Claude Code v2.1.299: Idle Compaction, CLAUDE_CODE_DISABLE_FILE_MENTIONS, and Stricter MCP Permission Matching

Claude Code v2.1.299 is a large release with 190 changelog entries. It adds idle compaction in the terminal, so a long conversation left idle is compacted before its prompt cache expires, along with CLAUDE_CODE_DISABLE_FILE_MENTIONS, new /usage warnings, and /effort and /fast in agent view. Several changes tighten permissions: MCP allow rules now reach only the server they name, UserPromptSubmit hooks run before skills and custom slash commands expand, and many sandbox, credential and mod-enforcement issues are fixed.

What’s New

Idle Compaction in the Terminal

A conversation of 200K+ tokens left idle for about 54 minutes is now compacted before its one-hour prompt cache expires, so your next message doesn’t reprocess it all. CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS changes the 200K-token minimum, and "idleCompaction": false in settings.json turns idle compaction off (the changelog notes that both need v2.1.290 or later).

`CLAUDE_CODE_DISABLE_FILE_MENTIONS`

With the new CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable, Claude gets the paths of @ file mentions to read with its file tools instead of the files’ contents.

Agent View: `/effort` and `/fast` for New Sessions

In agent view, /effort and /fast set what new sessions start with, and a bare /model, /effort or /fast there now opens a picker. The agents view peek panel also shows a “safe mode” line for background sessions started with --safe-mode.

New `/usage` Warnings

/usage now warns about max effort, workflows, always-on context and large tool results.

MCP Permission Rules Match Whole Server Names

MCP allow rules now reach only the server they name: mcp__a no longer allows a server named a__b or a_, so write mcp__<server>__* with the server’s whole normalized name. Agent tools: lists likewise take only the named MCP server’s tools; list a server whose name contains __ as mcp__<whole name>__*. Deny and ask rules for an MCP server (mcp__<server>) now also apply when the server’s normalized name contains a double underscore.

Hook Ordering and Blocking Changes

UserPromptSubmit hooks now run before a skill or custom slash command expands, so a hook that blocks the prompt also stops its embedded shell commands; a skill’s own front-matter UserPromptSubmit hook first runs on the prompt after the one that invokes the skill. Actions a plugin hook can block are now refused, not let through, when the hook cannot be handed them or cannot hand back its answer, and a tool that already ran has its result withheld.

Safer Resume Commands at Exit

The resume command printed at exit now names the session by its ID rather than its name, so that nothing in a session name can run when the line is pasted. For worktree sessions it uses -w and -r if the long flags do not fit the terminal.

MCP Redirects and Protocol Negotiation

Requests to claude.ai’s connector proxy and to Anthropic-hosted MCP servers no longer follow HTTP redirects (redirects by a connector’s own server are unaffected), and MCP requests in cloud and self-hosted runner sessions no longer follow redirects from the session’s MCP proxy. Cloud session and Remote Control MCP connectors negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags, with MCP_PROTOCOL_NEGOTIATION=legacy to opt out, and tool descriptions and server instructions from Anthropic’s first-party MCP servers at api.anthropic.com now reach Claude in full.

Mod API Additions

$.prompt.media lets a prompt.submit hook of a mod installed by managed settings read the bytes of an image or document attached to the prompt.
$.session.identity() tells mods installed by managed settings how the session is signed in, plus its organization and email when managed forceLoginOrgUUID lists that organization.
A mod’s Text gains size, weight, mono and tabular, and its Box gains named spacing steps (xs to xl); bold is deprecated in favor of weight.
The skill.prompt hook now receives the skill’s frontmatter, source, plugin name and file path; session.append gains a queue door; and the turn.start hook now also hears subagents’ and teammates’ turns, told apart by e.agentId.

Plugin Eval and Self-Hosted Runner Options

claude plugin eval accepts --disallow-tools and a disallowed_tools case field to keep specific built-in tools, such as Agent, out of eval runs. claude self-hosted-runner orchestrator gains --shutdown-drain-sec: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish.

Attribution Block Behind a Claude Apps Gateway

Setting CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway’s code policy turns off the attribution block in Claude Desktop’s Code tab. Claude Code sessions behind a gateway get a new field in the attribution block, which CLAUDE_CODE_ATTRIBUTION_HEADER=0 also removes.

Other Behavior Changes

Skills and commands whose file or folder name has hidden, direction-changing or blank-like characters, < or > are no longer offered until renamed.
/btw side questions in non-interactive sessions now return a timeout error when still unanswered after 11 minutes.
WebFetch page reads now pick their effort as web searches do.
A one-time note appears when plan mode won’t ask before most edits or commands because bypass permissions is available.
A local session can now watch up to 25 published artifacts at once, up from 10.
/ultrareview upload errors no longer suggest git add ., which could stage or commit untracked files such as .env.
In Cowork cloud sessions, a PermissionRequest hook can no longer approve shell commands or subagents in auto mode, and outside auto mode an approved-site Claude in Chrome action that the safety classifier flags now asks you instead of being refused, unless managed settings apply.

