Real Claude Code Changelog

Claude Code's release notes only describe what Anthropic chooses to announce, not everything they actually change. Bug fixes sometimes ship in one version but get announced in another, and even significant features can go unmentioned entirely.

Here are 3 examples of changes that were shipped but not announced at all:

Files Claude reads on your computer, and the output of commands it runs, become part of a cloud session — visible to anyone the session is shared with and, on Team or Enterprise plans, to your organization's administrators. (2.1.257)

Approving an Artifact live room lets page events from anyone in your organization start turns while you are not present. (2.1.251)

A comment from a writer on a watched Artifact can trigger automatic edits to it, subject to server-side re-checks on the writer, the edit grant, file count, size and rate. (2.1.248)

There are a lot more (over 100) in the changelog below. Coverage: 27 releases from 2.1.226 to 2.1.323.

:point_right: Read the changelog ↓

Measuring completeness

Tracking machinery is still a work in progress, so consistent full evaluation of each release is currently unviable. Significant architectural refactoring, like the React Compiler migration, interferes with a clean diff, so we've developed a completeness metric to make it clear how comprehensive each changelog entry is.

Visibility indicators

Naturally, we include entries that are also in the official changelog; therefore, each change is labeled with a badge.

Caveats

1. Just because a change is shipped doesn't necessarily mean anyone can use it because new features are often gated; that is, unavailable to most public users.

2. Anthropic can alter Claude Code's behavior without code changes by dynamically enabling feature flags in the GrowthBook console.

Have you found something we missed?

If so, please open an issue.

License

• Each entry listed in this changelog is licensed under CC BY 4.0, meaning you're free to quote entries provided you link back to this repository.
• Any strings which are quoted verbatim from Claude Code's source code are proprietary to Anthropic, so they don't fall under CC BY 4.0. You don't have to link back here for those.
• Neither we nor this repository are affiliated with or endorsed by Anthropic.
• The tools we develop to produce this changelog are closed source for the time being.

Changelog

2.1.323 ◆◇◇◇

• 🔴 Moved connector downloads out of the working tree's connector-downloads folder into Claude Code's per-project data folder, where cleanupPeriodDays cleanup applies (remote switch, off by default).
• 🔴 Added permissions.blockFileToolReadsOutsideWorkingDirectories in launch --settings: file reads use host folders plus Claude-owned files and path exemptions; /add-dir cannot widen them, and shell commands are unchanged.
• 🔴 Stopped mcp_tool hooks in cloud sessions from calling the linked-computer (remote-devices) or Claude in Chrome servers, because a hook call skips the normal permission check.
• 🔴 Refused subagent MCP resource reads and mcp_tool calls from subagents or certain background hooks to session-metadata servers that would treat those calls as the main session's.
• 🔴 Removed the <package>@npm route for installing a plugin straight from npm (remote switch, off by default); npm sources listed in a marketplace still work.
• 🔴 Added /motion and /whiteboard prompts for published Artifact types. They need Artifact access or host-provided command support; Whiteboard also needs organization policy.
• 🔴 Added CLAUDE_CODE_OVERLOADED_RETRY_MAX_WAIT_MS to cap the total time the main conversation waits through overload retries, from 5 to 60 minutes; CLAUDE_CODE_MAX_RETRIES and the retry watchdog take precedence.
• 🔴 Added a post-compaction reminder to re-read earlier text with the claude.ai conversation tool before quoting it, and to say so when it cannot (remote switch, off by default).
• 🔴 Added a warning when a named shared-memory delete is unconfirmed and sync is not sending changes, telling Claude that other sessions may still read the content and to correct any claim that it is gone.
• 🔴 Raised experimental observers from one to four per agent, named in the comma-separated observer field; CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS=1 enables them.
• 🟢 Widened Code Mode's model check from Opus 5.5 and Sonnet 5.5 to Fable and Mythos 5.2 or later and other Claude families at 5.5 or later; its experimental opt-in still applies (remote switch, off by default).
• 🟢 Raised the fallback context window for unknown model IDs from 200K to 1M; model data and window overrides still win, and CLAUDE_CODE_DISABLE_1M_CONTEXT=1 keeps the fallback at 200K.
• 🟢 Stopped writing new allow rules to settings when a secret scan flags or fails, or Git tracks the local settings file; existing saved rules are left alone.
• 🟢 Checked plugins against engines["claude-code"] in plugin.json at install, update and load; refused incompatible copies, but warned and continued for local author folders.

2.1.322 ◆◆◇◇

• 🟡 (2.1.323) Left plugins' config.set hooks unasked when /fast on or /fast off is typed on Vertex; the /fast menu still asks them.
• 🟢 Added fast mode on Vertex AI for Fable 5.2 and Mythos 5.2 in the global, us and eu regions; /fast turns it on for the session only, moves an unsupported model to Fable 5.2, and shows the price as 2x standard.
• 🟢 Retried Vertex fast-mode refusals at standard speed; a 400 about fast mode or speed skips fast mode for that model until /fast on or restart, while a 403 or 404 pauses fast mode for 30 minutes.

