Anthropic shipped four Claude Code releases in five days. Version 2.1.259 landed on 2 September 2026, 2.1.260 on 3 September, 2.1.261 on 4 September, and 2.1.263 on 6 September at 02:07 UTC, according to publish timestamps in the npm registry record for @anthropic-ai/claude-code. Read individually they look like routine point releases. Read together they add up to one thing: Claude Code can now run start to finish on a machine with no human at the keyboard, and it can finally tell you which of your skills are costing context without earning it. The full bullet list lives in the project's CHANGELOG.md on GitHub.
What shipped across the four releases
The releases are cumulative, so installing 2.1.263 gets you everything below. The table sorts by what each version actually changed for someone building with the tool rather than by bullet count.
| Version | Published (UTC) | Headline change for builders | Why it matters |
|---|---|---|---|
| 2.1.259 | 2 Sep 2026 | managedMcpServers managed setting, --permission-prompts none, GitLab merge request recognition, --json on claude plugin validate | The unattended-run foundation: central MCP config plus a documented way to refuse rather than block on prompts |
| 2.1.260 | 3 Sep 2026 | Fullscreen /diff panel, prompt-cache miss causes in /cost, /reload-plugins in headless sessions, text form of /advisor | Review and cost attribution stop being guesswork; headless sessions gain commands that were interactive only |
| 2.1.261 | 4 Sep 2026 | /skill-doctor, output limits raised to 128K via bashOutputMaxChars and taskOutputMaxChars, organization policy line in /status, --append-subagent-system-prompt-file | Context hygiene becomes measurable, and long tool output stops being silently clipped |
| 2.1.263 | 6 Sep 2026 | Bug fixes and reliability improvements | The version to actually install; no 2.1.262 was published to the registry |
Unattended runs no longer need a human to click approve
This is the change worth rearranging your week for. Before 2.1.259, a Claude Code session running in CI or on a scheduled host would hit a permission prompt and sit there. The new --permission-prompts flag, documented in the Claude Code CLI reference, sets who answers those prompts in print mode. Passing none means nobody answers and Claude Code denies the request instead of waiting. A denial is a result your pipeline can act on. A hang is not.
Paired with it is managedMcpServers, a managed setting for HTTP and SSE servers that lets an administrator define MCP connections centrally rather than having every runner carry its own config. Anthropic's MCP documentation covers how servers are wired up and how the related allowedMcpServers control behaves.
A working setup looks like this:
- Upgrade to 2.1.263 and confirm the version, since the fixes below only exist from 2.1.259 onward.
- Define your MCP servers once as a
managedMcpServersmanaged setting instead of per-runner config files, so a compromised or stale runner cannot introduce its own server. - Run the agent in print mode with
--permission-prompts noneand treat every denial in the transcript as a signal that your permission rules are too narrow, not as a failure to retry blindly. - Add
claude plugin validate --jsonto the same pipeline step. Machine-readable validation output means a malformed plugin fails the build instead of failing at runtime. - Widen the permission rules that produced legitimate denials, then re-run. Anthropic's guidance on turning off permission prompts in unattended runs is the reference for this loop.
- Only after the denial list is stable should you schedule the job. An unattended run whose permissions were never tuned will quietly do less work than you think.
If you are pushing further and want the agents themselves defined in the repository rather than configured by hand, this pairs directly with the ant apply workflow we covered in Anthropic's ant apply release, which creates and updates agents, environments, skills, memory stores, and deployments from files you commit.
/skill-doctor puts a number on context waste
Version 2.1.261 added /skill-doctor, which identifies unused skills and their context costs. That second half is the important half. Skills consume context whether or not the model reaches for them, and until now the only way to know which ones were dead weight was to remove them and see if anything broke. Anthropic's skills documentation now references the command.
The command reports; it does not prune. Deciding what to delete is still yours, which is the right split, because a skill that goes unused for a week may be the one that matters during an incident. Treat the output as an audit, run it against a real project rather than a toy one, and expect the surprise to be how much a handful of rarely triggered skills cost you on every single turn.
The permission fixes are the ones not to skim
Buried in the fix lists are three entries that describe real ways permission enforcement was failing. Version 2.1.259 fixed gaps in Read() deny rule coverage. Version 2.1.260 then fixed a zsh command-substitution bypass in permissions, fixed permission rule paths containing parentheses being silently dropped, and fixed a case where a single invalid regex made all file edits fail.
