From the toolroom

What the release notes didn’t say

Today’s docs are almost entirely a voice-and-tone rewrite (passive → active) with no changelog behind them, but a genuinely new Desktop feature slipped in under that cover. A new ‘Work across sessions’ section documents Claude listing, reading, renaming, messaging, and archiving your other Code tab sessions from plain-language requests like ‘what did the API session conclude?’ or ‘tell the payments session the schema changed.’ It only sees sessions the desktop app runs itself — local, SSH, and WSL — never cloud, CLI, or VS Code sessions, and skips archived ones and the session you’re asking from. Three safety rails ship with it: archiving always shows an approval card in every permission mode (Bypass permissions now lists this as an explicit exception), and an unwatched session such as a scheduled-task run can neither send nor receive messages (a limitation now spelled out on the scheduled-tasks page too). Separately, the Agent SDK’s todo-tracking doc quietly redefined its ‘Removed’ lifecycle step: a todo is now deleted explicitly with status: "deleted" in a TaskUpdate call, not auto-purged when its group completes.

What the release notes didn’t say

There is no changelog today, so every one of these is a doc-only change that shipped without an announcement. The quietest and most consequential: the advisor page walked back its promise that model aliases resolve to “the latest version of each model.” They now resolve to “Claude Code’s built-in default version for each model family, which advances with new Claude Code releases” — meaning an un-updated Claude Code will keep handing you an older model behind opus/sonnet/fable even after a newer one ships. The admin-setup page also removed the inline org-shared-environments guidance, pointing instead at a new cloud-environments page and moving the default-environment choice to its own admin URL. On the SDK side, the checkpointing docs newly admit two things that were previously unstated: subagent edits are never tracked or restored, and rewind now skips non-regular files rather than clobbering through links — a safety fix (v2.1.216+) surfaced only in prose. The hooks reference gained a DirectoryAdded event and a full rewrite of timeout semantics clarifying that older versions (pre-2.1.208/2.1.210) would stall unattended sessions on a PreToolUse or UserPromptSubmit hook timeout.

What the release notes didn’t say

There is no changelog entry today — everything below is the docs catching up with behavior that already shipped. The headline is that Claude Desktop can now authenticate against the same self-hosted Cloud gateway as the CLI: point Desktop’s bootstrapUrl at <listen.public_url>/user/bootstrap, and the gateway derives its model list, disabled tools, egress allowlist, and OTLP endpoint from the matched policy’s cli block. It is opt-in and fails closed — /user/bootstrap returns 404 unless a policy carries a desktop key, with rejections logged as desktop_bootstrap.denied. A new desktop policy block also gates Desktop-only features (tab visibility, local MCP, auto-updates, a persistent banner) with no CLI equivalent. The scattered min-version fences newly written into the gateway tables (v2.1.203 for Desktop, v2.1.207 for env-free auto mode, v2.1.206 for public-endpoint login) reveal these were binary features documented after the fact.

For SDK users, the Python ResultMessage now surfaces terminal_reason to tell a clean completion from an interrupt, and model_usage is properly typed as ModelUsage with two new keys — provider and canonicalModel — that let you see which upstream and pricing identity served each model. No pages, flags, or settings were removed.

What the release notes didn’t say

Today is a doc-only day with no changelog delta, but the error and env-var pages moved. Two refusal messages were retired: the wordy usage-policy refusal and the cybersecurity-topic warning are both now version-capped at v2.1.218, replaced by shorter strings (<model> can't help with this. Start a new session to continue and <model>'s safeguards flagged this message). If you match on refusal text in scripts or wrappers, update your patterns. Separately, the subagent nesting default finished a round trip: 5 layers (v2.1.172–216, unchangeable) → 1 (v2.1.217–218, off by default) → 3 (v2.1.219). The CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH knob flipped meaning with it — 1 now disables nesting rather than being the locked-off default, so anyone who set the flag during the brief opt-in window should recheck it.