2.1.321 ◆◇◇◇

• 🔴 Added folder browsing to claude remote-control: it lists folders below the shared folder for claude.ai and can start a session in a picked one unless settings' Read rules cannot be checked (remote switch, off by default).
• 🔴 Added a system-prompt rule to treat the user's name, project, email address and other personal details as private and keep them out of requests to outside services unless asked (remote switch, off by default).
• 🔴 Added a system-prompt note for Fable 5.2 and Mythos 5.2 to check documentation more often on tasks such as accelerator kernel optimization, citing training measures that limit advances in a narrow set of AI-development skills.
• 🔴 Added user-delegated runner sessions (CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API) that refuse gateways, custom API endpoints, background sessions and claude plugin eval, and limit local auto-mode checks to allowed models.
• 🔴 Blocked more Git forms in worktree-isolated Bash calls: fast-import --allow-unsafe-features, and (remote switch, on by default) git config --edit, git rebase --exec and Git run from above the shared checkout.
• 🔴 Added mod notification requests for supporting hosts: $.ui.notify accepts a key, delayMs or at up to 7 days ahead, and untilBack to cancel a pending alert on return; $.ui.cancelNotify asks the host to withdraw one.
• 🟢 Added Fable 5.2 (claude-fable-5-2, 1M context) as fable's built-in default outside gateways; eligible saved 5.1 picks move at startup, with Team/Enterprise waiting for organization access (remote switch, on by default).
• 🟢 Added claude remote-control --settings <file> for one JSON file shared by its child sessions; inline JSON is refused, and file changes prevent new sessions until Remote Control restarts.
• 🟢 Changed the privacy hook to deny Bash, Monitor and PowerShell inputs containing the signed-in email and a User-Agent-like setting, replacing broader email prompts (remote switch, on by default).
• 🟢 Added claude plugin restore-set-aside <plugin> for options and secrets saved during a managed marketplace replacement; --discard deletes those saved values instead, leaving plugin data folders alone.

2.1.319 ◆◇◇◇

• 🔴 Added approved downloads from claude.ai connectors into a Git-ignored connector-downloads folder, up to 10 files per result and 100 MiB each (remote switch, off by default).
• 🔴 Added local-file uploads for compatible claude.ai connectors through MCP's file-upload extension, with approval at Claude Code's own terminal (remote switch, off by default).
• 🔴 Skipped CLAUDE.md and project skills in connector-downloads folders and labeled reads as connector data. Project settings and .mcp.json are skipped when download files or a * .gitignore mark the folder.
• 🔴 Made connector-downloads folders in working directories or their Git roots block web tools under the existing connector-isolation policy; conversations can stay restricted after the folder is removed.
• 🔴 Blocked isolated-worktree Bash commands using Git options that can affect another checkout, including --ignore-other-worktrees, forced worktree add, fetch --update-head-ok and apply --unsafe-paths.
• 🔴 Added opt-in loading of large saved conversations from a resume index and newer transcript text, with whole-file fallback: CLAUDE_CODE_TRANSCRIPT_TAIL_LOAD=on (macOS and Linux).
• 🟢 Added permissions.denyInsteadOfPrompting to refuse calls still awaiting approval after rules, auto mode and hooks decide; allowed calls continue, and repeated refusals can end the turn.
• 🟢 Added CLAUDE_CODE_DISABLE_FEATURE_FLAGS=1 as an alternative to DISABLE_GROWTHBOOK=1 for stopping feature-switch fetching without turning off telemetry.

2.1.318 ◆◇◇◇

• 🔴 Added claude --cloud <local-session-id> to continue saved history in the cloud, filtering account-memory blocks and local attachments while leaving the original session unchanged (remote switch, off by default).
• 🔴 Added /project to assign usage reports to a claude.ai Project; --save applies it to future sessions in that folder (remote switch, off by default).
• 🔴 Added claude ultrareview eval for merged pull requests and JSON reports; --max-cost caps review starts, but the final bill can exceed it (remote switch, off by default).
• 🔴 Stopped allow rules for tools with the same Claude Code name within one MCP server; the rules work again once the server renames one of the tools (remote switches, off by default).
• 🔴 Added permission checks for private Artifacts marked as visible outside your organization, including unattended routine edits.
• 🔴 Added warnings when compaction, subagents and workflows relay text marked as a Remote Control report from another device, telling Claude to treat it as data rather than instructions.
• 🔴 Restricted more SSH proxy commands with unclear % expansions during worktree isolation, asking for written-out hosts and users (remote switch, on by default).
• 🟡 (2.1.323) Added opt-in experimental JavaScript code mode in the native interactive terminal for Opus 5.5 and Sonnet 5.5 through Anthropic. Auto mode reviews scripts before execution (remote switch, off by default).
• 🟢 Added stored-login expiry dates to claude auth status (loginExpiresAt) and headless JSON (credential_expires_at), plus warnings for headless text output. Dates can be estimates.
• 🟢 Stopped unattended launches from overwriting the global configuration when its JSON is malformed; errors explain how to restore a backup or repair the file.
• 🟢 Added input schemas or tool-search advice to some MCP tool-call errors when the schema was missing from Claude's prompt.

