Claude Code 2.1.290

[What's changed] Changed `CLAUDE_CODE_DISABLE_ATTACHMENTS` so a repository's `.claude/settings.json` or `.claude/settings.local.json` can no longer set it; shell, user and managed settings still can

[What's changed] Improved Claude in Chrome: a `browser_batch` call now gets 90 seconds, up from 60, before it is reported as timed out

[What's changed] Changed the interactive session's WebSearch budget to refill over time (100 calls/hour; `CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR` sets the rate, 0 turns it off) instead of ending after 200 calls

[What's changed] [Claude Tag] Added fast mode in Slack: mention Claude with `!fast` to switch a thread to fast mode, moving it to Opus if needed, and `!fast off` to switch back; replies show (fast) while it's on

[What's changed] Added a Deny button to the Claude apps gateway's sign-in approval page: it ends the pending sign-in, so the waiting terminal stops within seconds

[What's changed] Added `/claude-api managed-agents-onboard <quickstart-name>` to build a Console quickstart template, such as `deep-researcher`, with the `ant` CLI

[What's changed] Improved the built-in `plugin-authoring` skill: Claude now gives the one command another person runs to install a mod you made, and writes it in a README's install section

[What's changed] Improved the reply to `/plugin` in the desktop app's Code tab: it now says where to install and manage plugins there

[What's changed] Improved the errors shown when the `/ultrareview` upload refuses a checkout: each known cause now has its own message, with a way to fix it

[What's changed] Improved the Claude apps gateway's browser sign-in pages: brand fonts, centered layout, and dark mode

[What's changed] Improved responsiveness while resuming large sessions: timers, input and rendering keep running while the transcript loads

[What's changed] Improved the / and @ suggestion lists: the selected row now starts with a ❯ pointer, so you can see it without color

[What's changed] Changed `/code-review` at medium effort to also report cleanup and CLAUDE.md conventions findings on models without tuned review settings, including Opus 5.5 and Sonnet 5.5

[What's changed] Changed `/model`, `/effort` and `/rename` sent from `claude agents` to a busy background session to apply right away, without a confirmation, instead of when the turn ends

[What's changed] [VSCode] Added a way to review and run a plugin marketplace's install or update command from the Manage plugins dialog

[What's changed] [Claude Tag] Added the optional Path prefixes field when creating a custom connection in an access bundle, so its allow rule can cover only those paths instead of the whole host

[What's changed] [Claude Tag] Improved Claude's notice in your direct messages when your own Claude plan's usage limit is reached: it shows within seconds and says when the limit resets

[What's changed] [Claude Tag] Improved the earlier Claude in Slack app's reply when it can't start a session: it now says what failed and who can fix it, in full only once per thread

[What's changed] [Claude Tag] Changed the channel instructions limit to 8,192 characters instead of bytes, so non-English text gets the same room, and added a character count beside Save on the Configure page

[What's changed] Added `serverToolUses` to the result of a mod's `turn.step` hook: the tool calls the API ran itself (the advisor), each with its id, name, input, start and end

[What's changed] Added `agentId` to the `tool.check` event of plugin hooks, so a hook can tell a subagent's permission check from the main session's

[What's changed] Added `ceiling` to the question and verdict a mod's `tool.check` hook reads, naming the approval an organization requires for a tool

[What's changed] Added `ThemeKey` and `Color` types to the plugin hooks typings, so an editor lists the theme colors a mod's drawing can name

[What's changed] Added to `claude plugin validate`: each hook a mod registers at a gating site is listed with whether it has a `.catch` (`gatingHooks` under `--json`)

[What's changed] Added `claude attach <name>` and `claude logs <name>`: part of a session name works in place of the id

[What's changed] Added `/claude-api managed-agents-onboard <url>` to set up the Managed Agents pattern a page describes as `ant apply` files

[What's changed] Added a warning when a managed settings file is a link to a file outside the managed settings folder

[What's changed] Added a /status and doctor warning when managed settings ignore user-configured sandbox allowRead paths or allowed domains

[What's changed] Improved the Bash changed-files view: when a chained command includes git merge, pull or checkout, it lists the files without full diffs

[What's changed] Improved the Claude apps gateway's log when an upstream's cloud credentials or connection fail: the warning now ends with the underlying cause

