2.1.x Series (January-August 2026)

v2.1.261 (2026-09-04)

• Added: /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
• Added: bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
• Added: --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
• Fixed: Resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request
• Improved: The dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts

v2.1.260 (2026-09-03)

Adds a /diff panel for reviewing uncommitted changes live, and fixes two permission-rule bugs: paths with parentheses were silently dropped, leaving "read-only" folders writable, and a single uncompilable pattern could break every file edit in the session.

• Added: A diff panel that opens beside the conversation in fullscreen mode and shows your uncommitted changes as Claude edits; toggle it with /diff
• Added: A likely cause for prompt-cache misses (e.g. tool definitions or system prompt changed, idle past the TTL) to /cost and the status line's prompt_cache field
• Fixed (security): Edit/Write/Read permission rules whose path contains parentheses being dropped as invalid or ignored by the Bash sandbox, which left "read-only" folders writable
• Fixed (security): One file permission rule with an uncompilable pattern (e.g. an unclosed [) making every file edit fail with Invalid regular expression; such a deny rule now guards the literal path it spells
• Fixed: model: fable agents ignoring the [1m] tag on an ANTHROPIC_DEFAULT_FABLE_MODEL pin and silently running with a 200K context window
• Fixed: The /model picker not showing Fable 5.1 for organizations that can use it, which was only accepted when typed as /model claude-fable-5-1

v2.1.259 (2026-09-02)

Fixes concurrent sessions silently reverting each other's ~/.claude.json changes, which reset workspace trust and lost MCP/project state, and closes gaps in Bash Read() deny rules.

• Added: managedMcpServers managed setting: organizations can provide HTTP/SSE MCP servers to every user (same entry shape as .mcp.json); entries that name a command to run are skipped
• Added: --permission-prompts none for unattended headless hosts: anything that would prompt is denied automatically while the active permission mode (including auto mode) keeps deciding
• Fixed (security): Concurrent sessions silently reverting each other's ~/.claude.json changes: workspace trust no longer resets and MCP/project state is no longer lost when running many sessions at once
• Fixed (security): Bash Read() deny rules not covering files given as option values (--ignore-revs-file=.env, -f.env, @file), git diff/git grep file operands, or cd DIR && cat FILE compounds
• Fixed: Managed settings silently going unenforced when the managed-settings file, a drop-in, the MDM plist, or the HKLM value cannot be parsed: Claude Code now refuses to start and names the source

v2.1.258 (2026-09-01)

• Fixed: Claude Code failing to launch on macOS 12 (Monterey), a regression introduced in 2.1.255
• Fixed: Remote and scheduled sessions failing with "user messages must have non-empty content" after a re-sent permission approval could not be applied

v2.1.257 (2026-09-01)

Adds Claude Fable 5.1 as the new default Fable model (1M context) and a Containment Escape rule to auto mode against cloud metadata-credential fetches, egress evasion, and cross-tenant reach.

• Added: Claude Fable 5.1 (claude-fable-5-1), now the default Fable model: 1M context, $10/$50 per Mtok with $0.25/Mtok cache reads
• Added: A Containment Escape rule to auto mode so cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless your environment marks them expected
• Added: A one-time prompt in auto mode before the first file read outside the working directories, with the option to block such reads (permissions.blockReadsOutsideWorkingDirectories)
• Added: CLAUDE_CODE_SUBAGENT_MODEL_FORCE to apply CLAUDE_CODE_SUBAGENT_MODEL (or the main model) to every subagent, ignoring per-spawn and agent-definition model overrides
• Changed: defaultMode: "bypassPermissions" in .claude/settings.json or .claude/settings.local.json is now ignored, like "auto"; set it in user or managed settings, or pass --permission-mode
• Changed: Cowork and claude.ai cloud sessions: reading an artifact that isn't yours now always asks you first, even in auto mode

v2.1.252 (2026-08-31)

• Fixed: Bash commands failing with a task-output-swap error on some Macs
• Fixed: "always allow" not saving in a project with no .claude/settings.local.json yet
• Fixed: Remote Control sessions hosted by Claude Desktop or VS Code stalling for minutes after a degraded claude.ai connection

v2.1.251 (2026-08-28)

Adds PreModelSwitch/PostModelSwitch hook events, a spend-limit bar in /usage, and closes three security gaps: a symlink swap that bypassed file-tool permission checks, a plugin marketplace path-traversal escape, and sandboxed Bash output-file redirection.

• Added: PreModelSwitch and PostModelSwitch hook events (block, confirm, or annotate a model switch); SessionStart resume hooks now receive session staleness and estimated re-cache cost
• Added: Live streaming of a foreground subagent's tool calls and results to Remote Control clients
• Added: Spend limit bar in /usage and a rate_limits.spend_limit status line field for gateway users
• Fixed (security): File tools (Read, Write, Edit) following a symlink swapped after the permission check, which could read or write outside the approved location
• Fixed (security): Plugin marketplace commands could point outside the plugin directory; such paths are now rejected
• Fixed (security): Sandboxed Bash commands could redirect or replace their own output files
• Changed: CLAUDE_CODE_SUBAGENT_MODEL now sets the default subagent model rather than overriding everything; an agent's model: and per-spawn overrides take precedence

v2.1.250 (2026-08-27)

• Fixed: Bug fixes and reliability improvements

v2.1.248 (2026-08-27)

Adds a --restricted launch mode that strips out command/code-execution and web-fetch tools for locked-down environments, extends cross-session messaging to Bedrock/Vertex/Foundry, and fixes an hourly prompt-cache miss that was silently dropping extended-thinking context in long sessions.

