Jonathon's AI Wiki

What's New in Claude Code — Week 35 (August 24–30, 2026)

18 min read

Source: raw/anthropic-watch-claude-code-tag-v2-1-246.md, raw/anthropic-watch-claude-code-tag-v2-1-247.md, and ai-research/claude-code-release-v2-1-{248,250,251}.md — the anthropics/claude-code GitHub release notes for v2.1.246 through v2.1.251, published 2026-08-25 to 2026-08-28. The v2.1.248–251 files were fetched with gh release view on 2026-09-29 to fill a gap in the watch feed. Also ai-research/claude-code-docs-changelog-2026-08-28.md (the code.claude.com changelog for the same releases, fetched 2026-08-28), ai-research/claude-code-docs-whats-new-w35-2026-09-18.md (the official W35 digest, fetched 2026-09-18), ai-research/claude-code-docs-whats-new-w36-2026-09-18.md (the official W36 digest, which repeats several v2.1.251 items) and ai-research/claude-code-docs-whats-new-w34-2026-08-28.md (the official W34 digest, cited for ANTHROPIC_DEFAULT_MODEL).

Product: Claude Code · URL: https://github.com/anthropics/claude-code/releases · Official digest: https://code.claude.com/docs/en/whats-new/2026-w35 · Date: 2026-08-25 → 2026-08-28

Five releases this week (v2.1.246, 247, 248, 250, 251), after the week opened with v2.1.243 and v2.1.245, whose release notes are recorded at the end of Week 34. The week moves model defaults twice: Sonnet 5’s auto-compact window grows to its full 1M context, and seat-based Enterprise plans switch to Opus 5 by default. It also adds PreModelSwitch / PostModelSwitch hooks, per-model /effort memory, a prompt-cache line in /cost, and a --restricted mode that strips command-running tools. Continues into Week 36.

The official W35 digest (dated August 24–28, releases v2.1.240 → v2.1.250) headlines three features: /resume in the Desktop app, Claude-drafted feedback, and restricted mode. v2.1.251 is the week’s largest release — 71 entries in the code.claude.com changelog, against 57 for v2.1.246 — and its notes open with five path- and permission-boundary security fixes.

Key Takeaways

  • Sonnet 5 now auto-compacts near its full 1M window (v2.1.247). Sessions on the 1M window compact at about 967K tokens instead of about 934K. See Claude Sonnet 5.
  • Seat-based Enterprise subscriptions now default to Opus 5, “matching other premium plans” (v2.1.251). See Claude Opus 5.
  • New PreModelSwitch and PostModelSwitch hook events can block, confirm or annotate a model switch, and SessionStart resume hooks now receive session staleness and the estimated re-cache cost (v2.1.251). See Hooks.
  • /effort is remembered per model (v2.1.251): each model keeps its own effort setting when you switch. See Model vs Effort.
  • /cost shows a per-session prompt-cache line — hit ratio, misses, tokens re-cached, warm/cold — plus a prompt_cache object for status-line scripts (v2.1.251). Week 36 adds a likely cause for each miss.
  • --restricted / CLAUDE_CODE_RESTRICTED=1 removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files (v2.1.248).
  • Desktop /resume picks up CLI sessions (official W35 digest, no version given): type /resume in the Claude Code Desktop prompt box, find a terminal session by title, folder or branch, and continue it in the app with the full conversation.
  • CLAUDE_CODE_SUBAGENT_MODEL changed meaning (v2.1.251): it now sets the default subagent model; an agent definition’s model: and an explicit per-spawn model take precedence over it. Scripts that relied on it to force every subagent onto one model need the _FORCE variant added in Week 36.
  • The Workflow tool’s description shrank from about 5.7k to about 1k tokens, with the script-writing reference moved into a bundled workflow-authoring skill (v2.1.248). See Dynamic Workflows.
  • Claude Desktop and Cowork sessions are no longer deleted after 30 days (v2.1.248); the new desktopSessionCleanupPeriodDays setting caps the exemption.
  • Bedrock, Vertex AI and Foundry catch up on agent features: Claude can start /code-review on its own there (v2.1.246); cross-session SendMessage / ListAgents and /loop work there (v2.1.248); /radio too (v2.1.251). The official digest adds that on these providers /model and /effort now apply immediately instead of after the turn ends.
  • Security fixes worth updating for (v2.1.246–251). v2.1.251 lists five together: file tools following a symlink swapped after the permission check; plugin commands in a marketplace entry pointing outside the plugin directory; project settings enabling detailed beta tracing or bypassing an OTLP collector pinned by managed settings; the Workflow tool reading a scriptPath outside the session’s read permission before the check ran; and Grep/Glob ignoring Read(...) deny rules through symlinked paths. Also: arithmetic assignments such as OPTIND=1/0 being auto-approved (v2.1.251); telemetry carrying a third-party gateway’s API key to Anthropic (v2.1.246); and /ultrareview uploading prod.env-style, *.tfvars and credential swap files (v2.1.248).

