Major Updates in Claude Code v2.1.294~v2.1.295 - Addition of hooks onFailure: "block" and OSC 7501 Support

This is Ishikawa from the Cloud Business Division. I'll summarize the updates for Claude Code v2.1.294 and v2.1.295 (both released on 2026-10-08). This release continues with hook-related additions and fixes, and I think those using hooks as guards will find the content interesting. Today I tried out onFailure: "block" for hooks.

The previous update article is here.

https://dev.classmethod.jp/articles/20261008-cc-updates-v2-1-293/

Update Summary

This covers 2 versions with a total of 145 changes. v2.1.294 has only 2 hook-related changes, with the remaining 143 in v2.1.295. In my classification, there are 89 fixes, 22 improvements, 17 new features, 11 security changes, and 6 breaking changes, with many changes related to Claude apps gateway, mods/plugins, and MCP. Of these, 18 changes relate to VS Code extension, Claude Tag, Code Review, cloud sessions, and self-hosted runners.

Notable Updates

New Feature: Added onFailure: "block" to command / HTTP hooks (v2.1.295)

onFailure: "block" has been added to command hooks and HTTP hooks. If a hook fails to launch, times out, or exits with an unexpected exit code, it blocks the operation without letting it through. The official documentation's hooks page explains that for many hook events, exit codes other than 2 do not block on their own—for example, if a hook exits with code 1 while stdout is empty, processing continues as a non-blocking error. At the time of writing, onFailure is not yet documented on that page.

For those using hooks for permission or policy decisions, I think the ability to choose to stop an operation when the hook itself fails is significant.

New Feature: Added support for Program Status Protocol (OSC 7501) (v2.1.295)

Support has been added for the Program Status Protocol (OSC 7501). In terminals that implement this protocol, Claude Code can display whether it is working, waiting for a user response, or complete.

For those running multiple sessions in separate tabs, I think terminals that support this will make it easier to notice sessions waiting for a response.

Bug Fix: Fixed [1m] model requests failing in environments that reject the context-1m beta (v2.1.295)

Fixed an issue where all [1m] model requests would fail in environments where gateway, Bedrock, Vertex, or Foundry rejects the context-1m beta. Claude Code will now retry without the beta designation.

For those specifying [1m] models via Bedrock, Vertex, Foundry, or gateway, I think this fix resolves the state where all requests were failing.

Security: Fixed prompt / agent hooks written as instructions allowing operations that should be blocked (v2.1.294)

Fixed an issue where prompt hooks and agent hooks written as instructions (e.g., "Block commands that...") were allowing operations that should have been blocked.

For those using prompt hooks or agent hooks written as instructions as guards, I think it's worth verifying after updating that blocking works as intended.

Security: Fixed --tools and --restricted not applying to some built-in tools (v2.1.295)

Fixed an issue where --tools and --restricted were not applied to built-in tools registered after startup. Also fixed an issue where deprecated tool names were reaching tools outside the caller's tool set.

For those restricting tools with --tools or --restricted to build automation, I think this is a good opportunity to review whether the intended tool set is being respected.

Security: Fixed truncated tool inputs being passed to mod hooks (v2.1.295)

Fixed an issue where deeply nested tool inputs were being silently truncated partway through and passed to mod hooks, potentially allowing guard processing to pass through content it had not examined.

For those inspecting input content in mod hooks, I think this fix resolves one issue where content that had not been inspected could pass through.

Target Versions and Period

Update Details

New Features

Hooks

• Added onFailure: "block" to command / HTTP hooks: Blocks the operation without letting it through if a hook fails to launch, times out, or exits with an unexpected exit code (v2.1.295)

CLI / Terminal

• Added support for Program Status Protocol (OSC 7501): In terminals that implement this protocol, Claude Code can display whether it is working, waiting for a response, or complete (v2.1.295)
• claude -p outputs reason for waiting to stderr: If it does not exit after the last turn and is still waiting, it outputs a single line to stderr (if it is a terminal) indicating what it is waiting for (v2.1.295)
• Added CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS: Specifies the maximum time that unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) will wait for 429 and 529 errors (v2.1.295)
• Added quoted text to /copy picker: Allows copying a drafted message without the > symbol (v2.1.295)
• Added "Backgrounding cancelled" message: Displayed when a turn is stopped while ← is waiting for a running tool to complete (v2.1.295)