• Added: --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project, and local settings files
• Added: experimental.cacheTtl ("5m" or "1h") to agent frontmatter: a per-agent prompt cache TTL used when no subagent TTL setting is configured
• Added: claude self-hosted-runner --client-label <label> (or SELF_HOSTED_RUNNER_CLIENT_LABEL) to override the label the runner registers with (default: hostname)
• Added: Server-managed settings diagnostics: a startup warning when the settings fail to load, and a /doctor//status line explaining a load failure or why they weren't fetched
• Added: Cross-session messaging (SendMessage/ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabled
• Fixed: A prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh
• Fixed: The ScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, causing a full prompt-cache miss on the resumed session's first turn
• Fixed: Claude Desktop and Cowork sessions disappearing after 30 days; transcript cleanup now keeps desktop-written sessions while they are in the app, with a new desktopSessionCleanupPeriodDays setting to cap the exemption
• Fixed: /ultrareview and locally seeded cloud sessions uploading uncommitted edits to prod.env-style and *.tfvars files, or to editor swap/temp/backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machine
• Improved: The Workflow tool's prompt footprint, now about 1k tokens instead of 5.7k, with the script-writing reference moved into a bundled workflow-authoring skill

v2.1.247 (2026-08-26)

• Added: The SendFeedback tool: when something goes wrong in a session, Claude can draft a feedback report for you to review and send from /feedback (turn off with the feedbackDrafts setting)
• Added: /claude-api cost-optimize to profile an existing project's Claude API spend and work through cost levers (caching, token hygiene, batch, effort, model choice) one measured change at a time
• Changed: Sonnet 5's default auto-compact window now uses its full 1M context, so sessions on the 1M window auto-compact at about 967K tokens instead of about 934K
• Fixed: Sub-agents dying on a first-call model 404: they now use the session's fallback model chain, and the error returned to the parent includes the error type, status, request id, and model
• Fixed: A hook or background agent that printed megabytes of error output being able to overflow the conversation and wedge the session on "Prompt is too long"
• Fixed: /compact and "Summarize from here" in sessions started with --agent summarizing under the default system prompt instead of the conversation's own

v2.1.246 (2026-08-25)

• Added: A startup warning for Bash allow rules with a wildcard before the subcommand (e.g. Bash(git * main)), since they also match options inserted before the subcommand
• Added: An Auto mode tab to /permissions for viewing and editing auto mode classifier rules
• Fixed: The Write tool reporting "Out of memory" or freezing for a long time after overwriting a very large existing file, even though the file had been written
• Improved: Non-interactive sessions (-p, SDK, cloud sessions) automatically continue a response cut off mid-stream by a server error, connection loss, or stall instead of ending with an error

v2.1.245 (2026-08-25)

• Fixed: A crash on startup on Linux distributions that ship glibc 2.44 (for example Arch Linux, CachyOS, Fedora Rawhide)

v2.1.243 (2026-08-24)

• Added: A Loops breakdown to /usage: per-loop run count, total tokens, tokens per run, and last run
• Added: modelPicker setting to curate the /model picker with an ordered, labeled list of models
• Added: promptCacheTtl and subagentPromptCacheTtl settings so API-key and cloud-provider users can keep a 1-hour prompt cache on the main conversation while subagents stay at 5 minutes
• Added: A keyless sign-in under /login → Anthropic Console for organizations that don't allow API keys

v2.1.241 (2026-08-22)

• Fixed: Bug fixes and reliability improvements

v2.1.240 (2026-08-22)

• Fixed: Bug fixes and reliability improvements

v2.1.239 (2026-08-21)

A Bedrock streaming fix that was silently doubling billed API calls behind proxies, cross-session messaging comes to Windows, and cost estimates now reflect the data-residency premium.

• Fixed: Bedrock streaming behind proxies that strip the response Content-Type header, which silently doubled billed API calls by re-running every turn non-streaming
• Added: Windows cross-session messaging. Claude Code sessions across your machines can now message each other with SendMessage and find each other with ListAgents, as on macOS and Linux
• Added: Cost estimates (/cost, status line, --max-budget-usd) now include the 1.1× US-only-inference premium for data-residency workspaces
• Added: /claude-api upgrade migrates Python projects from anthropic 0.x to 1.x; the skill's Python reference is updated for 1.x (timeouts use anthropic.Timeout, not httpx.Timeout)
• Added: The one-time fullscreen renderer offer now also appears on Bedrock, Vertex, Foundry, and other previously excluded setups; new installs there start in fullscreen
• Fixed: Alpine/musl builds: native image paste, clipboard, and audio-capture add-ons now load (musl-built binaries instead of glibc ones the runtime refused)
• Fixed: Claude Code hanging at startup behind an HTTPS proxy when using Bedrock with an SSO profile and awsAuthRefresh; the credential pre-check now honors HTTPS_PROXY
• Fixed: A race where pressing Esc with a prompt queued could let the next turn finish early, leaving the session idle while Claude was still working
• Fixed: Custom session titles disappearing from /resume after more than ~64 KB of conversation was written following the rename
• Improved: ListAgents and /list-agents now list live teammates, not just subagents and other sessions
• [VSCode]: "View usage" in the usage-limit banner now sits inline with the warning text

v2.1.238 (2026-08-20)

A Bash-style word-delete keybinding option, plugin marketplace header injection for authenticated fetches, and a fix for unbounded memory growth in long interactive sessions.

• Added: A keybindingFlavor setting; set it to "readline" to make Ctrl+W in the prompt delete back to the previous whitespace, as in Bash (default "classic" is unchanged)
• Added: Plugin marketplaces: headersHelper on a url marketplace or a catalog entry runs a command that mints HTTP headers (e.g. a short-lived token) for catalog and same-origin archive fetches; it runs only at install/update time and confirms with [y/N] (or -y) first
• Added: claude self-hosted-runner --defer-shutdown-max-min <minutes>: on SIGTERM, keep serving attached sessions, park what's left after that many minutes, then exit
• Added: claude self-hosted-runner --proxy-authorization-command/--proxy-authorization-file for egress proxies that require a freshly issued Proxy-Authorization header on every connection
• Fixed: Unbounded memory growth in long interactive sessions; subagent tool results are now released once they leave the recent display window
• Fixed: Custom, project, and plugin output styles drifting back to the default voice mid-session
• Fixed: MCP elicitation dialogs showing nothing for URLs longer than 4,096 characters, and permission prompts dropping the "don't ask again" option when the project path didn't fit the terminal width
• Fixed: Self-hosted runners occasionally being removed by the server after a single slow or lost poll request, handing their healthy session to another runner

v2.1.237 (2026-08-19)

• Added: A built-in "Concise" output style. Claude leads with results and skips preamble and narration while doing the work just as thoroughly; select it under Output style in /config
• Fixed: Prompt caching for sessions running through an LLM gateway or a custom base URL

v2.1.236 (2026-08-19)

A default-model environment variable, an idle notification for cross-session messaging, and stricter wildcard read-deny rules in the macOS sandbox.

• Added: ANTHROPIC_DEFAULT_MODEL sets the model new sessions start on. A /model pick still overrides it and persists across restarts, unlike ANTHROPIC_MODEL
• Added: notify_when_idle on cross-session SendMessage. Ask another Claude Code session on this machine to send one notice when it next goes idle: opt-in, one-shot, no polling (macOS and Linux)
• Security: On macOS, wildcard read-deny rules such as **/.env now take precedence inside allowed read regions, cover the contents of matched directories, and cannot be bypassed by renaming the denied file
• Improved: Auto mode sets Monitor allow rules aside while it runs, so Monitor commands go through the same review as Bash commands
• Improved: Auto mode on Bedrock, Vertex AI, and Foundry, and with telemetry disabled, now uses the same classifier defaults as the Claude API, including severity-scored classification
• Improved: The auto mode git status check can no longer be fooled by a repo's status.showUntrackedFiles=no setting into reporting a clean tree
• Improved: /goal checks in automatically after 30 minutes (then 1h, 2h) when a goal is parked behind long-running background work, and /usage shows the usage-credits spend row for Team and Enterprise members
• Fixed: Clipboard copy, background housekeeping, background sessions, and local MCP logs breaking after the directory a session had switched into was removed (since 2.1.229)
• Fixed: The fullscreen renderer failing permanently after a single failed start; it now falls back to the classic renderer instead of exiting on every launch
• Fixed: The /model picker rendering taller than the terminal; it now shows as many models as fit, with the rest reachable by scrolling
• Fixed: Unhandled promise rejections when a subprocess fails to start, such as powershell.exe on WSL with Windows interop disabled (a 2.1.234 regression)
• Fixed: Runaway session recaps; recap text (automatic and /recap) is capped at 400 characters, cut at a word boundary
• Changed: SendMessage refuses further messages up front once a rapid burst would exceed the recipient inbox, instead of reporting them sent while they were dropped
• [VSCode]: Added screen reader support for the transcript, with live announcements for replies, permission requests, errors, and status changes, plus per-turn heading navigation

v2.1.235 (2026-08-18)

Prompt-input spellcheck, permission dialogs that say what a grant actually covers, and lighter background cloud sessions.

• Added: An optional spellcheck setting that underlines misspelled words in the prompt input as you type, using an installed aspell, hunspell, or ispell
• Improved: Permission dialogs. Display text and "don't ask again" options now always match what a grant would cover, and "don't ask again" is withheld when contents cannot be fully displayed
• Improved: Memory and CPU usage while cloud sessions such as /ultrareview or /autofix-pr run in the background; their event streams are no longer re-scanned and re-rendered on every update
• Improved: The embedded grep in native macOS and Linux builds. Pathological patterns fail fast instead of exhausting memory, and -m N with -A/-C prints correct context
• Improved: The context-limit error now says when auto-compact is off and points to /config to re-enable it
• Fixed: Shift+Tab inside the permission prompt's comment field approving the edit and granting session-wide edit permission instead of closing the field
• Fixed: Whole-prompt-cache invalidation when a language server disconnected or reconnected mid-session
• Fixed: The Agent tool advertising a general-purpose default in sessions where that agent is unavailable; an omitted subagent_type now returns an error listing the available agents
• Fixed: Nested markdown list items misaligning at depth 3+, prompt input highlights appearing shifted in some multi-line prompts, and slash commands run mid-response showing HTML entities
• Fixed: The expanded task list (ctrl+t) always starting collapsed when resuming into a session with open tasks
• Changed: Vim mode preserves NORMAL mode and cursor position when toggling the detailed transcript (ctrl+o) or closing a panel

v2.1.234 (2026-08-17)

NT-namespace path rejection extends across every pre-approval file access, a GitLab MR badge lands in the footer, sessions resume themselves when a usage limit resets, and the claude-api skill stops costing 200K tokens.

