v2.1.236

Claude Code v2.1.236 adds ANTHROPIC_DEFAULT_MODEL, an environment variable that sets the model new sessions start on, while a /model pick still overrides it and persists across restarts, unlike ANTHROPIC_MODEL. The release notes on Github list it alongside a sandbox tightening, changes to auto mode and a long run of fixes to background sessions and terminal rendering.

At a glance

• Cross-session SendMessage gains notify_when_idle, an opt-in, one-shot request asking another Claude Code session on the same machine to send a single notice when it next goes idle, without polling, on macOS and Linux.
• Auto mode's classifier on Bedrock, Vertex AI and Foundry, and with telemetry disabled, now uses the same defaults as on the Claude API, including severity-scored classification.
• On macOS, sandbox wildcard read-deny rules such as **/.env now take precedence inside allowed read regions, cover the contents of matched directories, and cannot be bypassed by renaming the denied file.

The release reads as maintenance on the parts of Claude Code that run unattended: background sessions, cross-session messaging, Remote Control and sandboxed reads. Several entries address behaviour that silently misreported success, including SendMessage calls counted as delivered while the target inbox dropped them, and an auto mode git check that could report a clean tree on a repository configured to hide untracked files. For automated setups, the correctness of those signals likely matters more than the new environment variable.

Auto mode sets Monitor allow rules aside while it is active

While auto mode is active, Monitor allow rules are set aside, so Monitor commands are reviewed the same way Bash commands are. The mode's git status check can no longer be fooled by a repository's status.showUntrackedFiles=no setting into reporting a clean working tree.

The /goal command handles stalled work differently: an idle session whose goal is parked behind long-running background work now checks in automatically after 30 minutes, then after one hour and two hours. Recap text, both automatic and from /recap, is capped at 400 characters and cut at a word boundary.

Pressing Enter on a slash-command typo now reports it instead of running the closest fuzzy match, while prefixes and aliases still run. SIGTERM in print and SDK mode no longer records an interrupted turn or synthetic tool denials before exiting; running commands are still terminated and the process still exits with code 143.

A regression from 2.1.229 broke clipboard copy and local MCP logs

Clipboard copy, background housekeeping, background sessions and local MCP logs all broke once the directory a session had switched into was removed, a regression present since 2.1.229. Skills hot-reload in SDK and VS Code sessions hit the same condition, raising an error on every skills change after the working directory was deleted.

A separate regression, introduced in 2.1.234, produced unhandled promise rejections when a subprocess failed to start, for example powershell.exe on WSL with Windows interop disabled. SendMessage calls were also rejected when a malformed closing tag left the message text inside the summary field.

SendMessage now refuses further messages to a session up front once a rapid burst would exceed what that session's inbox accepts, instead of reporting them sent while they were dropped. Remote Control marks a session offline within seconds when the CLI exits or its terminal closes.

The fullscreen renderer falls back to the classic renderer after a failed start

A single failed start of the fullscreen renderer no longer disables it permanently: it falls back to the classic renderer instead of exiting on every subsequent launch. Fullscreen mode also stopped hiding a newly sent message until the next update after a terminal resize.

Other fullscreen fixes cover a blank band that could remain above the prompt after a multi-line prompt was cleared, and panes that failed to repaint after the terminal was resized away and back. The /model picker no longer renders taller than the terminal, showing only as many models as fit and leaving the rest reachable by scrolling.

The picker's highlight now marks only the newest model's name. Terminal tab titles stop jumping in tmux under iTerm2 integration, since the title is written only when its text changes rather than every 960ms, and the Clawd mascot's eyes and feet render evenly in iTerm2 at font sizes that previously skewed them.

Screen reader support in VS Code

The VS Code extension gains screen reader support for the transcript, with live announcements for replies, permission requests, errors and status changes, plus per-turn heading navigation. The idle-notice option in cross-session SendMessage ships for macOS and Linux only, and the release notes say nothing about Windows support or a timeline for it.