Claude apps gateway

• Added per-upstream models list: Only models in the list are sent to that upstream (including during failover), and a single * entry in the list is treated as a wildcard (v2.1.295)
• Added support for timeouts.upstream_ttfb_ms for cloud upstreams: For upstreams such as Bedrock, Vertex, and Foundry, this sets the maximum time until the stream starts; if exceeded, it will failover or return 502 (v2.1.295)
• Added support for user settings forceLoginMethod: "gateway" and forceLoginGatewayUrl: Can be specified on machines without managed settings, and /login will open with that gateway (v2.1.295)
• Added request ID to audit events and responses: The inference audit event now includes upstream_request_id, which is the request ID for upstreams such as Amazon Bedrock and the Anthropic API. Successful inference responses include a request-id header, allowing correlation between Claude Code telemetry request_id and gateway audit logs (v2.1.295)

Mods / Plugins

• Added $.ui.notify for mods: Sends a native notification through the user's own notification settings and indicates which channel it was sent from (v2.1.295)
• Added child elements to mod Button: Can now hold strings and Text as child elements, allowing a single row in a list to become a single pressable element containing chips or faded supplemental text (v2.1.295)
• Warning when the config file that claude plugin writes to is not being loaded: Displays a warning when install, enable, disable, or marketplace add writes to a config file that is not being loaded (v2.1.295)
• claude plugin validate guides README installation lines: For plugins without an installation line in the README, shows the line to paste. The exit code does not change when --strict is specified (v2.1.295)

VS Code Extension / Claude Tag

• [VS Code] Added chat row for files sent by Claude: Clicking the filename opens it in the editor, and Claude's caption is displayed below. This row remains visible in the Focus view as well (v2.1.295)
• [Claude Tag] Show confirmation before adding channel admins: Adding a channel admin in managed settings may move that member to the Custom role and remove other access rights, so a confirmation is displayed before adding (v2.1.295)

Improvements

Hooks / Mods

• Improved judgment for prompt hooks on Stop / SubagentStop: Improved judgment when written as instructions (e.g., "Carry on if the build is broken"), making it less likely for Claude to stop early (v2.1.294)
• Changed display when mod rejects a call after tool execution: The tool is executed, and Claude and the user are now informed that the plugin has put the result on hold (v2.1.295)
• Organization mod toasts now display first: Displayed before other mods' toasts rather than waiting behind them (v2.1.295)
• Improved var rebinding error in hook modules: Errors in claude plugin validate and plugin loading now show the line that is rebinding, the cause, and how to address it (v2.1.295)
• Improved built-in plugin-authoring skill: No longer instructs sessions without a terminal to run terminal commands, and explains mod sharing only when asked (v2.1.295)

Claude apps gateway

• Using CountTokens API to retrieve token counts on Amazon Bedrock: Token counts used for /context and large file loading are now retrieved from the AWS CountTokens API instead of a 1-token model request. Requires granting bedrock:CountTokens permission (v2.1.295)
• Using Haiku 4.5 for background requests: Uses Haiku 4.5 instead of the session model, and falls back to the session model if the gateway does not provide Haiku 4.5 (v2.1.295)
• Improved handling of models in Bedrock regions outside the US geography: For models not listed in models:, AWS previously always rejected requests, but gateway will now try the model in the user's own region and, if rejected, indicates the model name to add (v2.1.295)
• Output warning while PostgreSQL is read-only: Logs a warning every 30 seconds indicating what will fail and how to recover (v2.1.295)
• Now delivering unknown desktop policy keys: Keys not in the bundled Claude Desktop schema now start and are delivered with a warning, eliminating the need for gateway upgrades for new Desktop settings (v2.1.295)

Tools / MCP

• Changed truncation point for MCP tool descriptions loaded in tool search: Changed from 2,048 characters to 16,384 characters (v2.1.295)
• Grep now executes searches with -l, -c, -r flags: Searches sent with these flags now execute without failing (v2.1.295)
• Improved Workflow tool scriptPath rejection message: Guides users toward inline specification via script, which can be used even in sessions without the Read tool (v2.1.295)
• Improved communication when large file uploads fail: When a failure occurs for an unknown reason, Claude reports the failure without reducing the file (v2.1.295)
• MCP tools now displayed with readable names in permission confirmation pending status: Shown with server name and readable name instead of mcp__server__tool format identifiers in Remote Control, claude.ai, and desktop apps (v2.1.295)
• rate_limit_event warning now shows whether additional usage is available: The headless usage limit warning now indicates whether the account has extra usage enabled (v2.1.295)

Display

• Changed tab position to be counted from the start of text: In responses with 2-character indentation, the first tab stop is now 8 cells from the start of the text (previously 6 cells) (v2.1.295)
• Artifact pages without a background now display in white: Displayed with a white background instead of off-white (v2.1.295)

