Claude Code 2.1.299 Release

Added

• Added CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents
• Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all
• Added CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later
• Added $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
• Added $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization
• Added size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight
• Added --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
• Added the skill's frontmatter, source, plugin name and file path to what a mod's skill.prompt hook receives
• Added /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker
• Added a "safe mode" line to the agents view peek panel for background sessions started with --safe-mode
• Added a one-time note when plan mode won't ask before most edits or commands because bypass permissions is available
• Added --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs
• Added support for turning off the attribution block in Claude Desktop's Code tab: set CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy
• Added a field to the attribution block in Claude Code sessions behind a Claude apps gateway; remove the block with CLAUDE_CODE_ATTRIBUTION_HEADER=0
• Added a queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
• Added a note in /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code
• Added /usage warnings for max effort, workflows, always-on context and large tool results
• [Claude Tag] Added the ability for Claude in Slack to delete a canvas it created in a channel when someone asks it to

Changed

• Changed plugin hooks and workflow scripts to refuse values they hand back that nest deeper than 28,000 levels, with an error naming the limit (workflow scripts allowed 100,000)
• Changed actions a plugin hook can block to be refused, not let through, when the hook cannot be handed them or cannot hand back its answer; a tool that already ran has its result withheld
• Changed requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers to no longer follow HTTP redirects; redirects by a connector's own server are unaffected
• Changed MCP requests in cloud and self-hosted runner sessions to no longer follow HTTP redirects from the session's MCP proxy
• Changed skill and command loading: one whose file or folder name has hidden, direction-changing or blank-like characters, < or > is no longer offered until renamed; such a name: is ignored
• Changed ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it
• Changed WebFetch page reads to pick their effort as web searches do: the caller's level on the caller's own model, otherwise the level settings give the small model
• Changed claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does
• Changed MCP allow rules to reach only the server they name: mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name
• Changed agent tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*
• Changed Claude in Chrome in Cowork cloud sessions outside auto mode: an approved-site action the safety classifier flags now asks you instead of being refused, unless managed settings apply
• Changed cloud session and Remote Control MCP connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; MCP_PROTOCOL_NEGOTIATION=legacy opts out
• Changed MCP tool descriptions and server instructions from Anthropic's first-party MCP servers at api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters
• Changed auto mode in Cowork cloud sessions: a PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied
• Changed the resume command printed at exit: it names the session by its ID and no longer by its name, so that nothing in a session name can run when the line is pasted
• Changed the resume command printed at exit of a worktree session: it uses -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
• Changed /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
• Changed UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
• Changed a skill's own front-matter UserPromptSubmit hook to first run on the prompt after the one that invokes the skill
• Changed the turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)
• Changed the errors shown when /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env
• Changed the cyber safeguard notice to no longer ask people to apply to the Cyber Verification Program
• [Cloud sessions] Changed deleting a self-hosted environment to turn off its routines right away, with the reason shown on each routine, instead of leaving their runs to fail
• [Claude Tag] Changed how Claude in Slack corrects a message it got wrong: it edits the message in place and adds a short "Edited" note instead of striking through the old text
• [Claude Tag] Changed Claude in Slack to join channels with more than 100 members quietly, with no intro message