What the release notes didn’t say

With no changelog today, every change here shipped silently in the docs. The headline is a quiet correction: agent view previously claimed to apply “each” configuration flag to itself, but the docs now scope that to just --settings and --plugin-dir — everything else is only passed through to dispatched sessions. The v2.1.200 history entry got the same treatment, narrowing “configuration flags placed after agents, such as --plugin-dir” down to a single --plugin-dir flag. If you relied on other flags self-applying to agent view, that was never really the behavior.

Two other undocumented additions: fullscreen rendering now maps a double-press of Ctrl+L (within two seconds) to /clear, with a hint on the first press — worth knowing before you accidentally wipe a conversation. And plugin marketplace manifests gained an optional url field on owner and author objects.

Finally, CLAUDE_CODE_GIT_BASH_PATH behavior changed in v2.1.219: a nonexistent or wrongly-named path (anything but bash.exe/sh.exe/bash/sh) is now ignored with a --debug warning and normal auto-detection, rather than the previous hard exit at startup. This closes a Windows footgun where Git for Windows’ git-bash.exe launcher was accepted uncritically as the shell.

What the release notes didn’t say

The day’s most interesting moves aren’t in the changelog. The self-hosted runners program is being quietly walked back in the docs: the Cloud-on-the-web page removed the sentence pointing orgs to manage runner pools from the Cloud environments page, and — more tellingly — a bullet about the runner post-session lifecycle hook was deleted from the already-published v2.1.169 changelog entry, not just from current docs. Editing history is a stronger deprecation signal than any release note.

Auto mode’s denial UX also quietly regressed. The v2.1.193 feature that showed the classifier’s written reason for each denial is now, in v2.1.208+, usually just the fixed text Blocked by classifier — the classifier scores severity internally rather than explaining itself, and you can’t configure which behavior you get. Separately, the Agent SDK docs gained an unannounced budget-cap change (subagent spend now counts toward the cap; hitting it kills background subagents and fails new spawns with Budget limit reached, v2.1.217+), and agent view gained a flag-ordering gotcha where --add-dir/--mcp-config before agents breaks claude agents --json.

The changelog itself

Opus 5 arrives as the default Opus model everywhere — direct API, Bedrock, and AWS aliases all now resolve opus to claude-opus-5 — with 1M context and $10/$50 fast mode. Opus 4.7 lost fast-mode support, subagents nest to depth 3 by default, and dynamic workflows now default to a medium size guideline (aim for <15 agents).

What the release notes didn’t say

There was no changelog today, which makes the doc edits the whole story. The headline is a pair of default flips buried in checkpointing.md and code-review.md: as of v2.1.218, /code-review runs as a background subagent with its own context window instead of filling your conversation, and forked skills now run in the background by default rather than always in the foreground. Both change day-to-day behavior without a corresponding changelog line. The consequence worth internalizing is the new Subagent edits not restored section — background subagent edits, including /code-review --fix, sit outside your checkpoints, so /rewind silently leaves them in place and you must revert with git. Only a foreground context: fork skill edits your tree during your own turn and stays rewindable. Two quieter items round it out: the /code-review /fix-issue 123 parsing changed so a stacked command is now read as target text rather than expanding as its own skill, and the Claude Security page added a note that Fable 5’s classifiers will block certain activities and auto-downgrade to Opus.

Among the version-tagged catch-ups, the practical one is --max-budget-usd: subagent spend now counts toward the cap, and from v2.1.217 the cap actually enforces — new subagents fail with Budget limit reached and running background subagents get stopped. You can also now kick off a cloud ultrareview from CI with claude -p '/code-review ultra'.

