GitHub Release: anthropics/claude-code v2.1.299 (14.10.2026)

What's changed

• Added CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents


• Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all


• Added CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later


• Added $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt


• Added $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization


• Added size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight


• Added --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish


• Added the skill's frontmatter, source, plugin name and file path to what a mod's skill.prompt hook receives


• Added /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker


• Added a "safe mode" line to the agents view peek panel for background sessions started with --safe-mode


• Added a one-time note when plan mode won't ask before most edits or commands because bypass permissions is available


• Added --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs


• Added support for turning off the attribution block in Claude Desktop's Code tab: set CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy


• Added a field to the attribution block in Claude Code sessions behind a Claude apps gateway; remove the block with CLAUDE_CODE_ATTRIBUTION_HEADER=0


• Added a queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent


• Added a note in /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code


• Added /usage warnings for max effort, workflows, always-on context and large tool results


• Fixed the error for a denied cloud session, which could point to the wrong organization when a key from apiKeyHelper was in use


• Fixed sessions on a gateway-specific model name behind a custom ANTHROPIC_BASE_URL ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request


• Fixed a mod that submits a prompt at the end of every turn keeping a headless run going past --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation


• Fixed cloud sessions sometimes showing the model's follow-up text after a tool group's one-line label


• Fixed the Write and Edit tools creating a mod in a session's mods folder without asking in accept-edits mode when the config directory's path has no .claude in it


• Fixed installed mods that kept running in an open session after being turned off remotely; they now unload between turns


• Fixed Edit and Retry in Cowork and claude.ai cloud sessions failing on a message stopped while its UserPromptSubmit or mod prompt.submit hooks were still running (regression in 2.1.296)


• Fixed an agent teammate started without a description keeping part of a credential from its prompt in the task description shown for it


• Fixed the claude.ai view of a Remote Control or cloud session freezing when a large batch of events could not finish uploading over a slow connection


• Fixed a sandboxed shell command being able to write into a --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox


• Fixed memory growth under heavy debug logging (--debug, --debug-file), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes


• Fixed memory growing without bound when debug output goes to stderr and the parent process stops reading it


• Fixed rm prompts on shell -c scripts that don't run rm. An rm built at run time in a script Claude Code can't read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1


• Fixed double-clicking a word in an expanded transcript row in fullscreen mode collapsing the row instead of selecting the word


• Fixed claude mcp list, claude doctor and /status reporting an empty .mcp.json as invalid


• Fixed /btw jumping the transcript to the bottom when asked while scrolled up in fullscreen


• Fixed sandboxed commands failing on WSL2 with bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode when the sandbox can write to the Windows drive


• Fixed scheduled wakeups (ScheduleWakeup) not firing while a background task was running in Agent SDK, IDE and claude remote-control sessions


• Fixed a mod's prompt.submit rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read


• Fixed a Remote Control prompt being lost when another queued prompt in the same batch failed to deliver


• Fixed a Remote Control prompt that had passed its hooks being dropped from prompt history when Stop interrupted the next queued prompt's hook


• Fixed sign-in, MCP servers and project trust appearing lost on Linux after a sandboxed command left an empty .config.json in the config directory


• Fixed /sandbox reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why


• Fixed SDK and headless sessions staying in auto mode after the host switched to a model that doesn't support auto mode


• Fixed MCP servers named constructor or prototype in an MCP config never being connected


• Fixed tools of an MCP server named constructor or toString asking for permission in auto mode and bypass permissions mode


• Fixed a spurious "synced[0] commands path not found" plugin error at startup when another Claude Code process had just updated a claude.ai-synced plugin


• Fixed the Artifact tool advising a retry when a publish that requests connectors or other access was refused by the server or a proxy (HTTP 403); it now says so and what to tell the user


• Fixed Cowork cloud sessions staying on an old account plugin after a plugin reload that timed out or a restart that reused a recent sync


• Fixed document blocks being dropped from your own message sent while Claude is working


• Fixed Claude in Chrome asking for permission while no browser is connected; it now says the extension is not connected


• Fixed the fullscreen "Update installed" notice being hidden behind the idle "/clear to save tokens" hint; it now shows beside the hint


• Fixed a mod hook, with or without a .catch, being run again without end when it waits on another mod's noun that does its work outside the call


• Fixed the Claude apps gateway serving models that a policy's availableModelsMatch: exact or deniedModels blocks; it now answers 400 and leaves them out of its model lists


• Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets ANTHROPIC_BASE_URL


• Fixed streams through a custom ANTHROPIC_BASE_URL being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded


• Fixed a mod's tool.describe or prompt.section answer that changed after $.ui.invalidate never reaching Claude; the new answer is now sent on the next turn