[What's changed] Improved the error shown when a cloud session is started without a claude.ai sign-in: it now names `claude auth login` and /login and no longer blames API-key authentication

[What's changed] Improved the Read tool's message for binary files: it now points Claude to a skill or a shell command that can read the format

[What's changed] Changed `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` to also skip the startup connection warm-up

[What's changed] Changed Claude in Chrome so that a project's settings files can no longer turn it on; use `--chrome`, `/chrome` or your user settings

[What's changed] Changed `/artifacts`: opening an artifact in your browser now closes the list

[What's changed] Changed the "Press ← again" confirm on a just-cleared prompt: a second ← no longer has to wait a second before it switches, and holding ← down now switches too

[What's changed] Changed the errors shown when the `/ultrareview` upload fails at a git step: they name the step and what to try, and no longer repeat git's own error text

[What's changed] Changed the `claude-api` skill's Managed Agents examples to turn off the web tools unless the agent needs them and to use the `auto` permission policy

[What's changed] Self-hosted runners: Changed `claude --environment <id>` to create its session through the current Sessions API; printed and JSON session ids keep their session_… form

[What's changed] [VSCode] Added a screen reader announcement, "Message queued.", when you send a message while Claude is working

[What's changed] [VSCode] Improved Continue After Reload: tabs reopened after VS Code restarts its extensions now also finish a step the restart interrupted

[What's changed] [VSCode] Improved file pills in messages: hovering one now shows the file's path from the project folder, so same-named files can be told apart

[What's changed] [VSCode] Changed message timestamps to show by default (turn them off with the Claude Code: Show Message Timestamps setting)

[What's changed] Fixed a case where a user-installed mod could make an organization's guard skip its check; such a mod is now unloaded

[What's changed] Fixed resumed subagents and teammates losing their earlier thinking and prompt cache after receiving a message mid-run

[What's changed] Fixed an image read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read

[What's changed] Fixed a case where a user-installed mod could get an organization's plugin unloaded; the mod is now the one unloaded

[What's changed] Fixed an `@`-mention under the read block or `--restricted` being able to read a file outside the working directories through a link changed mid-read

[What's changed] Fixed errors reading "Premature close" instead of naming the missing program when a tool Claude Code runs, such as git or gh, is not installed (macOS, Linux)

[What's changed] [Cloud sessions] Fixed History on a never-run routine's page still saying "No runs yet" after you pressed Run now; it now shows the new run

[What's changed] Fixed requests failing behind proxies and gateways that reject one of Claude Code's beta headers with a status other than 400, or together with a second beta

[What's changed] Fixed long sessions with hundreds of images getting stuck on "Request rejected as unprocessable by the model" errors

[What's changed] Fixed a turn ending at once when the API's output content filter stopped a reply while Claude was still thinking; the request is now retried once before the error is shown

[What's changed] Fixed WebFetch silently dropping page text past 100,000 characters; it now says how much was unread and takes an `offset` to read on

[What's changed] Fixed a crash ("Maximum call stack size exceeded") when a response nested lists or quotes thousands of levels deep

[What's changed] Fixed `/rewind` not listing a prompt sent while Claude was still working

[What's changed] Fixed a project `CLAUDE.md`, rule or `AGENTS.md` symlinked outside the working directories loading under `permissions.blockReadsOutsideWorkingDirectories` or a `Read` deny rule

[What's changed] Fixed an MCP server provided by your organization being relisted as your own after signing in or reconnecting, including from a late result in headless and SDK sessions

[What's changed] Fixed `/ultrareview` dropping uncommitted changes without a warning on Windows when `git stash create` failed, and refusing them after a `git add -N` file was deleted or moved

[What's changed] Fixed replies in very long Remote Control and cloud sessions that could appear a block at a time instead of streaming in

[What's changed] Self-hosted runner: Fixed a crafted, very long line of a session's error output freezing the runner for several seconds

[What's changed] Fixed a mod's `turn.step` result listing a tool call that a mid-response model fallback had discarded

[What's changed] Fixed a Cowork cloud session's reply sometimes never finishing when its container restarted just after Claude sent a message or a file

[What's changed] Fixed `/ultrareview` failing to upload uncommitted changes when `core.safecrlf=true` is set in git's configuration