Release table

VersionDate (UTC)Shape
v2.1.2462026-08-25Large (57 changelog entries); /permissions Auto mode tab, /cd applies project config immediately, non-interactive auto-continue
v2.1.2472026-08-26Sonnet 5 1M auto-compact, SendFeedback tool, /claude-api cost-optimize
v2.1.2482026-08-27--restricted, experimental.cacheTtl, Workflow tool slimmed
v2.1.249—No GitHub release page
v2.1.2502026-08-28”Bug fixes and reliability improvements” only
v2.1.2512026-08-28Largest of the week (71 changelog entries); Enterprise default Opus 5, model-switch hooks, per-model effort, /cost cache line, five-fix security batch

From the official W35 digest

The digest adds detail the release notes don’t carry, and lists “other wins” that appear in none of the itemised v2.1.246–250 notes.

/resume in the Desktop app

  • In a Claude Code Desktop session, run /resume to list the sessions you started from the CLI. Search by title, folder or branch, preview where you left off, then select one and press Enter; the conversation opens in the app with its context intact. Reference: code.claude.com/docs/en/desktop#coming-from-the-cli.
  • A long terminal session can now move into Desktop’s diff, terminal and preview panes without starting over.

Claude-drafted feedback (SendFeedback)

  • Claude drafts a report when a tool keeps failing, when it can’t help with a request, or when you point out a mistake. A card above the prompt shows the draft; you review, send or dismiss it. Nothing reaches Anthropic until you send it.
  • /feedback with no argument opens the queue of drafts from every session; select one to edit, send or discard it.
  • Turn drafting off by setting Claude-drafted feedback to off in /config (digest) — the feedbackDrafts setting in the v2.1.247 notes.
  • The digest says the feature “requires v2.1.238 or later”; the changelog lists the SendFeedback tool as added in v2.1.247.

Restricted mode (v2.1.248)

  • The digest’s stated use case is an evaluation harness driving claude on a shared machine.
  • Beyond removing the command-running tools and WebFetch, it confines the file tools to the working directories, loads only managed settings and --settings, and refuses the bypassPermissions mode. Because project settings aren’t loaded, a repo’s .claude/settings.json can’t loosen it.
  • To give back a removed tool, list it in --tools together with the other built-in tools you want, e.g. --tools "Bash,Read,Edit". --tools is an allowlist, and its default preset does not restore the removed tools.
  • Example: claude --restricted -p "review src/ for SQL injection risks".
  • It removes tool classes outright rather than gating them with permission rules, which fits untrusted-content pipelines and locked-down CI runs as well as eval harnesses.

Other wins not in the v2.1.246–250 notes

The digest’s range is v2.1.240 → v2.1.250, but these items appear in none of the itemised v2.1.246–250 notes. v2.1.240 and v2.1.241 were “bug fixes and reliability improvements” and v2.1.245 was the glibc fix, so they most likely shipped in v2.1.243 (2026-08-24), whose GitHub release body is only a CHANGELOG chore line.

  • modelPicker setting extends or replaces the /model picker’s built-in list with your own ordered, labelled entries, including Amazon Bedrock or Google Cloud Agent Platform model IDs.
  • promptCacheTtl: "1h" keeps a one-hour prompt cache on the main conversation when you use an API key or a cloud provider; subagentPromptCacheTtl sets the TTL for subagents and every other request outside the main conversation.
  • /usage Loops breakdown (Pro, Max, Team, Enterprise): run count, total tokens, tokens per run and last run for the /loop and scheduled tasks that used the most tokens. See Scheduled Tasks.
  • modelPricing managed setting: organizations on contracted rates get /usage, the status line and OpenTelemetry reporting cost at those rates instead of list price.
  • /login offers “Sign in with your Console account” under the Anthropic Console account option, so members of Console organizations that don’t allow API keys can sign in without creating one.
  • On Bedrock, Agent Platform and Foundry, /model and /effort apply immediately instead of after the turn ends.
  • Smaller installer: the native installer and auto-updater download a zstd-compressed build, about 75 MB instead of 340 MB on Linux x64, and native builds load code on demand, using roughly 40–70 MB less memory per session.