What the release notes didn’t say

The headline reversal isn’t in the 2.1.218 changelog at all — it’s a doc rewrite covering a v2.1.217 default flip. Subagents used to spawn their own subagents by default (up to five layers, v2.1.172–2.1.216); now that’s off unless you opt in via CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH. If your workflows relied on deep agent trees, they silently stopped nesting. A brand-new page, claude-security.md, ships an entire vulnerability-scanning plugin with no changelog mention — worth knowing it counts against plan usage and runs best in auto mode. Smaller silent changes: the login renewal warning now fires at three days instead of five; costs.md adds a ‘Why usage climbs’ explainer plus /usage behavior flags (long context, cache misses at ≥10%); teleported cloud sessions now get their own local copy that no longer syncs back to claude.ai; and the desktop ‘Remote’ session type was renamed ‘Cloud’. Subagent tool inheritance wording also tightened — ‘all tools’ became ‘every tool available to subagents,’ filtered for background runs.

Among the changelog items that actually change daily practice: /code-review now runs as a background subagent so it stops flooding your conversation, context: fork skills default to background execution, and agent names may no longer contain : (reserved for plugin namespacing).

What the release notes didn’t say

The changelog for v2.1.217 is a long list of fixes, but the most consequential behavior changes landed silently in the docs a version or two earlier. The commands page now notes that, since v2.1.215, /verify and /code-review run only when you invoke them — Claude used to be able to fire them autonomously. That’s a real narrowing of agent initiative and it appears nowhere in a changelog entry. Separately, checkpointing gained a new failure mode disclosure: /rewind now skips symlinked and hard-linked paths with a Restored the code, but skipped N files warning, and the docs admit that before v2.1.216 it wrote and deleted through those links without any warning — a quiet fix for silent data loss. Chrome integration was also walked back: API-key and long-lived-token sessions can no longer enable it (they previously could, only to 403 on every connection). Smaller undocumented shifts: --channels now accepts a Console API key rather than Claude.ai auth alone, both channels flags are hidden from --help, --settings files are capped at 2 MiB, and CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH (v2.1.214) makes OTEL body truncation configurable.

Of the changelog items proper, the two worth practitioners’ attention are structural guardrails on fan-out: subagents are now capped at 20 concurrent (override via CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) and no longer spawn their own nested subagents unless you raise CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH.

What the release notes didn’t say

The day’s docs diff is dominated by a change the changelog never mentions: a site-wide URL migration moving every page from /en/... to /docs/en/.... Hundreds of cross-links were rewritten in bulk (accessibility, admin-setup, and beyond), so any external link or bookmark to the old /en/ paths is now stale. Buried inside that mechanical churn is one genuine content edit worth catching: the admin login-enforcement table now states that forceLoginOrgUUID’s organization restriction covers the terminal, VS Code extension, and Agent SDK except Claude apps gateway sign-in, which doesn’t authenticate against an Anthropic organization. That’s a documented enforcement gap admins should know about, and it shipped without a changelog line.

Among the public 2.1.216 items, the ones that actually change day-to-day work are the quadratic message-normalization fix (the real culprit behind multi-second stalls in long sessions), the new sandbox.filesystem.disabled setting, and a cluster of symlink/hard-link path-safety fixes across .claude writes, /rewind, and worktree-isolated subagents.

The one changelog item that matters day to day (2.1.215) is a behavior removal: Claude will no longer trigger /verify or /code-review autonomously. If you were leaning on those skills firing automatically, they now require an explicit call.

What the release notes didn’t say

The more interesting changes shipped silently in the docs. The VS Code extension’s minimum supported version was rolled back from 1.98.0 to 1.94.0 across three spots (requirements, install troubleshooting, Spark icon) — a compatibility loosening with no changelog mention. New MCP guidance now warns that claude mcp add never validates credentials, so placeholder or wrong tokens are accepted at add-time and only show as failed when you later run /mcp. Install troubleshooting picked up specific 403 (proxy/network filter or unsupported region) and 5xx (transient) diagnoses instead of the old catch-all “network is blocking.” Security-conscious edits also landed: the Cloud gateway deploy guide now tells you to redact audit streams and developer identities before filing public issues, and the heapdump docs clarify that the -diagnostics.json file is the safe one to attach. Finally, /desktop handoff is now documented as macOS and x64-Windows only.

What the release notes didn’t say

The SDK hooks reference grew by nine events that the changelog never mentions — StopFailure, PostCompact, PermissionDenied, TaskCreated, Elicitation, ElicitationResult, InstructionsLoaded, CwdChanged, and FileChanged — all TypeScript-only. If you build with hooks, several of these are genuinely new surface area (watch a file, react to compaction completing, catch classifier denials, audit which CLAUDE.md files load).

The quieter behavior change matters more: the hook timeout default of 60 seconds was removed. Omitting timeout now yields per-event defaults — 10 minutes for most events, 30s for UserPromptSubmit, 10s for MessageDisplay. Any hook that leaned on a 60-second cap now runs under a much longer leash. Two new events (StopFailure, FileChanged) also use a stricter matcher grammar: only | separates alternatives, and FileChanged’s matcher doubles as the literal watch list of filenames.

Separately, forceLoginMethod/forceLoginOrgUUID enforcement expanded beyond the terminal to the VS Code extension, Agent SDK, setup-token, and install-github-app as of v2.1.212, and claude setup-token tokens no longer pull in claude.ai MCP connectors.

What the release notes didn’t say

The headline change is a removal the changelog is silent on: Fable 5 has been walked back as an advisor model. Where the docs previously told you the version needed to use Fable 5 as the advisor, they now state Claude Code simply doesn’t offer it — the picker shows it as a dimmed Fable 5 (temporarily unavailable) row, and --advisor fable is rejected outright. A Fable 5 main model still works but runs without an advisor, and a remotely configured rollout decides when the option comes back. Two smaller advisor details also surfaced only in the docs: the --advisor flag is now hidden from claude --help, and turning the advisor on prints an experimental-token-usage notice. Separately, the admin docs added a processWrapper ‘corporate launcher’ control for wrapping background-agent processes, and the Agent SDK picked up new Hosting and Session-storage pages (with a session_store adapter for serverless resume) — neither mentioned in the changelog.

Among the published changes, two matter day to day: /fork now copies your conversation into its own background session while the former in-session subagent becomes /subtask, and a plan-mode bug that let file-modifying Bash commands run without a permission prompt was fixed. New session caps also landed — 200 WebSearch calls and 200 subagent spawns per session — and the Task tool’s mode parameter is now deprecated and ignored.

What the release notes didn’t say

The changelog (2.1.211) is full of fixes but omits the day’s substantive doc changes. Cost tracking gained a table making explicit that the SDK usage field counts only the top-level loop and silently drops subagent tokens — a real accounting trap for anyone building supervisor/subagent workflows, where only total_cost_usd and modelUsage include the whole tree. Admin lockdown grew two undocumented capabilities: login enforcement (forceLoginMethod, forceLoginOrgUUID), which blocks ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN/apiKeyHelper sessions at startup while leaving cloud-provider sessions alone, and pluginSuggestionMarketplaces for allowlisting plugin suggestions. A new cross-cutting rule threads through every SDK permissions page: connector tools an org sets to ask now fall through to your callback in all modes and are hard-denied in dontAsk — allow rules no longer override org policy. Also newly documented: the 25k-token MCP output limit that spills to a file, and scoped Read/Edit path rules where //path means an absolute filesystem path and a single leading slash anchors at the rule’s source. Separately, the advisor page quietly added “Claude Platform on AWS” to the list of surfaces where the advisor tool isn’t available. No pages or flags were removed today.

What the release notes didn’t say

The headline change is a removal you won’t find called out: across agent-view.md, the long-standing ‘merge or push changes before deleting’ warning has been pared back to ‘commit’ everywhere. That’s not a copy edit — it reflects a behavior walk-back. Deleting a session (via Ctrl+X twice, claude rm, or the shell) now refuses to remove a worktree with commits that aren’t pushed anywhere, keeping the session row alongside it and naming the kept path and reason. The destructive-by-default delete that could vaporize unpushed commits is gone. Several other changes rode in under doc version stamps (v2.1.153–208) with no entry in the 2.1.210 changelog: the UserPromptExpansion hook, background sessions refusing /install-github-app and the /mcp settings list, /model <name> now persisting as the new-session default, screen-reader mode inheriting through CLAUDE_AX_SCREEN_READER on relaunch, and admin-managed organization-shared cloud environments for Claude Code on the web.