• ⭐ Security: Remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads now reject Windows NT-namespace (\??\) paths, hardening the remaining pre-approval file accesses against the NTLM credential-leak vector
• Added: A GitLab merge request badge in the footer and statusline. Repos with a GitLab remote and an authenticated glab CLI show MR !N with draft, pending, and green states
• Added: The optional CLAUDE_CODE_PROJECT_DIR_NAME environment variable, so hosts that give each session its own config directory can choose a short name for the per-project transcript directory
• Added: The selection:clear keybinding action, which clears an in-app text selection and also works in the agents view
• Changed: Claude Code continues a session automatically when a claude.ai usage limit resets; turn it off in /config under "Continue automatically at usage limit"
• Changed: Claude is told to use your account email only to identify you, and not to send it to unrelated services unless you ask
• Changed: Removed the "Default teammate model" setting from /config; agent-team teammates now use the leader's model unless the spawn names one
• Improved: The built-in claude-api skill costs ~25K tokens to load instead of ~200K+, by loading reference docs on demand
• Improved: /permissions can be opened while Claude is working, with rule changes applying to the rest of the turn, and /add-dir, /autocompact, /theme, /help, /config, and /advisor open mid-turn in the fullscreen TUI
• Improved: Your own prompts render markdown in the transcript, and auto-generated session titles read as short names ("Login button bug") rather than sentences
• Fixed: Auto mode in very long sessions repeatedly re-checking and denying sandboxed commands' network access after compaction, and session-scoped permission answers being dropped when answering background subagent prompts
• Fixed: MCP diagnostics printing resolved secrets; scope-conflict warnings show the configured ${VAR\} form and connection failures show only the server origin
• Fixed: strictKnownMarketplaces allowlists accepting SCP-style git marketplace sources whose host differs from the one git would connect to
• Fixed: Credential masking on relayed permission previews hiding commands, paths, or destinations from the approver, and oversized private-key blocks not redacting under full-strength redaction
• Fixed: Accepting the fullscreen renderer prompt restarting the session without its permission mode, tool rules, model, or effort flags, and /tui dropping launch --allowed-tools/--disallowed-tools rules
• Fixed: A crash when a non-streaming fallback API response (typically via third-party gateways) contained a thinking block missing its thinking field
• Fixed: Remote Control sessions keeping phones and claude.ai/code updated on permission mode and model, effort picks applying across hosts, and files sent during Desktop/VS Code-hosted sessions failing to upload
• Changed: /goal clears itself with a notice when a turn dies on an unrecoverable error, and checks in when background tasks keep it waiting 30+ minutes (CLAUDE_CODE_GOAL_CHECKIN_MINUTES=0 opts out)

v2.1.233 (2026-08-14)

Todo tools disappear on the newest models, memory cgroups arrive for Bash on Linux, and the NT \??\ path bypass is closed.

• Added: GitLab merge request URL support in the --worktree flag and the claude agents view, where MRs display as !N
• Added: An opt-in forward_user_identity apps gateway setting on Anthropic upstreams that sends the signed-in user's identity as headers, so a proxy behind the gateway can attribute spend per user
• Added: Opt-in memory cgroup support for Bash tool commands on Linux (CLAUDE_CODE_TOOL_MEMORY_LIMIT), so a runaway build cannot stall the session
• Added: CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS to configure the WebFetch session URL cache TTL (default unchanged at 15 minutes)
• Security: Fixed Windows paths spelled with the NT \??\ device prefix bypassing UNC path validation, closing an NTLM credential-leak vector
• Changed: Todo/task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to bring them back
• Changed: Reverted the 2.1.232 Bash permission changes for Cygwin-style symlinks on Windows and for input redirections (< file); a narrower version returns in a later release
• Fixed: Idle sessions on Linux sometimes keeping one CPU core at 100% when sandboxing is enabled
• Fixed: Notification hooks not firing for permission prompts when running under Claude Desktop or VS Code
• Fixed: MCP v2 connections endlessly reopening the subscriptions/listen stream against servers that terminate long-held streams on a fixed timeout, such as serverless hosts
• Fixed: Bundled skill aliases like /checkup and /review reporting "Unknown command" in -p mode when a user or project skill shadows the bundled skill
• Fixed: Skill and command argument substitution re-expanding argument values as template markers
• Fixed: Auto mode on Windows repeatedly stopping for manual approval on ordinary cd <dir> && <command> > file Bash commands (a 2.1.232 regression)
• Improved: claude self-hosted-runner session start time, apps gateway error forwarding for Vertex, Foundry, and Claude Platform on AWS 400/413 errors, and claude plugin validate checking bare .claude/skills directories
• Improved: Print mode writes a [claude-code:unrecognized_model] line to stderr when a request goes out for a model ID Claude Code does not recognize; map it with modelOverrides to silence

v2.1.232 (2026-08-13)

Subagent forking becomes the default, sessions can be @-mentioned by name, GitLab lands in plugin marketplaces, and three permission bypasses are closed on Windows.

