Claude Code v2.1.295: Hooks That Block on Failure, Program Status Protocol Support, and Gateway Model Lists

Claude Code v2.1.295 is a large release with 143 changelog entries. It lets command and HTTP hooks block an action when the hook itself fails, adds Program Status Protocol (OSC 7501) support so compatible terminals can show what Claude Code is doing, and adds several Claude apps gateway controls, including per-upstream model lists and a time-to-first-byte limit for cloud upstreams. The rest of the release fixes MCP reconnection, background sessions, plugins and mods, terminal freezes and more.

What’s New

Hooks That Block on Failure

Command and HTTP hooks now accept onFailure: "block": a hook that can’t start, times out, or exits with an unexpected code then blocks the action instead of letting it through.

Program Status Protocol (OSC 7501)

Claude Code now supports the Program Status Protocol (OSC 7501), so terminals that implement it can show whether Claude Code is working, waiting on you, or done.

Quoted Text in `/copy`

The /copy picker now includes quoted text, so a drafted message copies without its > markers.

`CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS`

The new CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS variable limits how long unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) waits out 429 and 529 errors.

Clearer `claude -p` Runs

When a claude -p run stays open after its last turn, it now prints a line on stderr, when stderr is a terminal, saying what it is waiting for. claude -p text output also no longer drops earlier responses when background work starts another turn; each turn’s response prints when the turn ends.

Backgrounding with `←`

Stopping the turn while ← is waiting for the current tool to finish now shows a “Backgrounding cancelled” message, and when text typed in the prompt cancels backgrounding, Claude keeps working in the foreground instead of stopping at the end of the current tool. Ctrl+C at the idle prompt of an attached background session now leaves a pending /loop wakeup alone, so pressing it twice detaches and the loop keeps running; press Esc to stop it.

Claude Apps Gateway Controls

Every upstream can take an optional models list: only the listed models are sent there, on failover too, and one * in an entry is a wildcard.
timeouts.upstream_ttfb_ms now works on Bedrock, Vertex, Foundry and other cloud upstreams, limiting how long a stream may take to start there before it fails over or gets a 502.
On machines with no managed settings, forceLoginMethod: "gateway" and forceLoginGatewayUrl in your own user settings make /login open on that gateway.
The inference audit event gains upstream_request_id, and successful inference responses carry a request-id header, so request_id in Claude Code telemetry matches the gateway’s audit log.
Behind a gateway on Amazon Bedrock, token counts now come from AWS’s CountTokens API, and background requests use Haiku 4.5 instead of the session’s model, falling back to the session’s model where the gateway does not serve Haiku 4.5.

Mod API: `$.ui.notify` and Button Children

Mods can call $.ui.notify to raise a native notification through your own notification setting, which says which channel sent it. A mod’s Button can now hold children (strings and Text), so a list row can be one pressable with a chip or a dim detail inside.

Plugin Command Warnings

claude plugin install, enable, disable and marketplace add now warn when the settings file they write to does not load. claude plugin validate also advises when a plugin’s README has no install line, printing the line to paste without changing the exit code, even with --strict.

Other Behavior Changes

MCP tool descriptions the model loads through tool search are now cut at 16,384 characters instead of 2,048.
Subagents preload at most 32 skills from the skills field, each once; a subagent with the Skill tool can still invoke the rest.
claude.ai connectors negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; MCP_PROTOCOL_NEGOTIATION=legacy opts out.
For WebSocket (ws) MCP servers, a message over 16 MiB is no longer parsed and closes the connection, matching the limit the other transports already have.
When claude agents is stopped along with its background service (macOS, or Linux without the service installed), running sessions now stop in about a minute unless it is run again, and a notice says so.
Tab stops now count from where a text starts instead of from the screen’s left edge, and toasts from your organization’s mods show ahead of other mods’ toasts.

VS Code: Files Claude Sends You

Files Claude sends you now get a chat row: click a file’s name to open it in the editor, Claude’s caption shows underneath, and the row stays visible in Focus view.