Models and defaults

  • Sonnet 5 auto-compact window → full 1M context, compacting at about 967K instead of about 934K tokens (v2.1.247).
  • Seat-based Enterprise default model → Opus 5 (v2.1.251).
  • /effort saves a default effort per model (v2.1.251).
  • Fixed Opus 5 requests failing with “effort … is not supported when thinking is disabled” at xhigh/max with thinking off; effort is now sent as high in that case (v2.1.251).
  • Fixed claude --bg --model fable on Max plans asking for usage credits while the interactive session on the same account still had Fable allowance (v2.1.251).
  • Fixed the “switch to Opus 1M for 5x more context” tip showing when the current Opus already has 1M (v2.1.251).
  • Fixed subagents dying on a first-call model 404: they now use the session’s fallback model chain (v2.1.247).
  • The default commit trailer becomes Co-Authored-By: Claude Code when the active model isn’t a recognized Claude model, for example a third-party model behind ANTHROPIC_BASE_URL (v2.1.251).

New commands and features

  • /permissions Auto mode tab for viewing and editing auto-mode classifier rules (v2.1.246); before it, inspecting those rules meant opening a settings file. See Auto Mode.
  • Bash permission prompts gain a tip and a one-keystroke “Yes, and switch to auto mode” option (v2.1.247); the digest says it appears in the Manual and acceptEdits modes when auto mode is available.
  • /cd now applies the new directory’s project settings, hooks, .mcp.json servers (behind the usual approval), skills and agents immediately instead of on --resume (v2.1.246).
  • Non-interactive sessions (-p, SDK, cloud) automatically continue a response cut off by a server error, connection loss or stall (v2.1.246); the digest adds that this applies when the partial response contains text and no tool calls.
  • /code-review can be started by Claude on its own on Bedrock, Vertex AI, Foundry, through the Claude apps gateway, and with telemetry disabled (v2.1.246).
  • /goal: idle sessions start at most three check-ins on long-running background work per goal; your next message allows three more (v2.1.246). See Scheduled Tasks.
  • End-of-turn duration line shows completion time, e.g. ✻ Sautéed for 23s · done 6:05 PM (v2.1.246).
  • SendFeedback tool: Claude drafts a feedback report you review and send from /feedback; turn off with feedbackDrafts (v2.1.247). Details under the digest section above.
  • /claude-api cost-optimize profiles a project’s Claude API spend and walks cost levers (caching, token hygiene, batch, effort, model choice) one measured change at a time; the /claude-api skill also gains Admin API coverage (members, invites, workspaces, API keys, rate-limit reports, workload identity federation, CMEK) (v2.1.247). See Cost & Intelligence Levers.
  • /usage-credits for Enterprise orgs billed via AWS Marketplace, self-serve Enterprise and Enterprise trials (v2.1.248).
  • Cross-session messaging (SendMessage / ListAgents) between sessions on the same machine now works on Bedrock, Vertex, Foundry and with telemetry off (v2.1.248).
  • /loop self-paced dynamic mode and the no-prompt autonomous default are always available, including on Bedrock/Vertex/Foundry (v2.1.248).
  • claude self-hosted-runner --client-label <label> / SELF_HOSTED_RUNNER_CLIENT_LABEL (v2.1.248).
  • /usage Spend limit bar and a rate_limits.spend_limit status-line field for developers behind a Claude apps gateway with spend limits (v2.1.251). See Claude Apps Gateway.
  • claude --help now lists attach, logs, stop, respawn and rm (v2.1.251).
  • A foreground subagent’s tool calls and results stream live to Remote Control clients (v2.1.251).
  • /radio is available on Bedrock, Vertex AI, Foundry, Claude Platform on AWS, and with telemetry off (v2.1.251).
  • /schedule explains that MCP servers configured in Claude Code can’t be attached to cloud routines (v2.1.251).

Settings and environment variables

  • spinnerTipsOverride accepts {id, text, cooldownSessions, priority} entries, tipsFile and label (v2.1.247), so organizations can rotate their own tips alongside the built-in ones.
  • feedbackDrafts (v2.1.247).
  • desktopSessionCleanupPeriodDays (v2.1.248).
  • An invalid crossSessionInbound value now warns and holds (user settings) or is refused (managed settings) (v2.1.248).
  • Managed settings: client-side timeout, MCP startup-mode and stream-watchdog environment variables no longer trigger the approval prompt (v2.1.248).
  • CLAUDE_CODE_SUBAGENT_MODEL is now a default, not an override (v2.1.251).
  • Project .claude/settings.json env can no longer set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR/TMP/TEMP — set them in your shell, user or managed settings (v2.1.251).
  • ANTHROPIC_CUSTOM_HEADERS from managed or project settings requires approval when it sets a credential, org/tenant, routing or API-behaviour header such as Authorization or Host (v2.1.251).
  • Server-managed settings that terminate sandbox TLS, proxy sandbox traffic, inject credentials or weaken isolation now require approval, and the approval dialog lists only settings changed since the last approval (v2.1.251).
  • Startup warning for Bash allow rules with a wildcard before the subcommand, e.g. Bash(git * main), since they also match options inserted before the subcommand (v2.1.246).
  • Digest-only settings (modelPicker, promptCacheTtl, subagentPromptCacheTtl, modelPricing) are listed under “From the official W35 digest” above.