• ⭐ Changed: Subagent forking is on by default. A subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background
• Added: Type @ in the prompt to mention another Claude session by name; Claude then uses SendMessage to reach that session directly
• Added: GitLab support in plugin marketplaces. Bare gitlab.com repo URLs, including nested subgroups, clone like github.com URLs, and clone auth-failure hints name your actual git host
• Added: Secret redaction for the GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-), full redaction of routable glpat-/gldt- tokens, and the same sandbox and credential-path protection for the glab CLI config store as gh
• Added: /config rows for "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse)
• Security: Fixed a PowerShell permission bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands' file access
• Security: Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require approval
• Security: Fixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmation
• Security: Hardened the auto-generated cross-session messaging socket directory on shared /tmp, and the Linux filesystem sandbox against a protected-path bypass
• Fixed: SendMessage now delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first
• Fixed: Interactive sessions on one machine keep unique names. Starting or renaming a session to a name another live session already uses gives it a name-word-word variant and tells you
• Fixed: MCP connections hanging for the full 30-second connect timeout when a server fails to answer the protocol-version probe
• Fixed: Remote Control sessions hosted by a bridge inside a cloud session inheriting that session's transcript or credentials, plus reattachment, idle-reachability, and history-restore regressions
• Fixed: mTLS client certificate rotation requiring a restart, malformed AWS or Vertex region values reaching request URLs, and stream idle timeouts failing requests on Bedrock, Vertex, and gateway deployments
• Improved: Settings accept additionalMarketplaces and allowedMarketplaces as aliases for extraKnownMarketplaces and strictKnownMarketplaces
• Improved: The managed settings approval dialog shows endpoint URLs, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides
• Improved: /code-review at high, xhigh, and max effort runs in a background agent like the other levels, and /plugin install plugin@marketplace refreshes the marketplace first
• Changed: sandbox.ripgrep is honored only from user, managed, and --settings settings; project settings can no longer override the sandbox's ripgrep binary
• Changed: Bash input redirections (< file) are permission-checked like their argument spellings on all platforms
• Changed: Fable 5 is offered as an advisor in /advisor again for organizations with Fable access, with usage-credits consent through /model fable

v2.1.231 (2026-08-13)

• Fixed: MCP OAuth sign-in failing with a redirect URI mismatch for servers that use a pre-registered OAuth client, such as Slack

v2.1.229 (2026-08-12)

Streaming and crash fixes across narrow terminals, Windows paths, and malformed tool calls, plus a command plugin marketplace source and tighter /commit-push-pr approvals.

• Added: Plugin marketplace command sources. A local command such as an IDE prints the plugin directory, which is re-resolved each session and applied without a restart; mode: "link" uses it in place
• Added: Server-supplied Claude Code hook support for self-hosted runner sessions, matching managed-environment behavior
• Added: SSE keepalive pings to gateway streaming responses during long thinking pauses, preventing idle-timeout disconnects on Vertex and Bedrock upstreams
• Added: ListAgents marks disconnected Remote Control sessions as offline and labels your cloud sessions as cloud
• Fixed: Long responses partly disappearing while streaming and being printed twice in the terminal
• Fixed: A crash to the error screen, including on --resume, when a tool call had a non-string glob, file_path, or command value
• Fixed: A RangeError crash when a progress bar or markdown table rendered in a very narrow terminal, which could also crash claude --continue/--resume at startup
• Fixed: A crash on Windows when a tool call or message referenced a file by an extended-length (\\?\) or UNC path
• Fixed: Auto mode failing on every tool call for users who disable the attribution header via CLAUDE_CODE_ATTRIBUTION_HEADER, and /model rejecting Sonnet/Opus 1M for claude.ai subscribers on a custom ANTHROPIC_BASE_URL
• Fixed: MCP OAuth with strict authorization servers by using 127.0.0.1 instead of localhost in the redirect URI
• Fixed: The Claude Code Review workflow generated by /install-github-app completing without posting its review on the pull request
• Fixed: Multi-second UI stalls after editing a file with thousands of IDE diagnostics while the IDE extension is connected
• Fixed: Dynamic workflows inside CPU-limited containers using the host machine's core count instead of the container's CPU limit
• Fixed: Conversations whose messages alone exceed the API's 32 MB request limit retrying compaction with nothing left to strip; they now fail once with a clear message
• Improved: Workflow fan-outs stagger same-prefix sibling agents so later agents read the cached prompt prefix instead of re-paying it (CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS=0 disables)
• Improved: Sandbox IPv6 literals in network domain lists are bracketed ([::1]:443), and ambiguous spellings are enforced fail-closed and flagged by /doctor
• Changed: /commit-push-pr no longer auto-approves git/gh commands with dangerous flags (--force, --amend, --no-verify)
• Changed: Self-hosted runner Windows startup requires an explicit --base-dir; there is no default checkout directory on Windows
• Added: [VSCode] Session groups in the sidebar. Right-click to create, rename, or delete; Cmd/Ctrl- or Shift-click to move several sessions at once
• Added: [VSCode] The /btw side-question panel is resizable by dragging its boundary, in both side-docked and stacked layouts

v2.1.228 (2026-08-11)

Hardening pass on claude.ai-synced skills, a Write tool rule change for newer models, and fixes for session cleanup touching memory folders.

