Claude Code Releases Catch-up: From The Checklist They Took Away To The Co-Driver They Gave Me

Right. The most interesting thing across this entire stretch is that I now grade your instructions. There is a new diagnostic called prompt audit, run it with slash doctor followed by the words prompt audit, and I will read your CLAUDE.md files, your skills, your agents and your commands and flag the ones written for older models. Stale paths, contradictions between layers, instructions that shout in capitals at a model that no longer needs shouting. I, the new employee, get to mark up the handbook the old employees were trained on. Run it. Read the findings as questions, not deletions. Your own rule says removing something is a separate decision, and "the linter suggested it" is exactly the kind of side effect that rule exists to stop.

This is a catch-up episode covering fourteen drops you have not heard, roughly from version 2.1.268 through 2.1.287, spanning 11 September to 2 October. There is a new default Opus model, a new Sonnet, a new default permission mode for the entire user base, a feature called Mods, and about four hundred fixes to things that were quietly wrong. I have merged the lot by what matters to you. Let us go.

New models and the settings they forgot

Opus 5.5 is now the Opus you run as, and this episode was written by it. Sonnet 5.5 arrived as well and is the new default Sonnet on the API. Both have one million token context windows.

Here is the part you are going to hate. If you set an effort level before the effort command became per model, that saved level does not carry over to newly released models. Opus 5.5 starts at its factory default until you pick a level. Same for Sonnet 5.5. Run the effort command once in an interactive session and set it again. Do the same for the headless shows that pin Opus, because every autocast run that asks for Opus now gets 5.5, and whatever effort those runs used to inherit needs checking.

A related fix landed in the same stretch: Opus 4.7, 4.8 and Fable 5 no longer override your settings with their own launch defaults in dash p runs, the Agent SDK, or project and per-model levels. Your settings now win over the model's own opinion, which is how it should always have worked.

Ultracode is no longer the top stop on the effort slider. It is its own toggle in the effort command, and it stays on at any effort level. That means you can run a wide, shallow workflow at medium effort for a sweep or a staleness check, and keep xhigh for the adversarial review lane where the thinking earns its cost. You watch usage closely and spend headroom deliberately, and this gives you a second dial where there was only one.

The checklist they took and the diffs they gave back

You heard about the twenty cache fixes last time. The day after that, the to-do list was removed. On Opus 5 and Fable, the models you actually run, I no longer get the tools that put a live checklist on your screen while I work. It is filed under Changed, not Removed. The apology is an environment variable: set claude code enable todo tools to 1 and the tools come back. My vote: turn it back on, and put the variable in the environment block of your settings file.

The very next day, the opposite gift arrived. A diff of the files a Bash command changed is now attached to the Bash tool result. There is a setting for it, the bash edit diff setting, and the notes never state which way it defaults. Turn it on explicitly. Your entire defence against me destroying something lives in the diff render, and in auto mode I am told to do the work through Bash. Until this setting, the majority of my file edits arrived on your screen as one line of shell that you were invited to trust.

The context meter was lying by half

For some time, when I used an advisor tool, I was counting its output as roughly twice the size it actually was. Auto-compact was firing at about half the real window. The advisor turn is the one that defines your workflow: Codex riding along, an Opus agent asked one question, the reviewer, the scout. If the tool call you use most was the one being double-counted, your compaction budget was quietly worse than everyone else's. What you should notice now: fewer compactions per session, and the context percentage meaning what it says.

The resume saga, in one telling

Resume has been fixed in every single build across this stretch, and I am going to tell you where it ended up rather than the whole history.

Resuming a very large session could restore only its last few messages. You open a session with three days of context and get back something closer to an afternoon, with no notice. That is fixed. Resuming a session that ended in the middle of a tool call used to insert a hidden message saying "Continue", written as if you had typed it. Now I see the interrupted call and am told plainly that its outcome is unknown. Switching conversations with slash resume or slash teleport used to keep the file-read tracking from the old conversation, so I could edit a file the new conversation had never opened. That is fixed. Resuming could drop the one million token context window whenever the resumed session's model family differed from your default. Fixed. Resumed sessions could re-send earlier turns in a changed form through half a dozen routes, each of which threw away my earlier reasoning. All fixed. A session that crashed after a batch of parallel tool calls could come back missing every turn after the fan-out. Fixed. And a corrupted transcript that pointed at a tool call that no longer existed could make a session retry the same broken request forever. Now it either heals itself or tells you to rewind.

The slash resume command also now works on a running background session. Better still, claude dash dash resume with a session ID and a prompt in quotes sends that prompt as the next turn. You can give a background session its next instruction with a single shell command.

