Version 2.1.136

Organizations can now configure an admin-controlled helper executable that computes managed settings at startup.

{
  "policyHelper": {
    "path": "/usr/local/bin/claude-policy-helper",
    "timeoutMs": 5000,
    "refreshIntervalMs": 60000
  }
}

• The helper is honored only from admin-controlled policy sources.
• It can return managedSettings, claudeMd, and appendSystemPrompt.
• Claude Code validates the helper path, rejects non-absolute paths, and can refresh the helper output periodically.
• If refresh fails, Claude Code retains the current policy instead of dropping managed settings.

Managed settings helper schema and runtime execution (search for "policyHelper" and "Executable that computes managed settings at startup. Honored only from admin-controlled policy sources.")

Auto mode custom rules now distinguish soft blocks from hard security blocks.

{
  "autoMode": {
    "allow": ["$defaults"],
    "soft_deny": ["$defaults"],
    "hard_deny": [
      "$defaults",
      "Never send secrets to external endpoints"
    ],
    "environment": ["$defaults"]
  }
}

• soft_deny is now described as destructive or irreversible behavior that clear user intent can authorize.
• hard_deny is new and covers security-boundary actions that user intent does not clear.
• claude auto-mode defaults, claude auto-mode config, and claude auto-mode critique now understand all four categories: allow, soft_deny, hard_deny, and environment.

Auto mode schema and CLI output now include hard_deny (search for "Rules for the auto mode classifier HARD BLOCK section" and "autoMode.{allow, soft_deny, hard_deny, environment}")

Claude Code can now notify you when remote routines have run.

claude

• When enabled, Claude Code checks Claude routine trigger state and shows a notification such as a routine name or “routines ran”.
• Notifications link back to /code/routines.
• This is gated by remote-session support and a feature flag, so not all users will see it immediately.
• Organizations can disable routine dispatch through policy.

Routine trigger notification path (search for "routine-fired", "/code/routines", and "Routines are disabled by your organization's policy.")

Claude Code now accepts streamable-http as an MCP transport alias for HTTP and gives clearer errors for invalid MCP server types.

{
  "mcpServers": {
    "example": {
      "type": "streamable-http",
      "url": "https://example.com/mcp"
    }
  }
}

MCP transport normalization and validation (search for "streamable-http" and "Valid types are: stdio, sse, http (or streamable-http), ws, sdk")

When adding HTTP/SSE MCP servers with --client-secret, Claude Code now preserves the server config even if secure storage is unavailable, then tells you how to retry secret storage.

claude mcp add --transport http my-server https://example.com/mcp --client-id abc --client-secret

MCP add fallback warning (search for "Server added, but the client secret could not be stored")

--worktree now gives more actionable errors when workspace trust has not been accepted, when a worktree branch is already checked out elsewhere, or when a stale worktree directory blocks reuse.

claude --worktree feature-name

Worktree diagnostics (search for "Workspace trust not yet accepted. Run \claude\ once in this directory and accept the trust dialog, then retry with --worktree." and "is already checked out in a worktree at")

Claude Code can now fall back to Windows PowerShell from WSL when checking or saving image clipboard contents.

WSL clipboard fallback to Windows PowerShell (search for "powershell.exe)" and "Get-Clipboard -Format Image")

The /effort help text now documents max as available for Opus 4.6/4.7 and Sonnet 4.6, instead of only Opus 4.6/4.7.

/effort max

Effort help text (search for "Opus 4.6/4.7, Sonnet 4.6")

• Fixed --worktree starting before workspace trust is accepted, replacing a later failure with a direct trust message. Evidence: trust gate added before worktree creation (search for "Workspace trust not yet accepted")

• Improved PowerShell 5.1 command safety detection for cwd-first command shadowing. Evidence: new warning for commands that create a file which shadows a later command (search for "Windows PowerShell 5.1 cwd-first resolution")

• Improved PowerShell validation around runtime-resolved Unicode codepoint escapes. Evidence: new classifier message (search for "PowerShell \u{HEX} codepoint escape is runtime-resolved and cannot be statically validated."`)

• Fixed bare Git repository detection to recognize .git files that contain gitdir: and avoid misclassifying linked worktrees or nested repositories. Evidence: updated Git structure detection (search for "gitdir:")