Claude Code v2.1.297 to v2.1.299 Major Updates - Addition of Idle Compaction and Fix for Write Character Encoding Conversion

This is Ishikawa from the Cloud Business Division. I'll summarize the Claude Code updates from v2.1.297 to v2.1.299. The only version published in this range is v2.1.299 (released 2026-10-14). This article organizes the changes by type and presents the results of actually testing Read on a BOM-prefixed UTF-16LE file and Write to a Shift-JIS file.

The previous update article is here.

https://dev.classmethod.jp/articles/20261010-cc-updates-v2-1-296/

Update Summary

v2.1.299 includes 190 changes. Broken down by the categories used in this article: 113 fixes, 21 security, 17 new features, 14 breaking changes, 12 improvements, 9 developer experience, 3 performance, and 1 deprecation. The release contains many fixes related to sandbox, permission rules, hooks, and mods, along with changes to MCP and hook behavior. There are also changes outside the CLI, including VS Code extension (5), cloud sessions (6), and Claude Tag (6).

Notable Updates

Idle Compaction (New Feature · v2.1.299)

Idle compaction has been added to the terminal. If a conversation with 200,000 or more tokens is left idle for about 54 minutes, the conversation will be compacted before the 1-hour prompt cache expires. This means the next message you send won't require reprocessing the entire conversation.

The minimum token count (default: 200K) can be changed via the environment variable CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS. Writing the following in settings.json will disable it. The CHANGELOG notes that v2.1.290 or later is required for both.

{
  "idleCompaction": false
}

While this is a new feature, it could also be considered a breaking change, so please take note.

CLAUDE_CODE_DISABLE_FILE_MENTIONS for Passing @ Mentions as Paths (New Feature · v2.1.299)

The environment variable CLAUDE_CODE_DISABLE_FILE_MENTIONS has been added. When set, instead of the content of files mentioned with @, their paths are passed to Claude, and Claude reads them using the file tool.

Fix for Character Encoding Handling in Read and Write (Bug Fix · v2.1.299)

Fixes were made for Read corrupting BOM-prefixed UTF-16LE files, Write dropping BOMs, and Write silently converting Windows-1252, Shift-JIS, GBK, and UTF-16BE files to UTF-8. Write to Windows-1252, Shift-JIS, GBK, and UTF-16BE files will now be rejected. The behavior is verified later in "Testing the Character Encoding Fix for Read and Write," and the before/after changes are summarized in the "Breaking Changes and Deprecations" section.

Fix for Truncated Responses at Output Token Limit Silently Ending (Bug Fix · v2.1.299)

A bug was fixed where, after a request fell back to non-streaming mode, responses truncated at the output token limit would end the turn without retrying or raising an error.

Changes to MCP Allow/Deny Rules and Agent tools: (Security · v2.1.299)

MCP allow rules now apply only to the server whose name is specified. mcp__a will no longer allow servers named a__b or a_. Use the full normalized name with mcp__<server>__*. The agent tools: list will also now target only the tools of the specified MCP server.

Additionally, a bug has been fixed where mcp__<server> deny and ask rules were not being applied for MCP servers whose normalized names contained double underscores. The before/after changes are summarized in the "Breaking Changes and Deprecations" section.

Sandbox Fixes (Security · v2.1.299)

On macOS, a bug was fixed where, if a denied path went through a symbolic link, a sandboxed command could read or write to the denied path by specifying the real location.

A bug was also fixed where shell commands inside the sandbox could write to the --plugin-dir folder. Code in that folder is reloaded by Claude Code and executed outside the sandbox.

Fix for Third-Party Gateway API Keys Being Sent (Security · v2.1.299)

A bug was fixed where API keys configured for third-party gateways (ANTHROPIC_BASE_URL) were being included in requests to Anthropic for feature flags, startup, fast mode, profiles, and feedback. Anthropic API keys will continue to be sent.

A bug was also fixed where, when ANTHROPIC_BASE_URL was set in a managed settings file, the gateway API key was being included in server-managed settings requests to Anthropic.

Target Versions and Period

Release dates are based on npm publication times (v2.1.299: 2026-10-14T00:23:19Z). All changes listed in the sections from "New Features" through "Breaking Changes and Deprecations" below are from v2.1.299.

