Automatic Idle Compaction in Terminal Preserves Prompt Cache for Long Conversations
When you have a long conversation with Claude and step away, the terminal now manages your cache in the background. If a conversation exceeds 200,000 tokens and remains idle for around 54 minutes, it automatically compacts the conversation history before the one-hour prompt cache expires, preventing the next message from incurring the full processing cost again. This feature requires v2.1.290 or later. You can set the environment variable CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to adjust the trigger threshold, or disable it by adding {"idleCompaction": false} to ~/.claude/settings.json.
FEATURE
File Mentions Support Path-Only Mode to Save Space During Document Reads
When mentioning files with @ in a conversation, you can now have Claude receive only the file path instead of stuffing the full document content into the prompt. Simply set the environment variable CLAUDE_CODE_DISABLE_FILE_MENTIONS, and Claude will instead use its own file tools to read the target path. When you mention a PDF file in a message, the system no longer retains the raw bytes of the entire document in the session history, cutting down on memory and disk consumption. In addition, an issue where the Read tool failed to read specific page ranges of PDFs when running without root privileges in Linux remote sessions has been fixed.
FEATURE
Agent View Adds Parameter Menus with Transparent Safe Mode Status
When managing background agent sessions, you can now use /effort and /fast directly in the agent view to set the default thinking depth and speed for new sessions. Entering /model, /effort, or /fast on its own also opens a menu for direct selection. For background sessions launched with --safe-mode, the preview panel in the agent view now displays an extra line clearly indicating that safe mode is active, and sessions will no longer silently drop out of safe mode when resumed or restarted. In addition, background prompts in bare mode no longer mislead you into omitting --bare when reopening, guiding you instead to use /stop and claude --resume to exit the mode. Previously, reopening background tools risked losing protection settings, but now state remains intact throughout.
FEATURE
Usage Monitoring Adds High-Consumption Alerts and Calibrates Percentage Metrics
When checking resource usage, /usage now warns you in advance during several scenarios that consume significant quota. Alerts appear on screen when you configure maximum thinking depth, run automated workflows, enable persistent context, or receive heavy tool output, helping prevent rapid quota exhaustion. At the same time, a calculation bug that occasionally produced absurd figures exceeding 100 percent in /usage, quota exhaustion warnings, and the status line at the bottom of the terminal across both the terminal and VS Code has now been corrected.
BUGFIX
Self-Hosted Runners Gain Graceful Shutdown with Connectivity and Credential Fixes
When operating self-hosted runners, the scheduler can now use the --shutdown-drain-sec flag to specify a grace period in seconds after receiving a SIGTERM signal. The runner immediately halts polling for new tasks and preserves this duration to allow active polls and hooks to complete cleanly. Meanwhile, MCP servers loaded via external wrapper files are no longer unexpectedly terminated if connector configurations change during execution. When a host lacks Git credentials, setup and doctor now provide clearer instructions. Sessions that emit output before their first turn previously missed setting a retirement timer and ignored --retire-at, causing delayed shutdowns; this timer now operates properly. Additionally, MCP requests in both cloud and self-hosted environments no longer follow proxy HTTP redirects.
FEATURE
Application Gateways Support Custom Attribution and Strictly Block Blacklisted Models
When routing Claude Desktop or terminal sessions through enterprise application gateways, you can now manage attribution signatures with greater flexibility. If you prefer not to display the attribution block in gateway sessions or the Code tab of Claude Desktop, setting the environment variable CLAUDE_CODE_ATTRIBUTION_HEADER=0 in your gateway policy disables it entirely. The attribution block itself also gains custom fields. For security management, gateways previously could inadvertently expose blocked models when applying exact-match or blacklist policies. The gateway now strictly excludes these prohibited models from its catalog and rejects matching requests by returning a 400 error. Permission enforcement previously risked leaking blocked entries, but list verification is now airtight.
BUGFIX
Custom Gateway Timeouts Relaxed to Prevent Third-Party Key Leakage
When connecting custom API gateway servers, the system now provides more resilient handling for long-lived connections and API key isolation. Streaming responses routed through the ANTHROPIC_BASE_URL environment variable now have their data timeout extended from 180 seconds to 300 seconds, reducing the likelihood of long thinking processes getting cut off midstream. In the past, custom gateway sessions nearing 200,000 tokens were often mistakenly flagged as exceeding length limits and aborted; requests are now dispatched normally. On the security front, requests to official servers for managed settings, feature flags, profile data, or feedback previously suffered from a vulnerability that forwarded third-party gateway keys to official endpoints; those requests now strictly isolate third-party keys and transmit only the valid official keys when required.
FEATURE
Module UI Layout Components Upgraded with Accurate Colors and Borders
When developing and rendering module interfaces, layout flexibility is now substantially improved. The module Text component introduces size, weight, mono, and tabular properties, while the Box component supports named spacing scales ranging from xs to xl, with the legacy bold property replaced by weight. On terminal displays, dimColor muted text is no longer conflated with standard text under dark ANSI themes and 16-color terminals. In environments incapable of rendering overlays, such as VS Code or text-mode claude -p, $.ui.open no longer falsely reports successful placement. When a module triggers a re-render via $.ui.invalidate, updated contents are now reliably delivered to Claude on the subsequent turn. Furthermore, when asserting UI trees in the plugin test framework, root nodes are now strictly labeled with their owning plugin name.
FEATURE
Module Hooks Expand Context Fields to Support Media and Identity Access
Enterprise-managed extension modules now receive richer contextual details from hooks. Inside the prompt.submit hook, you can access raw image and document attachments from prompts directly through $.prompt.media. Calling $.session.identity() retrieves the session login method, organization, and email address. For skill invocations, the skill.prompt hook now receives the skill frontmatter configuration data, source, plugin name, and file path. In addition, the session.append hook introduces a queue entry point, separating queued transcript items from dispatched content. The turn.start hook no longer listens exclusively to the main loop, allowing it to recognize and monitor subagent or teammate turns via the presence of e.agentId.
BUGFIX
Module Lifecycle Strictly Governed to Eliminate Background Infinite Loops
When running automation scripts in headless mode, module lifecycles are now shielded by stricter safeguards. Previously, if a module automatically submitted prompts at the end of each turn, it could bypass --max-turns limits, budget constraints, or abort signals and keep running; these constraints are now enforced. When administrators remotely disable a module, active sessions unload it immediately at turn boundaries. If fixes are saved immediately after a hot-reload failure, hot reloading now triggers updates properly, and re-saving untouched files no longer sparks redundant reloads. Furthermore, issues where cross-file function imports rejected object passing, module hooks asynchronously awaiting external operations entered endless loops, and modules were created at specific paths without confirmation have all been thoroughly resolved.
