Claude Code 2.1.296

When you dispatch subagents to handle heavy research branches, the background assistant's conversation history often fills up memory space faster than the main conversation.

You can now add an autoCompactWindow setting in a subagent's frontmatter or --agents flag definition, triggering automatic compaction for the subagent earlier than in the primary session. Additionally, when a tool call is interrupted by closing the session, restarting the subagent will no longer mistake the interruption for a user rejection. If you mistype a header field name in a custom agent file, the console will now directly flag unrecognized fields when running with --debug, complete with suggestions for potential typos.

When enterprise IT administrators deploy secure connections centrally, managed policies allow them to govern command-line and desktop tools simultaneously. The Claude apps gateway managed policy adds a code key that applies the same settings as cli to take effect in the desktop Code tab, and pairing it with desktop enables desktop gateway mode. When permitted gateway providers include "gateway", an issue where laptops specifying that gateway in settings were locked out has been fixed. When managed configurations mandate logging in via gateway without defining forceLoginGatewayUrl, an issue where login status was ignored has also been resolved. For adaptive thinking models such as Haiku 5.5, cases where certain gateways failed to calculate tokens (units of text used by AI for processing and billing) or miscounted them as budgeted thinking have been fixed. If a desktop session fails to launch, the exact reason is now directly shown as a response.

When you rely on external tools for feature extensions, parameter descriptions for tools can now be written with much greater detail. The default maximum length for initial MCP (Model Context Protocol, a standard connecting AI to external tools) tool descriptions and server instructions passed to the model has been increased from 2,048 characters to 4,096 characters. In headless sessions, an issue where switching directories or reloading plugins erroneously started disabled .mcp.json or plugin MCP servers from that directory has been resolved. When interrupt rewind is enabled via environment variable, restarting will no longer mistakenly rerun completed turns if the turn previously ended with an MCP tool result. When an MCP server requires authentication, cloud sessions will no longer be misidentified as non-interactive and trigger invalid local setup suggestions.

When letting Claude autonomously execute sequences of tasks, the interface presentation of tool execution states is now much clearer. Under auto mode, if a tool call remains unexecuted because checks have no available answer, the screen no longer flashes a bright red error message, displaying a muted "Not run" row instead. In cloud sessions, auto mode previously bypassed checks on Chrome browser actions when feature flags had not finished loading even after permissions were saved, a loophole that is now plugged. Additionally, an issue where editing your own generated artifacts occasionally met with rejections due to the system mistakenly claiming a change in share state has been completely resolved.

When you share debug logs with teammates or run automated code edits, protections for sensitive information and non-standard encoded files are now more comprehensive.

In shared conversation histories and debug logs, secret redaction previously missed values following empty keys or JSON embedded in shell strings, all of which are now masked. For security enforcement, Bash commands that assign to BASH_ARGV0 right before invocation previously bypassed permission checks automatically, but now prompt the user for confirmation. Meanwhile, when the Edit and NotebookEdit tools encounter files with invalid UTF-8 encodings such as Windows-1252, Shift-JIS, or GBK, they now outright reject edits rather than replacing non-ASCII characters and corrupting original contents.

When using shortcut keys to switch conversation histories in long sessions packed with code snippets, window rendering is now significantly faster. By caching syntax-highlighted code blocks, pressing Ctrl+O to cycle through history no longer feels laggy. When inspecting large log files, local garbage collection will skip rewrites if the reclaimable space is less than 10%, avoiding unnecessary disk writes. Furthermore, an issue where local garbage collection dropped messages containing Unicode line or paragraph separators U+2028 or U+2029, as well as an issue where running claude purge left such prompts behind, have both been resolved. Finally, sessions failing to load history when using --teleport will no longer anomalously open blank conversations.

When using arrow keys to push an active conversation to the background, background handling behavior is now far more predictable. Previously, pressing the left arrow ← to background a session allowed newly started turns or shell commands prefixed with ! to continue running silently, but they are now aborted immediately. Strict safeguards are also in place for input timing: submitting a prompt immediately after pressing ← while the background service is slow to respond no longer duplicates runs across foreground and background. Input dropped after pressing ← while startup hooks are still executing can now be recovered using the up arrow ↑. On the visual side, hovered links in full-screen mode now display an underline. Opening the /diff panel no longer blocks notifications. An issue causing garbage escape sequences like 52;c;… when copying text in terminals such as MATE has also been fixed.

When synchronizing plugins from the cloud or sharing settings across operating systems, the installation pipeline is now significantly more reliable.

