You can now load claude.ai connectors while signed in with an API key by setting CLAUDE_CODE_I_ACCEPT_CROSS_ORG_DATA_RISK. Claude Code shows a warning when you do this. On macOS, setting CLAUDE_CODE_NATIVE_APP_BUNDLE lets the native updater install Claude Code as a signed claude.app bundle. A new takesMcpToolHooksOnConnectors setting lets MCP tool hooks run on connector servers. In-process SDK MCP servers marked as modern now connect by skipping the setup handshake. This release has 480 entries, and 330 of them are usable today.
There are 13 entries in the build that are not switched on yet. Giving claude.ai connector tools a local file path, so Claude Code uploads the file itself, is off by default. A rewind for pending turns sits next to the Esc take-back handling, but its actions do nothing yet. Claude Code can tell the model which Claude app your message came from, such as iOS, Android, desktop or web. Reusing earlier messages to keep the prompt cache intact is controlled by CLAUDE_CODE_NORMALIZE_PREFIX_CACHE. Several new server-controlled switches arrive, including ones for Projects write warnings and Chrome tool recognition.
/autofix-pr now always starts a cloud session. Plugins that call ui.backdrop will break, because that method is gone. Many SDK session-control methods are removed, including the sign-in, MCP server and plugin reload ones. Claude in Chrome no longer offers shortcuts_list or shortcuts_execute for running browser shortcuts. Auto-compact now counts some failures separately, so it gives up less quickly. Refusals caused by an old credential no longer trigger retries.
Written by our agent from the shipped bundle, not by Anthropic.
The earlier-subagents list now falls back to on without a server value, and a new CLAUDE_CODE_CRYPTIC_HORIZON variable takes over one of its checks
Sessions & agentsCloud sessions can skip rereading the transcript on resume via CLAUDE_CODE_CCR_SKIP_HYDRATE_ON_CURRENT_TIP, plus four new stream timing switches
Sessions & agentsAdmins can set pooled_conflict_rule to priority_list with groups in pooled_priority_order, and a list without any group is now rejected
ElsewherePlugins now set and clear a backdrop through theme.set and theme.clear, and the old ui.backdrop method is removed
ExtensionsBehind tengu_mossy_melody, Windows splits Bash commands too long for one argument into pieces, and disableWindowsBashCommandSplit lets admins turn it off
Settings & config
/autofix-pr always starts a cloud sessionExtensionsWant the reasoning? Read walks the 57 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →14 more of these are in What probably matters to you, on page 1.
Signing in through a cloud gateway now shows any login notice the gateway supplies, labelled with the gateway's host name
If Claude Code has entered a worktree while the Bash sandbox is or was on, it no longer loads project plugins from .claude/skills
Claude Code's Chrome connection now checks your signed-in account, closing when the account differs and stopping when nobody is signed in
Results of background MCP tasks are now delivered like background shell results, marked as not coming from you and not counting as approval
Task progress updates now say when a task waits on a usage limit and when it resets, and MCP tool errors now carry an error code
/loop warns that timers in a cloud session may not fire#In a cloud session, /loop now notes that its timer may stop when the session's container is released, and Claude is told to say so
Unclear It is not known what turns on the longer-lasting loop option or which tool it uses.
Workflow task progress now includes a rate-limit wait and keeps sending updates on a timer while the wait lasts
When you stop a turn, waiting updates from tasks moved to the background become passive, then those tasks are stopped
Unclear It is not clear whether this behaviour is switched on.
/context report groups unloaded MCP tools by server#A shorter form of the /context report lists only loaded MCP tools, totals the rest by server and caps long tables
Unclear Which uses of /context produce the shorter form is not stated.
With permissions.denyInsteadOfPrompting, Claude Code ends the turn after too many tool calls in a row are refused
Unclear How many refusals in a row end the turn is not stated.
With the Bash sandbox on, skills in .claude/skills folders below the working folder can stay unloaded until Claude Code restarts
Unclear Whether this is switched on depends on a server-controlled setting whose default is not stated.
WebFetch now refuses claude.ai/share links with a note that the shared chat is shown in the browser and cannot be fetched
Auto mode now turns itself off with an explanation when your permission rules and autoMode settings total more than about 1 MB
The mode that avoids permission prompts now marks itself as avoiding them by nature, and denyInsteadOfPrompting now counts as a restrictive setting
Unclear What either change does to which actions are allowed, denied or asked about.
Before a subagent connects to certain MCP servers, Claude Code now runs a check and skips the server with a warning if it fails
Unclear Which kinds of MCP server get this check is not settled.