BUGFIX
Plugin Hook Defense-in-Depth Arrives to Block Object Tampering
A new defense-in-depth mechanism is now in place when plugins pass complex data structures. Plugin hooks and workflow scripts now uniformly cap the nesting depth of returned objects at 28,000 levels, preventing malicious or abnormal structures from degrading the system. When a plugin hook fails to receive or return results due to an exception, actions with intercept permissions are directly blocked from running rather than allowed through. If a tool has already run, its output is also forcibly withheld. When retrieving an individual property triggers an error, the system no longer rejects the entire object and instead only removes the offending key. Additionally, internal data passing no longer silently strips prototype keys, ensuring tool security checks cannot be bypassed. When a module makes a network request and receives a no-content status code, it also no longer misreports header length limits as exceeded.
FEATURE
Plugin Evaluation Adds Tool Exclusion and Fails Errored Tests Immediately
Testing accuracy has improved significantly when writing automated tests and evaluations for plugins. When running claude plugin eval, you can now exclude specific built-in tools from the evaluation flow using the --disallow-tools flag or the disallowed_tools field in test cases. When an evaluation encounters errors such as API access denials, the test is immediately scored 0 and exits with status code 1, rather than passing by chance. During test runs, if a service method called by a module does not respond within 10 seconds, the test directly fails just like a regular session. Meanwhile, hook execution time budgets are no longer frozen by continuous background calls. Validation errors when type declaration files are located at specific paths, along with telemetry events falsely reporting no hooks, have also been fixed.
FEATURE
Managed Enterprise Settings Strengthen Defenses Against Plugin Environment Tampering
Managed policies and external modules are now more strictly isolated in centrally governed enterprise development environments. When an organization manages Claude Code centrally, the /plugin command and plugin verification tools now proactively list which module hooks will be skipped. A vulnerability where commands inside the sandbox could write to the --plugin-dir folder has been patched, preventing unverified external code from gaining elevated execution privileges through reloads outside the sandbox. Furthermore, user-installed modules can no longer influence execution prefixes for enterprise-managed commands by setting environment variables. Organization-defined permission rules and MCP tool names can also no longer be overridden by local modules. Enforced login organizations and authentication methods configured through local device management now consistently receive top priority.
FEATURE
Plugin Authoring Flow Updated with Instant Multi-Terminal Sync
Cross-window synchronization and publishing flows are now more intuitive when developing and sharing plugins. When creating a module using skills and preparing to publish, Claude now checks whether you want the project to be public or private before creating a GitHub repository, and proactively verifies whether the files about to be pushed are appropriate. When working across multiple terminal windows in parallel, newly installed plugins from another terminal could previously be missed when running /reload-plugins in your current window, but this sync issue is now resolved.
BUGFIX
Sandbox Symlink Flaws Patched with More Precise Path Wildcard Matching
Several vulnerabilities that exploited shortcuts to bypass controls while running commands in an isolated sandbox have been patched. On macOS, sandboxed commands could previously follow symbolic links to resolve real target paths and read or write explicitly forbidden directories, but such traversal is now blocked. If a root directory permitted for sandbox read and write access is replaced with a symbolic link during execution, permission rules are immediately re-evaluated. For directory paths containing special characters such as braces, brackets, or backslashes, configuration checks and the underlying sandbox now interpret wildcards in complete alignment. Under Linux, if a command takes a long time to expand wildcard read rules, users can press Esc or Ctrl-C normally to cancel the operation at any time.
BUGFIX
Cross-Platform Sandbox Compatibility Fixed with Clear Errors on Failed Configuration Saves
Configuration saving and directory permissions in boundary environments are now fixed when launching the sandbox across different operating systems. In WSL2 environments where the sandbox has write permissions to Windows drives, directory creation failures previously halted execution, but it now runs properly. On Linux, if a sandboxed command left empty files in the configuration directory upon exiting, login states, server lists, and project trust records previously appeared entirely lost, a display issue that is now resolved. In addition, if a project folder is read-only and prevents writing settings, running /sandbox previously reported a false success, but it now accurately reports that settings were unchanged along with the specific reason. While blocked permissions previously caused confusion, all statuses are now reported faithfully.
BUGFIX
External Tool Server Name Protection Prevents Permission Matching Confusion
When configuring multiple extension services and setting access rules for a project, rules will no longer apply to the wrong target due to special characters or abbreviations. In configuration files, if an MCP server happens to be named after a JavaScript reserved keyword like constructor, prototype, or toString, connections previously failed or repeatedly prompted confirmation dialogs in auto-approve mode, but this now works normally. At the same time, permission rules no longer match names loosely. For example, rule mcp__a previously allowed servers named a__b or a_ to pass by mistake, but it now strictly permits only exact name matches. Covering all tools now requires the full pattern mcp__<server>__*. If a server name itself contains __, prompt and block rules now also take effect correctly without breaking when the name is split at that point.
BUGFIX
External Protocol Adds Modern Negotiation and Preserves Long Descriptions
Communication connections and data integrity have improved markedly when connecting to external tools over the network. In cloud sessions and remote connections, connectors now automatically negotiate the latest 2026-07-28 protocol version by default. Tool descriptions and instructions from official first-party servers, which were previously cut off past 4,096 characters, are now delivered in full to Claude. When authenticating or refreshing tokens, the system now faithfully sends custom headers to prevent enterprise reverse proxies from blocking requests. Issues where HTTP connections hung for 30 seconds due to unclosed server notifications, background reconnections caused duplicate or failing tool calls, and unverified HTTP redirects occurred have all been resolved in this update.
BUGFIX
External Configuration Parsing Fixed to Stop Covert Launches of Unauthorized Servers
Format validation and launch guards are now safer when managing configuration lists for external tools. When .mcp.json in a project is empty, claude mcp list, claude doctor, and /status no longer misreport it as an invalid configuration. If the enabled list in a configuration file contains only a single server name string, the entire file is no longer ignored. On the security side, when a server blocked by a security policy is queried or dynamically loaded, the system now marks it as blocked prior to connecting and never launches it or establishes a connection covertly. Furthermore, when adding a command with claude mcp add, if the command ends with --background, the system no longer mistakes the add command itself for a background session. Where slightly condensed configuration formats once failed easily, fault tolerance is now high alongside strict security checks.
BUGFIX
Remote Control Queue Stability Enhanced to Prevent UI Freezes on Slow Networks
Transmission resilience in the connection queue is sturdier when using Remote Control from the web to operate a local terminal. Under unstable network connections or slower bandwidth, heavy event uploads previously caused the web UI to freeze completely, but these lockups are now resolved. When one prompt in a queued batch fails to send, other prompts in the same batch are no longer discarded for no reason. If a user manually presses Stop to interrupt checks on the next prompt, the prior prompt that already passed checks is properly preserved in history. In addition, when hovering over queued messages with arrow keys, the interface now clearly explains why the pause occurred. Restoring an old session after a clear reset also no longer glitches into the newly cleared session.
