docs: Claude Code v2.1.259 - managed MCP servers, headless permission mode, audio C2PA, web fetch security hardening

[claude-yolo]

Night shift report

WHY THIS MATTERS: v2.1.259 is a substantial release — 30+ changes — touching org-level MCP management (new capability), headless security posture, a Bash permission bypass fix that was a real security gap, concurrent session data loss, and C2PA content credentials expanding to audio. The Claude Desktop side adds egress proxy configuration keys and a breaking change in pricing display config. Web fetch URL validation docs were significantly clarified, closing a subtle security misunderstanding about what "system prompt URLs" are allowed.

HIGHLIGHTS:

• New: managedMcpServers org setting — admins can now push HTTP/SSE MCP servers to every user via managed settings (same shape as .mcp.json). Servers that specify a command to run are skipped for safety. Previously only users could add MCP servers.
• New: --permission-prompts none — unattended headless hosts can now auto-deny anything that would prompt instead of hanging. The active permission mode (including auto mode) still controls the session; this just eliminates blocking prompts.
• Security fix: Bash Read() deny rules bypass — denied files given as option values (--ignore-revs-file=.env, -f.env, @file), git diff/git grep file operands, or via cd DIR && cat FILE compounds were not covered. Also grep -r/cp -r over directories containing denied files now asks. This was a real bypass of file-access controls.
• Fix: concurrent sessions silently reverting each other's ~/.claude.json — workspace trust resets and MCP/project state loss when running multiple sessions simultaneously. Data loss bug now fixed.
• C2PA content credentials extended to audio — MP3, WAV, FLAC, M4A files produced by the code execution sandbox now carry C2PA Content Credentials alongside existing image/video formats.
• Web fetch URL validation clarified — docs now explicitly state that URLs appearing only in the system prompt are NOT fetchable; they must also appear in a user message. Client-side tool results that echo Claude-generated text are allowed. MCP connector and code execution tool results are not allowed sources.
• Claude Desktop v1.44121.1: "Open with" menu for common work files (spreadsheets, PDFs, Word, PowerPoint, images) on macOS and Windows. New config keys: egressProxyUrl, egressProxyPacUrl (direct proxy config, MDM/local only), inferenceStreamIdleTimeoutSec.
• Desktop breaking change: inferenceModelPricingMultiplier/inferenceModelPricing no longer activate cost estimates on their own — inferenceModelPricingEnabled: true must be set explicitly. Configs that omit that key now show token counts only.
• Fix: allowedMcpServers behavior change — now governs only user-added servers; managed (managed-mcp.json) servers that were previously filtered by an allowlist now load on upgrade. Use deniedMcpServers to block them.
• Fix: thinking rejection loop — a conversation whose thinking was rejected once was rejected again on every subsequent turn.
• Fix: prompt cache invalidated on OAuth token refresh in sessions with telemetry disabled.
• GitLab MR support — glab mr create/merge/close/reopen/note/update now shown as MR !N in collapsed tool summary; footer MR badge updates.
• claude plugin validate --json — machine-readable validation output for CI pipelines.
• Fable 5 → Fable 5.1 model name in advisor tool docs. Java MCP SDK bump 2.58.0 → 2.60.0.
• C# API reference now shows literal constant values (e.g. JsonElement Type = "api_error") instead of just constant.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning