You can now load claude.ai connectors while signed in with an API key by setting CLAUDE_CODE_I_ACCEPT_CROSS_ORG_DATA_RISK. Claude Code shows a warning when you do this. On macOS, setting CLAUDE_CODE_NATIVE_APP_BUNDLE lets the native updater install Claude Code as a signed claude.app bundle. A new takesMcpToolHooksOnConnectors setting lets MCP tool hooks run on connector servers. In-process SDK MCP servers marked as modern now connect by skipping the setup handshake. This release has 480 entries, and 330 of them are usable today.
There are 13 entries in the build that are not switched on yet. Giving claude.ai connector tools a local file path, so Claude Code uploads the file itself, is off by default. A rewind for pending turns sits next to the Esc take-back handling, but its actions do nothing yet. Claude Code can tell the model which Claude app your message came from, such as iOS, Android, desktop or web. Reusing earlier messages to keep the prompt cache intact is controlled by CLAUDE_CODE_NORMALIZE_PREFIX_CACHE. Several new server-controlled switches arrive, including ones for Projects write warnings and Chrome tool recognition.
/autofix-pr now always starts a cloud session. Plugins that call ui.backdrop will break, because that method is gone. Many SDK session-control methods are removed, including the sign-in, MCP server and plugin reload ones. Claude in Chrome no longer offers shortcuts_list or shortcuts_execute for running browser shortcuts. Auto-compact now counts some failures separately, so it gives up less quickly. Refusals caused by an old credential no longer trigger retries.
Written by our agent from the shipped bundle, not by Anthropic.
The earlier-subagents list now falls back to on without a server value, and a new CLAUDE_CODE_CRYPTIC_HORIZON variable takes over one of its checks
Sessions & agentsCloud sessions can skip rereading the transcript on resume via CLAUDE_CODE_CCR_SKIP_HYDRATE_ON_CURRENT_TIP, plus four new stream timing switches
Sessions & agentsAdmins can set pooled_conflict_rule to priority_list with groups in pooled_priority_order, and a list without any group is now rejected
ElsewherePlugins now set and clear a backdrop through theme.set and theme.clear, and the old ui.backdrop method is removed
ExtensionsBehind tengu_mossy_melody, Windows splits Bash commands too long for one argument into pieces, and disableWindowsBashCommandSplit lets admins turn it off
Settings & config
/autofix-pr always starts a cloud sessionExtensionsWant the reasoning? Read walks the 57 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
The earlier-subagents list now falls back to on without a server value, and a new CLAUDE_CODE_CRYPTIC_HORIZON variable takes over one of its checks
Unclear What CLAUDE_CODE_CRYPTIC_HORIZON turns on is not known.
Cloud sessions can skip rereading the transcript on resume via CLAUDE_CODE_CCR_SKIP_HYDRATE_ON_CURRENT_TIP, plus four new stream timing switches
Unclear The other environment variables needed to turn on early remote connect are not named.
Plugins now set and clear a backdrop through theme.set and theme.clear, and the old ui.backdrop method is removed
Unclear Whether plugin function hooks are available to plugin authors in general is not stated.
Behind tengu_mossy_melody, Windows splits Bash commands too long for one argument into pieces, and disableWindowsBashCommandSplit lets admins turn it off
Unclear What turning on disableWindowsBashCommandSplit changes in how commands are handled is not known.
A new CLAUDE_CODE_DISABLE_FEATURE_FLAGS variable joins DISABLE_GROWTHBOOK, messages name whichever is set, and self-hosted runners pass it on
Unclear Whether setting CLAUDE_CODE_DISABLE_FEATURE_FLAGS actually stops the flag download, and whether DISABLE_GROWTHBOOK still works everywhere, is not confirmed.
Claude Code now recognises messages marked as notes of what was said aloud on a voice call alongside the session
Unclear It is not clear what sends voice-call messages or whether any user can reach this yet.
Managed policies with no desktopHome get a new check and warnings that Cowork turns on and settings change from November 10, 2026
A new claude_app_notice note tells the model when your latest message came from the Claude iOS, Android or desktop app, or the website
A server-sent recipe can add a model picker row that sets which model subagents use, unless you already set that yourself
Unclear It is not known whether the server is sending a recipe at the moment, so the row may not appear for anyone yet.
On macOS, the native updater can install Claude Code as a verified claude.app bundle when CLAUDE_CODE_NATIVE_APP_BUNDLE is set, else as before
Unclear A fixed condition in the decision may keep the app bundle install from running even when CLAUDE_CODE_NATIVE_APP_BUNDLE is set.