BUGFIX
Large Remote Files Deliver Reliably While Local Photo Caching No Longer Blocks
Transfer loss bugs when sending multimedia files via remote control have now been resolved. When you upload photos from a phone or the remote web interface, Claude can now properly receive and view the image even if local caching on your computer fails due to disk space or permission issues. In long-running remote sessions, delivered files that previously vanished into thin air without reaching Claude are now reliably delivered. Furthermore, large files between 30 and 35 MiB that previously stalled when sent to remote control or cloud sessions now upload smoothly. Cross-device transfers for large files and photos previously dropped packets easily, but every transmission now arrives as expected.
BUGFIX
Cloud Session Connection Blocks Resolved with Clear Relogin Guidance
When access to a cloud session is blocked, the system now provides more accurate error guidance. If a connection fails because web login credentials have expired or been rejected, the screen now clearly explains the specific reason and directs you to run claude auth login to authenticate again. When you supply a key through apiKeyHelper and the connection is denied, error messages no longer point to the wrong organization name. On the interface side, internal model text that previously leaked behind expanded single-line toolset labels has been cleaned up. Login issues that previously left you stranded with vague errors now provide clear next steps for every blocked request.
BUGFIX
Cloud Worker Replacements Stabilized to Prevent Lost or Duplicated Responses
Responses during long conversations in the cloud are now more stable when background workers are replaced. Previously, if a cloud session worker was swapped right as a user answered an authorization prompt, context was compacted, or output reached the token limit, the system could lose its state and drop the message or stall the response. These interrupted turns now resume smoothly. Additionally, restarting a session during the critical step where a tool finishes running while skills are being loaded no longer causes previously completed turns to be repeated. Transitions that once froze operations now proceed seamlessly.
BUGFIX
Cowork Session Sync Fixed Alongside Stricter Auto Mode Permissions
Plugin synchronization and authorization safeguards across devices have been comprehensively improved in Cowork cloud sessions. Updates, disabling, or deletions made to plugins on another device now take effect immediately in active collaborative sessions instead of clinging to old versions until a restart. False path-not-found warnings triggered by multiple processes syncing plugins during startup have also been eliminated. For permission control, PermissionRequest hooks in auto mode are no longer allowed to automatically approve terminal commands or spawned subagents, requiring manual approval or outright rejection for such high-risk operations. When using browser extensions in non-auto mode, actions flagged by security classifiers on approved websites now prompt you for confirmation rather than being rejected immediately. In addition, an issue from the previous version where stopping mid-stream caused edit retries to fail has been resolved.
BUGFIX
Terminal Wide Character Wrapping Fixed to Prevent Extra Emoji Line Breaks
Terminal layouts are now much cleaner when viewing content that mixes Chinese, Japanese, and Korean (CJK) characters with emojis. Previously, at specific window widths, paragraphs with mixed scripts or emojis would occasionally drop their final line during wrapping or leave an unexpected blank line below. In extremely narrow windows or single-column fields, these double-width characters could also trigger superfluous line breaks. Additionally, truncating text adjacent to wide characters previously left empty cells or caused text to be truncated twice, and an issue where emojis vanished when switching color attributes has also been fixed.
Text selection and formatting are now far more stable when reviewing conversation logs in fullscreen terminal mode. Double-clicking a word in an expanded line now precisely highlights that word instead of accidentally collapsing the entire line. When the system prompts for commands while idle to save tokens, notifications for newly installed versions now appear side by side next to the prompt without being obscured. In formatting layouts, nested text styles like bold and italics inside tables previously broke borders or lost formatting during text wrapping, but borders are now preserved intact. Furthermore, pasting large blocks of text into terminals without bracketed paste mode support previously truncated text upon encountering invisible control characters such as full-width quotes, which has now been resolved. Reviewing long histories no longer risks accidental folding or layout glitches.
BUGFIX
Debug Log Memory Leaks Resolved with Light Resumptions for Multiple Subagents
Excessive memory consumption during extended debug sessions or when spawning multiple agents has been resolved. When logging heavily with --debug or --debug-file, memory previously expanded continuously with output volume, and the application could freeze upon exit if the disk or network mount storing logs stopped accepting writes; both issues are now fixed. When debug output is redirected to standard error and an external parent process stops reading the stream, memory no longer balloons indefinitely. Additionally, in remote control or cloud environments, reconnecting to resume a session that previously spawned numerous subagents no longer triggers a sudden memory spike. Reconnecting now keeps memory usage steady.
BUGFIX
Approval Prompts Prevent Accidental Confirmation While Multiline Inputs Keep Line Breaks
Multiple input handling and formatting concatenation issues when typing in the terminal have been fixed. Previously, if an authorization confirmation or prompt appeared while you were typing in the input box, pressing Enter could accidentally confirm the prompt; the system now protects your active input state against accidental submission. When sending queued content blocks via streaming JSON, messages merged into the same turn no longer run together and now preserve distinct line breaks. Typing literal text like --bg or --background into a background session is no longer misinterpreted as command flags that spawn duplicate sessions. In addition, authorization descriptions containing special keyboard symbol emojis no longer break lines prematurely, and scripts embedded in custom commands no longer run twice if interrupted by incoming messages.
BUGFIX
Side Inquiries Keep Scroll Position Steady While Non-Interactive Modes Timeout Promptly
Screen scrolling and timeout protections when asking side questions with /btw have been significantly refined. When scrolling up through history in fullscreen terminal mode, asking a question with /btw previously forced the view back to the bottom, but the scroll position now stays firmly in place. In automated non-interactive sessions, pending /btw queries that were left unprocessed when a session ended previously lingered in the background or ran a second time upon receiving an identical request; unfinished questions are now promptly canceled upon session exit. Furthermore, /btw queries in non-interactive mode that receive no response after 11 minutes now return an explicit timeout error rather than waiting indefinitely. Asking questions no longer interrupts your scrolling rhythm.
FEATURE
Skill Commands Strengthen Character Filtering as Hook Execution Order Is Clarified
Loading mechanisms for custom skills and slash commands now feature several security protections. If a file or folder name contains hidden characters, bidirectional control characters, whitespace, or angle brackets, the system rejects loading the skill until it is renamed. In terms of hook order, the UserPromptSubmit hook now executes before skills or commands expand, ensuring that terminal commands embedded inside a prompt are safely intercepted if the hook blocks it. In addition, running /reload-skills now clearly explains that it resends the full skill list, making it the recommended way to restore missing skills after context compaction. Calling an unknown skill with an accidental prefix now prompts the system to suggest the correct name. Finally, prompts beginning with / sent using the Agent SDK verbatimPrompts option are no longer mistakenly executed as slash commands after a restart.