Hooks, MCP, plugins, skills and subagents

  • PreModelSwitch / PostModelSwitch hook events; SessionStart resume hooks receive staleness and estimated re-cache cost (v2.1.251). The official W36 digest describes the split: a PreModelSwitch hook can block a switch you request, and a PostModelSwitch hook can add context for Claude after the model changes. Before v2.1.251 a model switch was outside the hook system’s reach.
  • Agent frontmatter experimental.cacheTtl ("5m" or "1h") sets a per-agent prompt-cache TTL when no subagent TTL setting is configured (v2.1.248). See Subagents.
  • A subagent that stops at maxTurns returns its output marked partial, with a hint to continue it via SendMessage (v2.1.246).
  • Hooks: stdout that starts with { but isn’t valid JSON is now reported as a hook error; an invalid PermissionRequest/PreToolUse hook answer is named in the claude agents row (v2.1.248). Fixed the Notification hook not firing while the sandbox network-request prompt waits, and hook errors showing a literal ${CLAUDE_PLUGIN_ROOT} (v2.1.246).
  • MCP: a headersHelper that supplies Authorization now re-runs on 401 instead of falling into OAuth discovery (v2.1.248); tool arguments with an empty {} schema are no longer sent as JSON strings (v2.1.246); requiresUserInteraction tools no longer offer “don’t ask again” (v2.1.246); the SDK MCP handshake wait times out after 70 seconds (v2.1.251). On Bedrock/Vertex/Foundry and with telemetry off, Claude is told when a configured MCP server failed to connect (v2.1.247). See MCP.
  • Plugins: marketplace names with control or invisible characters are rejected (v2.1.247); marketplace-entry commands pointing outside the plugin directory are rejected as path traversal (v2.1.251); /reload-plugins counts skills under skills/*/SKILL.md (v2.1.246). Also fixed in v2.1.246: plugin skills whose frontmatter name already carries the <plugin>: prefix showing it doubled in the slash menu; claude plugin update failing when given a bare plugin name; and installation failing when plugin.json was saved with a UTF-8 byte-order mark. See Plugins and Marketplaces.
  • Agent teams: a teammate’s final answer now reaches the lead in the idle notification instead of a content-free “available” notice (v2.1.251). See Agent Teams.

Breaking and behaviour changes

  • shift+enter in the agent-view dispatch input inserts a newline; ctrl+enter dispatches and attaches (v2.1.248).
  • Cross-session peer messages collapse to a one-line preview; Ctrl+O expands (v2.1.247).
  • Claude in Chrome browser actions always go through Claude Code’s permission checks, including with telemetry disabled (v2.1.251).
  • Syntax highlighting removed for 1c, gml, isbl, mathematica, maxima and sqf; the binary is 2.5 MB smaller (v2.1.251).

The v2.1.251 security batch

The five fixes that open the v2.1.251 notes:

  • Symlink swap in file tools. Read, Write and Edit followed a symlink swapped inside the working directory after the permission check, so they could read or write outside the approved location — a time-of-check/time-of-use race.
  • Plugin path traversal. A command declared in a marketplace entry could point outside the plugin directory; such paths are now rejected with a path-traversal error.
  • Beta tracing scope. Project settings could turn on detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint could bypass an OTLP collector pinned by managed settings or a host app.
  • Workflow scriptPath read. The Workflow tool read — and quoted in error messages — a scriptPath outside what the session may read, before the permission check ran.
  • Grep/Glob deny rules. Read(...) deny rules weren’t applied to files reached through a symlinked search path.

Four of the five are a boundary checked against the wrong representation of a path (a symlink, a traversal, a lower settings scope); the Workflow one is an error path that read the file before the check. Each needs an attacker who controls the working directory, plugin files or project settings, so they matter most in shared CI, with third-party marketplace plugins, and on untrusted content, and little on a trusted single-user machine.

