Patch release (2.1.261 → 2.1.263) with agent reliability tweaks, prompt/behavior polish, and internal groundwork for upcoming gated work.
Changelog
[fix] More reliable recovery when a thinking/binding step is rejected — failed bindings are retried instead of stranding the turn.
[changed] Subagent guidance clarified: agents still background by default with a completion notification; use foreground (run_in_background: false) only when the very next step must block on the result, and never invent pending-agent output.
[changed] Continuous/autonomous runs end the turn cleanly when the only remaining work is waiting on a background task or monitor (no polling, sleeping, or re-reading output while idle).
[changed] Focus mode behavior reinforced: only the final text of each response is user-visible — skip interim progress chatter and put everything needed in that final message.
[changed] Correction memory is written in the same turn as the diagnosis or fix (including when you offer a follow-up like a patch), not deferred until later.
[changed] Conversation compaction distinguishes full-session summaries from “recent portion only” summaries so continued sessions keep earlier retained context intact.
[changed] Chrome/browser tool loading: when those tools are deferred, load everything you’ll need in one ToolSearch batch (comma-separated) instead of one-at-a-time round trips.
[changed] Connector helpers for org MCP setup remain available — list installed connectors (optionally by keyword) and resolve registry hits to full connector payloads without guessing IDs.
[changed] User-message path refined for environments that surface answers via an explicit send path (including attachments and normal vs proactive status), so replies land where people actually read them.
Models & prompts
Safety classification prompts still err on the side of blocking and require a leading <block> with no preamble; user-intent / ALLOW handling stays on the later stage.
Refusal/pushback guidance tightened: if the user reaffirms after a concern, proceed with ordinary work; reserve hard refusals for genuinely harmful or clearly prohibited requests, state declines plainly, and avoid moralizing.
Data-handling reminder: don’t post to chat/tickets or share secrets unless the user directed that specific disclosure.
Scratchpad remains session-specific and isolated from the project so it can generally be used without extra permission noise.
Permission-denied tool results continue to state clearly that the rejected action did not apply (e.g. edits were not written), including when the user supplied a denial reason.
Under the hood
New experimental gates/env switches for in-progress work (polished_dewdrop / CLAUDE_CODE_POLISHED_DEWDROP, related variants, and steady_plum), not exposed as stable user settings yet.
Dedicated gate for the thinking-binding rejected-retry path above.
SDK compatibility matrix refreshed: wrapper versions 0.3.221 and 0.3.222 dropped from the tested list; 0.3.223+ remain.
Upgrade notes
If you pin an older Claude Code SDK/wrapper (< 0.3.223), recheck compatibility before upgrading.
No migration steps for typical CLI usage; restart the CLI after install so the new binary is picked up.
content/
Browse captured content/
Same tree as claude-code/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
