Claude Code v2.1.299 发布：新增空闲压缩与文件提及环境变量

What's changed

Added CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents
Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all
Added CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later
Added $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
Added $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization
Added size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight
Added --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
Added the skill's frontmatter, source, plugin name and file path to what a mod's skill.prompt hook receives
Added /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker
Added a "safe mode" line to the agents view peek panel for background sessions started with --safe-mode
Added a one-time note when plan mode won't ask before most edits or commands because bypass permissions is available
Added --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs
Added support for turning off the attribution block in Claude Desktop's Code tab: set CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy
Added a field to the attribution block in Claude Code sessions behind a Claude apps gateway; remove the block with CLAUDE_CODE_ATTRIBUTION_HEADER=0
Added a queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
Added a note in /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code
Added /usage warnings for max effort, workflows, always-on context and large tool results
Fixed the error for a denied cloud session, which could point to the wrong organization when a key from apiKeyHelper was in use
Fixed sessions on a gateway-specific model name behind a custom ANTHROPIC_BASE_URL ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
Fixed a mod that submits a prompt at the end of every turn keeping a headless run going past --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation
Fixed cloud sessions sometimes showing the model's follow-up text after a tool group's one-line label
Fixed the Write and Edit tools creating a mod in a session's mods folder without asking in accept-edits mode when the config directory's path has no .claude in it
Fixed installed mods that kept running in an open session after being turned off remotely; they now unload between turns
Fixed Edit and Retry in Cowork and claude.ai cloud sessions failing on a message stopped while its UserPromptSubmit or mod prompt.submit hooks were still running (regression in 2.1.296)
Fixed an agent teammate started without a description keeping part of a credential from its prompt in the task description shown for it
Fixed the claude.ai view of a Remote Control or cloud session freezing when a large batch of events could not finish uploading over a slow connection
Fixed a sandboxed shell command being able to write into a --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox
Fixed memory growth under heavy debug logging (--debug, --debug-file), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
Fixed memory growing without bound when debug output goes to stderr and the parent process stops reading it
Fixed rm prompts on shell -c scripts that don't run rm. An rm built at run time in a script Claude Code can't read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1
Fixed double-clicking a word in an expanded transcript row in fullscreen mode collapsing the row instead of selecting the word
Fixed claude mcp list, claude doctor and /status reporting an empty .mcp.json as invalid
Fixed /btw jumping the transcript to the bottom when asked while scrolled up in fullscreen
Fixed sandboxed commands failing on WSL2 with bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode when the sandbox can write to the Windows drive
Fixed scheduled wakeups (ScheduleWakeup) not firing while a background task was running in Agent SDK, IDE and claude remote-control sessions
Fixed a mod's prompt.submit rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
Fixed a Remote Control prompt being lost when another queued prompt in the same batch failed to deliver
Fixed a Remote Control prompt that had passed its hooks being dropped from prompt history when Stop interrupted the next queued prompt's hook
Fixed sign-in, MCP servers and project trust appearing lost on Linux after a sandboxed command left an empty .config.json in the config directory
Fixed /sandbox reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why
Fixed SDK and headless sessions staying in auto mode after the host switched to a model that doesn't support auto mode
Fixed MCP servers named constructor or prototype in an MCP config never being connected
Fixed tools of an MCP server named constructor or toString asking for permission in auto mode and bypass permissions mode
Fixed a spurious "synced[0] commands path not found" plugin error at startup when another Claude Code process had just updated a claude.ai-synced plugin
Fixed the Artifact tool advising a retry when a publish that requests connectors or other access was refused by the server or a proxy (HTTP 403); it now says so and what to tell the user
Fixed Cowork cloud sessions staying on an old account plugin after a plugin reload that timed out or a restart that reused a recent sync
Fixed document blocks being dropped from your own message sent while Claude is working
Fixed Claude in Chrome asking for permission while no browser is connected; it now says the extension is not connected
Fixed the fullscreen "Update installed" notice being hidden behind the idle "/clear to save tokens" hint; it now shows beside the hint
Fixed a mod hook, with or without a .catch, being run again without end when it waits on another mod's noun that does its work outside the call
Fixed the Claude apps gateway serving models that a policy's availableModelsMatch: exact or deniedModels blocks; it now answers 400 and leaves them out of its model lists
Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets ANTHROPIC_BASE_URL
