Claude Code 2.1.260

What changed

Claude Code 2.1.260 shipped on September 3, 2026. The additions are mostly about making what is happening visible: a diff panel next to the conversation, a likely cause attached to prompt-cache misses, and /advisor and /reload-plugins reaching sessions that have no interactive UI. The rest is fixes — most notably in file permission rule handling, where a path containing parentheses left a “read-only” folder writable, and a revert of the 2.1.259 Bash argument check that denied ordinary build commands.

New features

• /diff panel

  Seeing what Claude had changed meant leaving the conversation to check separately. In fullscreen mode a panel now opens beside the conversation and shows your uncommitted changes as Claude edits. Toggle it with /diff.

• A likely cause for prompt-cache misses

  2.1.251 made /cost and the status line’s prompt_cache field report hit ratio, misses, tokens re-cached and warm/cold, but not why a miss happened. Both now add a likely cause — for example tool definitions or the system prompt changed, or the session sat idle past the TTL.

• /reload-plugins in headless sessions

  The command existed only in terminal sessions, so it never appeared in the Claude Code Desktop and SDK command lists. It has been added to headless sessions and now shows up in both.

• A text form of /advisor

  /advisor was a picker, so hosts without an interactive UI could not use it. /advisor, /advisor <model> and /advisor off can now be typed as text in the desktop app, Remote Control, and other headless (-p / Agent SDK) sessions.

• oidc.scope_on_refresh in the Claude apps gateway

  Some IdPs return an id_token on refresh only when openid is requested again. oidc.scope_on_refresh lets you set the scope sent on refresh for those providers.

• Claude apps gateway support for newer Claude Desktop keys

  desktop policy blocks did not recognize the settings keys added by recent Claude Desktop builds. They now support the newer keys, including userPluginMarketplacesEnabled and userPluginUploadsEnabled.

• [VSCode] Effort level in the footer model pill, Open and Closed status filters

  The footer model pill did not show the selected effort level, and the session list’s status filter menu had no way to separate open from closed sessions. The pill now includes the effort level (a stale value after switching models is fixed too), Open and Closed were added to the status filter menu, and the footer pills returned to their earlier compact size.

Key improvements

• ctrl+l / cmd+k clears the transcript view in fullscreen

  In fullscreen mode these keys did not behave like a terminal clear. They now clear the transcript view; scroll up to see earlier messages.

• ! bash-mode commands run outside the sandbox

  Under strict sandbox mode (sandbox.allowUnsandboxedCommands: false), commands you typed yourself at the ! prompt were sandboxed too. They now run outside the sandbox, like typing into your own terminal.

• Permission rules with text after the closing parenthesis reported as invalid

  A rule such as Bash(ls) x never matched anything and was silently ignored. It is now reported as an invalid setting, so you find out the rule is doing nothing.

• Clearer settings error for Windows paths containing parentheses

  In a rule such as Edit(C:\dir\(name)\**), \( is read as an escaped parenthesis rather than a path separator. The error now explains that and suggests an unambiguous spelling.

• A managed CLAUDE.md no longer triggers the security approval dialog

  A change to the server-managed CLAUDE.md (claudeMd) raised the approval dialog, so every rollout needed user confirmation. It no longer does; hooks, shell-command, sandbox, and unsafe env settings still require approval.

• Claude in Chrome follows your organization’s admin setting

  Turning Claude in Chrome off for an organization did not affect the client. It now follows the admin setting: when an admin turns it off, --chrome, /chrome and the browser tools are unavailable.

• Auto-compact for 1M-context models

  Compaction was not aligned to a 1M-token context window, and recovery compaction on very large contexts timed out at 10 minutes. Opus and Fable sessions now compact shortly before the 1M-token limit, and recovery compaction no longer times out.

• /effort on Claude Fable 5.1 keeps the prompt cache

  Changing effort mid-session invalidated the prompt cache, making the next request more expensive. On Claude Fable 5.1 it no longer does.

• /ultrareview waits up to 45 minutes

  Long-running cloud reviews outlived the 30-minute wait and their results were never collected. /ultrareview and claude ultrareview now wait up to 45 minutes.