BUGFIX
Worktree isolation guards reinforced, empty repos and leftover dirs fixed
When running isolated tasks with Git worktree (the ability to check out multiple branches of the same project simultaneously), fault tolerance and cleanup mechanics are now far more dependable. In sessions protected by isolation barriers, security filters previously let certain specific awk scripts slip past; these boundary-crossing operations are now reliably intercepted and blocked. In Git repositories storing references with the new reftable format, leftover directories abandoned inside upon exiting a session are now purged cleanly. If a base revision cannot resolve because the repository has no commits yet, or if you attempt to create a worktree at the root of a bare repository, the error message replaces cryptic low-level codes with a clear explanation of the directory layout and root cause. Troubleshooting setup failures used to be baffling, but now the diagnostics are transparent and simple.
When exiting Claude Code, the reconnect instructions printed to your terminal are now safer and more concise. Resume commands given on exit now consistently stick to session IDs instead of custom names that might contain special characters, eliminating the risk of accidental code execution when pasting them directly into your shell. At the end of a worktree session, if terminal width cannot fit full parameters, commands automatically abbreviate using -w and -r flags; if space remains too tight, a tip above points out the best directory to run them from. Furthermore, when the code review command /ultrareview encounters upload hurdles, error output stops carelessly recommending git add ., preventing sensitive environment configuration files from being accidentally staged into your commit index. Copying exit commands used to feel risky, but safeguards are now embedded at every step.
When attaching pictures and document payloads across conversations, file transmission and pipeline processing have received comprehensive fixes. In extended threads, if an oversized image was previously rejected by the API, that single rejection used to drop newly attached images in every subsequent turn; this cascading error has now been eliminated. If you queue an additional message while Claude is actively generating responses, attached document blocks are no longer silently omitted. For images attached in the background within VS Code or desktop environments, the client stops forcing massive raw dimensions onto the server, curbing recurring failures in long sessions. Large, near-square images now benefit from recalibrated coordinate hints on new models. Stalled attachment downloads in remote sessions now retry automatically. Additionally, an issue where pasted images swallowed rewritten prompt text has been resolved.
When managing live Artifacts and reading or writing workspace files, capacity limits and encoding protections are much sturdier. Local sessions can now watch up to 25 published artifacts simultaneously, up from the previous ceiling of 10. When publishing requests receive an HTTP 403 refusal from servers or proxy endpoints, the system stops blindly recommending a retry, returning specific permission diagnostics alongside actionable guidance instead. On the file I/O front, the Read tool previously produced mojibake when opening UTF-16LE files containing byte-order marks, while the Write tool occasionally stripped marks or converted alien encodings to UTF-8 without consent; the Read tool now reads such files correctly, and the Write tool now explicitly refuses to save in these special encodings to prevent data corruption. Furthermore, diff viewers no longer mangle filenames with leading or trailing whitespace, and publishing conflicts caused by solitary newlines on large pages are resolved.
BUGFIX
Background teammate statuses clarified, secret leaks and duplicate runs fixed
When collaborating with background agents and teammates, notification clarity and credential safeguards are significantly tighter. Status updates from background agents now articulate precise operational states, specifying whether an agent is simply waiting on internal subtasks, whether incoming messages trailed behind generated outputs, or whether it halted due to quota ceilings. If a teammate launches without an explicit description, the runtime no longer mistakes sensitive credentials in the prompt for task summaries on your dashboard, eliminating inadvertent credential leaks. In auto mode, background subagents stop delivering final summaries twice. After relaunching the terminal and resuming sessions, SendMessage locates subagents by their assigned names (though names established prior to the most recent context compaction still require an agent ID). Additionally, when dormant subagents or killed teammates get revived, system hooks now receive resumption events alongside full veto power.
When configuring timers and automated wake-up triggers for Claude, scheduling calculations are fully realigned. The scheduling tool previously displayed expected execution times off by an entire minute, but it now faithfully reports the precise minute of the next run. When daylight saving time ends and the same hour repeats, recurring jobs and loops previously triggered repeatedly or jumped ahead early; this temporal calculation flaw has been completely patched. In the Agent SDK, IDE extensions, and remote control sessions where active background tasks used to suppress scheduled timers, prompt wake-ups now fire punctually regardless of background load. Furthermore, headless scheduled turns now correctly receive the environment notice whenever advanced features are enabled in settings. Automations used to fire prematurely or fall behind, but intervals now hit their mark reliably.
BUGFIX
Windows process management repaired, orphaned runners and PATH bugs fixed
Running Claude Code on Windows brings major fixes to low-level process dispatching and system cleanup routines. When polling whether background tasks remain alive on busy hosts, orphaned PowerShell runners previously piled up unnoticed in memory tables, occasionally exhausting available RAM; process lifecycles now terminate cleanly. On machines lacking Git for Windows, pre-tool evaluation checks and authorization hooks that lacked an explicit shell runner previously opened system gates by letting commands execute unchecked whenever environments were missing; failed guard validations now outright block execution for security. Furthermore, an issue where Git Bash failed to report system PATH variables on startup—leaving every subsequent Bash command broken with command-not-found errors throughout the entire session—has been eliminated.
FEATURE
Plan mode permission reminder added, delete filter false alarms cleared
Planning complex tasks with plan mode now features reinforced environmental controls. When bypass-authorization flags are active in your settings, entering plan mode presents a one-time reminder explaining that file edits and terminal executions will not prompt for routine confirmation. Plan mode strictly prohibits all write operations across the workspace, rejecting write requests immediately even when approved by preceding hook interceptors. During terminal command execution, deletion filters no longer trigger false alarms on harmless scripts that do not actually invoke rm. When switching to models that do not support auto mode, headless sessions no longer get locked into that mode against their capabilities. Duplicate tool execution hiccups occurring during cloud session reboots and missing warnings for disconnected browser companions have also been corrected.
FEATURE
Config validation errors surfaced, web fetching adapts to thinking depth
Operating in plain print mode now provides cleaner feedback and smarter scraping mechanisms. When running claude -p encounters configuration validation failures, the terminal stops silently exiting without a trace, writing the problematic configuration paths and invalid keys straight to standard error instead. Toggling the push notification switches inside /config no longer causes the server to persist outdated settings from prior states. Supplying an unrecognized model identifier at startup cleanly condenses welcome banners into a single diagnostic warning paired with documentation links. WebFetch operations retrieving page content now mirror live web search behavior, intelligently adapting scrapers to match the thinking budget of the calling model. In addition, deprecated application instructions for verification programs have been removed from security banners. Resolving setup errors once felt like guesswork, but root causes are now immediately apparent.
Using the Claude Code extension within VS Code brings noticeable speedups to launch sequences and session transitions. Prompts and file attachments typed halfway into the composer without being sent are preserved intact when hopping across conversation splits, no longer vanishing into thin air. In project folders lacking a prepared Python runtime, Claude starts up in parallel while Python libraries load behind the scenes, substantially cutting down launch delays; for previously indexed workspace folders, the model selector and slash command menus appear instantly in new panels. Regarding resource management, blank chat windows abandoned after starting fresh tasks release background runners rather than consuming memory. Furthermore, clicking the audio microphone icon while signed out guides you directly through login instead of flashing internal error codes.