In the past, naming a marketplace constructor triggered internal errors during marketplace addition, updates, or plugin installation; the add command now explicitly disallows this name. At the same time, plugin keys named constructor or prototype will no longer be inadvertently wiped out when saving settings. In scenarios where multiple sessions share a settings directory, skills synced from claude.ai no longer get downloaded again at every sync without ever finishing their install.ai repeatedly downloaded and never finished installing has been resolved. Plugins declaring marketplace dependencies are also no longer mistakenly disabled when both items are synced from the cloud. A startup freeze caused by copying plugin paths pointing to /home from Linux to macOS has also been fixed.

When enterprise administrators set security rules to guard against dangerous tools, the workflow following tool interception now finishes cleanly.

In managed environments, an issue where the turn did not terminate after a PreToolUse hook denied a tool with "continue": false or after a managed prompt hook blocked a request has been fixed. An issue where PostToolUse hooks failed to apply updatedMCPToolOutput in certain sessions has also been resolved. Pressing Esc or interrupting while prompt submission hooks are running no longer causes headless sessions to exit, clears the input, or permits unreviewed prompts. Furthermore, as long as CLAUDE_ENV_FILE contains only basic variable assignments, PowerShell commands can now read environment variables written by hooks.

When you write custom modules to extend Claude's built-in features, helper methods provided by modules now target the caller environment accurately. The $ method provided by plugins previously executed in the working directory of the main session rather than that of the agent calling it, while ignoring the turn held by the calling hook; it now runs in the correct agent directory and respects the turn. For module lifecycle management, calling $.agent.register previously succeeded even if the module was reloaded or removed while its lingering hooks remained running, but the system now explicitly rejects such calls. Meanwhile, the network request utility $.http.fetch previously rejected HEAD requests whenever server headers declared a content length over the 4 MiB limit even though no body content was downloaded, and this restriction has now been removed.

When reviewing automated feedback or asking Claude to chart statistics, visual output is now noticeably cleaner.

In cloud sessions, the Agent SDK, and IDE integrations, running /code-review previously rendered an unformatted raw JSON array, but it now neatly structures results into a numbered list for straightforward line-by-line inspection. At the same time, the bundled data visualization (dataviz) skill received interface adjustments: light mode adopts a softer light purple for the seventh series, dark mode uses a gentler, more legible tone for primary text, and vertical Y-axis labels now use compact abbreviations such as 1K.

When running terminal tasks or installing tools on Windows, several permission and process handling quirks have been smoothed out. PowerShell previously prompted for confirmation on every command longer than roughly 1 KB; it now applies allow rules and read-only detection to commands up to 32 KB, cutting down on frequent interruption prompts. In MCP server lifecycle management, servers running over standard input and output were previously killed outright upon shutdown, but the system now closes standard input (stdin) first and waits 300 ms before terminating the full process tree. For plugin installations, running claude plugin install on machines without configured GitHub SSH keys now falls back to HTTPS automatically when repository cloning fails. In addition, a dangerous issue where running commands in Git Bash under bypass permissions to delete the user home directory failed to trigger a confirmation prompt has been fixed.

When using the Claude sidebar inside VS Code, browser action checks and interface preferences are now handled with greater rigor. Web operations executed via Claude in Chrome follow command-line terminal conventions by prompting the user before actions across all sessions, including connections via @browser. Once a site is approved within a session, repeated prompts for it are suppressed. In configuration handling, extension settings now include the claudeCode.spinnerVerbs key to provide autocomplete and schema validation in settings.json, preventing malformed values from crashing the chat panel. An issue where clicking full file path links inside chat on Windows failed to open files has been resolved. Progress spinner animations honor system or user settings to reduce motion by stopping playback. Furthermore, delayed message delivery after the display turned off or a remote window reconnected no longer makes the prompt cache clock wrongly read as warm (still valid).

When holding continuous conversations with Claude in Slack channels, thread readability is now significantly cleaner. Claude now retains the footer containing session links, model names, and cost details only on the most recent reply in a thread, while earlier replies automatically drop their footers to prevent duplicate clutter. This release also resolves multiple formatting details. URLs containing parentheses will no longer break hyperlinks or open incorrect web pages. Strings that resemble hex color codes, such as six-digit PR numbers, will no longer trigger accidental color swatches next to them. Plugin confirmation cards now properly display plugin names instead of internal IDs. When plugins not included in the channel are mentioned, the system explains the plugin source instead of mistakenly posting removal cards. Additionally, an issue in self-hosted environments where replies were lost when runners were swapped mid-task has been resolved.

When submitting a pull request for review, the Code Review check badge now reflects the real status as soon as the review finishes.

In the past, after a review finished, the Code Review check status on the pull request occasionally lingered on "in progress" without updating; it now immediately displays the specific determination result upon completion. Meanwhile, when administrators adjust Code Review configuration in settings and cannot save due to organization policy restrictions, the interface no longer outputs a vague failure message, but explicitly explains the specific reason why saving failed.