• Security: Hardened skills synced from claude.ai. They no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and on your machine their bodies do not run ! commands or expand @ files
• Changed: The Write tool lets newer models overwrite an existing file they have not read this session, matching the Edit tool's rules; older models still require the read first
• Fixed: Interactive sessions that could stop redrawing entirely, while the process kept running, after a rare internal layout error
• Fixed: Session cleanup deleting contents inside a project's memory folder
• Fixed: Remote Control /resume while connected leaking the resumed conversation's title or history into the connected session
• Fixed: git and Git Bash not being found on Windows when Claude Code is launched from a parent folder of the git installation
• Fixed: /tui reverting the session to an earlier model when /model had been changed since the last response
• Fixed: Cross-session messaging sometimes starting without an inbox in the first session after install or upgrade
• Fixed: Background plugin-cache cleanup deleting a plugin's cache when its only version is a symlinked development checkout
• Fixed: A settings-merge issue where a marketplace entry redefined in a higher-precedence tier could inherit another tier's custom headers; entries now merge whole
• Improved: Cross-session messages show the sender and body inline instead of a collapsed line, and Vertex AI credential handling fails within seconds instead of retrying for minutes
• Removed: The outdated note about auto mode sessions costing slightly more, from the first-use notice for Pro, Max, and Team plans

v2.1.227 (2026-08-10)

• Fixed: Feature flags being evaluated without the user's subscription tier when a session started with an expired login token, which could wrongly prompt Max plan users to enable usage credits for Fable
• Fixed: Every Bash command failing under claude-code-action with allowed_non_write_users on GitHub-hosted runners
• Fixed: /tui bringing back a conversation that had been rewound to before its first message
• Improved: The slash-command menu, where blue marks only the selected row, matched characters are bolded instead of recolored, and emoji or accented names keep their glyphs
• Improved: Performance, with fewer event-loop stalls on file-not-found suggestions and at-mention size checks

v2.1.226 (2026-08-08)

• Fixed: Bug fixes and reliability improvements

v2.1.225 (2026-08-07)

Gateway spend limits surface in the usage warning, and SendMessage can open a conversation with your Remote Control sessions on other machines.

• Added: Gateway spend-limit support in the usage warning. The limit-reached message names the cap, its reset time, and the operator's message (requires the gateway on 2.1.225)
• Added: A workspace trust prompt to claude agents for untrusted directories, matching the behavior of claude
• Added: SendMessage can start a conversation with your Remote Control sessions on other machines by name (ListAgents shows them as name [ref]), instead of only replying after they message you first
• Fixed: A transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking headless sessions until restart
• Fixed: MCP OAuth servers on macOS intermittently failing with a burst of 401 errors, as if never authenticated, after a keychain read timed out
• Fixed: Auto mode counting a safety-filter refusal of its own permission check toward the consecutive-block limit; the action is still denied, but the model is told to move on
• Fixed: Cross-session messages staying parked without a notice or expiry in headless sessions and during startup
• Fixed: Conversation history breaking on Remote Control session resume after very large conversations were compacted
• Fixed: claude self-hosted-runner registering and then failing every session when --base-dir cannot be created or written; it now exits at startup with a clear error
• Fixed: Claude Code on the web sessions being misreported as stuck, re-sending a growing event backlog on every reconnect
• Improved: Remote Control shows photos attached from the Claude app directly to Claude, instead of reading them from disk with a separate tool call
• Fixed: [VSCode] Focus view folding away the latest to-do list, a pending question's context, and settled answers; thinking-only folds show "Thought for Ns"

v2.1.224 (2026-08-07)

Two headline features: self-hosted environments for Team and Enterprise, and cross-session messaging between Claude Code sessions across your machines.

• ⭐ Added: Self-hosted environments. claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise plans
• Added: archive plugin source, for installing plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning
• Added: crossSessionInbound and dialogExpiry settings. Cross-session messages sent to a session running with bypassed permissions are held for your approval; messages to other sessions auto-deliver
• Added: Sandbox credential-masking options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims, and awsPairs/sigv4 for AWS SigV4 re-signing. These need network.tlsTerminate and are honored only from user, managed, or --settings settings
• Added: ANTHROPIC_BEDROCK_REGION_PREFIX for Bedrock, to prefer a specific cross-region inference profile over the AWS_REGION-derived one
• Security: Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list, rename, fork, delete and /resume no longer cross projects
• Security: Fixed sandbox filesystem deny entries written with a trailing slash (denyRead: "~/.aws/") being silently bypassable on Linux and macOS
• Fixed: SendMessage reporting "Message sent" when the write to a teammate's inbox had actually failed; failed deliveries are now reported as errors
• Fixed: Sandbox violation details never appearing in Bash tool results; Claude now sees which file or network access was denied and why
• Fixed: Plugin install records being silently corrupted when the same plugin is installed in multiple projects
• Fixed: A Remote Control session recreated after its server session expired uploading prior local conversation history into the new session
• Improved: Fullscreen mode keeps the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval
• Improved: Remote Control shows compaction progress and the post-compaction boundary to attached web and mobile clients, propagates /clear resets, and replaces the 8-second toast with a persistent failure indicator
• Removed: The 200-subagent-per-session spawn cap. Long-running sessions no longer refuse new agents; concurrency and depth limits still apply
• Changed: The /feedback survey transcript share now also uploads the last request's model settings with your consent: the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large
• Changed: The Bash tool description always notes that command output is displayed to the model, not reliably to the user

v2.1.223 (2026-08-05)

Security release closing three permission-check bypasses, plus a /review//code-review merge and marketplace wildcard entries.

• Security: Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
• Security: Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox
• Security: Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy
• Added: Owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings, for allowing or blocking all marketplace repos under a GitHub org
• Added: A warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead
• Added: A /teleport hint in cloud sessions showing how to continue locally with claude --teleport <session id>
• Fixed: Resuming a session after a mid-session /cd coming back empty, and a rare hang when parsing unusual git push output
• Fixed: Gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*
• Fixed: modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented
• Fixed: Managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key
• Fixed: Sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory
• Fixed: Forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
• Fixed: A resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment
• Changed: CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning appears when auto-compaction isn't holding the session to 200K
• Changed: Auto-compact keeps sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior
• Changed: /review is now an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use /code-review ultra for a deep cloud review
• Changed: /code-review with no effort level now reuses the level you typed last; type a level like /code-review high to change it

v2.1.222 (2026-08-04)

Security release fixing a worktree-isolation escape and a PreToolUse hook bypass, plus Remote Control auto-start locked to user scope and the ultraplan feature removed.

• ⭐ Security: Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type
• Security: Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
• Fixed: /usage-credits on Team and Enterprise showing "you've already sent a usage credit request" for members whose earlier request was dismissed, blocking them from sending a new one
• Fixed: The startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message
• Fixed: "Connection closed mid-response" errors being reported on responses that had actually completed
• Fixed: /usage overattributing usage to MCP servers: a server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it
• Fixed: Sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API
• Fixed: Org-restricted model: opus-style subagent and teammate family aliases dropping to the parent model instead of stepping down to the newest org-allowed model in the family
• Fixed: Stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire
• Fixed: claude.ai connectors being falsely marked as needing authorization when the session token is invalid; they now show a /login hint instead
• Improved: The /diff view, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web sessions to use raw git blob content, ignoring workspace-configured diff drivers and textconv
• Changed: Remote Control auto-start so repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on (they can still turn it off); enable it at user scope via /config
• Removed: The ultraplan feature

v2.1.221 (2026-08-03)

Security release with two permission-check bypass fixes (zsh, PowerShell), plus VSCode Focus view, sandbox credential masking, and a large MCP/session reliability sweep.

• Security: Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
• Added: [VSCode] Focus view (Ctrl+Alt+F or "Claude Code: Toggle Focus view"), a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator
• Added: mode: "mask" for sandbox credential files on Linux and WSL: sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; macOS falls back to deny
• Added: Warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added: A prompt-audit subcommand to the claude-api skill, for auditing prompts and tool descriptions for patterns written for older models
• Fixed: The thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
• Fixed: MCP servers from --mcp-config not connecting before the first turn in print mode (-p), which made the model emit tool calls as literal text
• Fixed: @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
• Fixed: A crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
• Fixed: WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled, and sandboxed large uploads failing with TLS errors through the sandbox proxy
• Fixed: Team and Enterprise spend-limit messages incorrectly blaming the org's monthly limit instead of your individual spend limit
• Fixed: Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
• Fixed: CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume; falsy values are now honored
• Fixed: A rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
• Fixed: Renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
• Fixed: Plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions, and the "Plugins changed" notification lingering after plugins reloaded instead of clearing
• Fixed: Vim mode, where the yank register now survives dialogs, history search, and the transcript view; undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
• Improved: Tool search on Google Vertex AI re-enabled for Claude 4.5-generation and newer models
• Improved: Auto mode permission checks for parallel tool calls are now cache-efficient, with reduced prompt-cache costs, and switching modes while a check is pending reliably prompts instead of applying the stale result
• Improved: Stats panel counts cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
• Improved: /ultrareview error messages when a repo shares no history with its base: a checkout with no branches is refused up front with advice to create one
• Improved: Windows startup reads process creation times via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
• Changed: Background sessions commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
• Changed: /plugin install refreshes a stale marketplace catalog and retries before reporting a plugin not found; plugins installed from /plugin activate immediately when safe instead of always requiring /reload-plugins
• Changed: Plugins accept "." as a skills path, and the root-level SKILL.md validation error now suggests using the plugin root
• Changed: /status shows the session kind: interactive, or a background job that is attached or unattended
• Changed: Sessions forked with /fork create a new worktree of their own instead of working in the original session's checkout
• Changed: Claude in Chrome closes the browser tabs it opens once it no longer needs them; fast mode reports on the stream when usage credits run out mid-session instead of failing silently
• Removed: The repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts

v2.1.220 (2026-07-24)

• Fixed: Bug fixes and reliability improvements

v2.1.219 (2026-07-24)

Model release. Claude Opus 5 takes over as the default Opus model, and the subagent nesting limit lifted two releases ago comes back at depth 3.