Fixed streams through a custom ANTHROPIC_BASE_URL being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
Fixed a mod's tool.describe or prompt.section answer that changed after $.ui.invalidate never reaching Claude; the new answer is now sent on the next turn
Fixed a settings file being ignored when enabledMcpjsonServers or disabledMcpjsonServers held a single server name (letters, digits, - or _) as a plain string
Fixed claude plugin test pausing a hook's time budget while a served $ method it had called kept making $ calls after answering
Fixed high memory use after resuming a cloud or Remote Control session that had run many subagents
Fixed plugin hooks being skipped when they pass a very deeply nested tool input or message on with next()
Fixed a value a mod's hook passes to next(), returns, or sends to a $ method being refused whole when one of its getters throws a RangeError; now only that key is refused
Fixed /usage, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (#92238)
Fixed wrapped text mixing CJK or emoji with Latin words losing its last line or leaving a blank row at some terminal widths
Fixed a cloud session sometimes ignoring the answer to a permission prompt or a question when the answer was given while the session's worker was being replaced
Fixed bold, italic and other nested text styles running over table borders or being lost on wrapped rows
Fixed Cowork cloud sessions running the old version of an account plugin changed, removed or disabled from another device until the session restarted
Fixed deny and ask rules for an MCP server (mcp__<server>) not applying when the server's normalized name contains a double underscore
Fixed long conversations losing newly attached images on every turn after one oversized image was refused by the API
Fixed the plugin_loaded telemetry event reporting has_hooks as false for plugins whose hooks are a hooks module, built-in plugins included
Fixed images attached while Claude is working (VS Code, desktop app, SDK) being sent at full size, which led to repeated image errors in long conversations
Fixed the image coordinate hint being missing or slightly off for large near-square images on newer models
Fixed feature flag, startup, fast mode, profile and feedback requests to Anthropic carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL); Anthropic API keys are still sent
Fixed a mod's hot reload ignoring a fix saved right after a failed reload; saving a mod file without changing it no longer reloads the mod
Fixed mods loaded from source files being refused when a hook hands $ to a function declaration imported from another file of the mod
Fixed a regression in 2.1.296 where cloud and headless sessions could run an approved tool call twice if a new message arrived as the session resumed after a restart
Fixed scheduled tasks being announced for the wrong minute: the scheduling tools now report each job's actual next run time
Fixed mods' hooks being handed values with __proto__ keys silently removed, which could skip a tool.check guard on a tool call another mod made
Fixed claude -p saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
Fixed long pastes in terminals without bracketed paste losing all text after an invisible control character, such as a mis-decoded curly quote
Fixed managed settings and organization policy not being fetched when the stored login's plan was changed locally on machines whose MDM or managed-settings file sets forceLoginOrgUUID
Fixed MCP connections over HTTP hanging for 30 seconds and failing when a server never ends the body of its reply to a notification (#99014)
Fixed MCP servers added to a running headless or SDK session being connected before some policy checks ran; a blocked server is now reported as failed without being contacted
Fixed claude mcp list, claude mcp get and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
Fixed /reload-plugins not loading a plugin installed from another terminal a moment earlier
Fixed blank rows appearing under CJK and emoji text squeezed into a one-cell column, as in a very narrow terminal
Fixed text cut in the middle beside wide characters leaving a cell unused or being cut twice, and an emoji vanishing where a color changed inside it
Fixed bare mode notices in background sessions telling you to restart without --bare, which keeps the mode; they now name /stop and claude --resume, as safe mode ones do
Fixed ← not saying why it stayed put over a queued message while Remote Control is on
Fixed $.http.fetch in mods refusing a 304, 204 or 205 response that declares a Content-Length over the 4 MiB body limit
Fixed /config push notification toggles sending your account the previous setting instead of the one you just chose
Fixed a cloud session leaving a reply unfinished when its worker was replaced just after the reply hit the output token limit
Fixed Read failing on PDF page ranges in remote sessions on Linux that run without elevated privileges
Fixed Enter answering a question or permission prompt that had been held back while you typed an unsent message
Fixed a file attached to a message in a remote session being left out when its download stalled part way; the download is now tried again
Fixed queued prompts sent as content blocks over --input-format stream-json running together without a line break when merged into one turn
Fixed self-hosted runner sessions shutting down MCP servers added through an --exec-path wrapper's own --mcp-config when connectors change mid-session
Fixed claude plugin eval passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
Fixed permission prompts cutting off or wrapping too early when the reason text contains keycap or joined emoji
Fixed forceLoginOrgUUID and forceLoginMethod from MDM or the managed-settings file being hidden or replaced by server-managed settings
Fixed --bare sessions leaving out an MCP server named constructor or prototype that --channels asked for