• Structured output in Workflow agent({schema})

  A JSON Schema that can never be satisfied only failed after the run started and burned through the retry cap. Such a schema is now rejected up front, and retry-cap errors include the last validation failure.

• Deleting a background session whose worktree has unpushed commits

  It was hard to tell what you were about to lose. The message now names the branch and commit count, and deleting again discards the worktree.

• No time limit on background commands started by subagents

  These commands were cut off after one hour. They now run until they exit or are stopped, matching the main session.

• Self-hosted runner --kill-session-after-min

  A session that was only waiting on its user was killed and reported as a failure. It is now released instead — paused, and resumable on the next message.

• Bedrock input-token counting for aborted requests

  Counting the input tokens of an aborted request meant sending a separate one-token request. The Claude apps gateway now uses AWS’s free CountTokens API instead; grant bedrock:CountTokens to use it.

• orgPluginSettings sent in the list form

  The Claude apps gateway now sends orgPluginSettings in the list form read by Claude Desktop 1.15200.0 and later. Older desktops ignore it.

• Misspelled fields in nested gateway policy objects

  A desktop policy that misspelled a field inside a nested object of a managedMcpServers or orgPluginSettings entry still started. The gateway now refuses to start and names the field.

• Claude apps gateway refresh-failure log

  A failed refresh did not say where it went wrong. The log now names the step that failed.

• Idle CPU usage of non-interactive sessions

  -p and SDK sessions used more CPU than necessary while waiting. Idle CPU usage is now lower.

• Updated model IDs in the bundled claude-api skill

  Its Go, Java, and C# samples used previous-generation model IDs. They now use current-generation model IDs, and the skill clarifies that cheaper worker or sub-agent models should be current-generation too.

• Reverted the 2.1.259 Read() deny rules on Bash arguments

  2.1.259 applied Read() deny rules to Bash command arguments. That denied npm run build under a Read(./**/build/**) rule in every mode and made cd … && grep prompt even in auto mode, so the change has been reverted.

Bug fixes

Permission rules & sandbox

• Edit/Write/Read permission rules whose path contains parentheses being dropped as invalid or ignored by the Bash sandbox, which left “read-only” folders writable.
• One file permission rule with an uncompilable pattern (e.g. an unclosed [) making every file edit fail with Invalid regular expression; such a deny rule now guards the literal path it spells.
• Bash permission checks auto-approving zsh commands that hide a command substitution in a REPORTTIME, REPORTMEMORY or DIRSTACKSIZE assignment; these now prompt for approval.
• permissions.blockReadsOutsideWorkingDirectories on macOS hiding the user’s git config from sandboxed git, and hiding a worktree-isolated sub-agent’s own checkout.
• Managed skillOverrides entries keyed on a bundled skill’s alias (e.g. checkup for /doctor) not applying, and Skill(name) deny rules not covering a nested skill listed as <dir>:name.
• Glob/Grep probing the search path on disk before the permission check; a missing path is now reported after permission is decided, as Read does.

Enterprise environments & credentials

• Bedrock model discovery, token counting and AWS SSO/STS credential calls failing with “unable to get local issuer certificate” when the corporate root CA is only in the OS certificate store.
• Managed settings not loading for claude.ai Enterprise/Team users who also had a leftover API key from an earlier /login.
• /status listing a signed-in claude.ai account and a configured API key as if both were in effect; the credential not in use is now marked.

Models & prompt caching

• model: fable agents ignoring the [1m] tag on an ANTHROPIC_DEFAULT_FABLE_MODEL pin and silently running with a 200K context window.
• The /model picker not showing Fable 5.1 for organizations that can use it, which was only accepted when typed as /model claude-fable-5-1.
• Prompt caching on Claude Fable 5.1 not covering the context attached after tool results, so it was re-sent as uncached input on every tool-call turn.
• Model switching staying blocked for the rest of the session after a plugin hook load failure; each switch now re-checks and the refusal names the cause.
• Model switching being blocked for the session when an organization-managed plugin’s marketplace could not be loaded.
• Remote Control accepting a model pick that is not a valid model name; it is now refused with an error instead of failing on the next message.