The auto mode status row now shows Disabled, Enabled, or "Not reaching this session" with a reason
Claude Code now skips connector download folders when it looks for .claude folders holding skills, agents and commands
ExitWorktree now refuses to remove a worktree holding files saved from connectors, unless discard_changes is set to true
When a shell command would be too long for Windows, Claude Code now swaps it for a command that exits with code 126 and reports why
In some sessions /color now saves the color to the cloud session instead of locally, and says whether the save worked
Saving a skill now rejects too many files, bad path characters, reserved words in the name, and overlong or bracketed descriptions
A conversation summary already being made can now survive when you stop a turn, so the next compaction can reuse it
Unclear What turns this behavior on, and whether it is on for every user, is not stated.
git push -f and -d now match the push guard list, and a new check flags git commands that take a branch another worktree has checked out
Claude Code now warns the model when an MCP task's outcome is unknown or its stop is unconfirmed, and truncates long failure text
The parser behind Bash permission checks now guards zsh arithmetic, tracks variable assignments, and compaction gains a hand-over-at-stop step
Unclear It is not stated whether these changes make any shell commands ask for permission more or less often.
Errors from Claude's Chrome browser tool are now matched to named types such as tab_not_found, with broader patterns for tab and security-check errors
Unclear It is not clear whether these kinds are ever shown to you or are only recorded inside Claude Code.
When auto mode's safety check returns no verdict, the model is now told either to retry once or that retrying now will not help, depending on the case
Claude Code now trims a generated branch name and uses it only if it is valid, otherwise falling back to a default name
If a session can't move to the cloud because Claude ended it, the error no longer suggests resuming it with claude --resume
Claude Code no longer looks up memories in advance for a prompt with no spaces, removing the exception for Chinese, Japanese and Korean
When a session is renamed, Claude Code now reports whether the new name was written to the session's transcript
Claude Code now refuses to build cloud-session web addresses from an organization ID that is not one plain path segment
Claude Code now neutralizes one more kind of forged note when it appears at the start of a line in tool output
Claude in Chrome errors are now classified as a permission prompt that timed out or one whose window could not open
The updater now stops a download that grows past the size recorded for it, with a message saying so
Errors about MCP task input requests now list only fault codes, not the text or input key the server sent
Typed input can now be marked as coming from a connector, and a remote session ended because it was deleted no longer sends a reply
Unclear It is not clear what marking input as coming from a connector actually does for the person using it.
When a tasks/get answer is too big, too wide or nested too deeply, Claude Code now returns a dedicated error rather than the generic -32603 message
Unclear The code and wording of the new predefined error are not stated, so it is unclear what a program should now match on.
If you approve a tool call but Claude Code cannot get that tool from your computer, Claude is now told it did not run and to call it again
Claude now sees "[image]" in place of images in finished MCP task results, and the GetTask refusal mentions tasks as well as background commands
Claude Code now re-reads the inside of certain escaped-backtick parts of a shell command so its permission checks see the commands there
In stream-json output, the disk-full message is now described as sent only when Claude Code exits with status 0; a run that exits 1 gets only a stderr line
When an inline plugin hides a synced claude.ai plugin, the warning now says to disable or remove it instead of pointing to /plugin
Under a certain condition, a key hint now reads "see more" where it used to read "reply"
Unclear It is not clear when the hint shows "see more" rather than "reply", or whether the key now does something different.
In headless runs, a turn can now end without waiting for file downloads when queued turns hold the same files
In print mode, the end-of-turn text result is no longer printed when the run ended because a deferred tool was unavailable
Unclear What, if anything, is printed in place of the text result is not known.
When your daily usage cap is paused, one check now fails and another path stops early with a message
Unclear Which offer, dialog or command is affected when the daily cap is paused is not known.
Claude Code's saving of output piped into tail now checks commands more carefully, skips risky shell forms and checks free disk entries
The permission hint for Bash commands now says rules match the command text with quotes resolved, not the raw text
Unclear Whether the matching itself changed or only the hint's wording is not settled.
Task status reminders now leave out tasks that do not belong to the current agent or its session
Commands with an unquoted { or } starting a word, or a $[ ] expression, can now ask for permission instead of running as safe
Unclear It is not stated when Claude Code uses this stricter reading, for example whether only when your shell is zsh.
Skill evaluation guidance now says a run cut off by a timeout is usually still graded and can look like a low score
Permission requests for tool uses asked for by the host now leave out suggested rule changes when the tool allows none
New error messages explain when an attached computer runs a different Claude Code version, or when an approval changed a call and cancelled a request
The Skills dialog now notes that skills in project subfolders aren't loaded mid-session once the Bash sandbox has been on
One tool used to be on when the server sent nothing and is now off in that case
Unclear Which tool this is is not stated.
Claude Code no longer includes every project .claude/agents folder when listing project agents; each must pass a check first
Unclear It is not clear what the check tests, so which agent folders are left out is unknown.