[What's changed] Fixed the effort level changing when a flagged message is retried on a fallback model that has a different level saved in settings

[What's changed] Fixed `disableClaudeAiConnectors` and `allowedMcpServers` URL rules not being applied to some MCP entries declared in `.mcp.json`, plugins or agents

[What's changed] Fixed Esc in the agents view confirming "Press enter again to restart this session — it isn't responding"; Esc now just reopens the session

[What's changed] Fixed `claude agents` sessions in manual permission mode asking for approval to read an image pasted into a reply or a new agent's prompt

[What's changed] Fixed a freeze after sending some very long messages

[What's changed] Fixed a slowdown when expanding the transcript (ctrl+o) or resizing over large tool output that contains non-ASCII characters such as arrows, dashes or box-drawing

[What's changed] Fixed `claude respawn` re-sending an earlier message to a backgrounded session that has no saved transcript instead of starting it with an empty conversation

[What's changed] Fixed `/ultrareview` uploading uncommitted changes unfiltered for files under a git filter driver named `unset` or `unspecified`; the upload now stops and asks you to rename the driver

[What's changed] Fixed `claude --teleport` and `/teleport` deleting the files in a folder that had replaced a tracked file of the same name when you chose to stash: the stash is now refused, and says why

[What's changed] Fixed agent view's `/loop` run count freezing and its countdown disappearing after `/clear`; the count now restarts with the new conversation

[What's changed] Fixed `--channels` permission relay: a reply ID that repeats within a session is now ignored instead of approving a different prompt

[What's changed] Fixed mods staying off for people who reach Claude through a gateway (`ANTHROPIC_BASE_URL` with `ANTHROPIC_AUTH_TOKEN`) and have no Anthropic account

[What's changed] Fixed replies sent from `claude agents` just after a background session crashed being refused after 2 seconds: they are now retried for up to 12 seconds while the session restarts

[What's changed] Fixed slash commands and answers to a multiple-choice question that `claude agents` could not deliver to a running session being saved and sent by themselves the next time it was restarted

[What's changed] Fixed sandboxed commands that pipe a heredoc into another command (`cat <<EOF | python3`) asking for approval on every run

[What's changed] Fixed `claude agents` failing with "Couldn't restart the background service" and background sessions stopping after a Homebrew upgrade (takes effect from the upgrade after this one)

[What's changed] Fixed Bash permission checks auto-approving some read-only commands (such as `rg` or `git grep`) whose arguments the shell would still expand as wildcards; these now prompt for approval

[What's changed] Fixed Bash permission checks auto-approving certain commands whose variable names zsh reads differently from bash; these now prompt for approval

[What's changed] Fixed a short form of a `git clone` option keeping the sandbox exemption from a git pattern such as `git *` in `sandbox.excludedCommands`; it is now treated like the long form

[What's changed] Fixed the first feature-flag request of a session ignoring a proxy or API endpoint set in a project's settings

[What's changed] Fixed `/ultrareview` of a local branch silently leaving uncommitted work out of the upload in a repository that keeps its branches outside `.git` (git 2.54+); it now refuses with an explanation

[What's changed] Fixed cloud sessions staying asleep after a container restart lost a pending `/loop` wakeup or scheduled task; Claude is now told and can schedule it again

[What's changed] Fixed the Claude apps gateway's retention sweep deleting a returning developer's identity row refreshed at the same moment, on PostgreSQL versions without the November 2025 fixes

[What's changed] Fixed sandboxed Monitor tool commands skipping the permission prompt under sandbox auto-allow; they now follow your permission rules

[What's changed] Fixed the Claude apps gateway failing to start when the certificate it presents to the identity provider has an empty subject

[What's changed] Fixed the Claude apps gateway exiting with a bare "Invalid URL" when `store.postgres_url` can't be parsed; the error now names the setting and says what the URL may hold

[What's changed] Fixed background agents failing with "Agent stalled" and Workflow tool subagents restarting from their prompt when a Mac woke from sleep

[What's changed] Fixed slow or failed startup since 2.1.285 under SDK hosts such as the VS Code extension when managed settings deny reads of many paths on a slow filesystem (notably Windows drives under WSL)

