Claude Code 2.1.235 to 2.1.238: what used to fail silently now tells you

Four Claude Code releases shipped between August 18 and August 20: 2.1.235 through 2.1.238, 93 changelog entries in total. Walking through them one by one would produce an unreadable list, so here they are grouped by theme, with what actually deserves your attention.

One thread runs through all four releases, and it is more interesting than any single new feature.

The thread: what used to fail silently now tells you

A dozen fixes, spread across the four releases, all address the same class of problem. Something did not work, and Claude Code let you believe it had.

• Cross-session messaging. A message too large for cross-session delivery used to be dropped silently; it is now refused up front (2.1.235). A burst of messages exceeding what the target session's inbox accepts was reported as sent while being dropped (2.1.236). Sending to a session that refuses inbound messages, via crossSessionInbound: "refuse", returned a silent success and now reports "refused" (2.1.238). And an inbox that drops your messages, on a rate limit or a full queue, now tells the sending session instead of letting them vanish (2.1.238).
• Slash command typos. Pressing Enter on a misspelled command, or one unavailable in the session, ran the closest fuzzy match. You typed one thing and Claude ran another. The command is now reported as unknown, while prefixes and aliases still work (2.1.236).
• Permission dialogs. Notebook cell delete and replace approval dialogs silently omitted the existing cell content when the cell could not be read; they now say why (2.1.235). And the "don't ask again" option is withheld when contents cannot be fully displayed, rather than letting you blindly grant a permission broader than what you can see (2.1.235).
• Networking. A proxy refusing a connection was reported as a generic network error; the proxy is now named (2.1.238). MCP elicitation dialogs showed nothing at all for URLs longer than 4,096 characters (2.1.238).
• Interface. The fullscreen renderer, after a single failed start, failed permanently on every subsequent launch. It now falls back to the classic renderer instead of exiting (2.1.236). An empty or malformed cloud environments list produced an unhelpful error (2.1.236).

None of these is dramatic on its own. Together they are the difference between a tool you can trust when it says nothing, and a tool whose silence proves nothing. If you drive several Claude Code sessions in parallel, the messaging fixes alone justify the update: until now, a lost message looked exactly like a delivered one.

headersHelper lands on plugin marketplaces

This is the real substantive addition in 2.1.238. The mechanism already existed for MCP servers: headersHelper names a command that Claude Code runs to generate request headers at connection time, which covers short-lived tokens, Kerberos, or an internal SSO, wherever OAuth does not apply.

2.1.238 extends that mechanism to plugin marketplaces: headersHelper can now sit on a url marketplace or on a catalog entry, where it mints headers for catalog and same-origin archive fetches. In plain terms, hosting a private plugin marketplace behind your own authentication becomes possible.

What makes this addition interesting is the security perimeter shipped alongside it, because a marketplace that can trigger an arbitrary command is a sizeable attack surface:

• a catalog entry's headersHelper runs only when you install or update that plugin, after its command is shown, and both claude plugin install and claude plugin update ask for [y/N] confirmation, which -y bypasses;
• a headersHelper declared in a project .mcp.json, and inline MCP servers in project agent files or ones passed through --add-dir, now require that folder's trust dialog to have been accepted, including under claude -p;
• a headersHelper coming from a project, a plugin, or an agent file runs without inheriting credential environment variables. User, managed, and claude.ai scope helpers run from the Claude config directory instead.

The logic is clear: code arriving from your project must not be able to help itself to your environment secrets. Worth noting, this extension to marketplaces is currently described only in the changelog; the marketplace documentation page does not cover it yet.

Remote Control: the release that makes it dependable

2.1.238 carries about a dozen Remote Control fixes. Taken together they tell the story of a feature moving from works-when-nothing-goes-wrong to actually dependable.

The most useful one day to day: a brief network hiccup delaying your sign-in renewal caused a disconnect with a misleading "login expired", even though your session was perfectly valid. Claude Code now retries and stays connected. In the same spirit, short HTTP 403 refusals from a network edge, a VPN, or a proxy are tolerated for up to 3 minutes, and the refusing party is named when a block persists.

The rest closes gaps you noticed quickly:

• messages sent from the web or the Desktop app while Claude was mid-turn disappeared from the transcript once the turn finished;
• a model pick made on a phone or on the web did not update the model shown in the terminal;
• a session whose process had crashed stayed unavailable until claude remote-control was restarted; it can now be reused the next time you message it;
• per-task Stop from the tasks panel did nothing on CLI-hosted sessions;
• ListAgents and SendMessage reported "Remote Control is not connected" in sessions run in server mode or hosted by Desktop and the IDE, when they could reach those peers perfectly well.

One detail worth flagging because it touches privacy: ListAgents and SendMessage exposed the idle worker that the agent view pre-warms for your next background session. It now appears only once a task has claimed it.

Pick your starting model without taking /model away

2.1.236 adds the ANTHROPIC_DEFAULT_MODEL environment variable. On paper it looks like ANTHROPIC_MODEL; in practice it behaves in the opposite way to what you would expect from an environment variable, and that is exactly what makes it useful.

ANTHROPIC_MODEL forces the model: on the next launch, Claude Code returns to it whatever you picked in /model. ANTHROPIC_DEFAULT_MODEL only supplies a starting point. Per the official documentation, it is the lowest-priority source: it applies only when the --model flag, ANTHROPIC_MODEL, a model value in any settings file (including the one /model saves), and an organization default model all leave the choice open. A choice you save with /model wins, on later launches too.