Of the changelog items proper, the ones that touch daily practice are the fix for isolation: 'worktree' subagents being able to mutate the main checkout, the new startup warning steering Write/Glob/NotebookEdit permission rules toward Edit/Read, and hook-timeout handling that no longer misreports as a user rejection and stalls unattended sessions.

What the release notes didn’t say

The changelog is dominated by screen reader mode and a long list of fixes, but the sharper changes are in the Agent SDK type surface. The AgentInput schema lost two fields outright — resume?: string and max_turns?: number — and subagent_type went from required to optional; mode also gained an auto value. On the output side, the sub_agent_entered result variant (interactive subagents) was removed entirely and replaced by remote_launched, reframing that code path around tasks dispatched to remote cloud sessions. None of this appears in the changelog, so SDK consumers reading only the release notes won’t know their resume/max_turns calls or sub_agent_entered handling just fell off the documented API. The advisor page separately deleted its v2.1.98 or later requirement and the plan-availability annotation, softening the feature’s gating in the docs.

Several behavior changes also shipped silently: MCP servers that hit an OAuth challenge now degrade to needs-auth and run without their tools; agent-team mailboxes are now validated JSON files that drop malformed entries instead of looping errors; SDK subagents with SendMessage now start with a roster of named peers; and the terminal_reason enum grew a batch of new values (api_error, budget_exhausted, malformed_tool_use_exhausted, and more). A new accessibility page and an admin-setup section on WSL Desktop sessions (wslInheritsWindowsSettings, CrowdStrike Falcon guidance) round out the undocumented surface.

What the release notes didn’t say

There was no changelog today, so every one of these shipped silently. The quiet removal is on Linux: the troubleshooting page no longer offers Linux users a download link at all — where macOS and Windows keep their one-click installers, Linux now gets ‘install with apt’ instead. In parallel, the desktop-linux page walked back its simple ‘download the .deb from claude.com/download’ instruction and replaced it with a package-pool curl that scrapes the apt repository index for the newest build. The practical read: Anthropic wants Linux desktop installs to go through apt so they stay updated, and is deliberately de-emphasizing the standalone-file path. Separately, the Agent SDK’s MCP page gained a cross-reference to MCP output limits — MAX_MCP_OUTPUT_TOKENS, a persist-to-disk fallback for oversized tool results, and a new anthropic/maxResultSizeChars per-tool annotation — surfacing behavior that practitioners hitting large MCP responses will want to know about but that never appeared in a changelog.

What the release notes didn’t say

The loudest change is one the changelog only half-tells. The 2.1.207 notes say Auto mode no longer needs the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on cloud providers — but the docs go further, stripping ‘research preview’ from Auto mode’s description in the glossary, the desktop page, and how-claude-code-works. Read together, Auto mode has effectively graduated on the Anthropic API too, and nothing in the changelog says so. Two other silent additions matter for practitioners: the SDK gained a SystemPromptFile type mapping to a new --system-prompt-file CLI flag (for prompts too large to survive argv length limits), and the permissions docs now admit that read-only shell commands such as ls and cat run with no prompt at all — you restrict them with sandbox denyRead rules. The ‘Manual’ permission-mode wording was also quietly softened from ‘asks before each action’ to ‘asks before file edits and most shell commands.’

Among shipped-and-documented items, the security-relevant ones lead: a plugin shell-injection fix rejecting ${user_config.*} in shell-form commands, a fix for non-interactive runs being silently recorded as having consented to remote managed settings, and Opus 4.8 becoming the default across Bedrock, Vertex, and Claude Platform on AWS.