Cloud Sessions / Claude Tag

• [Cloud Sessions] Activity after disconnection now displayed all at once: Missed activity is now displayed all at once instead of line by line (v2.1.295)
• [Cloud Sessions] Improved setup script field: Now taller by default, expands to fit the script, and can be resized by dragging (v2.1.295)
• [Claude Tag] Changed how long settings confirmation cards stay open: The settings confirmation card posted to Slack channels now stays open for 30 minutes instead of 10 (v2.1.295)
• [Claude Tag] Changed notifications for shared channels in Enterprise Grid: The notification about using organization defaults is now posted at most once a month, and only when someone mentions Claude (v2.1.295)

Security

• Fixed missed judgment in prompt / agent hooks written as instructions: Fixed an issue where operations that should be blocked were being allowed (v2.1.294)
• Fixed --tools and --restricted not being applied: Fixed an issue where they were not applied to built-in tools registered after startup, and an issue where deprecated tool names reached tools outside the caller's tool set (v2.1.295)
• Fixed truncated tool inputs being passed to mod hooks: Deeply nested tool inputs were being silently truncated partway through, potentially allowing guard processing to pass content it had not examined (v2.1.295)
• Fixed calls made by mods during reload passing through another mod's guard hooks: Calls made by a mod during reload due to plugin hook worker restart were passing through another mod's guard hook that has .catch. Such calls are now rejected (v2.1.295)
• Fixed prompts rewritten by prompt.submit hooks being saved with original content: Prompts rewritten or discarded by a mod's prompt.submit hook were being saved as-is in prompt history and the transcript's queued prompt record (v2.1.295)
• Fixed personal plugins being treated as organization-managed with a tampered managed settings cache: This was occurring on machines where plugins were enumerated and enabled in managed settings (v2.1.295)
• Fixed deny rules for Claude in Chrome specifying port 80: Deny rules for sites written as host:80 were not being applied to http:// pages for that host (v2.1.295)
• Fixed Bash permission check for for-loops targeting glob patterns: Improved accuracy of permission checks (v2.1.295)
• Fixed links rendered with invisible addresses: Raw terminal hyperlink byte sequences in responses and teammate messages were being rendered as clickable links with invisible addresses (v2.1.295)
• Changed Artifact tool permission confirmation when telemetry is disabled: Changed from confirming every time someone else's Artifact is read or data is edited to the same 5 questions as other installations (v2.1.295)
• Changed publishing of Artifacts in routine execution when telemetry is disabled: Scheduled execution and Run now routine execution now publishes new private Artifacts and updates own Artifacts without confirmation, same as other installations (v2.1.295)

Fixes (Notable)

Highlighting fixes related to stability and usability.

• Fixed [1m] model requests failing in environments that reject the context-1m beta: When gateway, Bedrock, Vertex, or Foundry rejects the context-1m beta, retries without the beta designation (v2.1.295)
• Fixed missing earlier responses in claude -p text output: Was occurring when background work started another turn. Each turn's response is now output when that turn ends (v2.1.295)
• Fixed remote MCP server reconnection for headless/SDK sessions: Fixed an issue where the server would remain disconnected after outages exceeding 15 seconds, and an issue where reconnection was attempted in rapid succession to servers that disconnect immediately after connecting. If disconnection continues, the interval is extended to up to 30 seconds (v2.1.295)
• Fixed MCP tool-returned files being saved as .bin: CSS, JavaScript, and XML files were being saved as .bin and could not be read with the Read tool. Font and icon files now receive their respective extensions (v2.1.295)
• Fixed marketplace being deleted without confirmation in /plugin Errors tab: A marketplace that failed to load was being deleted with Enter and its plugins were being uninstalled (v2.1.295)
• Fixed subsequent calls starting before subagent completion with CLAUDE_AUTO_BACKGROUND_TASKS: Subagents with edits or shell commands waiting in the background were being moved to background, and their calls were starting before the subagent completed (v2.1.295)
• Fixed parent session git information being passed to worktree subagents: Subagents running in dedicated linked worktrees were being passed the parent session's git branch, status, and recent commits (v2.1.295)
• Fixed files that produced no output in Bash being marked as read: After commands such as cat ran without producing output, those files were being treated as read (v2.1.295)
• Fixed skill allowed-tools and effort being lost: Was occurring when the Skill tool completed before the response stream ended, causing skill Bash commands to be rejected in -p execution (v2.1.295)
• Fixed terminal freezing with responses of tens of thousands of lines: Ctrl+C was also becoming unresponsive (v2.1.295)
• Fixed terminal freezing during syntax highlighting: Code containing very long lines, extended runs of blank lines, or unclosed strings and heredocs was causing freezes lasting seconds to minutes (v2.1.295)
• Fixed web search and agent hook evaluation taking a long time with xhigh / max effort: Was taking significantly longer than expected (v2.1.295)
• [VS Code] Fixed typed text being sent to the wrong conversation: When two Claude views were displayed simultaneously, keyboard focus could switch between them, causing typed text to be sent to the wrong conversation (v2.1.295)
• A quietly appreciated fix: Fixed an issue on macOS where starting a session in the home folder or a parent directory could cause the startup file count to reach other apps' data, potentially triggering an "access data from other apps" confirmation prompt (v2.1.295). For those who often launch claude in the home folder, I think this fix will reduce the sudden appearance of confirmation dialogs.
• In addition, numerous minor bugs have been fixed related to MCP connections, mod hot reloading, session resume and rollback, /loop and scheduled tasks, handling of Windows drive letters, Code Review, Claude Tag, cloud sessions, and more. See the CHANGELOG for all items.

