to a folder, Claude Code now leaves alone any existing file that has no record of an earlier save, and asks for another out_dir
Unclear It is not clear whether documents that other people may have written are still kept from being saved to files.
--permission-prompt-tool now uses the default handler when a request carries a client tool-use id and the tool has no input schema
Unclear It is not clear which requests carry a client-supplied tool-use id, so when the default handler takes over.
Connectors that have a web address but no directory entry are no longer found in certain modes
Unclear Which four modes cause these connectors to be hidden.
Claude Code ignores project and local settings inside a connector-downloads folder and refuses to save settings there
If a turn ends because of a new message or a permission check, its PostToolUse hooks stop at a time limit and the tool result is kept without their answer
If Claude Code has entered a worktree while the Bash sandbox is or was on, it no longer loads project plugins from .claude/skills
Claude Code's Chrome connection now checks your signed-in account, closing when the account differs and stopping when nobody is signed in
With the Bash sandbox on, skills in .claude/skills folders below the working folder can stay unloaded until Claude Code restarts
Unclear Whether this is switched on depends on a server-controlled setting whose default is not stated.
Auto mode now turns itself off with an explanation when your permission rules and autoMode settings total more than about 1 MB
Before a subagent connects to certain MCP servers, Claude Code now runs a check and skips the server with a warning if it fails
Unclear Which kinds of MCP server get this check is not settled.
Claude Code now skips connector download folders when it looks for .claude folders holding skills, agents and commands
When a shell command would be too long for Windows, Claude Code now swaps it for a command that exits with code 126 and reports why
Saving a skill now rejects too many files, bad path characters, reserved words in the name, and overlong or bracketed descriptions
git push -f and -d now match the push guard list, and a new check flags git commands that take a branch another worktree has checked out
Commands with an unquoted { or } starting a word, or a $[ ] expression, can now ask for permission instead of running as safe
Unclear It is not stated when Claude Code uses this stricter reading, for example whether only when your shell is zsh.
One tool used to be on when the server sent nothing and is now off in that case
Unclear Which tool this is is not stated.
which command is off the list of commands treated as safe#which was removed from the shell commands Claude Code treats as safe, alongside sleep, type, expr and seq
Unclear It is not confirmed that this list is what lets a command run without a permission prompt.
Bash commands with a pipe now get the same extra permission check as those with $, and git push -o is covered by push rules
Unclear Which commands have their PowerShell rule forms skipped is not stated.
A permission request now sets its prompt to default to No when the text it records as typed is empty
Unclear Which permission prompt this affects is not clear.
1 more of these is in What probably matters to you, above.
The browser tools no longer include shortcuts_list or shortcuts_execute, which listed and ran shortcuts and workflows
Unclear It is not known whether the browser extension now supplies these tools instead.
/autofix-pr always starts a cloud session#/autofix-pr no longer has a mode that watches the pull request from your current session, and now always starts a cloud session
Anthropic has not published official notes for v2.1.319 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
No change to the system prompt since v2.1.318.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
413 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 95 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?