Resuming & rewinding sessions

• /rewind and --rewind-files reporting success when checkpoint backup files were missing and nothing was actually restored.
• /rewind leaving stale file-read tracking from the rewound-away turns, which caused “File unchanged since last read” stubs and full-file re-injection after external edits.
• -p --resume/--continue (as used by the desktop app) failing on every retry once a session’s worktree directory lost its git metadata; it now fails once, then resumes without the worktree.

Agents & workflows

• A subagent that resumed another agent via SendMessage never being woken by that agent’s completion — the notification went to the main conversation instead.
• Agent teams: an in-process teammate’s transcript losing messages, or going blank, during long API retry waits (e.g. under CLAUDE_CODE_RETRY_WATCHDOG) as retry notices evicted real messages.
• A session that moved to the background appearing twice in ListAgents (once as a phantom “interactive” twin with the same name) and receiving SendMessage deliveries in the viewer.
• Intermittent “task output swap refused” errors when many sessions share a project directory.
• Workflow tool subagents being restarted as stalled while a long context compaction was still in progress.

MCP & connectors

• SDK-provided MCP servers (e.g. Desktop connectors) sometimes missing from the first turn and only appearing on the next one.
• Claude in Chrome tools failing with “Not connected” mid-task in cloud-hosted claude.ai sessions when a connector was added or removed.
• Plugins from a URL marketplace failing to install with “marketplace entry path does not stay inside the marketplace directory” when a host app (e.g. Claude Desktop) stores it as a directory.

Artifacts & IDE integration

• An extra browser tab opening when an artifact is published in a session you’re driving from claude.ai, the desktop app, or mobile (Remote Control).
• The Artifact tool’s first call failing with an “Invalid tool parameters” validation error in some Cowork sessions.
• IDE line selections being dropped when running a skill or slash command; the “N lines selected” context now reaches Claude.

Terminal & UI

• Flags, joined emoji and accented letters splitting across wrapped lines, and stale text staying on screen when a flag or joined emoji falls in the terminal’s last two columns (now shown as …).
• Ctrl+Z in fullscreen leaving the shell on the alternate screen, drawn over the paused interface.

GitLab repositories

• Repository detection for GitLab projects in nested subgroups (e.g. gitlab.com/group/subgroup/project).
• owner/repo#123 issue references in rendered output linking to github.com when working in a GitLab repository; they now link to the gitlab.com issue.

[VSCode]

• The welcome screen disappearing in a new session when Remote Control turns on automatically.
• The session history picker loading a session a second time when it is already open in another tab; it now switches to that tab.
• The session tab’s Rename command silently doing nothing while the tab’s view was reloading; it now always applies.
• A half-finished message, an empty tool card or an extra “Thought for” line staying on screen after Claude Code retried a dropped response.
• “Enable Remote Control for all sessions” not applying to a session tab that was still starting when the toggle was flipped.

Notes

• The 2.1.259 Read() deny rules on Bash arguments are gone — 2.1.259 applied Read() deny rules to Bash command arguments, but a rule like Read(./**/build/**) denied npm run build in every mode, so the change was reverted. If you relied on it to block file reads, it no longer applies after upgrading.
• ! bash-mode commands are not sandboxed, even in strict sandbox mode — with sandbox.allowUnsandboxedCommands: false on, commands you type yourself at the ! prompt still run outside the sandbox.
• Permission rules with text after the closing parenthesis are now invalid settings — if you have a rule like Bash(ls) x, it will be reported as an error after upgrading. It never matched anything, so the spelling needs fixing.
• Bedrock token counting needs bedrock:CountTokens — the Claude apps gateway counts an aborted request’s input tokens with AWS’s CountTokens API, which requires that grant.
• ctrl+l / cmd+k in fullscreen clears the view, not the conversation — scroll up to see earlier messages.
• Claude in Chrome follows your organization’s admin setting — when an admin turns it off, --chrome, /chrome and the browser tools are unavailable.
• The orgPluginSettings list form needs Claude Desktop 1.15200.0 or later — older desktops ignore it.