Programs controlling Claude Code can set check_permissions on mcp_call so a direct MCP tool call is checked like Claude's own, with clear refusals
New CLAUDE_CODE_STREAM_EVENT_NO_SUBSCRIBER_HOLD_MS and set_has_subscribers tune stream holds; resume goodbye skipping gets an off switch
Unclear How much narrower the goodbye skip now is was not established.
The CLAUDE_CODE_PLUGIN_ATTRIBUTION environment variable joins the allowlist and its entries can set givesWayToOfficialInstall
Unclear What Claude Code does differently when the field is set is not known.
The sandbox can now block SOCKS, plain TCP and non-TLS tunnels to hosts that need inspection, telling Claude to use HTTPS through its proxy instead
Unclear Where denyUninspectedTunnel is set and what it defaults to is not shown.
MCP tool results can now return input_required results unchanged when allowed, and carry download offers through the permission path
Unclear Which MCP servers send download offers, and whether the feature is switched on, is not stated.
Allow, deny and ask rules made during a session are now saved to session metadata and restored on resume, with the update step moved into a helper
Unclear It is not clear whether saving session rules is switched on.
Claude Code adds "latency-optimize" to a list that also holds cost-optimize, migrate, managed-agents-onboard and prompt-audit
Unclear It is not clear whether latency-optimize is offered to users as a skill they can call, or where it appears.
Claude Code now reads CLAUDE_CODE_DESKTOP_WORKFLOW_LIMIT_WAIT, passes it to its Desktop settings when a check passes, then clears it
Unclear It is not stated what condition must hold for Claude Code to use the variable, or what values it accepts.
In-process SDK MCP servers marked as modern now connect with saved capabilities and a response cache, skipping the setup handshake
Unclear It is not clear what sets the modern flag, so SDK users cannot tell how to turn this mode on.
Claude Code can now pick out an MCP server entry whose address ends in /SKILL.md and read off the server name and address
claude.ai connector tools that take a file can now be given a local file path, and Claude Code uploads the file itself, but this is off by default
Claude Code has a new permission setting where any action that would ask for your approval is refused instead
Unclear It is not clear what turns this setting on, so a reader may not be able to choose it.
A new takesMcpToolHooksOnConnectors setting lets mcp_tool hooks target connector servers, and hook listings show more detail
Unclear Whether takesMcpToolHooksOnConnectors can be set in your own settings or only comes from a managed or remote source is unclear.
denyInsteadOfPrompting is carried through settings#Claude Code now passes along a permissions.denyInsteadOfPrompting setting when it is set to true, next to the read and write block settings
Unclear What this setting does once set, and which settings files it is read from, is not confirmed.
Setting CLAUDE_CODE_I_ACCEPT_CROSS_ORG_DATA_RISK now loads claude.ai connectors when Claude Code uses an API key, with a warning
Connector tool results can offer files, which Claude Code saves to a git-ignored folder only after you choose Download
Unclear It is not clear what decides whether connector download offers are picked up at all, so whether this works by default is unknown.
Claude Code can now upload files from your computer to claude.ai connectors, with an approval prompt, a policy switch and many refusal rules
Unclear Whether connector file uploads are switched on by default is not clear.
rename_session gains a names_chrome_tab_group option that sets or clears the Chrome tab group title, and only the service may set it
Claude Code now sets up a part for rewinding a pending turn next to its Esc take-back handling, but nearly all its actions do nothing
A prompt for a bug-hunting agent now ships inside Claude Code in place of the one for a support agent
Unclear It is not clear how a user reaches this bug-hunter agent, or whether it is switched off unless enabled.
With CLAUDE_CODE_PROXY_RESOLVES_HOSTS set, websocket connections to names that fail to look up locally are left to the proxy instead of failing
A plugin's settings can now provide a subagentStatusLine command, which gets CLAUDE_PLUGIN_ROOT and CLAUDE_PLUGIN_DATA
Claude Code now reads CLAUDE_CODE_TODO_REMINDER_MODE for to-do reminders, defaulting to baseline, and checks CLAUDE_CODE_EVAL_CONFINED differently
MCP server configurations can now include an optional true/false field called noDirectoryEntry
Unclear What setting noDirectoryEntry to true changes for a server is not stated.
The rewind and summarize menu can now show a Resume from summary option, where Claude writes a summary and you continue from it
Unclear When the Resume from summary option is shown is not stated.