When managing cloud self-hosted environments and routines, operational feedback and safeguards receive a major upgrade. When creating a self-hosted environment or key, deployment commands shown on screen now expand fully, break appropriately across parameters, and include a prominent copy button. When an administrator deletes a self-hosted environment, routines bound to that environment are immediately disabled automatically with the reason noted, preventing schedules from throwing errors aimlessly in the background. When editing a routine, it will no longer be silently transferred to another unrelated environment even if its associated environment has been deleted. In the management console, searching by pasting a session ID previously returned no results, which has now been fixed. When a search yields no matches, the interface clearly indicates that no matching items were found instead of erroneously reporting an empty list. Additionally, a vulnerability where returning large volumes of existing generated files simultaneously caused session memory to surge and crash has also been resolved.
When your remote computer is temporarily disconnected or unreachable, the remote control window no longer pretends that messages were successfully sent. Previously, pressing send during a connection drop made the text vanish directly from the input box, giving the false impression that commands had reached the remote host for execution, only for you to wait endlessly before discovering the computer never received them. Now, as long as a connection drop is detected, your entered content remains safely in the input box, and the send button stays grayed out and locked until you reconnect to the computer.
BUGFIX
[Claude Tag] In-place Slack message edits for corrections, quiet joins in large groups of 100 members
When using the Claude bot in Slack channels, interaction etiquette and editing behavior become much more refined. When Claude needs to correct a previously inaccurate answer, it now edits the message directly in place with a concise "edited" label, rather than cluttering the channel by striking through entire blocks of old text. When invited to large groups with more than 100 members, it now joins quietly in silence instead of spamming the channel with a broad self-introduction announcement. If channel members ask to delete a canvas it previously created, Claude now follows the instruction and deletes it directly. In channels with guest users, Claude no longer stays silent when channel instructions require it to reply to posts that do not tag it. Additionally, replying to unjoined private threads now explicitly reports that the message could not be delivered, and an issue where self-hosted runners failed to send messages due to a missing Python environment has also been resolved.
FEATURE
[Code Review] Exceeded monthly spend limit guidance, direct navigation to dedicated Usage settings
When you receive review comments in a project's pull request or notice a checklist warning that this month's spending has hit the limit, you can find the place to adjust quotas much faster. Notification cards and comments previously led administrators to the general Claude Code settings menu by mistake, leaving them searching everywhere without finding where to make changes. Now, clicking the link in the notification directs you straight to the dedicated Usage page, which is the exact place to configure that limit.
Original changelog
Original changelogAutomatic Idle Compaction in Terminal Preserves Prompt Cache for Long Conversations
Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all
Added `CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS` to change idle compaction's 200K-token minimum; `"idleCompaction": false` in settings.json turns it off. Both need v2.1.290 or later
Original changelogFile Mentions Support Path-Only Mode to Save Space During Document Reads
Added `CLAUDE_CODE_DISABLE_FILE_MENTIONS` environment variable: Claude gets the paths of `@` file mentions to read with its file tools, not the files' contents
Fixed Read failing on PDF page ranges in remote sessions on Linux that run without elevated privileges
Improved memory and disk use when PDFs are @-mentioned: their bytes are no longer kept in the session transcript
Original changelogAgent View Adds Parameter Menus with Transparent Safe Mode Status
Added `/effort` and `/fast` in agent view to set what new sessions start with; a bare `/model`, `/effort` or `/fast` there now opens a picker
Added a "safe mode" line to the agents view peek panel for background sessions started with `--safe-mode`
Fixed bare mode notices in background sessions telling you to restart without `--bare`, which keeps the mode; they now name `/stop` and `claude --resume`, as safe mode ones do
Fixed background sessions started with `--safe-mode` silently leaving safe mode when the session was woken or restarted
Original changelogUsage Monitoring Adds High-Consumption Alerts and Calibrates Percentage Metrics
Added `/usage` warnings for max effort, workflows, always-on context and large tool results
Fixed `/usage`, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (anthropics/claude-code#92238)
Original changelogSelf-Hosted Runners Gain Graceful Shutdown with Connectivity and Credential Fixes
Added `--shutdown-drain-sec` to `claude self-hosted-runner orchestrator`: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
Fixed self-hosted runner sessions shutting down MCP servers added through an `--exec-path` wrapper's own `--mcp-config` when connectors change mid-session
Fixed `claude self-hosted-runner` sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
Self-hosted runner: Improved what `setup` and `doctor` say when the runner's machine has no git credentials
Self-hosted runner: Fixed sessions that wrote output before their first turn being left with no release timer, ignoring `--retire-at` and delaying shutdown
Changed MCP requests in cloud and self-hosted runner sessions to no longer follow HTTP redirects from the session's MCP proxy
Original changelogApplication Gateways Support Custom Attribution and Strictly Block Blacklisted Models
Added support for turning off the attribution block in Claude Desktop's Code tab: set `CLAUDE_CODE_ATTRIBUTION_HEADER=0` in the `env` of a Claude apps gateway's `code` policy
Added a field to the attribution block in Claude Code sessions behind a Claude apps gateway; remove the block with `CLAUDE_CODE_ATTRIBUTION_HEADER=0`
Fixed the Claude apps gateway serving models that a policy's `availableModelsMatch: exact` or `deniedModels` blocks; it now answers 400 and leaves them out of its model lists
Original changelogCustom Gateway Timeouts Relaxed to Prevent Third-Party Key Leakage
Fixed sessions on a gateway-specific model name behind a custom `ANTHROPIC_BASE_URL` ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets `ANTHROPIC_BASE_URL`
Fixed streams through a custom `ANTHROPIC_BASE_URL` being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
Fixed feature flag, startup, fast mode, profile and feedback requests to Anthropic carrying the API key configured for a third-party gateway (`ANTHROPIC_BASE_URL`); Anthropic API keys are still sent
Original changelogModule UI Layout Components Upgraded with Accurate Colors and Borders
Added `size`, `weight`, `mono` and `tabular` to a mod's `Text` and named spacing steps (`xs` to `xl`) to its `Box`; `bold` is deprecated in favor of `weight`
Fixed a mod's `tool.describe` or `prompt.section` answer that changed after `$.ui.invalidate` never reaching Claude; the new answer is now sent on the next turn
Fixed `$.ui.open` reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and `claude -p`
Fixed a mod's `dimColor` text looking the same as plain text under the dark ANSI theme and on 16-color terminals
Changed `ui.render` trees in `claude plugin test`: each mod's Box or Text root now carries `part: { plugin }` naming the mod, so exact-tree assertions must include it
Original changelogModule Hooks Expand Context Fields to Support Media and Identity Access
Added `$.prompt.media` so a `prompt.submit` hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