Fixes and Improvements

1M context models: Every request no longer fails on a [1m] model when a gateway, Bedrock, Vertex or Foundry refuses the context-1m beta; Claude Code now resends without it.
MCP connections: Remote MCP servers in headless and SDK sessions no longer stay disconnected after an outage longer than 15 seconds or reconnect in a tight loop to a server that drops each connection (repeated drops now back off, up to 30s); remote connections are no longer dropped when a server’s error reply happens to contain a network error name; and servers that repeat a pagination cursor are no longer asked for the same page up to 20 times at every connect.
MCP tools: CSS, JavaScript and XML files returned by MCP tools are no longer saved as .bin (font and icon files now get their own extension too), an interrupt no longer waits for a timeout while Claude waits for an MCP server’s resource list, and Claude is now told when you stop a long-running MCP tool call from the tasks panel or a connected client.
Tool restrictions and guards: --tools and --restricted now apply to built-in tools that register after launch, and deprecated tool names no longer reach tools outside the caller’s tool set. A mod’s hook is no longer handed a deeply nested tool input cut short with no error, and calls a mod makes while it reloads during a plugin hooks worker restart can no longer get past another mod’s guard hook that has a .catch.
Links in output: Raw terminal hyperlink bytes in a reply or a teammate’s message are no longer drawn as a clickable link with a hidden address, and a link address shown as text is no longer hidden by a colour or conceal style a reply left on.
Claude in Chrome: A site deny rule written with port 80 (host:80) now applies to plain http:// pages on that host.
Skills: A skill’s allowed-tools and effort are no longer dropped when the Skill tool finishes before the response stream ends, which had denied the skill’s Bash commands in -p runs.
Hooks: An async hook’s JSON output printed over several lines is no longer ignored, an async SessionStart hook’s unchanged context is no longer added again on every resume, variables a SessionStart hook writes to CLAUDE_ENV_FILE now reach the Bash tool after an in-app /resume or /branch, and web searches and agent hook evaluations no longer take much longer at xhigh and max effort.
Background sessions: Esc now stops a self-paced /loop moved to the background with ←; a queued message pulled back into the prompt with ↑ or Esc just after ← is now kept in prompt history; a background session’s /loop no longer stops without notice when its wakeup came due while the process was down; and commands and hooks in background sessions no longer inherit FORCE_COLOR=3.
Subagents and teammates: Subagents in their own linked worktree are no longer shown the parent session’s git branch, status and recent commits, forked skills invoked from Workflow subagents now deliver their results to the invoking agent, and in-process agent teammates no longer fail their first SendMessage call.
File tracking: A file is no longer treated as already read after a Bash command such as cat ran without printing it, and Edit no longer treats a file as fully read when its contents changed without its modification time advancing.
Tool input: Bash tool calls no longer fail when the model passes command_description instead of description, Grep now runs searches sent with grep’s -l, -c or -r flag, and the Read tool treats an empty pages parameter as omitted.
Freezes: The terminal no longer freezes, with ctrl+c ignored, when a response runs to tens of thousands of lines, no longer freezes for seconds on replies whose quotes nest deeper every few lines, and no longer freezes for seconds or minutes while syntax highlighting code with very long lines, long runs of blank lines, or unclosed strings and heredocs.
/model: Picking Max effort no longer claims it was saved as your default for new sessions (Max applies to the current session only), and Fable models listed in availableModels now appear in the /model picker for sessions signed in to a Claude apps gateway.
Plugins: /plugin’s Errors tab no longer removes a marketplace that failed to load, and uninstalls its plugins, on Enter without asking; claude plugin marketplace add now refuses a marketplace whose name no plugin can be installed under; marketplaces whose repository has large git submodules can be added and refreshed; and /model, /fast and /output-style now ask a plugin’s config.set hook before saving.
macOS: A file count at session start no longer reaches other apps’ data and raises the “access data from other apps” prompt when a session starts in the home folder or above, and background sessions that restart together after an update no longer sometimes run outside the stable app wrapper.
Windows: Project-scope plugins now load in VS Code on Windows despite drive-letter casing differences, plugin install and uninstall at project or local scope no longer miss or duplicate the install record when only the drive letter’s case differs, and short command output with CRLF line endings is no longer drawn on a single line.
VS Code: “Fork conversation from here” and Rewind’s conversation restore no longer fail with “Message not found in session”, Ctrl+Shift+Tab, Cmd+Shift+Tab and Alt+Shift+Tab in the chat input no longer also switch the permission mode, and keyboard focus no longer bounces between two Claude views visible at once.
Self-hosted runner: The runner no longer passes CCR_AUTO_MODE_ALLOW, CCR_AUTO_MODE_ENVIRONMENT and CCR_AUTO_MODE_SOFT_DENY into a session’s environment, and git fetches are no longer cut off while the git server is still reporting progress on a large repository; CLAUDE_RUNNER_FETCH_SERVER_PROGRESS_CAP_MS tunes or turns off the wait.
Code Review: Re-reviews no longer say no issues were found while earlier findings are still open (the comment now says how many remain open), and Code Review no longer skips a large CLAUDE.md’s rules when the pull request edits that file.

This release contains 143 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
If you run a Claude apps gateway on Amazon Bedrock, grant bedrock:CountTokens so the gateway can get token counts from AWS’s CountTokens API.