2.1.317 ◆◇◇◇

• 🔴 Added /use-case to choose an account's Life Sciences use case from the next request onward and save it for later sessions (remote switch, off by default).
• 🔴 Added Gmail attachments by file reference for sends and new drafts with named recipients, with per-call approval outside bypass mode (remote switch, off by default).
• 🔴 Made cloud routine changes and manual runs ignore whole-tool allow rules and request approval in ordinary modes; bypass mode can still allow them, and auto mode still reviews them.
• 🔴 Made Windows sandbox startup failures from extra hard links on protected files block sandboxed commands and outside-sandbox retries (remote switch, on by default).
• 🔴 Stopped /goal relayed from Slack, Teams or project threads from setting, clearing or showing the goal (remote switch, on by default).
• 🔴 Added warnings when a host reports personal hooks are off under CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG.
• 🔴 Added warnings for images hidden after an attachment deletion, telling Claude to avoid new visual claims or reopening saved copies.
• 🟡 (2.1.318) Added checks that refuse selected command forms on Bash 2–3, and some on Bash 4, with advice to simplify the command or use a newer shell (remote switch, on by default).
• 🟢 Added SDK hook failure blocking with onFailure set to block; callback errors or invalid replies stop tool calls and prompts, and the TypeScript SDK refuses a CLI that cannot honor it.
• 🟢 Made detected disk-full or quota errors saving transcripts or config exit 1 in claude -p text and JSON modes; stream-json warns without changing status. Desktop and SDK URL sessions skip this check (remote switch, on by default).
• 🟢 Marked partial Grep and Glob results as incomplete when a search times out, so Claude sees a warning even when some matches or no files are returned.

2.1.316 ◆◆◆◆

• 🔴 Changed macOS background sessions to build ClaudeCode.app from the embedded plist, or relaunch directly if absent, for executables in the native installer's versions folder; a remote wrapper-bypass switch defaults off.

2.1.315 ◆◇◇◇

• 🔴 Changed CA trust to drop self-issued CAs with invalid self-signatures, except bundled roots or those signed by kept certificates; CLAUDE_CODE_CLIENT_CERT skips main-list filtering; CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP=1 opts out.
• 🔴 Added access to listed attachment bytes during any plugin's prompt.submit hook; built-in modules always load, while other modules depend on a remote rollout switch.
• 🔴 Changed claude mcp serve to warn and skip deny and ask rules from settings files that fail to load instead of refusing the tool call.
• 🔴 Restricted more worktree-isolated Bash commands involving ambiguous expansions, sed, sshpass, kubectl exec, oc exec, gcloud … ssh or C-style loop variables (remote switches, on by default).
• 🔴 Added checks that .git belongs to the checkout before ignore-rule writes or locking Claude-created worktrees (remote switches, on by default), plus sandbox cleanup that preserves planted git folders and checks parents on macOS and Linux.
• 🔴 Removed the system-prompt instruction to match surrounding code's comment density, naming and idiom; models using the lean prompt now get no communication section.
• 🔴 Restricted /loop from relay participants and non-human input, except scheduled triggers and two exempt channels; human Remote Control input still works (remote switch, on by default).
• 🟡 (2.1.314) Stopped stored claude.ai sign-ins from being used while an API key helper from server-delivered managed settings is inactive, including when settings are loading or refused.
• 🟡 (2.1.316) Made Claude Code stop its shell commands on all exits on macOS and Linux, except processes marked to stay running, such as asynchronous hooks (remote switch, on by default).
• 🟡 (2.1.316) Improved Bash snapshots to keep multiline aliases outside Git Bash and dash-prefixed functions, omit disabled options except monitor, and avoid Git Bash winpty errors with errexit and pipefail.
• 🟡 (2.1.316) Added CLAUDE_CODE_SUBAGENT_EFFORT for subagents without an explicit effort, except fork and built-in web-fetch agents; CLAUDE_CODE_EFFORT_LEVEL still overrides it.
• 🟡 (2.1.316) Added CLAUDE_CODE_DISABLE_ULTRATHINK to disable the ultrathink effort boost, and support for triggering it from VS Code and Claude Desktop (remote switch, off by default).
• 🟡 (2.1.316) Added CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP to keep system cross-certificates that certify each other in a loop, and TLS errors that distinguish missing intermediates from stale trusted CAs.
• 🟡 (2.1.316) Added pooled monthly group budgets, layered group and email-domain policies, Bedrock guardrail input tagging, and validation of every model field with a 100-model limit to the Claude apps gateway.
• 🟡 (2.1.316) Added interactive Claude apps gateway sign-in to terminal claude auth login when required by managed settings, plus a hidden --gateway-json mode for VS Code.
• 🟡 (2.1.316) Added organization detection for Team and Enterprise claude.ai logins so their organization's API-fetched managed settings apply without approval; cached settings that fail verification are ignored.
• 🟡 (2.1.316) Stopped a host's --settings, the first rule added in /permissions and /auto-mode-setup from restoring defaults when managed autoMode.allow omits $defaults, while adding the Scheduled-Task Fires rule.
• 🟡 (2.1.316) Made prompts cleaned of invisible characters send on the first Enter; non-prompt modes, bidirectional controls, empty text, / or ! prefixes and exit words still require review.