Fixes and Improvements

Sandbox: A sandboxed shell command can no longer write into a --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox. On macOS, sandboxed commands can no longer reach a denied path by its real location through a symlink; denyRead and allowRead globs with braces, parentheses or backslashes in a folder’s name are read the same way by the settings checks and the sandbox; and allowRead and allowWrite glob entries are re-checked when the directory they start from is replaced by a symlink.
Credentials: Feature flag, startup, fast mode, profile and feedback requests to Anthropic no longer carry the API key configured for a third-party gateway (ANTHROPIC_BASE_URL), while Anthropic API keys are still sent, and the server-managed settings request no longer carries a third-party gateway’s API key when a managed settings file sets ANTHROPIC_BASE_URL. An agent teammate started without a description no longer keeps part of a credential from its prompt in its task description.
Plan mode and guards: Plan mode no longer runs a write that a PreToolUse hook or a mod’s tool.check hook allowed, and mods’ hooks are no longer handed values with __proto__ keys silently removed, which could skip a tool.check guard.
Mods and managed settings: Write and Edit no longer create a mod in a session’s mods folder without asking in accept-edits mode when the config directory’s path has no .claude in it, mods turned off remotely now unload between turns, a user-installed mod’s $.env.set no longer changes the environment of command hooks from managed settings, and enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods is improved.
Windows: PreToolUse and PermissionRequest hooks that set no shell no longer fail open when Git for Windows isn’t installed (a guard that fails now blocks the call), the process-liveness check no longer leaves orphaned PowerShell processes behind on busy machines, and Bash commands no longer fail with “command not found” for a whole session when Git Bash did not report its PATH at startup.
rm prompts: Shell -c scripts that don’t run rm no longer trigger rm prompts, and an rm built at run time in a script Claude Code can’t read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1.
Custom endpoints and gateways: Sessions on a gateway-specific model name behind a custom ANTHROPIC_BASE_URL no longer end with “Prompt is too long · automatic compaction failed” near 200K tokens, streams through a custom ANTHROPIC_BASE_URL now wait 300 seconds for data instead of being aborted after 180, and the Claude apps gateway now answers 400 for models that a policy’s availableModelsMatch: exact or deniedModels blocks.
MCP: HTTP MCP connections no longer hang for 30 seconds and fail when a server never ends the body of its reply to a notification; servers that a policy check blocks are no longer started by claude mcp list, claude mcp get or subagents, or contacted when added to a running headless or SDK session; MCP OAuth sign-in, token refresh and sign-out now send configured headers/headersHelper values; and MCP tool calls in headless and SDK sessions no longer fail or run twice when a background reconnect closes their connection.
MCP configuration: An empty .mcp.json is no longer reported as invalid by claude mcp list, claude doctor and /status; MCP servers named constructor or prototype now connect; and a settings file is no longer ignored when enabledMcpjsonServers or disabledMcpjsonServers holds a single server name as a plain string.
Memory: Memory no longer grows under heavy debug logging (--debug, --debug-file) or without bound when debug output goes to stderr and the parent stops reading it, high memory use after resuming a cloud or Remote Control session that ran many subagents is fixed, and @-mentioned PDFs’ bytes are no longer kept in the session transcript.
Images and files: Long conversations no longer lose newly attached images on every turn after one oversized image was refused, images attached while Claude is working are no longer sent at full size, and document blocks are no longer dropped from a message sent while Claude is working. Read no longer garbles UTF-16LE files with a byte-order mark, and Write no longer drops byte-order marks or silently converts Windows-1252, Shift-JIS, GBK or UTF-16BE files to UTF-8 (such writes are now refused).
Scheduling: Scheduled tasks are no longer announced for the wrong minute, scheduled tasks and loops no longer fire after every turn or early during the repeated hour when daylight saving time ends, and scheduled wakeups (ScheduleWakeup) now fire while a background task runs in Agent SDK, IDE and claude remote-control sessions.
Headless runs: claude -p now lists a settings file that fails validation, and its invalid entry, on stderr; a mod that submits a prompt at the end of every turn can no longer keep a headless run going past --max-turns, --max-budget-usd or an interrupt; and SDK and headless sessions leave auto mode when the host switches to a model that doesn’t support it.
Responses and subagents: Replies cut off at the output token limit no longer end the turn silently after a request fell back to non-streaming mode, background subagents in auto mode no longer send their final report twice, and SendMessage finds a subagent by name after the CLI restarts and resumes the session (names given before the last compaction still need the agent ID).
Usage display: /usage, the approaching-limit warning (terminal and VS Code) and the status line no longer sometimes show more than 100% used.
Text rendering: Wrapped text mixing CJK or emoji with Latin words no longer loses its last line or leaves a blank row, and bold, italic and other nested text styles no longer run over table borders or get lost on wrapped rows.
Remote Control and cloud sessions: Remote Control prompts are no longer lost when another queued prompt fails to deliver, photos and files sent over Remote Control now arrive (including files of 30 to 35 MiB), a Remote Control session whose computer can’t be reached keeps your text in the box with Send off until it reconnects, and cloud sessions no longer ignore a permission answer or leave a message unanswered when their worker is replaced.
Sessions and flags: Background sessions started with --safe-mode no longer silently leave safe mode when woken or restarted, claude mcp add <name> -- <command> --background is no longer started as a background session, and a prompt or reply of --bg or --background to a background session is no longer taken for the flag.
VS Code: An unsent prompt and its attachments are no longer lost when switching to another session and back, unused blank chats no longer keep a background Claude process running, the mic button offers to sign you in when you’re signed out of claude.ai, and startup is faster in workspaces without a Python environment and in new windows on folders you’ve opened before.
Claude Tag and Code Review: Claude in Slack can now delete a canvas it created when asked, corrects a message it got wrong by editing it in place with a short “Edited” note, and joins channels with more than 100 members quietly. Code Review’s monthly spend-limit comment and check-run card now link the Usage page, where that limit is set.

This release contains 190 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
Review MCP allow rules and agent tools: lists that relied on prefix matching: mcp__a no longer allows a server named a__b or a_, so write mcp__<server>__* with the server’s whole normalized name.