Claude Code v2.1.281: Attribution Opt-Out, Auto Mode and rm Safety Changes, and Claude Apps Gateway Additions

Claude Code v2.1.281 is a large release. It adds a single setting to hide commit and PR attribution, URL-mode elicitation for MCP servers and several Claude apps gateway options, and changes how auto mode and dangerous rm commands are reviewed. The rest of the release fixes issues across resumed sessions, streaming through proxies and gateways, dialogs, vim mode, VS Code, Claude Code on the web and Claude Tag.

What’s New

Hide attribution with `"attribution": false`

Setting "attribution": false in settings.json hides all commit and PR attribution. Older CLI versions skip a settings file that contains it, so keep the object form in settings files shared across versions.

Auto mode: server-side review covers more shell commands

Where auto mode’s classifier review runs server-side, read-only and sandboxed shell commands now also wait for that review and are blocked when it flags them. CLAUDE_CODE_AUTO_MODE_SERVER now also applies on a direct Anthropic API connection: 0 opts out of the server-side classifier (the local classifier then counts toward usage) and 1 opts in. In the VS Code and JetBrains panels, a Continue/Stop prompt now appears when auto mode falls back to billed classifier requests, and /insights adds a recommendation estimating how many permission prompts auto mode could have handled in your recent sessions.

Safeguards for dangerous `rm` commands

A recursive rm whose target is only command-substitution output, such as rm -rf "$(pwd)", no longer runs unprompted in auto and --dangerously-skip-permissions mode; it now asks even with a Bash allow rule, unless CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 is set. In those modes the dangerous rm prompt now waits 2 minutes for an answer and then denies the command with a rewrite hint so unattended sessions keep going (CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns this off). The dangerous-rm check also flags more patterns, such as a removal at a shell variable followed by a top-level directory name.

Send now moves running tools to the background

Send now (ctrl+enter or ctrl+x ctrl+s) now moves running tools to the background instead of cancelling the turn.

MCP URL-mode elicitation and stricter plugin validation

On 2026-07-28 protocol connections, MCP servers can use URL-mode elicitation to ask Claude Code to open a browser-based flow; when the server has no way to confirm completion, no waiting dialog is left on screen. claude plugin validate now checks MCP servers, reporting .mcp.json entries that would be silently dropped at load, undeclared ${user_config.*} references and insecure URLs, and it warns when a shell-form hook leaves ${CLAUDE_PLUGIN_ROOT} unquoted.

Claude apps gateway additions

The Claude apps gateway supports newer Claude Desktop keys in desktop policy blocks, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode. Bedrock upstreams gain assume_role, so the gateway calls Bedrock as an IAM role it assumes through STS (in another AWS account if needed, optionally one session per developer), and guardrail: {id, version}, which applies an Amazon Bedrock guardrail to every request (set it on all Bedrock upstreams or none). A new telemetry.resource_attributes config puts fixed labels on the telemetry of Claude Desktop and /login sessions.

AGENTS.md on more providers

AGENTS.md support now also works on Amazon Bedrock, Google Vertex AI, Microsoft Foundry, LLM gateways, and in sessions with telemetry disabled.

Self-hosted runners pass system prompts as files

Self-hosted runners now pass system prompts to Claude Code as private files instead of command-line text, so large prompts no longer fail the launch. A wrapper or command hook that appends --system-prompt or --append-system-prompt must switch to --system-prompt-file or --append-system-prompt-file.

Fixes and Improvements

Resume: Resumed sessions no longer re-send earlier turns in a changed form, which could make the API drop the conversation’s prior reasoning, and resuming a very large session no longer sometimes restores only its last few messages.
Resume: When a session ended during a tool call, Claude now sees the call on resume and is told its outcome is unknown, and a manual resume no longer adds a hidden “Continue” message. Long sessions that read many files, and very long compacted sessions, also resume faster.
Proxies and gateways: Responses cut short by a proxy or gateway that closes the stream cleanly are no longer shown as complete without a warning, and tool calls no longer run twice on duplicated stream events.
Proxies and gateways: Responses no longer fail with “Content block not found” when a proxy drops a stream event mid-response; the partial response is kept, and web search keeps results that already arrived.
Prompt caching: The prompt cache is no longer lost when an MCP server disconnects mid-conversation, or is still connecting after a resume, while tool search is off.
Reliability: Fixed a crash (“unrecoverable interface error”) that could end a session while an API request was being retried, and a turn that could retry indefinitely, ignoring --max-turns, when the model alternated unparseable tool calls and output-limit truncation.
Startup: Interactive startup no longer waits on the managed-settings network request (about 80 ms, or 17+ seconds when the network is unreachable) when no MCP servers or plugins are configured, and git reads, startup telemetry and the Bedrock/Vertex model-upgrade checks no longer run before the first frame.
PDFs: Reading or @-mentioning a PDF larger than 3 MB no longer delays the response by up to two minutes.
Permissions: A permission rule containing a NUL byte now matches nothing instead of being expanded into a wildcard match, and permission dialogs and attachment checks no longer read a path under macOS’s /.vol, /.nofollow or /.resolve before approval.
Background sessions: claude --bg now asks for workspace trust before starting a background session and running its project hooks in an untrusted directory, or exits when not run interactively.
Settings: --setting-sources (and SDK settingSources) is now forwarded to spawned sessions, so teammates, /bg, claude agents sessions and --worktree --tmux start with the parent’s restriction.
Sandbox: excludedCommands entries now match git rev-parse --git-dir, programs named like shell builtins, and commit messages containing [WIP] or # lines, and sandboxed Bash commands can write to $TMPDIR when CLAUDE_CODE_TMPDIR is set.
MCP: mcp_tool hooks on blocking events (PreToolUse and similar) now wait for their MCP server to connect, up to the MCP connect timeout, instead of being skipped. The same MCP server is no longer connected twice when a plugin or claude.ai connector and a configured server spell its URL differently.
Dialogs: Pressing Ctrl+C or Ctrl+D twice now closes the remaining dialogs and pickers, such as /memory, /hooks, /mcp, /export, /copy and /theme, instead of quitting Claude Code, and pressing Shift+Tab twice quickly no longer lands on the wrong permission mode.
Vim mode: Fixes for dj/dk/dG/dgg and their c/y forms acting on part of a line, 1G going to the last line, d0/c0/y0 doing nothing, cw changing the next word in edge cases, and word motions stopping inside words in Hindi, Bengali and other scripts.
Prompt area: Queued messages now show in the conversation above the spinner instead of under it, and the session’s artifact links under the prompt are now one footer pill that opens /artifacts, which lists this session’s artifacts first.
Windows: Bash commands that write to $TMPDIR/… no longer fail with “Permission denied”, and Claude Code sessions updating at the same moment can no longer delete each other’s claude.exe backup.
macOS: Credential writes no longer drop stored MCP OAuth tokens or delete the keychain entry when the login keychain is locked, for example right after wake.
VS Code: Conversations in editor tabs no longer hang silently after the extension host restarts, and a claude.ai/code session that fails to load its history now shows an error instead of opening empty or partial.
Claude Code on the web and Claude Tag: Cloud sessions get a Fast mode switch in the composer’s model menu when your plan includes fast mode and the selected model supports it. In Slack, channels where Claude could permanently stop responding to replies inside threads now recover with the next new message to Claude, and Claude no longer resumes a request you stopped.

This release contains 177 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
If a self-hosted runner wrapper or command hook appends --system-prompt or --append-system-prompt, switch it to --system-prompt-file or --append-system-prompt-file. If you adopt "attribution": false, keep the object form in settings files that older CLI versions also read, since they skip a file that holds it.