• Fixed a settings file being ignored when enabledMcpjsonServers or disabledMcpjsonServers held a single server name (letters, digits, - or _) as a plain string


• Fixed claude plugin test pausing a hook's time budget while a served $ method it had called kept making $ calls after answering


• Fixed high memory use after resuming a cloud or Remote Control session that had run many subagents


• Fixed plugin hooks being skipped when they pass a very deeply nested tool input or message on with next()


• Fixed a value a mod's hook passes to next(), returns, or sends to a $ method being refused whole when one of its getters throws a RangeError; now only that key is refused


• Fixed /usage, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (#92238)


• Fixed wrapped text mixing CJK or emoji with Latin words losing its last line or leaving a blank row at some terminal widths


• Fixed a cloud session sometimes ignoring the answer to a permission prompt or a question when the answer was given while the session's worker was being replaced


• Fixed bold, italic and other nested text styles running over table borders or being lost on wrapped rows


• Fixed Cowork cloud sessions running the old version of an account plugin changed, removed or disabled from another device until the session restarted


• Fixed deny and ask rules for an MCP server (mcp__<server>) not applying when the server's normalized name contains a double underscore


• Fixed long conversations losing newly attached images on every turn after one oversized image was refused by the API


• Fixed the plugin_loaded telemetry event reporting has_hooks as false for plugins whose hooks are a hooks module, built-in plugins included


• Fixed images attached while Claude is working (VS Code, desktop app, SDK) being sent at full size, which led to repeated image errors in long conversations


• Fixed the image coordinate hint being missing or slightly off for large near-square images on newer models


• Fixed feature flag, startup, fast mode, profile and feedback requests to Anthropic carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL); Anthropic API keys are still sent


• Fixed a mod's hot reload ignoring a fix saved right after a failed reload; saving a mod file without changing it no longer reloads the mod


• Fixed mods loaded from source files being refused when a hook hands $ to a function declaration imported from another file of the mod


• Fixed a regression in 2.1.296 where cloud and headless sessions could run an approved tool call twice if a new message arrived as the session resumed after a restart


• Fixed scheduled tasks being announced for the wrong minute: the scheduling tools now report each job's actual next run time


• Fixed mods' hooks being handed values with __proto__ keys silently removed, which could skip a tool.check guard on a tool call another mod made


• Fixed claude -p saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr


• Fixed long pastes in terminals without bracketed paste losing all text after an invisible control character, such as a mis-decoded curly quote


• Fixed managed settings and organization policy not being fetched when the stored login's plan was changed locally on machines whose MDM or managed-settings file sets forceLoginOrgUUID


• Fixed MCP connections over HTTP hanging for 30 seconds and failing when a server never ends the body of its reply to a notification (#99014)


• Fixed MCP servers added to a running headless or SDK session being connected before some policy checks ran; a blocked server is now reported as failed without being contacted


• Fixed claude mcp list, claude mcp get and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started


• Fixed /reload-plugins not loading a plugin installed from another terminal a moment earlier


• Fixed blank rows appearing under CJK and emoji text squeezed into a one-cell column, as in a very narrow terminal


• Fixed text cut in the middle beside wide characters leaving a cell unused or being cut twice, and an emoji vanishing where a color changed inside it


• Fixed bare mode notices in background sessions telling you to restart without --bare, which keeps the mode; they now name /stop and claude --resume, as safe mode ones do


• Fixed ← not saying why it stayed put over a queued message while Remote Control is on


• Fixed $.http.fetch in mods refusing a 304, 204 or 205 response that declares a Content-Length over the 4 MiB body limit


• Fixed /config push notification toggles sending your account the previous setting instead of the one you just chose


• Fixed a cloud session leaving a reply unfinished when its worker was replaced just after the reply hit the output token limit


• Fixed Read failing on PDF page ranges in remote sessions on Linux that run without elevated privileges


• Fixed Enter answering a question or permission prompt that had been held back while you typed an unsent message


• Fixed a file attached to a message in a remote session being left out when its download stalled part way; the download is now tried again


• Fixed queued prompts sent as content blocks over --input-format stream-json running together without a line break when merged into one turn


• Fixed self-hosted runner sessions shutting down MCP servers added through an --exec-path wrapper's own --mcp-config when connectors change mid-session


• Fixed claude plugin eval passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1


• Fixed permission prompts cutting off or wrapping too early when the reason text contains keycap or joined emoji


• Fixed forceLoginOrgUUID and forceLoginMethod from MDM or the managed-settings file being hidden or replaced by server-managed settings


• Fixed --bare sessions leaving out an MCP server named constructor or prototype that --channels asked for