Breaking Changes

There are 6 breaking changes, all in v2.1.295. The before/after examples below are based on the CHANGELOG descriptions; the pre-change behavior is described to the extent it can be inferred from the CHANGELOG. There are no deprecated items in this scope.

Subagents now pre-load a maximum of 32 skills (v2.1.295)

Subagents now pre-load a maximum of 32 skills from the skills field, once per skill. Subagents with the Skill tool can still call the remaining skills. Below is an example with 40 skills listed.

Before (up to v2.1.294):

40 skills listed in subagent's skills field (example)

→ No 32-skill pre-load limit

After (v2.1.295 onward):

40 skills listed in subagent's skills field (example)
→ Pre-load is limited to 32 skills, once per skill
→ Subagents with the Skill tool can still call the remaining skills

Ctrl+C in an attached background session no longer cancels /loop wakeups (v2.1.295)

Pressing Ctrl+C at the idle prompt of an attached background session no longer cancels pending /loop wakeups. Pressing it twice detaches, and the loop continues running. Press Esc to stop the loop.

Before (up to v2.1.294):

Ctrl+C at idle prompt of attached background session
→ Pending /loop wakeup is cancelled

After (v2.1.295 onward):

Ctrl+C → Pending /loop wakeup is unaffected
Ctrl+C ×2 → Detaches (loop continues running)
Esc → Stops the loop

Stopping claude agents along with the background service now causes running sessions to stop in approximately 1 minute (v2.1.295)

On macOS, or Linux without a service installed, stopping claude agents along with the background service will cause running sessions to stop in approximately 1 minute unless claude agents is run again. A notification to this effect is also displayed. The pre-change behavior is not described in the CHANGELOG.

Before (up to v2.1.294):

Stop claude agents along with background service
→ Handling of running sessions not described in CHANGELOG

After (v2.1.295 onward):

Stop claude agents along with background service
→ Running sessions stop in approximately 1 minute unless claude agents is run again
→ A notification to this effect is displayed

The claude.ai connector now negotiates MCP protocol version 2026-07-28 by default (v2.1.295)

For installations that do not fetch flags, the claude.ai connector now negotiates MCP protocol version 2026-07-28 by default. You can opt out with MCP_PROTOCOL_NEGOTIATION=legacy. Below is a configuration example (environment variable name and value are as stated in the CHANGELOG).

Before (up to v2.1.294):

# claude.ai connector on installations that don't fetch flags
# → Does not negotiate MCP protocol version 2026-07-28 by default

After (v2.1.295 onward):

# Negotiates MCP protocol version 2026-07-28 by default
# To opt out:
export MCP_PROTOCOL_NEGOTIATION=legacy
claude

Receiving a message exceeding 16 MiB from a WebSocket MCP server now closes the connection (v2.1.295)

For WebSocket (ws) MCP servers, messages exceeding 16 MiB are now closed without parsing. The same limit already applied to other transports.

Before (up to v2.1.294):

Receive a message exceeding 16 MiB from a WebSocket (ws) MCP server
→ Message is parsed

After (v2.1.295 onward):

Receive a message exceeding 16 MiB from a WebSocket (ws) MCP server
→ Connection is closed without parsing (same limit as other transports)

Self-hosted runners no longer pass CCR_AUTO_MODE_ALLOW and other environment variables to sessions (v2.1.295)

Self-hosted runners no longer pass CCR_AUTO_MODE_ALLOW, CCR_AUTO_MODE_ENVIRONMENT, or CCR_AUTO_MODE_SOFT_DENY to the session environment. Below is an example of checking values inside a session.

