Claude Code v2.1.290: claude attach and logs by Name, Managed Agents Onboarding, and a Refilling WebSearch Budget

Claude Code v2.1.290 is a large release with 190 changelog entries. It lets claude attach and claude logs accept part of a session name, adds Managed Agents onboarding commands to /claude-api, and replaces the interactive WebSearch cap with a budget that refills over time. Much of the rest tightens permission rules, sandbox checks and organization-managed settings, alongside many fixes for scheduled tasks, the agents view, /ultrareview, plugins and mods.

What’s New

`claude attach` and `claude logs` by Session Name

This release adds claude attach <name> and claude logs <name>, where part of a session name works in place of the session id.

Managed Agents Onboarding in `/claude-api`

/claude-api managed-agents-onboard <url> sets up the Managed Agents pattern a page describes as ant apply files, and /claude-api managed-agents-onboard <quickstart-name> builds a Console quickstart template, such as deep-researcher, with the ant CLI. The claude-api skill’s Managed Agents examples now turn off the web tools unless the agent needs them and use the auto permission policy.

WebSearch Budget Refills; WebFetch Reads Past 100,000 Characters

In interactive sessions, the WebSearch budget now refills over time at 100 calls per hour instead of ending after 200 calls; CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR sets the rate, and 0 turns it off. WebFetch no longer silently drops page text past 100,000 characters: it says how much was unread and takes an offset to read on.

Project Settings Can No Longer Turn On Claude in Chrome or Set `CLAUDE_CODE_DISABLE_ATTACHMENTS`

A project’s settings files can no longer turn on Claude in Chrome; use --chrome, /chrome or your user settings. A repository’s .claude/settings.json or .claude/settings.local.json can also no longer set CLAUDE_CODE_DISABLE_ATTACHMENTS, while shell, user and managed settings still can.

Bash Asks for Approval More Often

The Bash tool now asks before running pyright, which is no longer treated as a read-only command, and more forms of the ps command ask for approval instead of running without asking. Read-only commands such as rg or git grep whose arguments the shell would still expand as wildcards, and certain commands whose variable names zsh reads differently from bash, now prompt as well.

Managed Settings Warnings

Claude Code now warns when a managed settings file is a link to a file outside the managed settings folder. /status and doctor also warn when managed settings ignore user-configured sandbox allowRead paths or allowed domains.

`/code-review` at Medium Effort on More Models

/code-review at medium effort now also reports cleanup and CLAUDE.md conventions findings on models without tuned review settings, including Opus 5.5 and Sonnet 5.5.

Agents View and Background Session Changes

/model, /effort and /rename sent from claude agents to a busy background session now apply right away, without a confirmation, instead of when the turn ends. Background sessions waiting on a scheduled wakeup (/loop) are now left running through updates and low memory, and background sessions whose scheduled task is gone move to Completed about 20 seconds later.

Plugin and Mod API Additions

A mod’s turn.step result gains serverToolUses (the tool calls the API ran itself, the advisor), the tool.check event of plugin hooks gains agentId so a hook can tell a subagent’s permission check from the main session’s, and the question and verdict a mod’s tool.check hook reads gain ceiling, naming the approval an organization requires for a tool. The plugin hooks typings add ThemeKey and Color types, and claude plugin validate now lists each hook a mod registers at a gating site with whether it has a .catch (gatingHooks under --json).

Claude Tag: Fast Mode in Slack

Mention Claude with !fast to switch a Slack thread to fast mode, moving it to Opus if needed, and !fast off to switch back; replies show (fast) while it’s on. Custom connections in an access bundle gain an optional Path prefixes field so the allow rule can cover only those paths, and the channel instructions limit is now 8,192 characters instead of bytes, with a character count beside Save.

VS Code: Message Timestamps On by Default

Message timestamps now show by default; turn them off with the Claude Code: Show Message Timestamps setting. VS Code also adds a “Message queued.” screen reader announcement when you send a message while Claude is working, and a way to review and run a plugin marketplace’s install or update command from the Manage plugins dialog.

Claude Apps Gateway

The Claude apps gateway’s sign-in approval page has a new Deny button that ends the pending sign-in, so the waiting terminal stops within seconds. The gateway’s minimum supported PostgreSQL version changes from 14 to 11, and it now logs a warning during the last 30 days before the certificate it presents to the identity provider expires.