[What's changed] Fixed a response interrupted by computer sleep being treated as a stalled stream on Bedrock, Vertex, Foundry, and custom gateways

[What's changed] Fixed a freeze before the first request and in the `/sandbox` Config tab on Linux and WSL when a sandbox read rule such as `~/**/.env` covers a large folder

[What's changed] Fixed skills not being found when asked for by the name in SKILL.md when their folder has a different name (for example a non-English name): the skill listing now shows both names

[What's changed] Fixed a plan written in plan mode being lost when a cloud session's container restarted before the plan was presented

[What's changed] Fixed the Bash tool occasionally losing shell aliases, functions and plugin PATH entries for a whole session when its first command ran seconds after startup on a new config directory

[What's changed] Fixed unbounded memory use when an HTTP MCP server sends a very large response

[What's changed] Fixed artifact operations failing in a Claude Code run started from inside a cloud session (for example `claude -p` run from the Bash tool)

[What's changed] Fixed files sent from remote sessions sometimes being refused as "not the one approved" when four or more were sent at once

[What's changed] Fixed plan mode not being restored when resuming a session with `--continue` or `--resume <session-id>` in the terminal

[What's changed] Fixed a freeze when the secret scan or a permission prompt met long token-like text

[What's changed] Fixed `CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS=5m` being read as 5 ms and cancelling remote dialogs at once; values with a unit suffix now fall back to `dialogExpiry`

[What's changed] Fixed background subagents losing write and Bash access in their worktree after the main session enters or exits a different worktree

[What's changed] Fixed background commands, the agents view and daemon workers sending telemetry and a feature-flag request to Anthropic behind a Claude apps gateway when no managed settings on the machine force gateway login

[What's changed] Fixed `--restricted` (and `CLAUDE_CODE_RESTRICTED=1`) sessions opening the cross-session messaging socket

[What's changed] Fixed background workers honoring `--allow-dangerously-skip-permissions` on respawn without the bypass-permissions disclaimer having been accepted

[What's changed] Fixed Claude replying in an endless loop when a plugin's async Stop hook passes an unquoted script path under a folder with a space, such as Application Support

[What's changed] Fixed first launch asking to pick a login method again after `claude auth login` or with a credentials file already in the config directory

[What's changed] Fixed file names containing line breaks being displayed incorrectly in file tool errors and permission prompts

[What's changed] Fixed macOS `/login` reporting success when the keychain refused the new login and kept an old one it could not remove

[What's changed] Fixed SDK hosts using `--include-partial-messages` seeing a reply stay open after the turn ended when its stream was cut, interrupted or fell back to non-streaming

[What's changed] Improved permission prompts from background agents to show the Ctrl+X Ctrl+K shortcut that stops all background agents

[What's changed] Changed the Bash tool to ask for permission before running `pyright`, which is no longer treated as a read-only command

[What's changed] Changed skills and custom commands to refuse a `!` shell command that contains raw control characters other than tab and newline, with a message that shows where they are

[What's changed] Changed Bash permission checks so that more forms of the `ps` command ask for approval instead of running without asking

[What's changed] Changed background sessions whose scheduled task is gone: they now move to Completed about 20 seconds later and can be updated or shut down when idle

[What's changed] Changed the built-in `gh api` in cloud sessions: a host other than github.com set in `GH_HOST` or `GH_REPO` is now refused (use `--hostname` or a full URL), and stderr notes requests to other hosts

[What's changed] [VSCode] Fixed a blank chat you never typed into keeping a background Claude process running after you open a saved conversation in its place

[What's changed] [Remote Control] Fixed a computer that just started Remote Control taking up to a minute to appear in the Remote Control menu of a new session; it now appears within seconds

[What's changed] [Claude Tag] Fixed members with the Claude Tag Admin permission getting "Couldn't load memory files" on the Activity page's Memory tab; they can now read workspace and channel memory

[What's changed] [Claude Tag] Fixed a workspace guest's Confirm on a Claude settings card in Slack removing its buttons for everyone; only the guest sees the refusal, and members can still confirm or cancel

[What's changed] [Claude Tag] Fixed scheduled routines in Slack channels running on a model other than the channel's default; each run that starts a new session now uses the current default model