Fixed resuming a conversation from before /clear reattaching to the Remote Control session of the conversation after it
Fixed a prompt starting with /, sent with the Agent SDK's verbatimPrompts option, running as a slash command when CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran it after a restart
Fixed background sessions started with --safe-mode silently leaving safe mode when the session was woken or restarted
Fixed scheduled tasks and loops firing again after every turn, or firing early, during the repeated hour when daylight saving time ends
Fixed the diff view listing a new file whose name begins or ends with a space under the wrong name
Fixed MCP tool calls in headless and SDK sessions sometimes failing or running twice when a background reconnect closed the connection they were running on
Fixed /btw side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
Fixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink
Fixed sandbox denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
Fixed sandbox glob allowRead and allowWrite entries not being re-checked when the directory they start from is replaced by a symlink
Fixed worktree-isolated sessions accepting some awk programs the isolation guard should refuse
Fixed claude mcp add <name> -- <command> --background being started as a background session
Fixed a prompt or reply of --bg or --background to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
Fixed a custom slash command's embedded shell line running twice when a newer message interrupted the command while its prompt was being checked
Fixed --worktree sessions leaving a folder behind in .git/worktrees in repositories using git's reftable ref storage
Fixed claude self-hosted-runner sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
Fixed Ultracode not being announced to scheduled tasks and other delivered headless turns when ultracode is on in settings
Fixed MCP OAuth sign-in, token refresh and sign-out not sending configured headers/headersHelper values, which broke servers behind an authenticating proxy
Fixed the Artifact tool reporting a spurious one-line difference against the live page, and refusing the publish, when a large page with a line break after <head> is published again unchanged
Fixed $.ui.open reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and claude -p
Fixed the agent.spawn mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries resume, and a mod can refuse it
Fixed claude plugin validate rejecting a mod's $.state references when plugin.json has no types key and the contract is at ./types/index.d.ts
Fixed a mod's dimColor text looking the same as plain text under the dark ANSI theme and on 16-color terminals
Fixed plan mode running a write (an MCP tool's, a file's, a shell command's) that a PreToolUse hook or a mod's tool.check hook allowed
Fixed background subagents in auto mode sometimes sending their final report twice, once as the result and once as a message
Fixed SendMessage not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
Fixed replies cut off at the output token limit ending the turn silently, with no retry or error, after a request fell back to non-streaming mode
Fixed Read garbling UTF-16LE files with a byte-order mark, and Write dropping byte-order marks or silently converting Windows-1252, Shift-JIS, GBK or UTF-16BE files to UTF-8 (now refused)
Fixed cloud sessions sometimes leaving a message unanswered when the worker was replaced right after a compaction
Fixed cloud sessions and CLAUDE_CODE_RESUME_INTERRUPTED_TURN sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step
Fixed photos sent over Remote Control being dropped when their copy could not be saved on your computer; Claude now still sees the photo
Fixed files sent over Remote Control sometimes not arriving in long-running sessions
Fixed files of 30 to 35 MiB sent over Remote Control or to a cloud session not arriving
Fixed a user-installed mod's $.env.set changing the environment or shell prefix that command hooks from managed settings start with
Windows: Fixed the process-liveness check leaving orphaned PowerShell processes behind on busy machines until memory ran out
Windows: Fixed PreToolUse and PermissionRequest hooks that set no shell failing open when Git for Windows isn't installed; a guard that fails now blocks the call
Windows: Fixed Bash commands failing with "command not found" for a whole session when Git Bash did not report its PATH at startup
Self-hosted runner: Improved what setup and doctor say when the runner's machine has no git credentials
Self-hosted runner: Fixed sessions that wrote output before their first turn being left with no release timer, ignoring --retire-at and delaying shutdown
Improved the error shown when a cloud session is refused because your claude.ai login was rejected or has expired: it now tells you to sign in again with claude auth login
Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods
Improved memory and disk use when PDFs are @-mentioned: their bytes are no longer kept in the session transcript
Improved sandboxed Bash on Linux: Esc and Ctrl-C now work while wildcard read rules are being expanded for a command
Improved the startup warning for an unrecognized model ID: it is now one short line under the welcome banner with a docs link, instead of a long raw message
Improved the plugin-authoring skill's steps for sharing a mod: Claude asks public or private and checks the files before creating a GitHub repository
Improved the Skill tool's "Unknown skill" error to suggest a skill's listed name when Claude wrongly adds the anthropic-skills: prefix to it
Improved /reload-skills to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
Improved the error shown when a worktree cannot be created because its base commit does not resolve: it now says how the lookup ended and the likely reasons, such as a repository without a commit