Before (up to v2.1.294):

# Inside a session started by a self-hosted runner (example)
echo "$CCR_AUTO_MODE_ALLOW"   # Value passed from runner is present

After (v2.1.295 onward):

# Inside a session started by a self-hosted runner (example)
echo "$CCR_AUTO_MODE_ALLOW"   # No longer passed from runner
# CCR_AUTO_MODE_ENVIRONMENT / CCR_AUTO_MODE_SOFT_DENY are the same

Trying out hooks' onFailure: "block"

In Claude Code v2.1.295, onFailure: "block" was added to command hooks and HTTP hooks. The CHANGELOG describes that if a hook fails to launch, times out, or exits with an unexpected exit code, it blocks the operation without letting it through.

In this test, I prepare a UserPromptSubmit hook that exits with code 1, and use claude -p to verify how the prompt is handled when onFailure is not specified versus when onFailure: "block" is specified.

What this test verifies

• When onFailure is not specified, the prompt is sent to Claude and a response is returned even if a hook exits with code 1
• When onFailure: "block" is specified, the same hook blocks the prompt and no response is returned
• In both cases, the exit code of claude -p is 0

Only the "unexpected exit code (exit 1)" case is verified. The cases where a hook fails to launch or times out are not covered.

Step 1: Create a temporary working directory

Work in an empty directory with no project settings (.claude/settings.json, etc.). Since --setting-sources project is specified from Step 4 onward, any project settings in the working directory will also be loaded.

% WORKDIR=$(mktemp -d)
% cd "$WORKDIR"
% pwd
/var/folders/pk/lwtwfbyd5svbgb_4jry_tghr0000gn/T/tmp.GC2Q9xVhdQ

Step 2: Create two settings files

Create two settings files that register a command hook on UserPromptSubmit that only runs exit 1. The only difference is the presence or absence of "onFailure": "block".

Settings file without onFailure:

cat > settings-default.json <<'EOF'
{
  "hooks": {
    "UserPromptSubmit": [
      {
        "hooks": [
          { "type": "command", "command": "exit 1" }
        ]
      }
    ]
  }
}
EOF

Settings file with onFailure: "block":

cat > settings-block.json <<'EOF'
{
  "hooks": {
    "UserPromptSubmit": [
      {
        "hooks": [
          { "type": "command", "command": "exit 1", "onFailure": "block" }
        ]
      }
    ]
  }
}
EOF

The meaning of each key is as follows.

The official documentation's hooks page explains that for many hook events, exit codes other than 2 do not block on their own—if a hook exits with code 1 while stdout is empty, processing continues as a non-blocking error. The exit 1 in this test falls into this case.

Step 3: Run without onFailure

% claude -p --max-turns 1 --setting-sources project --strict-mcp-config --settings ./settings-default.json "Please respond with just OK" 2>&1; echo "exit=$?"

Result:

OK
exit=0

Even though the hook exited with code 1, processing continued and Claude's response OK was returned.

The options specified in the command are as follows (descriptions are based on the official CLI reference).

Step 4: Run with onFailure: "block"

Use the same command as Step 3, changing only the file passed to --settings to settings-block.json.

% claude -p --max-turns 1 --setting-sources project --strict-mcp-config --settings ./settings-block.json "Please respond with just OK" 2>&1; echo "exit=$?"

Result:

UserPromptSubmit operation blocked by hook:
[exit 1]: failed; blocking because onFailure is "block"
No stderr output
exit=0

UserPromptSubmit operation blocked by hook: was displayed, the prompt was blocked, and no response from Claude was returned. Each line of the output indicates the following.

Step 5: Compare results

• Even with the same hook exit code of 1, specifying onFailure: "block" blocked the prompt.
• The claude -p exit code was 0 even when blocked. When determining from a shell script whether a prompt was blocked, it is necessary to check the output content rather than the exit code.

In both executions, the claude -p exit code was 0. Note that only the unexpected exit code (exit 1) case was verified here; the cases where a hook fails to launch or times out were not tested.

On the other hand, since script bugs or missing dependent commands can also stop prompts, I think it is best to limit hooks with this setting to those with stable behavior. Also, since the claude -p exit code was 0 even for blocked executions, checking output content will be necessary when determining results from a script.

Closing

In v2.1.294 and v2.1.295, fixes to missed judgment in hooks written as instructions continued alongside the addition of onFailure: "block", which stops operations when a hook itself fails. For those using hooks as guards, I think this is a good opportunity to review existing hook settings.

If you are using hooks, why not update and try out onFailure: "block"?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://code.claude.com/docs/en/hooks

https://code.claude.com/docs/en/settings

https://dev.classmethod.jp/articles/20261008-cc-updates-v2-1-293/