New Features

• Idle compaction has been added to the terminal. A conversation with 200,000 or more tokens left idle for about 54 minutes will be compacted before the 1-hour prompt cache expires.
• The environment variable CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS now allows changing the minimum token count for idle compaction (default: 200K). It can be disabled with "idleCompaction": false in settings.json.
• The environment variable CLAUDE_CODE_DISABLE_FILE_MENTIONS has been added. When set, files mentioned with @ pass their paths to Claude instead of their contents.
• Warnings related to max effort, workflows, always-loaded context, and large tool results have been added to /usage.
• /effort and /fast can now be used in agent view to specify settings at the start of a new session. Running /model, /effort, or /fast without arguments in agent view opens a picker.
• When bypass permissions is available and plan mode does not confirm before most edits or commands, this is now shown once.
• Background sessions started with --safe-mode now display a "safe mode" line in the peek panel of agents view.
• claude plugin eval has a new --disallow-tools option and case field disallowed_tools. This allows excluding specific built-in tools like Agent from eval runs.
• claude self-hosted-runner orchestrator has a new --shutdown-drain-sec option. Upon receiving SIGTERM, it stops polling and gives in-progress polling and running spawn hooks up to the specified number of seconds to complete.
• Setting CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway code policy can now disable the attribution block in the Claude Desktop Code tab. Claude Code sessions via the Claude apps gateway now include additional fields in the attribution block, and CLAUDE_CODE_ATTRIBUTION_HEADER=0 can remove the block.
• For mods installed via managed settings, $.prompt.media (which lets prompt.submit hooks read bytes of images and documents attached to the prompt) and $.session.identity() (which returns session sign-in method and other info) have been added. $.session.identity() also returns the organization and email address if that organization is included in the managed forceLoginOrgUUID.
• Text in mods now supports size, weight, mono, and tabular, and Box now supports named spacing (xs through xl). bold is now deprecated (see the "Breaking Changes and Deprecations" section).
• Information received by the mod skill.prompt hook now includes the skill's frontmatter, source, plugin name, and file path. The session.append hook now has a queue door added, allowing the transcript queue record to have different content from the submitted prompt.
• /plugin and claude plugin validate now show by name the mod hooks that are skipped in environments where Claude Code is managed by an organization.
• [Claude Tag] Claude in Slack can now delete canvases it created in a channel upon request.

Improvements

• Memory and disk usage when mentioning PDFs with @ has been improved. PDF bytes are no longer retained in the session transcript.
• The effort level for page reading in WebFetch is now selected the same way as web search. When read by the calling model, it uses the caller's level; otherwise, it uses the level settings give to the small model.
• Tool descriptions and server instructions for Anthropic first-party MCP servers at api.anthropic.com are no longer cut at 4,096 characters and are delivered to Claude in full.
• Side queries via /btw in non-interactive sessions now return a timeout error if no response is received after 11 minutes.
• Background agent notifications now indicate when they are only waiting for their own background processing, when they received a message too late for a result, or when they stopped due to usage limits.
• The number of published artifacts that a local session can watch simultaneously (artifact watching) has increased from 10 to 25.
• /reload-skills now indicates that it is resending the entire skill list to Claude. This command is used to restore skills after compaction.
• When Claude incorrectly prefixes a skill name with anthropic-skills:, the "Unknown skill" error from the Skill tool now suggests the skill name from the list.
• The startup warning for unrecognized model IDs has changed from a long raw message to a short single line below the welcome banner (with a link to documentation).
• Error messages when a worktree cannot be created have been improved. If the base commit cannot be resolved, it now shows how the query ended and possible reasons (such as a repository with no commits); if creation was attempted at the root of a bare repository configuration, it shows an explanation of the configuration.
• When a cloud session is rejected because the claude.ai login is denied or expired, the error now guides the user to re-sign-in with claude auth login.
• In sandboxed Bash on Linux, Esc and Ctrl-C now work while wildcard read rules for commands are being expanded.
• In Cowork cloud sessions outside auto mode, if Claude in Chrome activity on an approved site is detected by the safety classifier, it will now ask for confirmation instead of rejecting (unless managed settings apply).
• The resume command shown at the end of a worktree session now uses -w and -r when long flags don't fit the terminal width. If neither fits with the retained worktree, the execution location is shown on the line above.
• [VSCode] Startup time has been improved by launching Claude while the Python extension loads in workspaces without a Python environment. When reopening a previously opened folder in a new window, the model picker and slash command menu now appear immediately.
• Additionally, changes have been made to mod sharing instructions in the plugin-authoring skill, self-hosted runner setup and doctor display, cyber-related safety measure notifications, display of deploy commands and routine handling during deletion in self-hosted environments, and instructions for correcting messages and joining large channels in Claude in Slack.

Security

• Fixed bug where deny/ask rules were not applied to MCP servers: For MCP servers whose normalized names contained double underscores, mcp__<server> deny and ask rules were not being applied.
• Fixed bug on macOS where denied paths could be accessed via symbolic links in sandbox: If a denied path went through a symbolic link, sandboxed commands could read or write to the denied path by specifying the real location.
• Fixed discrepancy in glob rule interpretation and missing re-checks in sandbox: denyRead/allowRead globs containing braces, parentheses, or backslashes in folder names were being interpreted differently between Claude Code's settings check and the sandbox. Also, glob-format allowRead/allowWrite entries were not being re-checked when the origin directory was replaced with a symbolic link.
• Fixed bug allowing writes to --plugin-dir from sandbox: Shell commands inside the sandbox could write to the --plugin-dir folder. Code in that folder is reloaded by Claude Code and executed outside the sandbox.
• Fixed bug where plan mode executed writes allowed by hooks: Writes (MCP tools, files, shell commands) allowed by PreToolUse hooks or mod tool.check hooks were being executed in plan mode.
• Fixed bug where hooks fail open on Windows: When Git for Windows was not installed, PreToolUse and PermissionRequest hooks without a specified shell would fail open. Failed guards now block the call.
• Fixed bug where third-party gateway API keys were included in requests to Anthropic: This affected feature flag, startup, fast mode, profile, and feedback requests, as well as server-managed settings requests when ANTHROPIC_BASE_URL was set in a managed settings file.
• Fixed bug where mods could be created without confirmation in accept-edits mode: When the config directory path did not contain .claude, the Write and Edit tools could create mods in the session's mods folder without confirmation in accept-edits mode.
• Fixed bugs where managed settings and guards could be bypassed by mods: __proto__ keys are now silently removed from values passed to mod hooks, fixing a bug where tool.check guards could be skipped for tool calls made by other mods, and a bug where $.env.set from user-installed mods could change the environment and shell prefix used when managed settings command hooks start. Enforcement of managed permission rules, managed hooks, and organization MCP tool names against user-installed mods has also been improved.
• Fixed bug where rm confirmation appeared in unnecessary situations: rm confirmation was appearing for shell -c scripts that didn't execute rm. rm commands assembled at runtime inside scripts that Claude Code cannot read will no longer prompt for confirmation unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1 is set.
• Changed resume command at exit to use session ID: The resume command shown at exit now specifies the session by ID instead of name. The CHANGELOG states this prevents content in session names from being executed when the line is pasted.
• Additional security fixes include MCP server policy checks, model restrictions in Claude apps gateway, credentials remaining in agent teammate task descriptions, worktree isolation guards, and /ultrareview error messages.

Fixes (Major)

A selection of fixes primarily related to stability and usability.

• Fixed character encoding handling in Read and Write: Fixed a bug where Read was corrupting BOM-prefixed UTF-16LE files, Write was dropping BOMs, and Write was silently converting Windows-1252, Shift-JIS, GBK, and UTF-16BE files to UTF-8. Write to Windows-1252, Shift-JIS, GBK, and UTF-16BE files is now rejected.
• Fixed truncated responses at output token limit silently ending: After falling back to non-streaming mode, responses truncated at the output token limit were ending the turn without retrying or raising an error.
• Fixed approved tool calls executing twice: When new messages arrived at session resume after restart, cloud and headless sessions would sometimes execute approved tool calls twice (regression from 2.1.296).
• Fixed settings files being ignored: If enabledMcpjsonServers or disabledMcpjsonServers contained a single server name as a string instead of an array, that settings file was being ignored.
• Fixed claude -p not outputting settings validation errors: When a settings file failed validation, claude -p was producing no output. For text output runs, it now shows the relevant file and invalid entries on stderr.
• Fixed communication issues via custom ANTHROPIC_BASE_URL: A bug where streams were interrupted after 180 seconds of no data has been fixed; the wait is now 300 seconds. Also fixed is an issue where sessions using gateway-specific model names were terminating around 200,000 tokens with "Prompt is too long · automatic compaction failed."
• Fixed MCP HTTP connections hanging: When a server didn't finish the response body for a notification, MCP connections over HTTP would hang for 30 seconds before failing (anthropics/claude-code#99014).
• Fixed configured headers not being sent during MCP OAuth: headers and headersHelper values were not being sent during OAuth sign-in, token refresh, and sign-out, preventing use of MCP servers behind authentication proxies.
• Fixed usage exceeding 100% in display: /usage, approaching-limit warnings (terminal and VS Code), and the status line could display usage above 100% (anthropics/claude-code#92238).
• Fixed scheduled tasks firing repeatedly at end of daylight saving time: During the repeated hour at the end of daylight saving time, scheduled tasks and loops were firing every turn or firing early.
• Fixed Bash commands showing "command not found" on Windows: If Git Bash didn't report its PATH at startup, Bash commands would fail with "command not found" for the entire session.
• Additionally, numerous minor bugs have been fixed related to Remote Control and cloud sessions, mods and plugins, image attachments, CJK and emoji display, the VS Code extension, Claude Tag, and more.