Fixes and Improvements

Requests: Requests no longer fail behind proxies and gateways that reject one of Claude Code’s beta headers with a status other than 400, or together with a second beta. Long sessions with hundreds of images no longer get stuck on “Request rejected as unprocessable by the model”, and when the API’s output content filter stops a reply while Claude is still thinking, the request is retried once before the error is shown.
Scheduled tasks: /loop with an interval and reminders now come back on resume after the conversation was compacted (for compactions made from this version on), tasks set in the foreground now fire after a ← or /background hand-off, and recurring ones no longer fire an extra run on every resume, respawn or fork.
Resume: Resumed subagents and teammates keep their earlier thinking and prompt cache after receiving a message mid-run, plan mode is restored when resuming with --continue or --resume <session-id> in the terminal, and timers, input and rendering keep running while a large session’s transcript loads.
Permission rules: Deny and ask rules no longer miss a command or path whose name came from a variable set as a prefix on declare, typeset, export or readonly; Read deny rules now apply to image paths pasted or dragged into the prompt and to file names listed for an @-mentioned folder; and permission rules and safety checks now apply after a PreToolUse hook rewrites a tool call’s input.
Plan and auto mode: Plan mode no longer lets the auto mode classifier approve non-read-only connector tools that carry a server-pushed ask policy, and auto mode denials no longer suggest a permission rule that would skip the classifier for a whole tool or that Claude Code would ignore.
Restricted and bypass modes: --restricted (and CLAUDE_CODE_RESTRICTED=1) sessions no longer open the cross-session messaging socket, and background workers no longer honor --allow-dangerously-skip-permissions on respawn without the bypass-permissions disclaimer having been accepted.
Links and symlinks: A project CLAUDE.md, rule or AGENTS.md symlinked outside the working directories no longer loads under permissions.blockReadsOutsideWorkingDirectories or a Read deny rule; through a link swapped mid-read, an image read on macOS and Windows can no longer return a file outside what was approved, and an @-mention under the read block or --restricted can no longer read a file outside the working directories; and edits to the file a symlinked settings file points at now get the settings-file permission question.
Organization controls: A user-installed mod can no longer get an organization’s plugin unloaded or make an organization’s guard skip its check; such a mod is now unloaded instead. An MCP server provided by your organization is no longer relisted as your own after signing in or reconnecting, and disableClaudeAiConnectors and allowedMcpServers URL rules are now applied to the MCP entries declared in .mcp.json, plugins or agents that they previously missed.
Sandbox: Sandboxed commands that pipe a heredoc into another command (cat <<EOF | python3) no longer ask for approval on every run, sandboxed Monitor tool commands now follow your permission rules under sandbox auto-allow, and a short form of a git clone option no longer keeps the sandbox exemption from a pattern such as git * in sandbox.excludedCommands.
/ultrareview: Uncommitted changes are no longer dropped, refused or uploaded unfiltered in several edge cases (a failed git stash create on Windows, core.safecrlf=true, a git filter driver named unset or unspecified, branches kept outside .git with git 2.54+), and upload errors are shorter, name the failing step and suggest a fix.
Agents view: Esc no longer confirms the “restart this session” prompts, repeated Ctrl+X no longer deletes the whole next section, replies sent just after a background session crashed are retried for up to 12 seconds while it restarts, and claude agents no longer fails with “Couldn’t restart the background service” after a Homebrew upgrade (taking effect from the upgrade after this one).
Sleep and wake: Background agents no longer fail with “Agent stalled”, and Workflow tool subagents no longer restart from their prompt, when a Mac wakes from sleep; a response interrupted by computer sleep is no longer treated as a stalled stream on Bedrock, Vertex, Foundry and custom gateways; and automatic compaction no longer gives up with “Prompt is too long” when a Mac sleeps while it runs.
Freezes and memory: Fixed freezes after some very long messages, on long token-like text in the secret scan or permission prompts, on very long unbroken text during secret masking, and when a sandbox read rule such as ~/**/.env covers a large folder on Linux and WSL. Startup is no longer slow or failing (since 2.1.285) under SDK hosts such as the VS Code extension when managed settings deny reads of many paths on a slow filesystem, and an HTTP MCP server sending a very large response no longer causes unbounded memory use.
Skills and commands: Skills are found by the name in SKILL.md even when their folder has a different name, and the skill listing shows both names. On Windows, multi-line ! shell blocks in skills and commands work with CRLF line endings, and skills and custom commands now refuse a ! shell command that contains raw control characters other than tab and newline.
Bash tool: The Bash tool no longer occasionally loses shell aliases, functions and plugin PATH entries for a whole session when its first command runs seconds after startup on a new config directory, and errors now name the missing program instead of reading “Premature close” when a tool such as git or gh is not installed (macOS, Linux).
Dialogs and login: CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS=5m is no longer read as 5 ms; values with a unit suffix now fall back to dialogExpiry. First launch no longer asks you to pick a login method again after claude auth login, and macOS /login no longer reports success when the keychain refused the new login.
Network traffic: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC now also skips the startup connection warm-up, an MCP server blocked by a network proxy (HTTP 403) is no longer retried three times, and background commands, the agents view and daemon workers behind a Claude apps gateway no longer send telemetry and a feature-flag request to Anthropic when no managed settings force gateway login.
Claude in Chrome: A browser_batch call now gets 90 seconds, up from 60, before it is reported as timed out, and /chrome “Reconnect extension” now restores browser tools after a failed Chrome connection, with an explanation when it can’t.
VS Code: A blank chat no longer keeps a background Claude process running after you open a saved conversation in its place, a permission prompt that arrives behind an open dialog no longer takes keyboard focus, Continue After Reload now also finishes a step the restart interrupted, and hovering a file pill shows the file’s path from the project folder.
Code Review: Blocking review comments no longer open with a “nit” label that contradicts their severity, and tips to comment “@claude review” are no longer posted on fork and Manual-mode pull requests in organizations that have turned Code Review off.

This release contains 190 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
If a project’s settings files turned on Claude in Chrome or set CLAUDE_CODE_DISABLE_ATTACHMENTS, they no longer take effect there: use --chrome, /chrome or your user settings for Claude in Chrome, and your shell, user or managed settings for CLAUDE_CODE_DISABLE_ATTACHMENTS.