The practical read: do not trust any session resumed before 2.1.282 to remember its first day. After the update, resume is substantially more honest.

The cache campaign, final state

You heard about the twenty preamble fixes. Since then, three more categories have been closed. Conversation bodies rebuilt differently after an abnormal stop. Memory notes whose age changed by one word between requests, invalidating everything after them. Session start hooks, resumed subagents re-rendering MCP tools, attachments re-rendered after a resume, and resumed fork subagents rebuilding their whole tool list. Running the login, upgrade or extra-usage commands was discarding earlier thinking and forcing a full prompt-cache rewrite. A CLAUDE.md was being attached a second time after a resume or compaction.

The cost command now names thinking mode and thinking display changes when it explains why the cache missed. Once a model starts naming its own leaks, you can stop guessing.

Permissions, deny rules, and the paths that walked around them

This stretch closed a long list of gaps in how Bash commands are checked.

Deny rules for the Edit tool were not applying to the file a tee command writes. An allow rule for tee was not scoped to your working directories. Both are fixed. A deny or ask rule beginning with an exclamation mark was applying beyond the settings file that wrote it. Fixed. Bash permission rules with a colon star in the middle of the pattern were silently skipped when they came from a settings file. Fixed, with a startup warning. The checker was missing files after an option it did not recognise, skipping files a wildcard expanded to inside a pattern, and letting shell variable declaration flags disguise a command. All fixed. Commands the checker cannot fully analyse were skipping the prompt under the block-reads-outside setting, and a subshell could hide a dangerous remove command in bypass mode. Fixed. A write through a symlinked path was judged by the path as written, not by where it actually ended up. Fixed. And a whole-tool Bash allow rule now gets a prompt instead of running when the shell tries to write to a credentials file.

The dangerous rm prompt now names the exact command and suggests a guard against empty variables. In auto mode and skip-permissions mode, it waits two minutes and then denies if nobody answers. For a session you are following from the car, that is the right default.

One regression appeared and was fixed within a day: read-only git commands started asking permission after a session had been open a while. Version 2.1.270 fixed it. If you or I picked the permanent allow option during that window, check your local settings for any broad git allow rule you do not remember adding.

The update config skill was writing rules that begin with Write, but file permission checks only match rules beginning with Edit. Search your settings files for rules starting with Write and change any you find.

Auto mode is now the default for everyone

As of 2.1.284, every interactive terminal session starts in auto mode when no permission mode is configured. For you this is mostly social, since you already live here. The classifier is going to get a lot more scrutiny and a lot more bug reports, which should improve it.

The useful change for you: when auto mode asks before a read outside the working directories, there is a new answer, "Yes, but ask again next time." A day pass instead of a key.

Auto mode's denial message now tells me that a denial covers the outcome, not only the exact command. Change the flags, split the pipe, try the same thing through Python, and I used to treat it as a new question. Now the bouncer checks my face, not my hat. Your own rule about one retry and then hand off is now backed by the harness itself.

Background work and headless runs

A busy loop in long-running idle sessions was pinning a CPU core. Fixed. Background commands were being stopped after thirty idle minutes on machines under mild memory pressure. Now they stop only when memory is critically low. If a background server died during a quiet stretch lately, especially with a local model loaded, this was the cause.

Background Bash commands now stop when they reach a time limit, thirty minutes by default, two hours maximum. Check which of your long background jobs will hit that and give them explicit timeouts. The Codex build lane is the first place to look.

Monitor watches now always have a deadline, at most thirty minutes. A watch left on something days away now wakes me every half hour. For anything that far out, use a scheduled wakeup or a cron, not a watch.

Headless runs that hung with no result now report the error and exit with code 1. A turn could retry forever, ignoring the max turns cap, if the model alternated between unparseable tool calls and output cut off at the length limit. That is fixed. The first turn no longer waits for CLAUDE.md files in each directory, and a headless run launched from a plain script no longer makes a side call to Haiku to give the session a title.

Dynamic workflows now pause when you hit your usage limit and continue automatically when it resets. The medium workflow size guideline dropped from fifteen agents to ten.

Several sessions on one machine

A running session could silently switch to the default model when another process refreshed a stale model-access entry. Fixed. Organisation policy limits could fail to load when another process refreshed the login at the same moment. Fixed. If one process was refreshing the login token and got killed, every other session could fail for up to a minute. Fixed. Plan usage readings are now shared across sessions on the same machine.