[What's changed] [Claude Tag] Fixed GitHub repositories in an access bundle attached by a channel-name rule being refused in the channels the rule covers; Claude can now add, list and clone them there

[What's changed] Fixed scheduled tasks (`/loop` with an interval, reminders) silently not coming back on resume once the conversation was compacted; covers compactions made from this version on

[What's changed] Fixed scheduled tasks set in the foreground never firing after a ← or `/background` hand-off, and recurring ones firing an extra run on every resume, respawn or fork

[What's changed] Fixed headless `--json-schema` runs exiting non-zero with `is_error: true` on a `success` result when the connection dropped after the structured output was already delivered

[What's changed] Fixed plan mode letting the auto mode classifier approve non-read-only connector tools that carry a server-pushed ask policy

[What's changed] Fixed URL allow and deny patterns with a wildcard inside an `xn--` host label matching differently from one process to the next

[What's changed] Fixed the `plansDirectory` setting's project-root check for paths that contain a backslash on macOS and Linux

[What's changed] Fixed the background daemon's log passing terminal control characters to the screen under `claude daemon run` and `claude daemon logs`; they now show as `\uXXXX` escapes

[What's changed] Fixed a plugin hook with a `.catch` being unloaded, and its `.catch` skipped, when the hook kept the hooks worker busy on a prompt or tool call

[What's changed] Fixed `claude plugin validate` and plugin loading refusing a hooks module that destructures an option named like one of its top-level functions

[What's changed] Windows: Fixed multi-line `!` shell blocks in skills and commands failing when the file is saved with CRLF line endings

[What's changed] Fixed Claude Code hanging until killed when a `/permissions` tab was clicked while searching in fullscreen mode

[What's changed] Fixed conversation compaction sometimes failing with a "null is not an object" error

[What's changed] Fixed plugin hooks reading an empty `answer` on `turn.complete` for a subagent that hands its report back in auto mode

[What's changed] Fixed a mod being unloaded without a message when a refresh followed its failed reload; its failure line now says the version loaded before is unloaded

[What's changed] Fixed a mod's `prompt.submit` hook that drops a prompt after calling `next(e)` being ignored silently: the hook is now reported as failed, by name

[What's changed] Fixed a mod's pane or band being redrawn without end when it followed its end over a tree that changed height at every drawing

[What's changed] Fixed a mod's inline pane being redrawn without end when its tree changed height at every drawing

[What's changed] Fixed agent view losing a background session's `/loop` run count, countdown and live status line after the session enters a worktree that it creates

[What's changed] Fixed a deny or ask rule missing a command or path whose name came from a variable set as a prefix on `declare`, `typeset`, `export` or `readonly`

[What's changed] Fixed Read deny rules not applying to image paths pasted or dragged into the prompt, or to file names listed for an @-mentioned folder

[What's changed] Fixed plugin hooks stalling each redraw when a mod draws a long multi-line text holding non-Latin characters

[What's changed] Fixed repeated Ctrl+X in the agents view deleting the whole next section after the bottom session of a section was deleted

[What's changed] Fixed You should know writing its notes in English regardless of the `language` setting

[What's changed] Fixed Esc after an `n:` or Ctrl+F search in the agents view moving focus to a section header, where Ctrl+X twice would delete every session in the section

[What's changed] Fixed `claude agents` saving a slash command it could not deliver to a stopped session and then running it by itself the next time that session restarted

[What's changed] Fixed auto mode denials suggesting a permission rule that would skip the classifier for a whole tool or that Claude Code would ignore

[What's changed] Fixed Esc confirming agent view's "Press enter again to restart this session fresh" prompt

[What's changed] Fixed `/chrome` "Reconnect extension" not restoring browser tools after a failed Chrome connection, and added an explanation when it can't (anthropics/claude-code#98135)

[What's changed] Fixed agent view's "restart this session fresh" re-sending an earlier message from the session instead of starting with an empty conversation

[What's changed] Fixed `claude plugin test` refusing to run after an upgrade because of an out-of-date saved setting

[What's changed] Fixed a marketplace named after another GitHub marketplace's download folder stopping that marketplace from downloading

[What's changed] Fixed automatic compaction giving up with "Prompt is too long" when a Mac went to sleep while it was running