2.1.314 ◆◇◇◇

• 🔴 Added /send-to-project for local claude.ai sessions with organization permission, live Remote Control, typed input or headless stdin and confirmation (remote switch, off by default); CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC disables it.
• 🔴 Added a server-only auto mode option for Anthropic API sessions, some settings requiring a direct connection (remote switch, off by default); actions without a verdict cannot run, and some settings skip local subagent-report review.
• 🔴 Added a cloud-session stop for sustained use of at least 90% of all sandbox CPUs, ending shell commands and child processes while keeping files; inactive unless remote configuration sets a duration.
• 🔴 Added Design Sync checks for local-file uploads that reject protected files, hard links, files requiring separate read approval, and files replaced after validation.
• 🔴 Added opt-in stream-json merging for consecutive text updates with CLAUDE_CODE_STREAM_EVENT_HOLD_MS (1–2,000 milliseconds) and line-size limits via CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES.
• 🔴 Added an instruction not to recreate existing games, defaulting to Opus 5.5 outside Cowork and local-agent sessions; CLAUDE_CODE_MODEL_CAPABILITIES and capability settings can override it.
• 🟡 (2.1.316) Added an Opus 4.8 fast-mode deprecation warning with a remotely configurable removal date, defaulting to 2026-11-30; fast mode itself is unchanged.
• 🟢 Made permissions.blockWritesOutsideWorkingDirectories block Claude Code settings edits by Write, Edit and NotebookEdit inside working directories; some session files and shell commands are exempt, and no allow rule overrides it.
• 🟢 Restricted Claude apps gateway upstreams with groups to developers with matching identity-provider claims; developers without group claims can use only upstreams without groups.
• 🟢 Added Bedrock guardrail_trace logging of triggered policies and filters, excluding matched text but potentially including request IDs, subjects and emails; the raw trace is removed from responses.
• 🟢 Added lower-effort retries for organization effort caps without changing user settings, excluding auto mode safety checks and requests naming a flagged-response fallback model (remote kill switch, off by default).
• 🟢 Added signed-out retries for HTTP and SSE MCP servers when stored sign-in is rejected and no refresh token is saved (remote switch, on by default).
• 🟢 Changed /upgrade for App Store and Google Play plans to direct users to the mobile app, then /login to activate the updated plan, instead of opening browser sign-in.
• 🟢 Renamed the /permissions review tab to Recently blocked, clarified that approval adds no rule, and blocked approvals for missing, blank, unreadable or truncated inputs and calls too tall to display.
• 🟢 Fixed terminal hyperlinks staying enabled when FORCE_HYPERLINK is set to false, no or off.
• 🟢 Made sandboxed headless --resume and --continue rebuild protections when entering a worktree, refusing to resume if rebuilding fails (remote switch, on by default).

2.1.312 ◆◇◇◇

• 🔴 Added server-provided Cyber Verification Program status to cyber-safeguard refusals, only on Anthropic's API, Claude Platform on AWS or Google Cloud, and Claude apps gateways.
• 🔴 Blocked CLAUDE_CODE_OAUTH_TOKEN, CLAUDE_CODE_OAUTH_REFRESH_TOKEN, CLAUDE_CODE_OAUTH_SCOPES and CLAUDE_CODE_OAUTH_CLIENT_ID in project settings, preserving shell and user settings.
• 🔴 Stopped several first-party requests from following cross-origin redirects, and OAuth token, refresh, revoke and account requests from following any redirects.
• 🔴 Changed the model-training notice to request opt-in only when unset; grove_locked_by_claude_science limits it to OFF and locks the setting in /privacy-settings.
• 🔴 Added session activity, approval status and a default 60-minute idle timeout to claude remote-control folder hosting, with two presses of x within 5 seconds to disconnect (remote switches, off by default).
• 🔴 Stopped Bash read-only checks and non-exact allow rules approving words with *, ? or [ or nonliteral assignments after builtin, command or noglob (remote switch, on by default); extra-check errors now need approval.
• 🟢 Made Write require a full read in one call before replacing nested CLAUDE.md, path-matched rules or @-included files truncated in context (remote switch, on by default).
• 🟢 Added Claude apps gateway oidc.user_id_claim for custom user-ID claims (default sub), including nested paths; sub remains required and invalid claims fail with USER_ID_CLAIM_MISSING.
• 🟢 Made fullscreen queued-message send-now hints clickable with mouse support, including with all keys rebound but not unbound; CLAUDE_CODE_DISABLE_MOUSE and CLAUDE_CODE_DISABLE_MOUSE_CLICKS disable clicks.
• 🟢 Changed unknown model IDs, including application inference profile ARNs unless mapped by modelOverrides, to use shorter system prompts on Bedrock, Vertex, Foundry and Mantle; CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT=0 forces full prompts.
• 🟢 Added refusal fallback for unknown model IDs, using configured Opus when available on cloud providers; disable it with CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK or per-model no_refusal_fallback via CLAUDE_CODE_MODEL_CAPABILITIES.
• 🟢 Changed CLI-started cloud sessions to request titles and branch names from an Anthropic endpoint, except under HIPAA or zero-data-retention restrictions or without an organization-policy verdict.
• 🟢 Limited prompt and agent hooks to 24 concurrent per session, plus 12 for hooks past event timeouts, keeping 12 per event, with a one-second timeout minimum; PermissionRequest agent hooks are exempt from concurrency limits.
• 🟢 Changed subagents to honor autoCompactWindow when it is smaller than CLAUDE_CODE_AUTO_COMPACT_WINDOW; larger values still do not override the environment.
• 🟢 Changed OpenTelemetry mcp_server.name to report real names for fixed-URL MCP servers from verified official Anthropic marketplace plugins, excluding variable URLs and MCPB servers.
• 🟢 Changed claude_code.safety_event and its matching first-party analytics event to off by default; their remote switch can still enable them.