• Fixed resuming a conversation from before /clear reattaching to the Remote Control session of the conversation after it


• Fixed a prompt starting with /, sent with the Agent SDK's verbatimPrompts option, running as a slash command when CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran it after a restart


• Fixed background sessions started with --safe-mode silently leaving safe mode when the session was woken or restarted


• Fixed scheduled tasks and loops firing again after every turn, or firing early, during the repeated hour when daylight saving time ends


• Fixed the diff view listing a new file whose name begins or ends with a space under the wrong name


• Fixed MCP tool calls in headless and SDK sessions sometimes failing or running twice when a background reconnect closed the connection they were running on


• Fixed /btw side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run


• Fixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink


• Fixed sandbox denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox


• Fixed sandbox glob allowRead and allowWrite entries not being re-checked when the directory they start from is replaced by a symlink


• Fixed worktree-isolated sessions accepting some awk programs the isolation guard should refuse


• Fixed claude mcp add <name> -- <command> --background being started as a background session


• Fixed a prompt or reply of --bg or --background to a background session being taken for the flag, which could start new sessions over and over instead of delivering it


• Fixed a custom slash command's embedded shell line running twice when a newer message interrupted the command while its prompt was being checked


• Fixed --worktree sessions leaving a folder behind in .git/worktrees in repositories using git's reftable ref storage


• Fixed claude self-hosted-runner sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty


• Fixed Ultracode not being announced to scheduled tasks and other delivered headless turns when ultracode is on in settings


• Fixed MCP OAuth sign-in, token refresh and sign-out not sending configured headers/headersHelper values, which broke servers behind an authenticating proxy


• Fixed the Artifact tool reporting a spurious one-line difference against the live page, and refusing the publish, when a large page with a line break after <head> is published again unchanged


• Fixed $.ui.open reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and claude -p


• Fixed the agent.spawn mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries resume, and a mod can refuse it


• Fixed claude plugin validate rejecting a mod's $.state references when plugin.json has no types key and the contract is at ./types/index.d.ts


• Fixed a mod's dimColor text looking the same as plain text under the dark ANSI theme and on 16-color terminals


• Fixed plan mode running a write (an MCP tool's, a file's, a shell command's) that a PreToolUse hook or a mod's tool.check hook allowed


• Fixed background subagents in auto mode sometimes sending their final report twice, once as the result and once as a message


• Fixed SendMessage not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)


• Fixed replies cut off at the output token limit ending the turn silently, with no retry or error, after a request fell back to non-streaming mode


• Fixed Read garbling UTF-16LE files with a byte-order mark, and Write dropping byte-order marks or silently converting Windows-1252, Shift-JIS, GBK or UTF-16BE files to UTF-8 (now refused)


• Fixed cloud sessions sometimes leaving a message unanswered when the worker was replaced right after a compaction


• Fixed cloud sessions and CLAUDE_CODE_RESUME_INTERRUPTED_TURN sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step


• Fixed photos sent over Remote Control being dropped when their copy could not be saved on your computer; Claude now still sees the photo


• Fixed files sent over Remote Control sometimes not arriving in long-running sessions


• Fixed files of 30 to 35 MiB sent over Remote Control or to a cloud session not arriving


• Fixed a user-installed mod's $.env.set changing the environment or shell prefix that command hooks from managed settings start with


• Windows: Fixed the process-liveness check leaving orphaned PowerShell processes behind on busy machines until memory ran out


• Windows: Fixed PreToolUse and PermissionRequest hooks that set no shell failing open when Git for Windows isn't installed; a guard that fails now blocks the call


• Windows: Fixed Bash commands failing with "command not found" for a whole session when Git Bash did not report its PATH at startup


• Self-hosted runner: Improved what setup and doctor say when the runner's machine has no git credentials


• Self-hosted runner: Fixed sessions that wrote output before their first turn being left with no release timer, ignoring --retire-at and delaying shutdown


• Improved the error shown when a cloud session is refused because your claude.ai login was rejected or has expired: it now tells you to sign in again with claude auth login


• Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods


• Improved memory and disk use when PDFs are @-mentioned: their bytes are no longer kept in the session transcript


• Improved sandboxed Bash on Linux: Esc and Ctrl-C now work while wildcard read rules are being expanded for a command


• Improved the startup warning for an unrecognized model ID: it is now one short line under the welcome banner with a docs link, instead of a long raw message


• Improved the plugin-authoring skill's steps for sharing a mod: Claude asks public or private and checks the files before creating a GitHub repository


• Improved the Skill tool's "Unknown skill" error to suggest a skill's listed name when Claude wrongly adds the anthropic-skills: prefix to it


• Improved /reload-skills to say it re-sends the full skill list to Claude, which is how to get skills back after compaction


