Anthropic shipped four Claude Code releases in five days, landing 2.1.259 on 2 September, 2.1.260 on 3 September, 2.1.261 on 4 September and 2.1.263 on 6 September.[1] The npm registry record confirms the publish timestamps: 2.1.261 at 2026-09-04T17:49:34.927Z and 2.1.263 at 2026-09-06T02:07:58.391Z, with no 2.1.262 in the time map.[3]
Read together they amount to one capability shift: Claude Code can now run start to finish on a machine with no human at the keyboard, and it can finally tell you which of your skills are costing context without earning it.[1] At the center of it is a small design choice — deny instead of hang.
Unattended agent runs broke on permission prompts: a scheduled session would hit one and sit there. The new flag closes that hole — --permission-prompts none, for unattended headless hosts: anything that would prompt is denied automatically while the active permission mode (including auto mode) keeps deciding.[2] A denial is a result a pipeline can act on; a hang is not.
Around it, the same release added managed MCP servers as a managed setting, so organizations can provide HTTP/SSE MCP servers to every user,[2] plus a machine-readable --json form of claude plugin validate, so a malformed plugin fails the build instead of failing at runtime.[2]
The companion release added a skill audit: /skill-doctor shows which loaded skills go unused and what they cost in context, so you can prune them.[2] Because skills consume context whether or not the model reaches for them, dead weight was previously invisible until removed.
Cost attribution got sharper too: /cost now names a likely cause for prompt-cache misses — tool definitions or system prompt changed, idle past the TTL —[2] and output limits were raised through bashOutputMaxChars and taskOutputMaxChars settings, up to 128K characters, so long tool output stops being silently clipped.[2]
The unattended story also relaxed time limits: the one-hour cap on background commands started by subagents was removed — they now run until they exit or are stopped, matching the main session.[2] And when the API returns no response headers, the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes.[2]
The machinery is new enough to bite. One week later, 2.1.260 reverted a 2.1.259 change that applied Read() deny rules to Bash arguments — it denied npm run build under a Read(./**/build/**) rule in every mode.[2] Deny-don't-hang trades one failure mode for another: a rule that over-matches turns a working run into a silent refusal, and the fix landed within a day.
There is a distribution trap too. The npm dist-tags at fetch time (2026-09-08) point latest at 2.1.265 while stable still resolves to 2.1.236 — roughly 29 versions apart.[3] An install pinned to the stable channel carries none of the unattended fixes, including the permission handling.[unverified]
The phrase worth keeping is the flag's own contract: refuse rather than block. It is a general design principle for machines that run without a person watching — the failure mode moves from "waiting forever" to "visible denial," which is the same move observability needs to make agent failures legible.[unverified]
Skill context accounting is the quieter innovation: /skill-doctor makes context a budget you can audit, in the same release family that lets a headless session run start to finish by itself.[unverified]
Honest caveats: this digest covers four point releases with no changelog entry for the final one (2.1.263 is "bug fixes and reliability improvements"); independent field reports of the unattended behavior do not yet exist; and the feature that matters most — how permission rules behave at scale — is precisely the one where a fix had to ship a day later.[2][unverified]
[1] creativeainews.com/articles/claude-code-2-1-263-unattended-ci-skill-audits-2026 — Claude Code 2.1.263: Unattended CI Runs and Skill Audits (Creative AI News, 2026-09-05)"Anthropic shipped four Claude Code releases in five days.""Claude Code can now run start to finish on a machine with no human at the keyboard, and it can finally tell you which of your skills are costing context without earning it."
[2] raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md — anthropics/claude-code CHANGELOG.md (fetched 2026-09-08)"Added `--permission-prompts none` for unattended headless hosts: anything that would prompt is denied automatically while the active permission mode (including auto mode) keeps deciding""Added `managedMcpServers` managed setting: organizations can provide HTTP/SSE MCP servers to every user (same entry shape as `.mcp.json`); entries that name a command to run are skipped""Added `/skill-doctor` to show which loaded skills go unused and what they cost in context, so you can prune them""Added a likely cause for prompt-cache misses (e.g. tool definitions or system prompt changed, idle past the TTL) to `/cost` and the status line's `prompt_cache` field""Removed the one-hour time limit on background commands started by subagents; they now run until they exit or are stopped, matching the main session""Reverted the 2.1.259 change applying `Read()` deny rules to Bash arguments; it denied `npm run build` under a `Read(./**/build/**)` rule in every mode"
[3] registry.npmjs.org/@anthropic-ai/claude-code — npm registry record for @anthropic-ai/claude-code (fetched 2026-09-08)"2.1.261": "2026-09-04T17:49:34.927Z", "2.1.263": "2026-09-06T02:07:58.391Z""stable": "2.1.236", "latest": "2.1.265", "next": "2.1.265"
Cross-check note: the release dates come from both the article and the npm registry time map, which agree; the registry also shows the latest tag has moved past the article's 2.1.263 to 2.1.265 since publication. The changelog quotes are verbatim from the raw file fetched today. "No 2.1.262 in the time map" is a direct observation of the fetched registry record, not a company claim.