Making "Pick Up Where You Left Off When the Limit Resets" the Default — Claude Code v2.1.234/235 Tackle Unattended-Run Wait Times and the Gap Between What Approval Screens Show and What They Actually Grant

Claude Code shipped two patches on consecutive days: v2.1.234 on August 17, followed by v2.1.235 the next day, on the 18th. There are few flashy new features—mostly quiet, unglamorous improvements. But read the two releases together and a shared intent comes into focus.

One goal is to reduce the things that slip through the cracks during long, unattended runs. The other is to make sure that what an approval screen shows matches the permissions that are actually granted. The more you run agents in a person's place, the more these two points matter.

Waiting Out the Usage-Limit Reset and Crossing It on Its Own

The headline feature in v2.1.234 is the ability to automatically continue a session that has hit the claude.ai usage limit. Once the limit resets, Claude Code picks up the work it had paused on its own. You can turn it off via "Continue automatically at usage limit" in /config.

Until now, hitting the limit stopped the work, leaving a gap until a person came back and stepped in. For use cases where you hand off overnight or long-running tasks, those "hours of waiting" quietly add up. The design is simple: when the next window opens, it crosses over and keeps going by itself.

The same version also adds one more piece to the development toolkit. For repositories that have a GitLab remote and are authenticated with the glab CLI, a merge request badge (!N, along with draft/pending/green status) appears in the footer and status line. It's a nod to teams operating outside of GitHub.

Closing Credential Leak Paths Before They're Used

What stands out in v2.1.234 is a set of fixes that preemptively seal off paths where credentials could leak out. Rather than plugging individual holes, they tighten up the places that touch files before approval, all at once. There are three main ones.

• Rejecting Windows special paths: Remote file reads, session restoration, CLAUDE.md ingestion, workflow scripts, and file uploads now reject Windows NT namespace paths (those beginning with \??\). The aim is to block a path that could siphon out NTLM credentials.
• Fixing masking in the approval preview: A bug where credential masking in the permission preview could hide the command, path, or destination itself from the approver has been fixed. Large private-key blocks also get stronger redaction. This keeps approvers from misreading what they're allowing.
• Stopping secret exposure in MCP diagnostics: Scope-conflict warnings now show the configured ${VAR} form, and connection-failure details now show only the server's origin. This prevents resolved secrets from ending up in logs.

On top of that, a bug where a session-level "deny" could be dropped in permission checks for background subagents has been fixed. In other words, a "no" you've answered once won't be quietly overridden behind the scenes.

Aligning the Meaning of "Yes" With What's on Screen

The next day's v2.1.235 extends this thread to the accuracy of approval dialogs. At its core is a fix to keep the display from diverging from the actual permissions.

The dialog's displayed text and the scope of "Don't ask again" now always match the permissions that are actually granted. When the full contents can't be displayed, "Don't ask again" isn't offered. This guarantees the obvious: only the scope the approver saw gets permitted.

One operation that invited mix-ups was also eliminated. Pressing Shift+Tab in the comment field of a permission prompt would, instead of closing the field, approve the edit and grant edit permissions for the entire session—that behavior has been fixed. In addition, the approval dialog for deleting or replacing a notebook cell used to silently hide existing content it couldn't read; it now displays the reason.

Some smaller conveniences were added, too. An optional spellcheck setting was added that uses aspell or hunspell to underline spelling mistakes as you type a prompt. The memory and CPU consumption of background cloud sessions (such as /ultrareview) has also been reduced.

How It Helps in Real Operation, and What to Watch For

Summing up the two days of updates, the value points in two directions. One is fewer gaps in unattended runs, thanks to automatic resumption after a usage-limit reset. The other is that approval screens now "work as shown," with fewer credential leak paths. The more you take your hands off and let the agent run, the more that latter groundwork pays off.

That said, there are caveats worth keeping in mind alongside the convenience. A setting that automatically crosses usage limits and keeps running can quietly pile up execution time and cost. If you're running it unattended, it's wise to design it together with caps on cost and execution scope. As the approval-related fixes in this release show, keeping people able to correctly grasp "what was permitted" is a prerequisite for entrusting automation.

References: Claude Code changelog (official) / anthropics/claude-code CHANGELOG / Claude Updates: v2.1.235 / Releasebot: Claude Code updates / Havoptic: Claude Code releases