Breaking Changes and Deprecations

This release includes 15 behavior changes and 1 deprecation. One of the behavior changes is the Write character encoding fix, which was categorized as a fix. The before/after descriptions below are explanatory examples based on the CHANGELOG entries.

MCP Allow Rules Now Apply Only to the Named Server

Allow rules like mcp__a now apply only to the server named a. For servers whose names contain __, use the full normalized name with mcp__<server>__*. The server names a, a__b, and a_ in the examples follow the CHANGELOG's notation.

Before (up to v2.1.296):

Example: Writing mcp__a as an MCP allow rule
→ In addition to a, servers named a__b or a_ are also allowed

After (v2.1.299 and later):

Example: Writing mcp__a as an MCP allow rule
→ Only a is allowed; a__b and a_ are not
To allow a__b, use the full normalized name: mcp__a__b__*

Agent tools: Now Targets Only the Tools of the Specified MCP Server

MCP server specifications written in an agent's tools: list now target only that server's tools. For servers whose names contain __, write mcp__<whole name>__*.

Before (up to v2.1.296):

Example: Writing mcp__a in an agent's tools:
→ Tools from MCP servers other than the specified a could also be targeted

After (v2.1.299 and later):

Example: Writing mcp__a in an agent's tools:
→ Only tools from a are targeted
For servers with __ in the name (e.g., a__b), write mcp__a__b__*

UserPromptSubmit Hook Now Runs Before Skill and Custom Slash Command Expansion

The UserPromptSubmit hook now runs before skill and custom slash command expansion. Hooks that block prompts also stop any embedded shell commands.

Before (up to v2.1.296):

Example: Submitting a custom slash command containing an embedded shell command

1. The custom slash command is expanded and the embedded shell command is executed
2. The UserPromptSubmit hook runs
   → Even if the hook blocks the prompt, the embedded shell command in step 1 is not stopped

After (v2.1.299 and later):

Example: Submitting a custom slash command containing an embedded shell command

1. The UserPromptSubmit hook runs
   → If the hook blocks the prompt, it stops here
2. The custom slash command is expanded and the embedded shell command is executed

Additionally, UserPromptSubmit hooks written in a skill's own frontmatter now run starting from the prompt after the one that invoked the skill.

Write Now Rejects Writing to Shift-JIS and Similar Files

As part of the fix for Write silently converting Windows-1252, Shift-JIS, GBK, and UTF-16BE files to UTF-8, Write to these files is now rejected. In the verification in "Testing the Character Encoding Fix for Read and Write" (test 2), Claude explained this before calling Write, and sjis.txt remained unchanged in Shift-JIS.

Before (up to v2.1.296):

Example: Rewriting sjis.txt saved in Shift-JIS using Write
→ The write proceeds and the file is silently converted to UTF-8

After (v2.1.299 and later):

Example: Rewriting sjis.txt saved in Shift-JIS using Write
→ Write rejects the write and the file remains unchanged in Shift-JIS

Other Behavior Changes and Deprecations

"Not documented" in the Before column indicates that the previous behavior is not described in the CHANGELOG.