2.1.311 ◆◇◇◇

• 🔴 Added shell-only CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS to skip bypass-mode rm prompts until Bash, Edit or Read deny or ask rules, outside-directory read blocks or approval hooks or tools apply; Claude-run CLIs are excluded.
• 🔴 Added managed-settings-only extraKnownMarketplaces[…].pluginDigests to pin organization-tier hooks of plugins enabled by managed settings in prependPlugins or appendPlugins to matching plugin-folder SHA-256 digests.
• 🔴 Restricted repository and other plugins' environment variables for managed authentication and OpenTelemetry helpers and organization-plugin MCP and LSP servers; trusted-repository identifiers still reach apiKeyHelper and cloud helpers.
• 🔴 Added working-directory rechecks before tool calls, including file tools, rejecting calls if the session's project directory is deleted or resolves to a different path.
• 🔴 Allowed self-hosted runners behind an agent proxy to use Anthropic-managed git with --exec-path or command hooks, with Claude Code 2.1.311 or newer.
• 🔴 Made opt-in MCP cross-app sign-in (CLAUDE_CODE_ENABLE_XAA=1) stop sign-in and silent refresh when the issuing authorization server is no longer advertised; re-add the server with its client secret for expected moves.
• 🔴 Updated /claude-api docs for Go /v2, Java SDK 3.2.0, PHP SDK 1.0.0 or later for Managed Agents, automatic pause_turn resumption in newer Python and TypeScript runners, and API-key precedence over OAuth.
• 🔴 Added Shift+Up and Shift+Down to change effort at the prompt, stopping below max (off by default); /effort max is still needed for max.
• 🟢 Added --hold-idle-file (SELF_HOSTED_RUNNER_HOLD_IDLE_FILE) to hold idle claude self-hosted-runner sessions using a fresh regular file, excluding detected network paths and uncheckable links; --max-hold-min defaults to 24 hours.
• 🟢 Added compaction and retry when standard-context requests over 200K tokens are rejected for requiring usage credits, if auto-compaction is on and succeeds (switch on by default; cloud switch off by default).
• 🟢 Improved Write and Edit result diffs for replacements with no shared lines or unchanged outer lines; harder cases still have a five-second limit.
• 🟢 Added support in the @ file picker for Git-ignored files re-included by .ignore or .rgignore.
• 🟢 Stopped deleting a subagent's clean isolated worktree while another task still uses it as its working directory.
• 🟢 Improved /mcp sign-in status: clearing authentication now reconnects remote servers immediately, and connected tools alone no longer count as signed in.
• 🟢 Improved /rewind warnings: conversation restore removes the selected and later messages, while code restore overwrites whole files but leaves Bash changes to other files untouched.
• 🟢 Added a follow-up for missing <summary> blocks in /compact and overlong-request compaction (switch on by default), excluding some automatic compactions, agent-team teammates and rewind summaries.
• 🟢 Improved dropped-connection errors for Anthropic's API to name the proxy or ANTHROPIC_BASE_URL gateway, or mention VPNs, firewalls and security software; cloud sessions are unchanged.
• 🟢 Changed --output-format json and stream-json to escape DEL, C1 and Unicode format characters, plus U+2028 and U+2029 in json (switch on by default), without changing parsed text.

2.1.310 ◆◇◇◇

• 🔴 Changed /teleport to allow confirmed cloud continuation with local changes or unpushed commits, using the branch as last pushed or the default if absent remotely; repositories rooted at the home folder or without origin are refused.
• 🔴 Stopped enforcing sandbox deny paths on other computers, with /status and claude doctor warnings; file-tool denies still apply, and write and edit denies from managed policy, user settings or --settings are generally kept.
• 🔴 Updated /claude-api model retirements and Anthropic-managed Google Cloud guidance; added a retiring-model scan behind a remote switch and experiment (off by default).
• 🔴 Fixed damaged blocked entries discarding all of NODE_EXTRA_CA_CERTS, and allowed two roots outside Anthropic, Claude, cloud-provider API and telemetry domains, except with Anthropic credentials or certain proxies.
• 🔴 Added support for Anthropic-managed git sessions with supplied git setup through self-hosted agent proxies (--agent-proxy-url or relay mode), except on Windows or runners using --exec-path or command hooks.
• 🔴 Stopped hooks attributed to the organization from inheriting repository settings' env, and added debug logs naming withheld variables.
• 🔴 Restricted shell auto-approval for path-like or command-substituted environment values and six more zsh builtins, and blocked Read on /dev/pts/N, /dev/ptmx and /dev/tty*.
• 🔴 Restricted more git init options, -c settings, GIT_TEMPLATE_DIR and ARGV0 in worktree-isolated sessions and subagents, behind a remote switch (on by default).
• 🟡 (2.1.311) Added opt-in CLAUDE_CODE_MODEL_CATALOG support for Bedrock, Vertex, Foundry and Bedrock Mantle; remote catalogs stay disabled with nonessential traffic off, and project settings can only disable it.
• 🟢 Made Monitor, plugin monitors, Monitor scheduling guidance and the block on long foreground sleeps independent of remote flags; Monitor still requires a non-Windows system or Git Bash.
• 🟢 Added retries without effort-2025-11-24 and output_config.effort on 400 responses rejecting the beta, and expanded fallback for rejected mid-conversation system messages.
• 🟢 Fixed background cleanup considering recent agent worktrees for removal when a very large cleanupPeriodDays value creates an invalid cutoff date.
• 🟢 Added symlink destinations to file read permission prompts outside remote workspaces, with a warning when a target cannot be resolved.
• 🟢 Fixed quoted-only PreToolUse and PermissionRequest command hooks allowing calls on Windows without Git Bash, behind a remote switch (on by default), except hooks with shell, args, async or "onFailure": "continue".
• 🟢 Changed auto mode's first outside-directory read prompt to clarify that shell commands it cannot check require approval when the sandbox does not restrict those reads.
• 🟢 Added mod Image support in tmux with kitty 0.28+, Ghostty or iTerm2 3.5+, requiring allow-passthrough and focus-events; iTerm2 also needs passthrough on, fullscreen rendering and a window no larger than the terminal.
• 🟢 Improved Linux and WSL sandbox errors for AppArmor blocking bubblewrap, and made sandbox.failIfUnavailable refuse startup when that restriction prevents sandboxing.
• 🟢 Improved MCP timeout errors in print-mode and SDK sessions when a server question goes unanswered, telling Claude not to retry that turn; a repeated-question cap is off by default.

2.1.296 ◆◇◇◇

• 🔴 Added SDK set_model support for replacing only the custom system prompt via only_if_model_is_current: true, requiring a nonempty prompt and an explicit matching model, excluding hybrid mode and Remote Control.
• 🔴 Fixed strict-host permission replies allowing tool calls when their requested deny or ask restrictions could not be kept.
• 🔴 Added experimental Agent effort values lower and higher for relative adjustments (off by default), excluding max, forks, remote agents and teammates, subject to existing model and effort overrides.
• 🔴 Added experimental MCP file-argument uploads for supported claude.ai connectors and matching host-held HTTP servers (off by default), requiring authorization for local files.
• 🔴 Added an opt-in host policy restricting SendMessage to plain-text messages between agents in the same session.
• 🟢 Improved secret redaction for plain and escaped assignments when an empty value precedes a later value, including JSON in shell strings.
• 🟢 Added allow_large to Read for larger text files in local sessions with spare context, without increasing remote-call or other-machine limits.
• 🟢 Added an Edit encoding check that refuses UTF-8 rewrites of files containing invalid UTF-8 bytes, rather than replacing undecodable characters.
• 🟢 Added subagent autoCompactWindow in frontmatter and --agents to lower local windows to integer token counts of 100,000–1,000,000; CLAUDE_CODE_AUTO_COMPACT_WINDOW takes precedence and built-in forks keep the parent's window.
• 🟢 Added CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to override models for Workflow agents only; empty values and inherit leave selection unchanged, and forced-model policy still applies.
• 🟢 Added CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS to set eligible overload retries' backoff cap to 32,000-64,000 ms; jitter and Retry-After can extend delays.
• 🟢 Changed Sonnet 5.5 cache-read cost estimates from $0.20 to $0.10 per million tokens; account billing is unaffected.
• 🟢 Improved plugin diagnostics to identify hooks.json hooks or hook modules skipped for duplicate plugin names, and explain which enabled copy takes precedence.
• 🟢 Added a /code-review foreground-fork formatter for numbered findings with file and line locations or a no-findings message; raw text and JSON modes bypass it.

2.1.267 ◆◇◇◇

• 🔴 Added session.compact hooks to veto or rewrite non-isolated compaction, plus $.session.compact() for plugins to request compaction between turns in bound, non-headless sessions.
• 🔴 Added if_version checks to Artifact set, delete and batch entries behind the version-pin gate, with no non-atomic fallback for pinned batches.
• 🔴 Made HIPAA restrictions survive organization switches until restart, preserving Remote Control denial and adding HIPAA checks for /insights and transcript-scanning statistics.
• 🔴 Made sec-default precede user plugins where hooks modules are enabled on machines with managed settings or in Team/Enterprise organizations; only managed secDefault: false can opt out.
• 🔴 Improved shared-memory sync to handle deleted-content conflicts, removing stale local copies when timestamp checks pass and otherwise preserving them.
• 🟢 Added global and per-model maxEffortLevel caps across providers; output_config.effort in CLAUDE_CODE_EXTRA_BODY bypasses them.
• 🟢 Fixed malformed managed allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins dropping restrictions; empty allowlists now apply unless valid entries remain.
• 🟢 Fixed a directory containment bypass by rejecting relative marketplace paths that contain backslashes.
• 🟢 Made command, skill and subagent effort override pinned defaults for Opus 4.7, Opus 4.8 and Fable 5, while still respecting environment effort, model support and caps.
• 🟢 Improved auto-mode safety review for Workflow agent() output schemas above 4,096 code units, up to 4,000,000, subject to a node budget, while still blocking schemas it cannot review.
• 🟢 Added one automatic retry on a fresh connection for eligible transport failures during Artifact deploy uploads, excluding user aborts, started responses and ambiguous or near-complete uploads.
• 🟢 Made usage-limit warnings reuse valid, unretired readings from the past 30 minutes when an allowed response omits them (remotely controlled, on by default).

2.1.263 ◆◆◆◇

• 🔴 Added effort-reduction prompts for Fable 5.1 at high, xhigh or max, with remotely configured targets and confirmation before saving defaults; switching is blocked during ultracode.
• 🔴 Added experimental CLAUDE_CODE_POLISHED_DEWDROP for eligible first-party requests: drop asks to discard mismatched thinking blocks, block requests an error, and off leaves the policy unset.
• 🔴 Added HTTP 400 fallback for an unsupported thinking-binding beta or extra block_binding inputs when binding is active and its beta is prepared; generated values stay omitted until reset or unlatch, but explicit betas can still be sent.

2.1.259 ◆◇◇◇

• 🔴 Made invalid allowUnattendedServing settings block unattended cloud commands until corrected, requiring approval to run commands on this computer.
• 🔴 Changed Artifact pinning to affect only the user's private sidebar, without changing visibility; pinning someone else's Artifact requires live consent, and unpinning is reversible.
• 🟢 Restricted organization-managed MCP servers to HTTP/SSE over valid HTTPS URLs and prevented local removal.
• 🟢 Added --permission-prompts none for headless --print hosts to automatically deny actions that need a prompt; cloud sessions still send prompts to the host over stdio.
• 🟢 Fixed config writes using defaults after a rejected locked reread by rebasing on the enqueue-time snapshot when safe or refusing the write.
• 🟢 Stopped agents from launching agents, skills, workflows or monitors, or resuming or messaging agents, while their stop is still completing.

2.1.258 ◆◆◆◆

• 🟢 Stopped user messages with empty content arrays from reaching the API, dropping them before request processing.
• 🟢 Stopped extra model calls when a re-sent permission approval cannot be applied and no prompt or deferred work remains.

2.1.257 ◆◇◇◇

• 🔴 Added release-manifest signature checks to native updates and blocked installation of staged binaries that no longer match verified checksums, with legacy signature exceptions.
• 🔴 Changed cloud-sync consent to warn that files Claude reads and command output can be seen by session viewers and Team/Enterprise admins, and cloud changes are not copied back locally.
• 🟡 (2.1.267) Made resumed conversations reuse the recorded system prompt despite later prompt flags, when system-prompt recording is enabled.
• 🟢 Added support for fencing Read, Grep, Glob and LSP to working directories in every permission mode; sandbox fencing excludes the relaxed filesystem policy.
• 🟢 Stopped repositories from granting bypassPermissions through project or local settings; only policy settings, user settings or flags may enable it.

2.1.252 ◆◇◇◇

• 🔴 Added support for retaining prompt_snapshot events through session-context processing.
• 🔴 Added explanations for session-context rereads after compaction, managed-settings changes, working-directory additions, settings sync or account changes.
• 🔴 Added a model instruction to stop using the previously announced scratchpad directory when it becomes unavailable.
• 🟢 Stopped Remote Control sessions from waiting for session-persistence writes after tools finish, so degraded connections no longer hold turns open.

2.1.251 ◆◇◇◇

• 🔴 Added support for Artifact live room page events from anyone in your organization with the page open, now or after sharing, to start turns after room approval, even without you present.
• 🔴 Added guidance to use --fork-session when branching a copied conversation.

2.1.250 ◆◆◇◇

• 🔴 Changed Artifact watch guidance to restart watches only on user request or when the task needs republishes, noting they do not reconnect automatically.
• 🔴 Improved Artifact re-watch notices to explain that there is nothing to re-watch while live updates are off.
• 🔴 Added cf_mitigated and upgrade_rejected classifications for WebSocket upgrade failures, with their HTTP status codes.
• 🔴 Improved stalled Artifact watch reports with reconnect limits, unavailable errors and HTTP status details from startup failures.
• 🔴 Changed stalled Artifact watches to allow separate randomized long delays and clear the old stall deadline when rearmed.
• 🔴 Added passive delivery for watch-ended notices while keeping their advice attached.