What the release notes didn’t say

The published changelog for 2.1.205–2.1.206 covers /cd suggestions, a CLAUDE.md-trimming /doctor check, and a pile of fixes — but the more interesting movement is in the docs it didn’t touch. Three things were removed or walked back: plan mode’s allowedPrompts field is now marked deprecated, no longer used (Claude Code still accepts it only so existing transcripts validate); /doctor’s summary of the daemon-status check was deleted outright; and agent view lost the done/total parallel-work count from its row summaries. Separately, the SDK grew an entire interrupt-receipt protocol — interrupt() can now resolve with an SDKControlInterruptResponse.still_queued list, feature-detected via a new open-ended capabilities array on SDKSystemMessage — plus name/body fields on peer message origins, none of which surface in the changelog. Two silent behavior changes are worth noting for anyone relying on them: an invalid --json-schema now fails the run at startup instead of degrading to unstructured text, and auto mode’s visibility classifier was narrowed to read commands but not their output, so evidence a repo is public must now come from your own words, not a gh repo view result.

What the release notes didn’t say

The 2.1.205 changelog is all agent-view polish, but the docs diff exposes a much larger, mostly undocumented v2.1.203 overhaul of how background sessions source their environment. The headline reversal: a gateway ANTHROPIC_BASE_URL exported in your dispatching shell now reaches the session’s worker (along with ANTHROPIC_CUSTOM_HEADERS and the credential exported beside it) when the supervisor shares that gateway environment. Before this, the base URL was dropped while the API key was kept — so the gateway’s key was sent to Anthropic’s default endpoint and every request failed with a 401. The dispatching shell’s PATH is now forwarded the same way. On the removal side, agent view’s empty-state onboarding hint (the one with example prompts) was deleted in favor of plain section headers, and the hint that appeared below a solitary session row is gone as well. The ←-to-background flow also stopped silently restarting in-flight subagents, and effortLevel set in settings.json now follows a session across backgrounding and restarts instead of being frozen at dispatch.

Among the actually-listed 2.1.205 items, two matter for practitioners: auto mode now blocks tampering with session transcript files, and background-task notifications explicitly state that no human input occurred — closing a hole where a fabricated in-transcript approval could be acted on. /doctor is now a full setup checkup with /checkup as its alias.

What the release notes didn’t say

The changelog is almost entirely background-agent and TUI fixes, but the docs tell a different story. The biggest quiet change: auto permission mode is no longer TypeScript-only. The “(TypeScript only)” tag was removed from the agent-loop, permissions, quickstart, and Python reference pages simultaneously, and "auto" was appended to Python’s PermissionMode literal — meaning the Python SDK now supports model-classified tool approval with zero changelog acknowledgement. Second, the custom-tools error-handling docs were rewritten to contradict their prior guidance: an uncaught exception used to “stop the agent loop” and fail the whole query; now the SDK’s in-process MCP server catches it, converts it to an error result, and the loop continues — so returning isError: true is now about composing a better message, not keeping the query alive. The same page newly admits a Python/TypeScript asymmetry: the Python SDK drops audio and binary-resource blocks from tool results and only logs a warning. None of these appear in the changelog.

Also landing silently: scoped hook-matcher naming for plugin-bundled MCP servers (mcp__plugin_<plugin>_<server>__<tool>), and expanded PermissionRequest subagent fields (agent_id/agent_type) in Python. Of the actual changelog items, the ones worth acting on are the 2.1.203 background-agent fixes — sessions were leaking a stale PATH and dropping shell-exported ANTHROPIC_BASE_URL (sending keys to the wrong endpoint with a 401), and worktree-isolated subagents were running commands in the parent checkout.

Most of this release is friction removal for people already living in Claude Code day to day. The Remote Control path finally behaves the way you’d expect from a phone or browser, and session resume stops punishing anyone with a worktree-heavy repo. The /review split is worth internalizing: the plain command is fast again, and the heavyweight multi-agent review now lives behind /code-review with an explicit effort level.