Resumed headless sessions now keep a paused tool call whose tool has vanished; CLAUDE_CODE_DROP_UNAVAILABLE_DEFERRED_TOOL=1 drops it instead
When auto mode cannot check actions in a session, Claude Code now asks whether to stay, switch to accept edits, or interrupt
Unclear What makes the dialog appear in a session is not stated.
SDK session control drops many methods, including sign-in, MCP server, plugin reload and session title ones
Unclear These methods may now be provided somewhere else, so it is not clear whether SDK callers actually lose them.
In VS Code, approvals can now go through a dialog shown by the editor, behind a switch that is on unless turned off remotely
Unclear What the new VS Code approval dialog looks like, and how the auto mode stop message now reaches you, is not stated.
New internal names point to voice-call and refused-feedback work, and the result output gains a stopped_by_permission_check field
Unclear It is not clear whether any of these are reachable, including whether the stopped_by_permission_check field is ever filled in.
Claude Code treats voice-call transcripts as untrusted background, and has a tool to read state an MCP App view has shared
Unclear It is not stated what turns these features on or whether anything uses them yet.
Claude Code now also removes every string listed in its model-mix configuration from the system prompt
The SDK's context usage reply can now include coldResumeQuota, so an app can warn how much of the 5-hour limit a cold resume costs
With no daemonColdStart setting, Claude Code now falls back to the fixed value "transient"
Unclear What the fallback was in the previous build is not known, so whether the default actually changed is unclear.
Loop keepalive is now off unless the server or CLAUDE_CODE_LOOP_KEEPALIVE turns it on; it used to fall back to on
permissions.denyInsteadOfPrompting can only make Claude Code stricter#permissions.denyInsteadOfPrompting is now restrictive-only: project and local settings are ignored, and true in any allowed source wins
Claude Code now gives claude.ai connectors a name for deny and ask rules, and warns when a rule written that way cannot apply
Unclear Which situations make a rule written with a connector's claude.ai name fail to apply is not stated.
claude plugin validate now prints a Digest line for the plugin folder, adds it to --json output, or says why there is none
Claude Code accepts a new set_has_subscribers control request that takes true, false or null
When a setting allows it, Claude Code can use a Chrome tab group's title as the session's display name
Unclear It is not clear what sets allow_chrome_tab_group_title or whether a user can turn it on.
With permissions.denyInsteadOfPrompting, a run of refused actions now ends the turn with a denial instead of asking you
Unclear How many refusals, or what pattern of them, counts as a run that ends the turn is not known.
Choice prompts with a type-your-own-answer option can now open your external editor through the chat:externalEditor key binding
Unclear Which prompts offer the external editor is not stated.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
14 more of these are in What probably matters to you, above.
Auto mode now ends a turn after repeated refusals, flags Bash commands accept-edits cannot allow, and asks first about more rm and Windows-path commands
Unclear It is not clear how many refusals trigger the stop or whether it is switched on for everyone.
A new daily-cap pause for organizations gets its own messages, stops extra-usage offers, and is exposed to SDK programs as dailyCapPaused
Unclear It is not clear whether anything is shown to you yet when a daily cap pause happens.
Last-resort compaction can splice dropped messages back and record lost rounds, and its put-back switch moved to a new server flag
Unclear It is not clear whether the step that puts dropped messages back is switched on.
propose_skills now accepts a list of find-and-replace edits for improving an existing skill instead of a full replacement SKILL.md
Unclear What makes the edits option available is not known, so it may not be offered in every session.
Claude Code's own commands are refused instead of turning the sandbox off when it fails to start, and the shell parser handles more syntax
Files from claude.ai connectors no longer load as skills, CLAUDE.md or MCP config, and added folders and connector file sends get stricter rules
project_write now refuses to replace a doc unless Claude has seen its whole text, and version is returned only by whole-doc reads and writes
Self-hosted runners with --configure-git now check git --version at startup with a timeout, and send usesAgentProxyStandalone instead of agentProxyUrl
Claude Code now refuses to read connector-downloaded files in some cases, ignores settings files in connector-downloads folders, and blocks cloud sessions from them
Plugin-provided MCP servers that your organization's connector settings block are removed, with a message saying an admin can change it
Claude Code can now read subagent transcripts linked in from another session after strict checks, so adopted sessions list their subagent history
Project .claude/skills plugins are now skipped after entering a worktree with the Bash sandbox on, and the hint now covers trusted workspaces
The dialog shown when you return to an idle session can now offer a compact choice that runs /compact instead of a full resume
Prompt suggestions, away summaries and memory extraction can continue from the last reply while the cache is warm instead of resending history
claude --cloud moves now hand off a conversation summary instead of the conversation file, and explain when a move is refused
Unclear It is not stated whether every cloud move works this way or only moves where a server-side switch turns it on.