Read that middle one again. A permission rule whose path contained parentheses was being dropped, meaning a rule you wrote and believed was in force was not. The regex bug is the mirror image: one bad pattern taking down every file edit rather than just its own rule. Both are the failure mode where the safety mechanism appears configured and is not, which is worse than having no rule at all because it removes the caution you would otherwise apply. Anyone running agents against a repository they care about should read our deep dive on stopping AI coding agents from deleting your files alongside this upgrade.
2.1.260 also reverted the Read() deny rule changes from 2.1.259, so if you tested permission rules against 2.1.259 specifically, retest them. The same release strengthened the safety prompts around dangerous rm commands.
Bigger outputs and honest cache accounting
Two quieter changes will show up in daily use. Version 2.1.261 raised output limits through the bashOutputMaxChars and taskOutputMaxChars settings, both now accepting values up to 128K characters. If you have been working around truncated test output or clipped build logs by piping through head and re-running, that workaround is retired. Note that these two settings do not yet appear in the published settings reference, so the changelog is currently the authoritative description of them.
Version 2.1.260 added prompt-cache miss causes to /cost and the status line. Cache misses are where agent spend quietly goes, and until now the number told you that you missed without telling you why. Attribution turns a mysterious bill into a fixable configuration problem, and it pairs with the general cost tracking documentation. The same release removed the one-hour limit on background commands, which matters for any long build or test suite you were previously splitting up.
Check which channel you are actually on
One detail from the registry is worth acting on. As of 6 September 2026 the package's latest tag points at 2.1.263 while the stable tag still points at 2.1.236. That is a gap of 27 published versions. If your install pins the stable channel, none of the changes described here are on your machine, including the permission fixes. Confirm which tag you resolved before assuming an upgrade gave you anything, and check the version list in the Claude Code releases feed against what you have installed.
What to do next
Upgrade to 2.1.263 and verify the resolved version rather than trusting the install command. Retest any permission rules containing parentheses in their paths, and any rule set you validated against 2.1.259, because 2.1.260 both fixed the parentheses bug and reverted a deny-rule change. Run /skill-doctor once against your largest real project and read the context-cost column before deleting anything. If you operate CI runners, move MCP configuration to managedMcpServers and add --permission-prompts none behind a tuned permission rule set, in that order. Doing the second without the first produces a job that silently denies its way to a useless result.
Frequently asked questions
What does --permission-prompts none actually do?
It sets who answers permission prompts in print mode to nobody, and Claude Code denies the request rather than waiting for input. The practical effect is that an unattended run finishes with denials recorded in the transcript instead of hanging indefinitely on a prompt no one will see.
Does /skill-doctor remove unused skills automatically?
No. The command identifies unused skills and reports their context costs. Removing them is a separate decision you make, which is appropriate because a skill that looks unused across a normal week may be the one you need during an incident.
Why is there no version 2.1.262?
No 2.1.262 appears in the npm registry record for the package. The published sequence goes 2.1.261 on 4 September straight to 2.1.263 on 6 September. Skipped patch numbers are common when a release is pulled or superseded before publication, and nothing in the changelog documents a 2.1.262.
I am on the stable channel. Do I have these changes?
Almost certainly not. The registry's stable tag resolved to 2.1.236 on 6 September 2026 while latest resolved to 2.1.263. Check which tag your install actually resolved, because the permission enforcement fixes in 2.1.259 and 2.1.260 are the kind you do not want to assume you have.
Which of these changes affect the VS Code extension?
Several. Version 2.1.261 added an MCP server management interface, a custom style walkthrough, session indicator rings, prompt fold buttons, and archive and unarchive actions, and both 2.1.260 and 2.1.261 changed the model picker to a flat list. Version 2.1.260 added effort level display in the footer and session status filters.
Do I need to change anything if I only use Claude Code interactively?
The permission fixes apply to you regardless, so upgrading is still worth doing. Beyond that, the fullscreen /diff panel from 2.1.260 and the raised output limits from 2.1.261 are the changes you will notice, while the unattended-run flags and managed MCP settings are aimed at scheduled and CI usage.
How does this relate to running agents defined as code?
Directly. These releases harden how an agent session behaves on an unattended host, while the separate ant apply command handles defining the agents, skills, and deployments themselves as files in your repository. The two solve adjacent halves of the same problem.