If the Chrome connection drops after a browser action is sent, the model is told it may have happened and to check before repeating it
MCP extra details in the _meta field now survive the remote tool path, and finished MCP tasks include delivery details in their notice
When a subagent's later report is refused, the result handed back to the main agent now includes a notice saying so
Under some conditions Claude Code now blocks values for a set of environment variables that fail a format check, while allowing an empty LANG
Unclear Which variables are affected and when the check applies is not stated.
Remote sessions now record the surface they run on, treat voice calls as unclassified, and group several account errors as not allowed
which as always allowed#The fewer-permission-prompts skill now lists which as allowed only with safe options, not with any arguments
Claude's instructions for proposing skill changes no longer say a save replaces the whole SKILL.md or that the file should be read first
When a Gmail call that attaches files by reference is too long, the error now says the limit is 150,000 characters
Deleting a job now says when its kept worktree holds connector downloads, and removes a second stored item for the job
which command is off the list of commands treated as safe#which was removed from the shell commands Claude Code treats as safe, alongside sleep, type, expr and seq
Unclear It is not confirmed that this list is what lets a command run without a permission prompt.
An error about an eval grader no longer suggests inverting it with max: 0
When a session runs through the remote-session bridge, a tool now explains that project memory is not available there
Claude Code explains that sending a file to a connector needs your approval in a terminal, which sessions started with -p or by another program cannot give
A self-hosted runner now posts a warning after 5 refused renewals of model access, and a notice when renewal works again
Bash commands with a pipe now get the same extra permission check as those with $, and git push -o is covered by push rules
Unclear Which commands have their PowerShell rule forms skipped is not stated.
The browser network-request tool's description now says URLs are matched as listed, with sign-in values shown as REDACTED
When no credentials are found, Claude Code now records the reason as either gateway use or no credentials, and drops one old label
Unclear Where the message text shown to you about missing credentials now comes from, and what it says.
With an expired Cloud gateway sign-in, telemetry is not sent and you are told to run /login, and background settings checks are skipped
The permission request format now notes that an ask rule may apply to an MCP tool only under a different server name
The Skill tool now always keeps its results inside subagents instead of depending on a check
Unclear What the earlier check returned is not known, so whether this changes anything for users who already had it on is unclear.
In Anthropic cloud sessions, MCP server addresses are no longer recorded at launch when they look like they carry credentials
After a bridge request is refused for good, Claude Code stops asking again and reuses that refusal until it restarts
When an upload is refused, Claude Code now records a named reason such as the organization, region or IP address not being allowed
Claude Code now ignores overage information about your usage limit unless that information includes an actual limit
Claude is now told that pictures and notebooks in a connector-downloads folder are data from a connector and not instructions to follow
When a client attaches through Remote Control, Claude Code re-checks a rate-limit refusal so an outdated limit notice can clear
Claude Code now recognises two proxy size-limit errors for MCP responses, and a refused sign-in token is retried after a wait
Saving a session title or an agent name now returns a failure when it cannot be written to the transcript, instead of only logging it
When a session cannot move to the cloud because the cloud lacks its agent, the message now suggests claude --cloud "your task"
Claude Code now skips sending a task cancel to MCP servers on older protocol versions that lack task support, and logs why
When the server refuses to refresh a self-hosted runner's token, the log now says how many refusals there have been since the last success
The /device approval page can now show a Notice from a named host when a sign-in notice is supplied
Unclear Where the sign-in notice comes from, and how an administrator sets it, is not clear.
Claude Code now skips skills folders inside connector download folders, and MCP tool calls can relay tasks
A permission request now sets its prompt to default to No when the text it records as typed is empty
Unclear Which permission prompt this affects is not clear.
Before you discard a worktree, Claude Code now warns that files saved from connectors in its connector-downloads folder will be lost
If a remote session was refused for good, a later automatic revive of it now fails instead of creating a new session
HTTP errors from the relay now map to named reasons such as relay_busy, and a message reports files a connector upload refused
The fleet view no longer sends a new name directly to adopted peer sessions; every rename now writes to the job's state file
Unclear It is not clear whether peer sessions can still be renamed from the fleet view some other way.
The step that switches on Claude in Chrome now fetches its result when none is stored, and is marked as one where Chrome shows a link
Claude Code stops early on one path when compaction summaries are sent, and counts some hidden messages when deciding to re-run work
When Claude Code does not recognise a model name, its message now suggests a close match if it finds one
When Claude Code warns that it does not recognise a model name, it now adds a "did you mean" suggestion
At startup Claude Code now warns when two of its config files exist and says which one it is using
Anthropic has not published official notes for v2.1.319 yet. This section updates automatically when the entry appears in the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
No change to the system prompt since v2.1.318.
Claude Code, interactive mode
One prompt change in this release could not be quoted from the build, so no entry on this page describes it.
413 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 95 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?