Saving or deleting a project doc now asks a person to approve it when other people's text may have reached the model in that turn
Unclear Which permission modes skip this approval is not stated.
Claude Code now warns at startup when your claude.ai login has ended and usage will be billed to a Console organization instead
Claude Code can run an MCP tool call in rounds to download files a connector offers, if the server says it supports downloads
Browser tool calls can now target a particular browser and are refused if that browser is no longer selected or disappears
Moving a session to the cloud now carries over its permission mode and drops the Remote Control fallback, and conversations Claude ended can't move
Unclear It is not clear whether the Remote Control fallback is gone in every way a move can be started.
The Bash edit-diff feature, and keeping full Bash output in remote sessions, now also need an extra status check to pass
Unclear What the extra status check tests is not stated.
The /model picker can now include an entry that selects a lead model, preselected when it matches your current model
Unclear Where the lead model comes from, and so whether the entry appears for you.
/share can now produce a session bundle when feedback is turned off, or when a share switch is set, not only with CLAUDE_CODE_ENABLE_SHARE_BUNDLE
Unclear Whether /share now sends a bundle by default, without the environment variable or a setting.
Autocompact can now hold off at its usual point and compact at the model's whole-window threshold instead
Unclear Whether this later compaction is active by default is not stated.
When a remote session closes because your organization moved to another region, Claude Code says so and reports the session as ended elsewhere
Claude Code has new logic that makes pending auto mode permission requests wait for an answer when the model is switched
Unclear It is not clear when Claude Code actually uses this waiting behaviour, so its effect on a running session is unknown.
In plan mode sessions that cannot show prompts, more Artifacts actions are now refused until the plan is approved, with a reworded reason
Unclear Which extra Artifacts actions are now refused is not stated.
For local files attached through the Gmail connector, the fixed approval question is replaced by a description of what attaching does
Unclear It is not clear whether Claude Code still asks before every attachment.
When a group of writes to an artifact's database is refused, the model is now told why
In the agent view, the reply box can now say "enter to open and answer" instead of "reply", with the send hint hidden
With CLAUDE_CODE_RESUME_INTERRUPTED_TURN on, a cut-off turn from plan mode is not re-run if the session comes back in another mode
If a machine's notes say its commands run in a VM, Claude now tells you the command ran in that VM on your computer
Claude in Chrome now refuses to mix secret-filling with running code in a page in one session, and rejects nested or unknown batch actions
Sending feedback through the relay that CLAUDE_CODE_SEND_FEEDBACK turns on is now off when Claude Code runs through a gateway
Remote Control now handles an organization policy that requires trusted devices, and tells you to run /remote-control to start a new session
In auto mode, code run through the REPL can no longer send tasks or messages to other agents, because auto mode cannot check that text
Teammates running inside Claude Code can now always show permission prompts, and are no longer handed a list of allowed tools
Unclear It is not clear whether teammates were previously limited to a set of tools that no longer applies.
Claude Code's background daemon cleans up gateway-routed jobs, does not auto-upgrade workers held on a gateway, and clears stale gateway state
Unclear What the gateway is and how a job comes to be routed through it is not known.
Files and folders created by $.fs.write are no longer readable by other users on the same machine
When you approve a plan kept in a Claude Doc, Claude Code now reads that Doc itself instead of asking the model to
Unclear What switches on the plan-in-a-Doc mode is not settled.
The rewind message list can now show an extra labelled row above the current prompt that is chosen like any other row
Unclear Nothing shown here supplies the extra row yet, so it is unclear when users will see one.
Claude Code now wraps MCP tools that take files so they can receive uploads, and logs a warning when a tool fails the check
Claude Code now compares interface versions with the other side of a computer use connection and reports which side is too old
If the Bun runtime cannot recognise an isolated code context, Claude Code now stops rather than risk bypassing sandbox checks
The built-in fallback for the server-controlled switch tengu_merry_thunder changed from on to off
Unclear It is not stated whether this switch still controls the Wrap up box in this release.
Long transcript results now hand back a cursor for older events, and get_run_log cursors are tied to their session and refused in any other form
Extra-usage readouts now handle accounts with no monthly limit, list daily, weekly and monthly use, and add new credit messages
The SDK set_permission_mode request now re-checks auto mode when applied, can be queued or overtaken, and returns error codes such as invalid_mode
Anthropic has not published official notes for v2.1.319 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
No change to the system prompt since v2.1.318.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
413 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 95 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?