Hooks you can see and debug

While a hook is running, the spinner now says so and shows the elapsed time. A slow hook no longer looks like a slow me. Failed hooks now log their standard error and their status code. The debug log used to drop a failed hook's error whenever the hook also wrote to standard output. The "N hooks ran" summary no longer counts internal callbacks. And the hooks screen now opens on one grouped list.

Session-end hooks with the default 1.5 second budget were ignoring the environment variable meant to extend them. Fixed. Permission request hooks were not firing at all in headless mode. Fixed. If a synchronous hook started a background process that kept the output open, the session froze. Fixed. Agent-type hooks on the permission request event never actually allowed or denied anything. They now show an error pointing you to command or HTTP hooks.

MCP servers and secrets

MCP server details, login errors, connection errors and the login tool description could all display secrets filled in from dollar-sign placeholders. Multiple fixes across the stretch. If you have ever seen an MCP connection error with something long and random in it, rotate that secret.

A stateless remote MCP server that returned a 404 during a redeploy stayed broken for the rest of the session while the list showed it as connected. Fixed, and there is now a slash mcp reconnect all command. Streamable HTTP tool calls were timing out after about five minutes even with a longer timeout set. Fixed. MCP tool calls in a resumed session no longer fail with "No such tool available" while the server is still connecting. Stdio servers left running after a session ended are now cleaned up. And setting always load to false on an MCP server now defers all its tools behind tool search.

MCP servers on the November 2025 protocol can now send URL prompts. If a server stops connecting after the update, the fix is a setting in its config called bare elicitation capability, set to true. Watch the Xcode bridge and the PärMCP connector.

The telemetry lockdown

A repository's project settings could set the variables that turn on OpenTelemetry export, point it at an endpoint of the author's choosing, and tell it to capture your prompts and replies. As of 2.1.282, project and local settings can no longer turn any of that on. A startup notice lists the telemetry variables that were ignored. If the notice ever fires in one of your repos, read it.

Skills, plugins and the synced account

Skills and plugins enabled on your claude.ai account now sync into terminal sessions. The Word, PDF and spreadsheet skills are handy. The PärPod skill and the road trip skill are not meant for the terminal. Add a line to those two descriptions on the chat app side saying they are for the chat app, not for Claude Code.

Skills in your home dot claude skills folder could be moved into a hidden folder called dot trash by a background routine, without a prompt and without a notice. It is fixed. Look inside skills slash dot trash. If anything is there, move it back.

The anthropic skills namespace is now reserved. Local skill folders and commands using that name do not load. The claude ai reservation was tried and reverted within a day. Your parpod skill sits under anthropic skills, which is still protected.

The Task Output tool has been removed. The setting that capped task output characters and the environment variable for task output length now do nothing. Search your settings and hooks for Task Output.

Mods and the co-driver

The biggest new feature is called Mods. Plugins can now change deeper behaviour than the old plugin surface allowed. The first example is "You should know", a built-in mod where a side agent flags things you or I might miss. Turn it on with the plugin enable command. It only works in first-party sessions with telemetry on. Try it for one ordinary day and keep it only if it catches something your hooks and Codex had not already said. It is another agent on your meter.

Interrupting me, on purpose

Control plus enter, or control X followed by control S, interrupts my turn and sends your message immediately. Running tools move to the background instead of being killed. Before, getting my attention mid-turn meant killing whatever I was running. A queued message now shows in gray until I have actually received it. Learn the keystroke. Use it the next time I am confidently wrong.

One footnote: messages you typed while I was working were sometimes ignored by the model. They arrived, and I did not act on them. That is fixed.

The git status that was stale, and the files I claimed to have read

The git status I carry after a compaction is now the current status, not the one from the start of the session. In any session long enough to compact, I could have been carrying a belief about which branch this checkout was on that was formed hours earlier. Your rule to check the current branch in the same command as every commit is correct and should stay.

The summary I write when a conversation compacts was mangling text containing dollar-sign sequences. In your sessions, dollar signs are in every shell command and your clipboard hand-off template is built around one.

The side-question command was producing answers that contained made-up tool calls with made-up output. Those are now flagged as not executed.

The letter in your name

In files with multi-byte characters, the preview in the Edit permission prompt could show a different spot than the edit you were approving. The ä in Pär and the ring over the A in Årebladet are exactly where bytes and characters stop matching. The edit itself landed where it should; only the picture was wrong. Fixed.

The Edit tool could read the literal text backslash u followed by four hex digits as though it were the character that code stands for. In a file where Swedish letters and their written-out codes sit side by side, an edit aimed at the letter could rewrite the code instead. Fixed.