Concretely: this is the variable to set in your shell when you want a team-wide or machine-wide default without taking the decision away from anyone.

Two documented traps are worth knowing. The variable is ignored if you set it to default, inherit, opusplan, or haiku, if enforceAvailableModels is on, if availableModels or organization restrictions exclude the model, or if the model is not available to your account. More importantly: when a new session would start on the variable's model, a session you resume with --resume, --continue, or the /resume picker starts on it too, without restoring the model saved in that session's transcript. If you resume an old session expecting its model back, you will not get it.

The spell checker, and what it does not do

2.1.235 adds a spellcheck setting that underlines misspelled words in the prompt input as you type. It relies on no remote service: Claude Code uses the checker you installed, aspell, hunspell, or ispell, running the first of the three it finds on your PATH, in that order.

The documentation spells out several limits the changelog does not mention, and they save an unpleasant surprise. The feature is off by default. It checks only the input box, never Claude's replies and never your files. It checks nothing in shell mode, in Ctrl+R history search, during voice dictation, or in screen reader mode. Finally, per the settings reference, spellcheck is read only from user settings, the --settings flag, and managed settings: putting it in project settings will do nothing.

Two quiet security tightenings

macOS sandbox (2.1.236). Wildcard read-deny rules such as **/.env now take precedence inside allowed read regions, cover the contents of matching directories, and can no longer be bypassed by renaming the denied file. All three parts matter: a deny rule that evaporates the moment it lands inside an allow region protects nothing.

Auto mode (2.1.236). Three changes pulling in the same direction. Monitor allow rules are set aside while auto mode is active, so Monitor commands go through the same review as Bash commands. The classifier now uses the same defaults on Bedrock, Vertex AI, and Foundry, and when telemetry is disabled, as it does on the Claude API, severity-scored classification included. And the git status check can no longer be fooled by a repository set to status.showUntrackedFiles=no into reporting a clean tree.

That last point is the kind of detail that decides whether a guardrail is worth anything: an auto mode that believes the working tree is clean because a local setting hides untracked files from it makes decisions on a false picture of the repository.

Three habits that change

Ctrl+L and Cmd+K in fullscreen (2.1.238) now simply repaint the screen. The double-press /clear shortcut was removed, which puts an end to the automatic /clear loops triggered in one-row nvim terminals. If double-pressing to clear the conversation was a habit, it is /clear from now on.

Ctrl+W can behave like Bash (2.1.238). The new keybindingFlavor setting accepts "readline", which deletes back to the previous whitespace instead of only the previous word. The default, "classic", is unchanged.

claude mcp list and claude mcp get (2.1.238) show disabled servers as ⊘ Disabled instead of connecting to them for a health check. Faster, and more honest about what is actually running.

The rest, usefully brief

• Long-session memory leak (2.1.238): unbounded memory growth in long interactive sessions is fixed, with subagent tool results released once they leave the recent display window. In the same vein, 2.1.235 cut the memory and CPU used by background cloud sessions, whose event streams are no longer re-scanned and re-rendered on every update.
• "Concise" output style (2.1.237): a built-in style where Claude leads with results and skips preamble and narration, while doing the work just as thoroughly. Pick it under Output style in /config. 2.1.238 also fixes custom, project, and plugin output styles drifting back to the default voice mid-session.
• Startup (2.1.236 and 2.1.238): the session counter is written in the background, bare claude starts sooner on macOS, and the automatic update check waits about 10 seconds after launch instead of competing with startup for CPU.
• /goal (2.1.236): an idle session whose goal is parked behind long-running background work now checks in automatically after 30 minutes, then 1h, then 2h.
• /usage (2.1.236): shows the usage-credits spend row for Team and Enterprise members, and a capped row at 0% before anything is spent.
• Self-hosted runners (2.1.238): --defer-shutdown-max-min <minutes> keeps attached sessions served on SIGTERM, then parks what is left after that many minutes before exiting. --proxy-authorization-command and --proxy-authorization-file cover egress proxies requiring a freshly issued Proxy-Authorization header on every connection. 2.1.238 also fixes runners occasionally removed by the server after a single slow or lost poll, handing their healthy session to another runner.
• Accessibility (2.1.236): the VSCode extension gains screen reader support for the transcript, with live announcements for replies, permission requests, errors, and status changes, plus per-turn heading navigation.
• Session recaps (2.1.236): automatic recaps and /recap are capped at 400 characters, cut at a word boundary, ending the occasional runaway recap.
• Regressions closed (2.1.236): clipboard copy, background housekeeping, background sessions, and local MCP logs broke after the directory a session had switched into was removed, a regression since 2.1.229. And the unhandled promise rejections when a subprocess fails to start, for example powershell.exe on WSL with Windows interop disabled, were a 2.1.234 regression.

Should you update

Yes, and without hesitation if you fall into one of three cases.

If you run several Claude Code sessions talking to each other, the cross-session messaging fixes change what the tool is: until now a lost message was indistinguishable from a delivered one. If you use Remote Control, 2.1.238 is the release that takes it from functional to dependable, in particular the end of "login expired" disconnects on a mere network hiccup. If you leave very long interactive sessions running, the 2.1.238 memory leak fix is for you.

For everyone else, the tightened macOS sandbox deny rules and the auto mode hardening are worth the update, even though nothing about them is visible day to day.

Only one change needs adapting to: double-pressing Ctrl+L or Cmd+K no longer clears the conversation in fullscreen mode. If that was a reflex, it is /clear now.

Source: the official Claude Code changelog, supplemented by the model configuration documentation, the settings reference, and interactive mode.