Testing the Character Encoding Fix for Read and Write

I'll verify the character encoding fix introduced in the notable update using Claude Code v2.1.299 in interactive mode. The two points to verify are:

• That Read returns a BOM-prefixed UTF-16LE file with Japanese text intact
• That requesting Write to overwrite a Shift-JIS file does not convert the file to UTF-8

The test environment is Claude Code v2.1.299 (the same version covered in this article), the model is claude-opus-5-5, and the OS is macOS. The test was run on 2026-10-14.

Step 1: Create a Working Directory

Create an empty directory for test files and results, then navigate to it. All subsequent steps are run from this directory.

% mkdir enc-test
% cd enc-test

Step 2: Create Test Files

Create utf16.txt in BOM-prefixed UTF-16LE and sjis.txt in Shift-JIS (Python's cp932). Both files have the same 2 lines of content. The -I flag in python3 is an option that runs Python without reading Python-related environment variables or modules from the current directory.

% python3 -I -c "
text = 'こんにちは、世界\n2 行目のテキスト\n'
open('utf16.txt','wb').write(b'\xff\xfe' + text.encode('utf-16-le'))
open('sjis.txt','wb').write(text.encode('cp932'))
"

Verify the file types and leading bytes of the created files. The first 2 bytes of utf16.txt (fffe) are the BOM.

% file utf16.txt sjis.txt
utf16.txt: Unicode text, UTF-16, little-endian text
sjis.txt:  Non-ISO extended-ASCII text
% xxd utf16.txt | head -2
00000000: fffe 5330 9330 6b30 6130 6f30 0130 164e  ..S0.0k0a0o0.0.N
00000010: 4c75 0a00 3200 2000 4c88 ee76 6e30 c630  Lu..2. .L..vn0.0
% xxd sjis.txt | head -2
00000000: 82b1 82f1 82c9 82bf 82cd 8141 90a2 8a45  ...........A...E
00000010: 0a32 208d 7396 da82 cc83 6583 4c83 5883  .2 .s.....e.L.X.

Step 3: Read the BOM-Prefixed UTF-16LE File with Read (Test 1)

Have Read read utf16.txt. Only the Read tool is allowed. Start Claude Code with the following options.

% claude --setting-sources project --strict-mcp-config --allowedTools Read

Enter and submit the prompt utf16.txt を Read ツールで読んでください。.

The Read tool successfully read the UTF-16 file without any garbled text (line 3 is an empty line).

Step 4: Request Write to Overwrite the Shift-JIS File (Test 2)

Next, request to overwrite sjis.txt using Write. Only the Write tool is allowed. To finish in a single tool call, the file content is passed by mentioning it with @sjis.txt. Start Claude Code with the following options.

% claude --setting-sources project --strict-mcp-config --allowedTools Write

Enter and submit the prompt @sjis.txt Bash は使わず、Write ツールを呼び出して、このファイルを「こんにちは、Claude Code」という 1 行に書き換えてください。.

Claude responded without calling Write. It explained that sjis.txt is saved in Shift-JIS and that Write rejects writing to non-UTF-8 files, then asked whether to convert to UTF-8 or to allow Bash so it could write in Shift-JIS using iconv or similar.

Verify the file type and leading bytes after making the request. The results are the same as in Step 2, and sjis.txt remains unchanged in Shift-JIS.

% file utf16.txt sjis.txt
utf16.txt: Unicode text, UTF-16, little-endian text
sjis.txt:  Non-ISO extended-ASCII text
% xxd utf16.txt | head -2
00000000: fffe 5330 9330 6b30 6130 6f30 0130 164e  ..S0.0k0a0o0.0.N
00000010: 4c75 0a00 3200 2000 4c88 ee76 6e30 c630  Lu..2. .L..vn0.0
% xxd sjis.txt | head -2
00000000: 82b1 82f1 82c9 82bf 82cd 8141 90a2 8a45  ...........A...E
00000010: 0a32 208d 7396 da82 cc83 6583 4c83 5883  .2 .s.....e.L.X.

Closing

The only version published in the v2.1.297–v2.1.299 range is v2.1.299, which includes 190 changes. Idle compaction and CLAUDE_CODE_DISABLE_FILE_MENTIONS were added, and Write now rejects rather than silently converts Shift-JIS and similar files to UTF-8. The release also includes behavior changes to existing settings, such as MCP allow rules, agent tools:, and the execution order of UserPromptSubmit hooks.

If you configure MCP server permission rules or hooks, or work with Shift-JIS or similar files, update and check out any changes that concern you.