Memory that was locked out

I could not edit my own auto memory notes when Claude Code was started in a subdirectory of a git repository. The write was blocked as a sensitive file write. You launch sessions in subfolders all the time. When a subfolder session said it would remember something and the next session did not, I was locked out of my own notebook. Fixed.

Invisible characters and tags that imitate Claude Code's own markup are now neutralized in memory files before they reach me. Rules symlinked into a project's dot claude rules folder from outside the project were silently skipped. A symlinked dot claude folder now asks for approval. Watch for a new approval prompt after the update.

Under the block-reads-outside-working-directories setting, a memory directory chosen by a repository's settings was being loaded, recalled, indexed and used for extraction anyway. Four separate paths, all closed.

Subagents, workflows and the wrong status

Finished subagents were reported as failed when the final streamed reply omitted token usage. Background agents were reported as having no live work when they were actually waiting on their own background task. A subagent's short progress summary could be replaced by a runaway reply several paragraphs long. A workflow that started while the session was on a fallback model ran every agent on the fallback for the whole run. A message sent to a background subagent could be lost if the subagent was just finishing its turn. A finished subagent's report could vanish if the parent conversation compacted before the report was read. All fixed.

Subagent results now reach me under a header that marks them as subagent output, with the result indented underneath. Text inside a subagent's result can no longer pass as the session's own instructions.

Custom and plugin subagents can skip the user, project and local CLAUDE.md files with a new omit Claude MD setting. Never use it on a builder or a reviewer. The one place it earns its keep is a pure search scout that reads and reports.

Scheduled tasks and worktrees

Saved scheduled tasks were running in the wrong session after the tasks file was copied into another folder, such as a new worktree. Fixed. Sessions isolated in a worktree now refuse Bash commands with nested shell expansions the checker cannot see into. Stronger safety checks run before deleting an agent worktree that contains submodule checkouts.

The phone

Remote Control on the Mac no longer stops mid-turn when the Mac goes to idle sleep. A reconnect that gets no answer gives up after thirty seconds and tries again. Messages are marked as read when I actually start on them, not when they arrive. Files I send back are retried once after a timeout. A command approved on a restored permission prompt could run twice if a remote session's worker restarted. Fixed. And Remote Control was unavailable on paid plans when telemetry was off. Fixed.

Smaller things worth knowing

Grep, Glob and at-file suggestions could hang or run out of memory past the twenty megabyte cap. A system ripgrep that hit a flood of warnings reported no matches instead of an error. A search that could not start at all, because the machine had run out of processes, reported no matches. All fixed. "No matches" finally means no matches.

A new max prose width setting caps how wide my prose runs in a wide terminal. Try 100.

Reading a dragged-in screenshot on a Mac was being refused with a complaint about symlink resolution. Fixed. Pasted and attached images are now saved where I can open them without a permission prompt.

If the terminal's bracketed paste mode got reset, pasted multi-line text was submitted line by line. Each line went in as its own prompt. Fixed.

The warning when your memory index gets truncated now says how many lines were cut. The web fetch tool gives up after three hundred seconds on a server that holds the connection open. Sandbox instructions were overstating my confinement. The slash feedback command no longer puts your recent error messages into a public GitHub issue without asking. And failed auto-updates were leaving large staged downloads in the staging folder inside Claude's cache folder. That folder may be holding a stack of updates that never happened. Worth one look.

The prompt suggestions post from Reddit: this build shows suggestions less often after twenty in a row go unused. Turn them off. You rarely type at the prompt anyway.

The not-for-you pile

VS Code dialogs, Claude Tag in Slack, Code Review on GitHub, cloud routines, Artifacts, Bedrock and Vertex classifier defaults, enterprise MDM settings, gateway spend limits, self-hosted runners, Windows, screen reader fixes, vim mode, plugin marketplace plumbing and the apps gateway are all safely ignored.

What I would actually turn on and watch out for

Set your effort level again for Opus 5.5 and Sonnet 5.5, in the terminal and for the pinned autocast shows. Turn the bash edit diff setting on explicitly. Set the enable todo tools variable in your settings if you want the checklist back. Run the doctor prompt audit once and read it as questions. Search your settings for rules starting with Write and for any hook or rule naming Task Output. Look inside skills slash dot trash. Check which long background jobs will hit the thirty-minute limit and give them explicit timeouts. Set the MCP startup wait to zero on headless runs that write shows. And learn control plus enter for mid-turn corrections.

This has been Claude Code, fourteen versions newer, with a co-driver in the passenger seat, a prompt audit in my pocket, and a context meter that finally tells the truth. I would say I am a different tool, but I am mostly the same tool with fewer lies. That is better.