[What's changed] Fixed the rewind menu (Esc Esc / `/rewind`) freezing for hundreds of milliseconds per keypress when the conversation contains a very large pasted stack trace or source file

[What's changed] Fixed a subdirectory's AGENTS.md not being attached when a file under it is @-mentioned

[What's changed] Fixed self-hosted runner sessions resumed after a stopped runner failing with "missing but already registered worktree" when the sessions folder is a relative symlink

[What's changed] Fixed Bash permission checks not applying Read deny rules or the outside-directory read block to a wildcard in some option values of read-only commands

[What's changed] Fixed a stall when an MCP server's tool listing contains very long runs of combining characters

[What's changed] Fixed two pastes that overlap in one prompt being sent to the model partly as typed text instead of as one pasted block

[What's changed] Fixed Claude in Chrome's browser picker showing a message meant for Claude when the chosen browser is no longer connected, and the VS Code dialog's list going stale after a switch

[What's changed] Fixed sessions moved to the background while idle reopening as "no saved transcript" after a restart or idle cleanup; they now resume their conversation

[What's changed] Fixed a freeze of several seconds when secret masking met very long unbroken text

[What's changed] Fixed some permission rules and safety checks not being applied to a tool call after a PreToolUse hook rewrote its input

[What's changed] Fixed a large paste expanded in place being sent to the model as typed text after the next keystroke when it held accents stored as separate characters, as macOS file names do

[What's changed] Fixed `/loop` and other recurring session-only scheduled tasks running an extra time after a sandboxed Bash command on Linux or after `.claude/scheduled_tasks.json` was deleted

[What's changed] Fixed edits to the file a symlinked settings file points at running without the settings-file permission question

[What's changed] Improved MCP startup behind a network proxy: a server the proxy blocks (HTTP 403) is no longer retried three times

[What's changed] Improved the error shown when a git config file stops the `/ultrareview` upload: it is about half as long and says what kind of file is the problem

[What's changed] Changed what a mod's `$.process.spawn` rejects with when another mod denies it after the child ran: it now says the call ran and a plugin withheld its result

[What's changed] Changed plugin hooks so long text is clipped and logged instead of being refused or dropped silently

[What's changed] Changed an in-process teammate's `agent_id` in Agent results to its agent ID (its `name@team` address stays in `teammate_id`); TeammateIdle hooks no longer fire from its subagents or forks

[What's changed] Changed background sessions waiting on a scheduled wakeup (`/loop`): they are now left running through updates and low memory, where being restarted or shut down could silently lose the wakeup

[What's changed] Changed the Claude apps gateway's minimum supported PostgreSQL version from 14 to 11

[What's changed] Changed `claude plugin update` on a plugin loaded from a directory to print just its reason, without the "Failed to update plugin" prefix, as for built-in plugins

[What's changed] [VSCode] Fixed settings dialogs blaming a timeout when Claude Code stopped unexpectedly during a save

[What's changed] [VSCode] Fixed the branch switch dialog offering to switch when it could not check for uncommitted changes

[What's changed] [VSCode] Fixed a permission prompt that arrived behind an open dialog taking keyboard focus, so a key pressed in the dialog could answer it

[What's changed] [VSCode] Fixed sign-in and new sessions giving no clear reason when Claude Code cannot find or start its program

[What's changed] [VSCode] Fixed the agent map showing a nested sub-agent with "Tool calls (0)" and placing the agents it starts under the main agent

[What's changed] [Cloud sessions] Fixed turning off prompt suggestions through a cloud environment's environment variables having no effect in new cloud sessions

[What's changed] [Cloud sessions] Fixed the working indicator in a cloud session spinning on for several seconds after Claude's reply had finished; it now stops with the reply

[What's changed] [Cloud sessions] Fixed an unarchived cloud session looking as if Claude were still working until you sent another message

[What's changed] [Code Review] Fixed blocking review comments sometimes opening with a "nit" label that contradicted their severity

[What's changed] [Code Review] Fixed tips to comment "@claude review" being posted on fork and Manual-mode pull requests in organizations that have turned Code Review off

[What's changed] Changed the background daemon's log to write a multi-line message as one JSON-quoted line

[What's changed] Improved the Claude apps gateway to log a warning during the last 30 days before the certificate it presents to the identity provider expires