Claude Code v2.1.236: ANTHROPIC_DEFAULT_MODEL, Idle Notifications for SendMessage, and Stronger macOS Sandbox Read-Deny Rules
Claude Code v2.1.236 adds ANTHROPIC_DEFAULT_MODEL, an opt-in notify_when_idle for cross-session SendMessage, stronger macOS sandbox read-deny rules, auto mode updates, and VS Code transcript screen reader support.
Claude Code v2.1.236 is a large release with 33 changelog entries. It adds an ANTHROPIC_DEFAULT_MODEL environment variable, an opt-in idle notification for cross-session SendMessage, and stronger wildcard read-deny handling in the macOS sandbox, alongside several auto mode refinements. The rest of the release fixes fullscreen rendering, the /model picker, Remote Control, and sessions whose working directory was removed, and adds screen reader support to the VS Code transcript.
What’s New
ANTHROPIC_DEFAULT_MODEL Environment Variable
The new ANTHROPIC_DEFAULT_MODEL environment variable sets the model that new sessions start on. Unlike ANTHROPIC_MODEL, a /model pick still overrides it and persists across restarts.
Idle Notifications for Cross-Session SendMessage
Cross-session SendMessage gains a notify_when_idle option that asks another Claude Code session on the same machine to send one notice when it next goes idle. It is opt-in and one-shot, involves no polling, and is available on macOS and Linux.
Stronger Read-Deny Rules in the macOS Sandbox
On macOS, wildcard read-deny rules such as **/.env now take precedence inside allowed read regions and cover the contents of matched directories. They can also no longer be bypassed by renaming the denied file.
Auto Mode Updates
While auto mode is active, Monitor allow rules are now set aside, so Monitor commands are reviewed the same way Bash commands are. On Bedrock, Vertex AI, and Foundry, and when telemetry is disabled, the classifier now uses the same defaults as on the Claude API, including severity-scored classification. The git status check also can no longer be fooled into reporting a clean tree by a repo’s status.showUntrackedFiles=no setting.
/goal Check-Ins for Idle Sessions
An idle session whose goal is parked behind long-running background work now checks in automatically after 30 minutes, then after 1 hour and 2 hours, instead of waiting for you to return.
Slash-Command Typos Are Reported
Pressing Enter on a slash-command typo, or on a command unavailable in the current session, now reports it instead of running the closest fuzzy match. Prefixes and aliases still run.
Screen Reader Support in the VS Code Transcript
In VS Code, the transcript now supports screen readers, with live announcements for replies, permission requests, errors, and status changes, plus per-turn heading navigation.
Fixes and Improvements
- Removed working directories: Clipboard copy, background housekeeping, background sessions, and local MCP logs no longer break after the directory a session had switched into is removed (an issue since 2.1.229). Skills hot-reload in SDK/VS Code sessions no longer raises an error on every skills change after the session’s working directory is deleted (2.1.229+).
- Fullscreen: The fullscreen renderer no longer fails permanently after a single failed start; it now falls back to the classic renderer instead of exiting on every subsequent launch. Fullscreen mode no longer sometimes withholds a newly sent message until the next update after a terminal resize, a blank band no longer remains above the prompt after clearing a multi-line prompt, and panes now repaint after resizing the terminal away and back.
/modelpicker: The picker no longer renders taller than the terminal; it shows only as many models as fit the window, with the rest reachable by scrolling. It also now highlights only the newest model’s name.SendMessage: Calls are no longer rejected when a malformed closing tag left the message text inside the summary field. Once a rapid burst would exceed what a session’s inbox accepts, further messages are now refused up front instead of being reported as sent while they were dropped.- Subprocesses: Unhandled promise rejections no longer occur when a subprocess fails to start, for example
powershell.exeon WSL with Windows interop disabled (a regression in 2.1.234). - Managed settings: The managed-settings approval prompt no longer sometimes fails to appear at startup while still capturing the first keypress as approval.
- Print/SDK mode: SIGTERM no longer records an interrupted turn or synthetic tool denials before exiting; running commands are still terminated and the process still exits with code 143.
- Remote Control: Sessions are now marked offline within seconds when the CLI exits or its terminal closes. When using Remote Control, the Fable 5 first-time usage-credits prompt no longer auto-selects the fallback model after 60 seconds without an answer.
- Self-hosted runner: Sessions released on idle, retire, or startup timeout no longer occasionally resume on another runner before the post-session hook has finished.
- Session recaps: Recap text (automatic and
/recap) is now capped at 400 characters and cut at a word boundary, fixing occasional runaway recaps. /usage: The usage-credits spend row now appears for Team and Enterprise members, and a capped row shows at 0% before anything is spent.- Terminal and startup: Tab titles no longer jump in tmux (iTerm tmux integration); the title is now written only when its text changes instead of animating every 960ms. Startup performance is improved by writing the session counter in the background.
This release contains 33 changes in total; see the official changelog linked below for the complete list.
How to Update
- Check your installed version:
claude --version - Update in place:
claude update - If you set
ANTHROPIC_MODELto choose a starting model, note the newANTHROPIC_DEFAULT_MODELalternative: it sets the model new sessions start on while still letting a/modelpick override it and persist across restarts.