Ask another session to "tell me when you're free"—Claude Code v2.1.236 tightens the "wait handling" of parallel unattended agents and a secret-file gap at once

Stop watching the screen until it frees up

When you run several instances of Claude Code at once, you tend to keep peering at the screen, waiting for one of them to finish. v2.1.236, released on August 19, 2026, bundles in a handful of small mechanisms that take that "waiting" off your hands.

None of them are flashy new features. But they are the kind of tweaks that pay off most when you line up multiple agents and run them unattended. This time we'll sort through those "handling" improvements, along with the secret-file gap that was closed alongside them.

Ask another session to "ping me when you're free"

SendMessage, which sends instructions to another Claude Code running on the same machine, gained a notify_when_idle option. It's a mechanism to have the other session send back a single notification the next time it becomes idle.

No polling (periodic checking) is needed, and the notification fires exactly once. It's an optional flag that only takes effect when the other side accepts it. Support is limited to macOS and Linux. "Let me know when you're done" can now be exchanged between sessions themselves, rather than through a person.

A stalled goal comes back on its own

When a session that was given a goal with /goal stops because it's waiting on a long-running background process, it used to keep waiting until a person returned. In v2.1.236, when a goal gets blocked by background work like that, the session now checks back on it automatically—after 30 minutes, then again after 1 hour, then after 2 hours.

Pin the "starting model" for unattended runs

A new environment variable, ANTHROPIC_DEFAULT_MODEL, was added. It lets you specify the model a new session uses first.

Unlike the existing ANTHROPIC_MODEL, this one is positioned as a "default." If the user reselects with /model, that choice takes precedence and persists across restarts. It's a compromise well suited to unattended operation: align the initial starting model across an organization or scripts, while not killing local overrides.

Closing the "rename dodge" for secret files

This release also adds a move on the sandbox (the mechanism that isolates execution) side. On macOS, a wildcard read-deny rule like **/.env now takes precedence even inside a region where reads are allowed. It covers the contents of the target directory too, so you can't work around it by renaming a denied file.

Put the other way, it means that until now, even a file you'd decided to keep unreadable had room to be touched inside an allowed region or via a rename. The wider the read permissions you hand an agent, the more the risk remains that a secret file—like an .env holding credentials—slips into the readable range. This change closes one of those gaps.

The "checkpoint" for unattended runs got a bit stricter too. While auto mode is running, the permission rules for the Monitor command are set aside, and it's vetted by the same standard as Bash. Checking whether the working tree is dirty can also no longer be faked by the repo-side status.showUntrackedFiles=no setting.

Cleaning up backstage oversights

The unshowy bug fixes also line up in ways that matter for unattended, long-running operation.

• Double resume in the self-hosted runner: Fixed a case where a session released due to idle, retirement, or a startup timeout could be resumed by a different runner before its post-session hook finished.
• MCP v2 reconnect runaway: Fixed behavior where, against servers that cut long connections after a set time (serverless setups and the like), the subscription stream was reopened over and over.
• Fullscreen display collateral damage: Changed the fullscreen renderer so that, instead of becoming permanently unable to start after a single render failure, it falls back to the conventional method.

Where it pays off: "parallel, unattended operation"

Each item is modest, but the direction is consistent. Line up multiple sessions, give them goals, and run them in the background—these changes tighten up the "waiting," the "oversights," and the "careless permission leaks" that arise from that style of use, so things keep running without a person glued to the screen.

Adopting them isn't hard. Pinning the starting model is just a matter of placing ANTHROPIC_DEFAULT_MODEL in your environment variables, and the automatic goal check-ins and auto-continuation can be tuned from /config. The more a shop has started running agents by the count, the more this kind of "handling" polish ties directly to the daily cost of keeping watch.

References: Claude Code changelog (official) / anthropics/claude-code CHANGELOG / Releasebot: Claude Code updates