Claude Code 2.1.299: idle conversations auto-compact, MCP permissions tighten

Claude Code 2.1.299, released October 14, 2026, is a dense one: roughly forty additions and changes, plus over a hundred fixes, most of them for mod and plugin authors, the Claude apps gateway, or Claude Tag in Slack. Three things are worth your direct attention: idle conversations now compact themselves automatically, MCP permission rules stop spilling over onto servers they were never meant to touch, and a batch of fixes closes real security gaps, from plan mode to the sandbox.

Idle conversations now compact themselves

The prompt cache lasts an hour on a subscription, and five minutes on an API key or once you're drawing on usage credits. Past that window, your first message after a break misses the cache and reprocesses the whole conversation from scratch, which gets expensive once a conversation runs into the hundreds of thousands of tokens.

2.1.299 adds idle compaction for terminal sessions: a conversation over 200,000 tokens that sits idle for about 54 minutes gets compacted before that one-hour cache expires, heading off the more expensive of the two costs. Two settings tune this, both requiring v2.1.290 or later: CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS changes the 200K-token threshold, and "idleCompaction": false turns the feature off entirely. There's nothing to opt into, this is the new default: if you come back to a long session after stepping away and part of its history is already summarized, this is what ran while you were gone.

MCP permission rules no longer spill onto the wrong server

MCP rule syntax fits in three lines: mcp__puppeteer matches any tool from the puppeteer server, mcp__puppeteer__* does the same with an explicit wildcard, and mcp__puppeteer__puppeteer_navigate targets one specific tool. 2.1.299 fixes a bug that broke that guarantee: an allow rule written as mcp__a could also allow a server actually named a__b or a_. A rule meant to allow just one server could silently open access to another whose name just happened to start the same way. The fix enforces exact matching: to target a server whose own name already contains __, you now write mcp__<the server's whole name>__*. The same fix applies to a subagent's tools: list, which now takes only the named server's own tools. The opposite bug existed on the deny side: a deny or ask rule written as mcp__<server> didn't apply when the server's normalized name contained a double underscore, and that's fixed too. If your settings rely on MCP rules to isolate a sensitive server, it's worth checking them after you update.

The second tightening is on the network side. In a cloud session, a proxy rewrites each connector's URL and authenticates to it with the authorization you granted in claude.ai. 2.1.299 stops following HTTP redirects in two places: on requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers, and, in cloud and self-hosted runner sessions, on MCP requests redirected by the session's MCP proxy. Redirects issued by a connector's own server are unaffected. The changelog doesn't spell out the scenario it guards against, but a redirect that is no longer followed can no longer take a request to a host nobody configured.

Three security fixes worth knowing about

Plan mode promises that edits stay blocked until you approve them, except in interactive terminal sessions where bypass permissions is available: Claude reads, explores, and writes a plan, but doesn't touch your source. 2.1.299 fixes a case where that promise didn't hold: if a PreToolUse hook or a mod's tool.check explicitly approved a write, it ran anyway during planning, without waiting for your go-ahead. If you run hooks like that in plan mode, it's fixed now.

On the sandbox side, the docs already describe paths the sandbox protects with no way to exempt them, including through a symlink pointing at a protected settings file. 2.1.299 closes two related gaps: a sandboxed command could write into a --plugin-dir folder, whose code Claude Code then reloads and runs outside the sandbox, which amounted to an escape by the back door; and on macOS, a path denied for reads or writes stayed reachable by its real location when the denied path passed through a symlink. Both are now closed.

Last, skill and custom command loading now refuses a file or folder name containing hidden, direction-changing, or blank-like characters, or < or >: until it's renamed, the skill isn't offered, and a name: field containing such characters is ignored. That kind of character is typically used to make one skill name look like another at a glance, so this closes a real spoofing vector.

The rest, briefly

• Safer resume command: the command printed at session exit now identifies the session by its ID rather than its name, so a malicious session name can't run anything if the line is pasted as shown.
• /effort and /fast in agent view: both now set what new sessions start with directly from that view, and typing a bare /model, /effort, or /fast there opens a picker.
• A louder /usage: it now flags max reasoning effort, workflow usage, always-on context, and large tool results, the kind of costs that pile up unnoticed.
• /ultrareview: its error messages no longer suggest git add . when uploading the repository fails, since that command can stage untracked files such as .env.
• Everything else in this release is mostly for mod and plugin development, the Claude apps gateway, Windows, cloud sessions, and Claude Tag in Slack.

What to take away

The real default-behavior change is idle compaction: it asks nothing of you, but a long session left idle and resumed later may already have traded some history detail for a summary, and both settings exist if that tradeoff doesn't suit you. Beyond that, this release closes concrete security gaps rather than shipping visible features: MCP permission rules that spilled onto the wrong server, HTTP redirects that Anthropic's MCP proxies still followed, a plan mode that a hook could bypass, and two ways out of the sandbox. None of this changes how you work day to day, but if any of these pieces are part of your setup, the update is worth taking.