Claude Code 2.1.299 landed in the npm registry on October 14 at 00:23 UTC. I wrote about 2.1.296 four days ago; two version numbers got skipped in between. This one is big, with well over a hundred changelog entries, and at least one of them can quietly break an existing setup.
Idle compaction is timed against the cache, not the conversation
The most interesting addition happens while you’re doing nothing. A conversation above 200,000 tokens that sits untouched for roughly 54 minutes now gets compacted in the terminal before its prompt cache expires at the one-hour mark. The point is that your next message doesn’t have to push the whole thing back through the model.
You can move the threshold with CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS or turn the whole
thing off with "idleCompaction": false in settings.json. Both need version 2.1.290 or
later.
Alongside it comes CLAUDE_CODE_DISABLE_FILE_MENTIONS. Set it, and an @ file mention
gives Claude the path to read with its own file tools rather than dropping the entire file
into the context. In agent view, /effort and /fast now set what new sessions start
with, and /usage warns you about max effort, workflows, always-on context and large tool
results.
Four sandbox holes are closed
The security section is uncomfortable reading. A sandboxed shell command could write into a
--plugin-dir folder whose code Claude Code then reloads and runs outside the sandbox. On
macOS, a denied path could be reached by its real location when that path runs through a
symlink. Plan mode was carrying out writes that a PreToolUse hook had allowed. And
several requests to Anthropic, including the one for server-managed settings, were sending
along a third-party gateway’s API key whenever ANTHROPIC_BASE_URL was set.
Anyone with underscores in their MCP rules should go and look
The entry that creates work sits far down the list. MCP allow rules now reach only the
server they actually name: mcp__a no longer allows a server called a__b or a_. The
correct form is mcp__<server>__* with the full normalized name. The same applies to
agents’ tools: lists, and a server with a double underscore in its name has to be spelled
out there.
It’s the right call, and it’s still a change to a running system. If someone on your team set a short prefix rule months ago, you’ll find out when a tool suddenly asks for permission. Deny and ask rules had the opposite bug, by the way: they weren’t applying at all to server names containing a double underscore.