Notable fixes

  • Prompt cache: a miss roughly once an hour in long sessions after an OAuth token refresh re-rendered tool definitions (v2.1.248).
  • Security: symlink swap after permission check (v2.1.251); Grep/Glob and symlinked Read(...) deny rules (v2.1.251); OPTIND=1/0-style arithmetic assignments (v2.1.251); third-party gateway API key sent with telemetry to Anthropic (v2.1.246); /ultrareview and locally seeded cloud sessions uploading uncommitted edits to credential-like files (v2.1.248). Full v2.1.251 list above. See Ultrareview.
  • Auto mode tool calls denied as “temporarily unavailable” on very large sessions — the safety-check deadline now scales with prompt size (v2.1.246).
  • Resumed sessions failing every turn with a 400 when saved history contained tool blocks written by a third-party API proxy (v2.1.246).
  • Also v2.1.246: /fork from an already-forked or backgrounded session starting with an empty conversation; markdown rendering switched off for a whole message when its first 500 characters had no markdown; background sessions failing to open with “Couldn’t start the background service … EACCES” while another Claude Code process was re-installing the npm package.

Try It

  • Update now if you run Claude Code in shared CI, with third-party marketplace plugins, or on untrusted files. The v2.1.251 batch closes permission bypasses that matter most there.
  • Add a PreModelSwitch hook if a mid-session model switch has ever cost you a cold cache: the SessionStart resume payload now carries the estimated re-cache cost to decide with.
  • Check /cost after a long session to see the prompt-cache hit ratio and whether the cache went cold. Two causes of misses fixed this week: tool definitions re-rendered after an OAuth token refresh, and the ScheduleWakeup tool definition changing on --resume once an account entered usage overage (both v2.1.248).
  • Audit scripts that set CLAUDE_CODE_SUBAGENT_MODEL. From v2.1.251 an agent’s own model: wins; set CLAUDE_CODE_SUBAGENT_MODEL_FORCE (v2.1.257) if you need the old override, or remove model: from the agent definitions that should follow the variable.
  • On a seat-based Enterprise plan, check which model new sessions start on. It is now Opus 5; ANTHROPIC_DEFAULT_MODEL (added in Week 34) sets the start model, and a /model pick still overrides it and persists.
  • Try claude --restricted for sessions that should only read and edit files in one directory; add back a single tool with --tools.
  • On Bedrock, Vertex AI or Foundry, try /loop and SendMessage. Neither needs the Anthropic API any more; the patterns in Scheduled Tasks apply.
  • Run /claude-api cost-optimize on a project whose API spend is growing. Changing one lever at a time lets you attribute each saving.
  • In the Desktop app, run /resume to continue a terminal session there.
  • If you keep project env entries for TMPDIR or CLAUDE_CONFIG_DIR, move them to your shell or user settings; project settings no longer apply them.

Open Questions

  • v2.1.249 has no GitHub release page. Whether it shipped through another channel is not stated.
  • v2.1.250 is unitemized (“Bug fixes and reliability improvements”).
  • What does “estimated re-cache cost” measure — tokens, dollars, or both? The release note names the field but not its unit. Does it account for the warm/cold cache tiers?
  • What does session staleness measure — time since the last turn, or since the session was backgrounded? Neither the changelog, the GitHub release nor the 2026-09-20 hooks-page snapshot names the input fields; an earlier version of this digest gave them as sessionStaleness and estimatedRecacheCost without a source.
  • What matcher and block-decision format does PreModelSwitch take? None of the sources here documents its input or output schema.
  • Does desktopSessionCleanupPeriodDays have a default? The note says it caps the exemption but gives no default value.
  • Which release shipped the digest’s other wins (modelPicker, promptCacheTtl, the Loops breakdown, modelPricing, Console sign-in, the zstd installer)? v2.1.243 is the likely candidate by elimination; no source itemises it.
  • When did SendFeedback ship — v2.1.238 (the digest’s minimum version) or v2.1.247 (the changelog entry)?
  • Does --restricted remove MCP tools? The sources say it removes the built-in tools that run commands or code; MCP servers can run code on their host, and neither source addresses them.
  • What triggered the v2.1.251 security batch? No CVE, external report or incident is named. Five boundary fixes landing together suggests a deliberate audit.
  • Was the lost teammate final answer a regression from the v2.1.232 subagent-forking changes? Not confirmed.
  • How does experimental.cacheTtl interact with subagentPromptCacheTtl? The note says the frontmatter value applies “when no subagent TTL setting is configured”, which implies the setting wins; not stated directly.

Graph View

Backlinks