2.1.248 ◆◇◇◇

• 🔴 Added /limit-reset so eligible users can reset their session limit once a week; usage still counts toward the weekly limit.
• 🔴 Added automatic edits to watched artifacts from writer comments, subject to server rechecks of the writer, thread edit grants and single-file, size and rate limits.
• 🔴 Added live presence data on artifact pages, shared among viewers and produced by the page's code rather than typed as messages.
• 🔴 Added a server-configured ◆ <text> status pill to the prompt footer.
• 🔴 Added sdkMcpServers settings, sent separately so older CLIs ignore them.
• 🔴 Changed directory sync to distinguish uploads that are incomplete, interrupted, stalled, abandoned or arriving mid-session.
• 🔴 Renamed Coordinator check-in to Worker check-in.
• 🟡 (2.1.212) Changed Windows PowerShell selection to prefer PowerShell 7 when installed, including Microsoft Store installs, with Windows PowerShell 5.1 as fallback.
• 🟢 Added --restricted / CLAUDE_CODE_RESTRICTED to remove Bash, PowerShell, REPL and WebFetch unless in --tools, limit file tools to the working directory, reject bypassPermissions and ignore user, project and local settings.
• 🟢 Added claude self-hosted-runner --client-label to override the runner's registration label.
• 🟢 Added a workflow-authoring skill with the Workflow tool's script-writing reference.
• 🟢 Added a warning when your GitHub CLI token lacks the workflow scope needed to push changes to Actions workflow files.
• 🟢 Added desktopSessionCleanupPeriodDays to limit how long transcripts written by desktop-host surfaces, including Claude Desktop and Cowork, survive cleanup.
• 🟢 Changed handling of invalid crossSessionInbound values to warn and hold messages, or reject messages under managed settings.
• 🟢 Removed the runtime gate for /loop's self-paced dynamic mode.
• 🟢 Restricted cross-session trust in Linux user namespaces to processes with mapped user IDs.
• 🟢 Changed OAuth refresh to explain when another Claude Code process holds the refresh rather than sending you to the login screen.

2.1.247 ◆◇◇◇

• 🔴 Added Artifact preview to return screenshots of a local .html file in light and dark themes at desktop and phone widths
• 🔴 Added Claude Design authorization handling that distinguishes missing claude.ai credentials from valid credentials without Claude Design access
• 🔴 Added a remote-tool protocol for claude --cloud sessions, with tool announcements from attached machines and per-call approval
• 🔴 Added a /cloud-plugins consent flow for sending a machine's plugins to cloud sessions
• 🔴 Added a system prompt for writing on the user's behalf and updated memory instructions and the whiteboard, design, and agent-design-patterns skills
• 🔴 Renamed /design-login to /design login
• 🟢 Changed spinnerTipsOverride from strings to {id, text, cooldownSessions, priority} entries plus tipsFile and label, removing excludeDefault
• 🟢 Changed MCP connection errors to distinguish servers that do not answer from unreachable servers
• 🟢 Changed oversized hook and background output to be truncated with an explicit marker rather than overflowing the conversation
• 🟢 Changed terminal output to filter control and invisible characters in marketplace names and rendered hyperlinks

2.1.246 ◆◇◇◇

• 🔴 Added a shared whiteboard artifact for wireframe diagrams with shapes, sticky notes, arrows, freehand drawing, and text
• 🔴 Added artifact asset stores with upload_asset and list_assets for images, video, PDFs, fonts, and text files
• 🔴 Added artifact watching to notify sessions when pages are republished and wake cloud sessions when comments arrive
• 🔴 Added unattended replies to artifact comments after explicit consent, limited to artifacts the user can edit and whose link they supplied
• 🔴 Added scheduled recurring cloud agents, including cron-style routines
• 🔴 Added memory stores with addressable documents, a description, a writable or read-only flag, and an index document
• 🔴 Added cloud-session sync for the working tree and the user's CLAUDE.md, permission rules, and preferences
• 🔴 Stopped running hooks for cloud-originated calls unless their commands can be pinned to a single script outside the synced project
• 🔴 Reorganized embedded modules and assets across all five platforms, adding 189 records per client
• 🟡 (2.1.275) Added plugin sync from claude.ai, with a setting to turn it off
• 🟡 (2.1.243) Added organization-managed modelPricing overrides, recording whether requests use list rates or managed pricing

2.1.243 ◆◆◆◇

• 🔴 Changed the LSP tool gate to default on instead of requiring an environment-variable opt-in

2.1.241 ◆◆◆◇

• 🔴 Added the effective Sable Thrush feature gate to experiment_gates notifications sent to the VS Code extension
• 🔴 Changed non-interactive sessions, including SDK and -p, to allow thinking narration and connector text unless display is explicitly omitted
• 🔴 Changed narration signature decoding to use atob and Uint8Array instead of Buffer, returning cleanly on malformed base64
• 🔴 Removed internal narration exports NARRATION_SUMMARY_LABEL and getSignatureBlockKind
• 🔴 Changed SDK documentation to clarify that null restores Claude Code's own thinking-display handling

2.1.226 ◆◆◆◆

• 🔴 Changed only file and product version resources on Windows, with no substantive JavaScript changes and identical bundled prompts across all five clients