Improved the error for creating a worktree at a bare-repository layout's root: it now explains the layout instead of an unrelated git error
Improved artifact watching: a local session can now watch up to 25 published artifacts at once, up from 10
Improved background agent notifications: they now say when an agent is only waiting on its own background work, got a message too late for its result, or was stopped by a usage limit
Changed plugin hooks and workflow scripts to refuse values they hand back that nest deeper than 28,000 levels, with an error naming the limit (workflow scripts allowed 100,000)
Changed actions a plugin hook can block to be refused, not let through, when the hook cannot be handed them or cannot hand back its answer; a tool that already ran has its result withheld
Changed requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers to no longer follow HTTP redirects; redirects by a connector's own server are unaffected
Changed MCP requests in cloud and self-hosted runner sessions to no longer follow HTTP redirects from the session's MCP proxy
Changed skill and command loading: one whose file or folder name has hidden, direction-changing or blank-like characters, < or > is no longer offered until renamed; such a name: is ignored
Changed ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it
Changed WebFetch page reads to pick their effort as web searches do: the caller's level on the caller's own model, otherwise the level settings give the small model
Changed claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does
Changed MCP allow rules to reach only the server they name: mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name
Changed agent tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*
Changed Claude in Chrome in Cowork cloud sessions outside auto mode: an approved-site action the safety classifier flags now asks you instead of being refused, unless managed settings apply
Changed cloud session and Remote Control MCP connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; MCP_PROTOCOL_NEGOTIATION=legacy opts out
Changed MCP tool descriptions and server instructions from Anthropic's first-party MCP servers at api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters
Changed auto mode in Cowork cloud sessions: a PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied
Changed the resume command printed at exit: it names the session by its ID and no longer by its name, so that nothing in a session name can run when the line is pasted
Changed the resume command printed at exit of a worktree session: it uses -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
Changed /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
Changed UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
Changed a skill's own front-matter UserPromptSubmit hook to first run on the prompt after the one that invokes the skill
Changed the turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)
Changed the errors shown when /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env
Changed the cyber safeguard notice to no longer ask people to apply to the Cyber Verification Program
[VSCode] Fixed an unsent prompt and its attachments being lost when switching to another session and back
[VSCode] Fixed unused blank chats keeping a background Claude process running after starting a new conversation
[VSCode] Fixed the mic button showing an internal error message when you are signed out of claude.ai; it now offers to sign you in
[VSCode] Improved startup time in workspaces without a Python environment by starting Claude while the Python extension loads
[VSCode] Improved startup: the model picker and slash command menu now fill in right away in a new window on a folder you've opened before
[Cloud sessions] Fixed a memory spike that could crash a session when many of its existing output files were re-sent to it at once
[Cloud sessions] Fixed saving an edited routine silently moving it to a different environment when its own had been deleted or wasn't in the list; the routine now keeps its environment
[Cloud sessions] Fixed Sessions search in a self-hosted environment's admin details finding nothing when you paste the session ID from a session's link
[Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches
[Cloud sessions] Improved the deploy command shown when you create a self-hosted environment or environment key: it shows in full, wraps between arguments, and has a visible copy button
[Cloud sessions] Changed deleting a self-hosted environment to turn off its routines right away, with the reason shown on each routine, instead of leaving their runs to fail
[Remote Control] Fixed Remote Control sessions whose computer can't be reached still appearing to send your messages; your text now stays in the box and Send is off until it reconnects
[Claude Tag] Added the ability for Claude in Slack to delete a canvas it created in a channel when someone asks it to
[Claude Tag] Fixed Claude in Slack staying silent on untagged posts that a channel's own instructions tell it to answer, such as posts that tag someone else, in channels with guests
[Claude Tag] Fixed Claude in Slack reporting a reply to another channel's thread as posted when it isn't a member there; it now says the reply wasn't delivered and how to fix that
[Claude Tag] Fixed Claude in Slack sometimes ending a turn without posting its answer when a self-hosted runner's image has no python3
[Claude Tag] Changed how Claude in Slack corrects a message it got wrong: it edits the message in place and adds a short "Edited" note instead of striking through the old text
[Claude Tag] Changed Claude in Slack to join channels with more than 100 members quietly, with no intro message
[Code Review] Fixed Code Review's monthly spend-limit comment and check-run card sending admins to Claude Code settings; they now link the Usage page, where that limit is set