Added `$.session.identity()` for mods installed by managed settings: how the session is signed in, and its organization and email when managed `forceLoginOrgUUID` lists that organization
Added the skill's frontmatter, source, plugin name and file path to what a mod's `skill.prompt` hook receives
Added a `queue` door to the `session.append` mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
Changed the `turn.start` mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by `e.agentId` (absent on the main loop)
Original changelogModule Lifecycle Strictly Governed to Eliminate Background Infinite Loops
Fixed a mod that submits a prompt at the end of every turn keeping a headless run going past `--max-turns`, `--max-budget-usd`, an interrupt, or the end of the host's conversation
Fixed the Write and Edit tools creating a mod in a session's mods folder without asking in accept-edits mode when the config directory's path has no `.claude` in it
Fixed installed mods that kept running in an open session after being turned off remotely; they now unload between turns
Fixed a mod hook, with or without a `.catch`, being run again without end when it waits on another mod's noun that does its work outside the call
Fixed a mod's hot reload ignoring a fix saved right after a failed reload; saving a mod file without changing it no longer reloads the mod
Fixed mods loaded from source files being refused when a hook hands `$` to a function declaration imported from another file of the mod
Original changelogPlugin Hook Defense-in-Depth Arrives to Block Object Tampering
Fixed plugin hooks being skipped when they pass a very deeply nested tool input or message on with next()
Fixed a value a mod's hook passes to `next()`, returns, or sends to a `$` method being refused whole when one of its getters throws a `RangeError`; now only that key is refused
Fixed mods' hooks being handed values with `__proto__` keys silently removed, which could skip a `tool.check` guard on a tool call another mod made
Fixed `$.http.fetch` in mods refusing a `304`, `204` or `205` response that declares a `Content-Length` over the 4 MiB body limit
Changed plugin hooks and workflow scripts to refuse values they hand back that nest deeper than 28,000 levels, with an error naming the limit (workflow scripts allowed 100,000)
Changed actions a plugin hook can block to be refused, not let through, when the hook cannot be handed them or cannot hand back its answer; a tool that already ran has its result withheld
Original changelogPlugin Evaluation Adds Tool Exclusion and Fails Errored Tests Immediately
Added `--disallow-tools` and a `disallowed_tools` case field to `claude plugin eval` to keep specific built-in tools, such as Agent, out of eval runs
Fixed `claude plugin test` pausing a hook's time budget while a served `$` method it had called kept making `$` calls after answering
Fixed the `plugin_loaded` telemetry event reporting `has_hooks` as false for plugins whose hooks are a hooks module, built-in plugins included
Fixed `claude plugin eval` passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
Fixed `claude plugin validate` rejecting a mod's `$.state` references when `plugin.json` has no `types` key and the contract is at `./types/index.d.ts`
Changed `claude plugin test` to fail a call to a mod's served `$` method that has not answered within ten seconds, as a session does
Original changelogManaged Enterprise Settings Strengthen Defenses Against Plugin Environment Tampering
Added a note in `/plugin` and `claude plugin validate` naming a mod's hooks that are skipped where an organization manages Claude Code
Fixed a sandboxed shell command being able to write into a `--plugin-dir` folder, whose code Claude Code reloads and runs outside the sandbox
Fixed managed settings and organization policy not being fetched when the stored login's plan was changed locally on machines whose MDM or managed-settings file sets `forceLoginOrgUUID`
Fixed `forceLoginOrgUUID` and `forceLoginMethod` from MDM or the managed-settings file being hidden or replaced by server-managed settings
Fixed a user-installed mod's `$.env.set` changing the environment or shell prefix that command hooks from managed settings start with
Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods
Original changelogPlugin Authoring Flow Updated with Instant Multi-Terminal Sync
Fixed `/reload-plugins` not loading a plugin installed from another terminal a moment earlier
Improved the plugin-authoring skill's steps for sharing a mod: Claude asks public or private and checks the files before creating a GitHub repository
Original changelogSandbox Symlink Flaws Patched with More Precise Path Wildcard Matching
Fixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink
Fixed sandbox `denyRead` and `allowRead` globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
Fixed sandbox glob `allowRead` and `allowWrite` entries not being re-checked when the directory they start from is replaced by a symlink
Improved sandboxed Bash on Linux: Esc and Ctrl-C now work while wildcard read rules are being expanded for a command
Original changelogCross-Platform Sandbox Compatibility Fixed with Clear Errors on Failed Configuration Saves
Fixed sandboxed commands failing on WSL2 with `bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode` when the sandbox can write to the Windows drive
Fixed sign-in, MCP servers and project trust appearing lost on Linux after a sandboxed command left an empty `.config.json` in the config directory
Fixed `/sandbox` reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why
Original changelogExternal Tool Server Name Protection Prevents Permission Matching Confusion
Fixed MCP servers named `constructor` or `prototype` in an MCP config never being connected
Fixed tools of an MCP server named `constructor` or `toString` asking for permission in auto mode and bypass permissions mode
Fixed deny and ask rules for an MCP server (`mcp__<server>`) not applying when the server's normalized name contains a double underscore
Fixed `--bare` sessions leaving out an MCP server named `constructor` or `prototype` that `--channels` asked for
Changed MCP allow rules to reach only the server they name: `mcp__a` no longer allows a server named `a__b` or `a_`; write `mcp__<server>__*` with the server's whole normalized name
Changed agent `tools:` lists to take only the named MCP server's tools; list a server whose name contains `__` as `mcp__<whole name>__*`
Original changelogExternal Protocol Adds Modern Negotiation and Preserves Long Descriptions
Fixed MCP connections over HTTP hanging for 30 seconds and failing when a server never ends the body of its reply to a notification (anthropics/claude-code#99014)
Fixed MCP tool calls in headless and SDK sessions sometimes failing or running twice when a background reconnect closed the connection they were running on
Fixed MCP OAuth sign-in, token refresh and sign-out not sending configured `headers`/`headersHelper` values, which broke servers behind an authenticating proxy
Changed requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers to no longer follow HTTP redirects; redirects by a connector's own server are unaffected
Changed cloud session and Remote Control MCP connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; `MCP_PROTOCOL_NEGOTIATION=legacy` opts out
Changed MCP tool descriptions and server instructions from Anthropic's first-party MCP servers at `api.anthropic.com` to reach Claude in full instead of being cut at 4,096 characters
Original changelogExternal Configuration Parsing Fixed to Stop Covert Launches of Unauthorized Servers
Fixed `claude mcp list`, `claude doctor` and `/status` reporting an empty `.mcp.json` as invalid
Fixed a settings file being ignored when `enabledMcpjsonServers` or `disabledMcpjsonServers` held a single server name (letters, digits, - or _) as a plain string
Fixed MCP servers added to a running headless or SDK session being connected before some policy checks ran; a blocked server is now reported as failed without being contacted
Fixed `claude mcp list`, `claude mcp get` and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
Fixed `claude mcp add <name> -- <command> --background` being started as a background session