• Improved the error shown when a worktree cannot be created because its base commit does not resolve: it now says how the lookup ended and the likely reasons, such as a repository without a commit


• Improved the error for creating a worktree at a bare-repository layout's root: it now explains the layout instead of an unrelated git error


• Improved artifact watching: a local session can now watch up to 25 published artifacts at once, up from 10


• Improved background agent notifications: they now say when an agent is only waiting on its own background work, got a message too late for its result, or was stopped by a usage limit


• Changed plugin hooks and workflow scripts to refuse values they hand back that nest deeper than 28,000 levels, with an error naming the limit (workflow scripts allowed 100,000)


• Changed actions a plugin hook can block to be refused, not let through, when the hook cannot be handed them or cannot hand back its answer; a tool that already ran has its result withheld


• Changed requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers to no longer follow HTTP redirects; redirects by a connector's own server are unaffected


• Changed MCP requests in cloud and self-hosted runner sessions to no longer follow HTTP redirects from the session's MCP proxy


• Changed skill and command loading: one whose file or folder name has hidden, direction-changing or blank-like characters, < or > is no longer offered until renamed; such a name: is ignored


• Changed ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it


• Changed WebFetch page reads to pick their effort as web searches do: the caller's level on the caller's own model, otherwise the level settings give the small model


• Changed claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does


• Changed MCP allow rules to reach only the server they name: mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name


• Changed agent tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*


• Changed Claude in Chrome in Cowork cloud sessions outside auto mode: an approved-site action the safety classifier flags now asks you instead of being refused, unless managed settings apply


• Changed cloud session and Remote Control MCP connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; MCP_PROTOCOL_NEGOTIATION=legacy opts out


• Changed MCP tool descriptions and server instructions from Anthropic's first-party MCP servers at api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters


• Changed auto mode in Cowork cloud sessions: a PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied


• Changed the resume command printed at exit: it names the session by its ID and no longer by its name, so that nothing in a session name can run when the line is pasted


• Changed the resume command printed at exit of a worktree session: it uses -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it


• Changed /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes


• Changed UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands


• Changed a skill's own front-matter UserPromptSubmit hook to first run on the prompt after the one that invokes the skill


• Changed the turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)


• Changed the errors shown when /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env


• Changed the cyber safeguard notice to no longer ask people to apply to the Cyber Verification Program


• [VSCode] Fixed an unsent prompt and its attachments being lost when switching to another session and back


• [VSCode] Fixed unused blank chats keeping a background Claude process running after starting a new conversation


• [VSCode] Fixed the mic button showing an internal error message when you are signed out of claude.ai; it now offers to sign you in


• [VSCode] Improved startup time in workspaces without a Python environment by starting Claude while the Python extension loads


• [VSCode] Improved startup: the model picker and slash command menu now fill in right away in a new window on a folder you've opened before


• [Cloud sessions] Fixed a memory spike that could crash a session when many of its existing output files were re-sent to it at once


• [Cloud sessions] Fixed saving an edited routine silently moving it to a different environment when its own had been deleted or wasn't in the list; the routine now keeps its environment


• [Cloud sessions] Fixed Sessions search in a self-hosted environment's admin details finding nothing when you paste the session ID from a session's link


• [Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches


• [Cloud sessions] Improved the deploy command shown when you create a self-hosted environment or environment key: it shows in full, wraps between arguments, and has a visible copy button


• [Cloud sessions] Changed deleting a self-hosted environment to turn off its routines right away, with the reason shown on each routine, instead of leaving their runs to fail


• [Remote Control] Fixed Remote Control sessions whose computer can't be reached still appearing to send your messages; your text now stays in the box and Send is off until it reconnects


• [Claude Tag] Added the ability for Claude in Slack to delete a canvas it created in a channel when someone asks it to


• [Claude Tag] Fixed Claude in Slack staying silent on untagged posts that a channel's own instructions tell it to answer, such as posts that tag someone else, in channels with guests


• [Claude Tag] Fixed Claude in Slack reporting a reply to another channel's thread as posted when it isn't a member there; it now says the reply wasn't delivered and how to fix that


• [Claude Tag] Fixed Claude in Slack sometimes ending a turn without posting its answer when a self-hosted runner's image has no python3


• [Claude Tag] Changed how Claude in Slack corrects a message it got wrong: it edits the message in place and adds a short "Edited" note instead of striking through the old text


• [Claude Tag] Changed Claude in Slack to join channels with more than 100 members quietly, with no intro message


• [Code Review] Fixed Code Review's monthly spend-limit comment and check-run card sending admins to Claude Code settings; they now link the Usage page, where that limit is set