Claude Code 2.1.291 fixes a four-day-old bug that could lose the last messages of a session

Anthropic published Claude Code 2.1.291 on October 6, 2026 with exactly two lines of release notes, and both are regressions. The first, introduced in 2.1.288 on October 2, meant the last messages of a session could be lost when quitting. The second, introduced in 2.1.290 on October 5, meant cloud sessions could drop answers to permission prompts. Between them sits 2.1.290 itself, a large release whose most consequential entries are permission fixes.

What 2.1.291 repairs

The session-loss bug lived in three releases, 2.1.288, 2.1.289, and 2.1.290, for four days. A session that ended with a quit could come back on resume without its final exchanges. The notes do not say how often it happened or what triggered it, only that it was a regression and that it is fixed.

The second fix is narrower. In 2.1.290, a cloud session could drop your answer to a permission prompt, which in practice means an approved action might not run, or a prompt might appear to hang. That regression lasted one day.

The permission fixes in 2.1.290

Version 2.1.290 is long, but a handful of its fixes change what Claude Code is allowed to do without asking you.

• Some permission rules and safety checks were not applied to a tool call after a PreToolUse hook rewrote its input. A hook could therefore change a call into something your rules would have blocked.
• Plan mode let the auto mode classifier approve connector tools that are not read-only when the server attached its own ask policy.
• Background workers respawned with the dangerous skip-permissions flag honored it even when the bypass disclaimer had never been accepted.
• A project CLAUDE.md, rule, or AGENTS.md symlinked outside the working directories loaded despite the setting that blocks reads outside them, and edits to the target of a symlinked settings file ran without the settings-file permission question.
• The disableClaudeAiConnectors and allowedMcpServers rules were not applied to some MCP entries declared in .mcp.json, plugins, or agents.
• Several Bash commands that used to run as read-only now ask: commands whose arguments the shell would expand as wildcards, commands whose variable names zsh reads differently from bash, more forms of ps, and pyright.

What else arrived in 2.1.290

Two additions are practical for anyone running several sessions. The claude attach and claude logs commands now accept part of a session name in place of its id. The Claude apps gateway's sign-in approval page gained a Deny button that ends a pending sign-in so the waiting terminal stops within seconds. Status and doctor now warn when managed settings ignore your sandbox allowRead paths or allowed domains, and plugin hooks get an agentId on the tool.check event so a hook can tell a subagent's permission check from the main session's.

One fix matters for research work in particular: WebFetch had been silently dropping page text past 100,000 characters. It now reports how much went unread and takes an offset to continue. The same release caps memory use when an HTTP MCP server returns an oversized response.