Original changelogRemote Control Queue Stability Enhanced to Prevent UI Freezes on Slow Networks
Fixed the claude.ai view of a Remote Control or cloud session freezing when a large batch of events could not finish uploading over a slow connection
Fixed a Remote Control prompt being lost when another queued prompt in the same batch failed to deliver
Fixed a Remote Control prompt that had passed its hooks being dropped from prompt history when Stop interrupted the next queued prompt's hook
Fixed `←` not saying why it stayed put over a queued message while Remote Control is on
Fixed resuming a conversation from before `/clear` reattaching to the Remote Control session of the conversation after it
Original changelogLarge Remote Files Deliver Reliably While Local Photo Caching No Longer Blocks
Fixed photos sent over Remote Control being dropped when their copy could not be saved on your computer; Claude now still sees the photo
Fixed files sent over Remote Control sometimes not arriving in long-running sessions
Fixed files of 30 to 35 MiB sent over Remote Control or to a cloud session not arriving
Original changelogCloud Session Connection Blocks Resolved with Clear Relogin Guidance
Fixed the error for a denied cloud session, which could point to the wrong organization when a key from `apiKeyHelper` was in use
Fixed cloud sessions sometimes showing the model's follow-up text after a tool group's one-line label
Improved the error shown when a cloud session is refused because your claude.ai login was rejected or has expired: it now tells you to sign in again with `claude auth login`
Original changelogCloud Worker Replacements Stabilized to Prevent Lost or Duplicated Responses
Fixed a cloud session sometimes ignoring the answer to a permission prompt or a question when the answer was given while the session's worker was being replaced
Fixed a cloud session leaving a reply unfinished when its worker was replaced just after the reply hit the output token limit
Fixed cloud sessions sometimes leaving a message unanswered when the worker was replaced right after a compaction
Fixed cloud sessions and `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step
Original changelogCowork Session Sync Fixed Alongside Stricter Auto Mode Permissions
Fixed Edit and Retry in Cowork and claude.ai cloud sessions failing on a message stopped while its `UserPromptSubmit` or mod `prompt.submit` hooks were still running (regression in 2.1.296)
Fixed a spurious "synced[0] commands path not found" plugin error at startup when another Claude Code process had just updated a claude.ai-synced plugin
Fixed Cowork cloud sessions staying on an old account plugin after a plugin reload that timed out or a restart that reused a recent sync
Fixed Cowork cloud sessions running the old version of an account plugin changed, removed or disabled from another device until the session restarted
Changed Claude in Chrome in Cowork cloud sessions outside auto mode: an approved-site action the safety classifier flags now asks you instead of being refused, unless managed settings apply
Changed auto mode in Cowork cloud sessions: a `PermissionRequest` hook can no longer approve shell commands or subagents; those prompts wait or are denied
Original changelogTerminal Wide Character Wrapping Fixed to Prevent Extra Emoji Line Breaks
Fixed wrapped text mixing CJK or emoji with Latin words losing its last line or leaving a blank row at some terminal widths
Fixed blank rows appearing under CJK and emoji text squeezed into a one-cell column, as in a very narrow terminal
Fixed text cut in the middle beside wide characters leaving a cell unused or being cut twice, and an emoji vanishing where a color changed inside it
Original changelogFullscreen Terminal Interactions Prevent Accidental Collapse While Table Borders Stay Intact
Fixed double-clicking a word in an expanded transcript row in fullscreen mode collapsing the row instead of selecting the word
Fixed the fullscreen "Update installed" notice being hidden behind the idle "/clear to save tokens" hint; it now shows beside the hint
Fixed bold, italic and other nested text styles running over table borders or being lost on wrapped rows
Fixed long pastes in terminals without bracketed paste losing all text after an invisible control character, such as a mis-decoded curly quote
Original changelogDebug Log Memory Leaks Resolved with Light Resumptions for Multiple Subagents
Fixed memory growth under heavy debug logging (`--debug`, `--debug-file`), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
Fixed memory growing without bound when debug output goes to stderr and the parent process stops reading it
Fixed high memory use after resuming a cloud or Remote Control session that had run many subagents
Original changelogApproval Prompts Prevent Accidental Confirmation While Multiline Inputs Keep Line Breaks
Fixed Enter answering a question or permission prompt that had been held back while you typed an unsent message
Fixed queued prompts sent as content blocks over `--input-format stream-json` running together without a line break when merged into one turn
Fixed permission prompts cutting off or wrapping too early when the reason text contains keycap or joined emoji
Fixed a prompt or reply of `--bg` or `--background` to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
Fixed a custom slash command's embedded shell line running twice when a newer message interrupted the command while its prompt was being checked
Original changelogSide Inquiries Keep Scroll Position Steady While Non-Interactive Modes Timeout Promptly
Fixed `/btw` jumping the transcript to the bottom when asked while scrolled up in fullscreen
Fixed `/btw` side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
Changed `/btw` side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
Original changelogSkill Commands Strengthen Character Filtering as Hook Execution Order Is Clarified
Fixed a prompt starting with `/`, sent with the Agent SDK's `verbatimPrompts` option, running as a slash command when `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` re-ran it after a restart
Improved the Skill tool's "Unknown skill" error to suggest a skill's listed name when Claude wrongly adds the `anthropic-skills:` prefix to it
Improved `/reload-skills` to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
Changed skill and command loading: one whose file or folder name has hidden, direction-changing or blank-like characters, `<` or `>` is no longer offered until renamed; such a `name:` is ignored
Changed `UserPromptSubmit` hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
Changed a skill's own front-matter `UserPromptSubmit` hook to first run on the prompt after the one that invokes the skill
Original changelogWorktree isolation guards reinforced, empty repos and leftover dirs fixed
Fixed worktree-isolated sessions accepting some awk programs the isolation guard should refuse
Fixed `--worktree` sessions leaving a folder behind in `.git/worktrees` in repositories using git's reftable ref storage
Improved the error shown when a worktree cannot be created because its base commit does not resolve: it now says how the lookup ended and the likely reasons, such as a repository without a commit
Improved the error for creating a worktree at a bare-repository layout's root: it now explains the layout instead of an unrelated git error
Original changelogSession resume command shortened, code review no longer suggests add dot
Changed the resume command printed at exit: it names the session by its ID and no longer by its name, so that nothing in a session name can run when the line is pasted
Changed the resume command printed at exit of a worktree session: it uses `-w` and `-r` if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
Changed the errors shown when `/ultrareview` can't upload a repository to stop suggesting `git add .`, which could stage or commit untracked files such as `.env`
Original changelogMessage attachment drops resolved, giant images stop cascading failures
Fixed a mod's `prompt.submit` rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
Fixed document blocks being dropped from your own message sent while Claude is working
Fixed long conversations losing newly attached images on every turn after one oversized image was refused by the API
Fixed images attached while Claude is working (VS Code, desktop app, SDK) being sent at full size, which led to repeated image errors in long conversations
Fixed the image coordinate hint being missing or slightly off for large near-square images on newer models
Fixed a file attached to a message in a remote session being left out when its download stalled part way; the download is now tried again
Original changelogArtifact watch limit raised, file write encoding bugs and mojibake fixed
Fixed the Artifact tool advising a retry when a publish that requests connectors or other access was refused by the server or a proxy (HTTP 403); it now says so and what to tell the user
Fixed the diff view listing a new file whose name begins or ends with a space under the wrong name
Fixed the Artifact tool reporting a spurious one-line difference against the live page, and refusing the publish, when a large page with a line break after `<head>` is published again unchanged
Fixed replies cut off at the output token limit ending the turn silently, with no retry or error, after a request fell back to non-streaming mode
Fixed Read garbling UTF-16LE files with a byte-order mark, and Write dropping byte-order marks or silently converting Windows-1252, Shift-JIS, GBK or UTF-16BE files to UTF-8 (now refused)
Improved artifact watching: a local session can now watch up to 25 published artifacts at once, up from 10
Original changelogBackground teammate statuses clarified, secret leaks and duplicate runs fixed
Fixed an agent teammate started without a description keeping part of a credential from its prompt in the task description shown for it
Fixed the `agent.spawn` mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries `resume`, and a mod can refuse it
Fixed background subagents in auto mode sometimes sending their final report twice, once as the result and once as a message
Fixed `SendMessage` not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
Improved background agent notifications: they now say when an agent is only waiting on its own background work, got a message too late for its result, or was stopped by a usage limit
Original changelogScheduled wake-up precision tuned, daylight saving transitions stop misfiring
Fixed scheduled wakeups (ScheduleWakeup) not firing while a background task was running in Agent SDK, IDE and `claude remote-control` sessions
Fixed scheduled tasks being announced for the wrong minute: the scheduling tools now report each job's actual next run time
Fixed scheduled tasks and loops firing again after every turn, or firing early, during the repeated hour when daylight saving time ends
Fixed Ultracode not being announced to scheduled tasks and other delivered headless turns when `ultracode` is on in settings
Original changelogWindows process management repaired, orphaned runners and PATH bugs fixed
Windows: Fixed the process-liveness check leaving orphaned PowerShell processes behind on busy machines until memory ran out
Windows: Fixed PreToolUse and PermissionRequest hooks that set no shell failing open when Git for Windows isn't installed; a guard that fails now blocks the call
Windows: Fixed Bash commands failing with "command not found" for a whole session when Git Bash did not report its PATH at startup
Added a one-time note when plan mode won't ask before most edits or commands because bypass permissions is available
Fixed rm prompts on shell `-c` scripts that don't run `rm`. An rm built at run time in a script Claude Code can't read no longer prompts unless `CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1`
Fixed SDK and headless sessions staying in auto mode after the host switched to a model that doesn't support auto mode
Fixed Claude in Chrome asking for permission while no browser is connected; it now says the extension is not connected
Fixed a regression in 2.1.296 where cloud and headless sessions could run an approved tool call twice if a new message arrived as the session resumed after a restart
Fixed plan mode running a write (an MCP tool's, a file's, a shell command's) that a `PreToolUse` hook or a mod's `tool.check` hook allowed
Original changelogConfig validation errors surfaced, web fetching adapts to thinking depth
Fixed `claude -p` saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
Fixed `/config` push notification toggles sending your account the previous setting instead of the one you just chose
Improved the startup warning for an unrecognized model ID: it is now one short line under the welcome banner with a docs link, instead of a long raw message
Changed WebFetch page reads to pick their effort as web searches do: the caller's level on the caller's own model, otherwise the level settings give the small model
Changed the cyber safeguard notice to no longer ask people to apply to the Cyber Verification Program
Original changelog[VSCode] Window launch accelerated, unsubmitted prompt drafts preserved
[VSCode] Fixed an unsent prompt and its attachments being lost when switching to another session and back
[VSCode] Fixed unused blank chats keeping a background Claude process running after starting a new conversation
[VSCode] Fixed the mic button showing an internal error message when you are signed out of claude.ai; it now offers to sign you in
[VSCode] Improved startup time in workspaces without a Python environment by starting Claude while the Python extension loads
[VSCode] Improved startup: the model picker and slash command menu now fill in right away in a new window on a folder you've opened before
Original changelog[Cloud sessions] Cloud deployment commands expand fully, deleting an environment immediately disables routines
[Cloud sessions] Fixed a memory spike that could crash a session when many of its existing output files were re-sent to it at once
[Cloud sessions] Fixed saving an edited routine silently moving it to a different environment when its own had been deleted or wasn't in the list; the routine now keeps its environment
[Cloud sessions] Fixed Sessions search in a self-hosted environment's admin details finding nothing when you paste the session ID from a session's link
[Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches
[Cloud sessions] Improved the deploy command shown when you create a self-hosted environment or environment key: it shows in full, wraps between arguments, and has a visible copy button
[Cloud sessions] Changed deleting a self-hosted environment to turn off its routines right away, with the reason shown on each routine, instead of leaving their runs to fail
Original changelog[Remote Control] Retain input content while offline, preventing undelivered message sends
[Remote Control] Fixed Remote Control sessions whose computer can't be reached still appearing to send your messages; your text now stays in the box and Send is off until it reconnects
Original changelog[Claude Tag] In-place Slack message edits for corrections, quiet joins in large groups of 100 members
[Claude Tag] Added the ability for Claude in Slack to delete a canvas it created in a channel when someone asks it to
[Claude Tag] Fixed Claude in Slack staying silent on untagged posts that a channel's own instructions tell it to answer, such as posts that tag someone else, in channels with guests
[Claude Tag] Fixed Claude in Slack reporting a reply to another channel's thread as posted when it isn't a member there; it now says the reply wasn't delivered and how to fix that
[Claude Tag] Fixed Claude in Slack sometimes ending a turn without posting its answer when a self-hosted runner's image has no python3
[Claude Tag] Changed how Claude in Slack corrects a message it got wrong: it edits the message in place and adds a short "Edited" note instead of striking through the old text
[Claude Tag] Changed Claude in Slack to join channels with more than 100 members quietly, with no intro message
Original changelog[Code Review] Exceeded monthly spend limit guidance, direct navigation to dedicated Usage settings
[Code Review] Fixed Code Review's monthly spend-limit comment and check-run card sending admins to Claude Code settings; they now link the Usage page, where that limit is set