• Added: sandbox.network.strictAllowlist to deny non-allowlisted hosts for sandboxed commands without prompting
• Added: The DirectoryAdded hook, firing after /add-dir or the SDK register_repo_root control request registers a new working directory mid-session
• Added: mcp_server_errors to the headless stream-json init event, listing --mcp-config entries skipped by config validation; terminal runs print a startup warning
• Added: The workflowSizeGuideline settings key, so the advisory Dynamic workflow size guideline can be set from any settings file (the /config row hides while one is set)
• Added: Nested subagent forwarding in stream-json, so subagents spawned at depth 2 and deeper appear when --forward-subagent-text is set, keyed by their spawning Agent tool_use id
• Added: The current default workflow size to the running-workflow status line, with a pointer to /config
• Fixed: claude -p text output dropping the answer already produced when a turn died on a mid-stream API error
• Fixed: The /model picker showing the merged Opus row as plain "Opus" instead of "Opus (1M context)", and the Fable model row showing "Requires usage credits" for plans that include it
• Fixed: Copy-on-select inside GNU screen printing base64 into the terminal instead of copying the selection
• Fixed: Remote Control clients keeping a stale fast-mode status after a model switch, reconnect, or failed org check
• Fixed: CLAUDE_CODE_GIT_BASH_PATH on Windows exiting or being used as bash when the path isn't a bash/sh binary; it is now ignored with a warning
• Fixed: Vim mode where pressing ← on an empty prompt returned to the agent view only from INSERT, not NORMAL mode
• Fixed: Screen-reader mode rewriting the entire input line on every keystroke instead of echoing only the typed character
• Added: HTTP status and error text to claude mcp list and /mcp when a server fails to connect, plus a warning for MCP config values with hidden leading or trailing whitespace
• Changed: Subagents spawn nested subagents up to depth 3 by default (was 1 since 2.1.217); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to disable nesting
• Changed: Dynamic workflows default to a medium size guideline (aim for fewer than 15 agents); pick another size or unrestricted with Dynamic workflow size in /config
• Changed: Managed MCP allowlist/denylist ${VAR\} entries resolve from the startup environment and managed-settings env instead of settings-file env
• Changed: The /model picker highlights only the newest model's name, so the highlight marks the new release
• Removed: Opus 4.7 from fast mode; /fast now applies to Opus 5 and Opus 4.8
• Changed: The claude-api skill defaults to Claude Opus 5, with a migration path from Opus 4.8

v2.1.218 (2026-07-22)

Large bug-fix release, plus a change in how /code-review runs and a workspace-trust requirement for agent frontmatter hooks.

• Changed: /code-review runs as a background subagent, so review work no longer fills the conversation and stacked slash commands stay its review target
• Security: Agent frontmatter hooks now require the agent file's own folder to have accepted workspace trust, so hooks no longer run from untrusted folders
• Fixed: Windows paths with \u-prefixed segments (like C:\Users\unicorn) being corrupted into CJK characters in tool inputs, which made those files inaccessible
• Fixed: The left arrow key discarding the conversation with no undo; presses right after editing now ask to confirm, and Esc in the agent view returns to the conversation it backgrounded
• Fixed: Multi-line paste collapsing into one line with j in place of newlines in terminals that encode pasted newlines as Ctrl+J
• Fixed: /context reporting stale pre-compact token usage after compacting from the message picker
• Fixed: /ultrareview failing on descriptive arguments like "review my auth changes"; they now run a review of the current branch with the text applied as a note to the findings
• Fixed: /code-review ultra silently running a local review in non-interactive sessions instead of launching the cloud review
• Fixed: Gateway spend metering to price Bedrock application-inference-profile ARNs and other config-mapped upstream model IDs at the configured model's rates
• Fixed: Spurious "[Request interrupted by user]" messages after interrupted tool calls, and an unpaired tool_use block left in the transcript when a tool aborted mid-response
• Fixed: Crashes (maximum call stack exceeded) when a deeply nested watched directory tree was deleted or moved, and when rendering deeply nested UI trees
• Fixed: A retry loop re-sending identical doomed requests after a context-overflow error with a large thinking budget; Ctrl+B backgrounding now applies the same background-shell caps as other paths
• Fixed: Fork-session lineage being lost after compaction in headless and SDK sessions, and a resumed session failing every turn or crashing on resume when its history held a malformed delta attachment
• Fixed: The Bedrock setup wizard failing profile verification for assume-role profiles in partitioned AWS regions and on proxy-only networks
• Fixed: The "N MCP servers need authentication" startup notice over-counting claude.ai connectors that aren't connected in claude.ai
• Fixed: Prompt history entries being dropped or duplicated when history writes raced or failed
• Fixed: Remote sessions continuing to send heartbeats after their worker was replaced, leaving long-lived desktop and IDE processes retrying a rejected request every few seconds forever
• Added: Screen-reader announcements of deleted text for word and line deletions (Option+Delete, Ctrl+W, Cmd+Backspace, Ctrl+U, Ctrl+K) in --ax-screen-reader mode
• Added: An announcement when fast mode changes as a result of switching models via /config model=<x> or Remote Control
• Changed: Auto mode adjudicates the dangerous-rm, background-&, and suspicious-Windows-path checks instead of opening permission dialogs, and plan mode with auto no longer prompts for Bash commands the static analyzer can't prove read-only
• Changed: /deep-research starts only when invoked manually; Claude no longer launches it on its own
• Changed: Skills with context: fork run in the background by default; opt out per skill with background: false
• Changed: Agent markdown files reject agent names containing :, which is reserved for plugin namespacing
• Changed: Server-managed settings so benign feature and cost toggles no longer trigger the settings-approval prompt
• Added: yes/no/on/off/1/0 (case-insensitive) as accepted values for skill and plugin frontmatter booleans, alongside true/false

v2.1.217 (2026-07-21)

Subagent fan-out gets budget guardrails: a concurrency cap, nesting off by default, and --max-budget-usd finally halting background agents.

• Added: A cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) so one message can't fan out unbounded background agents
• Changed: Subagents no longer spawn nested subagents by default; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting (restored to depth 3 in v2.1.219)
• Fixed: --max-budget-usd not stopping background subagents; once the cap is reached, new spawns are denied and running background agents are halted
• Added: Emoji shortcode autocomplete in the prompt input (type :heart: to insert ❤️, or :hea for suggestions), disabled with the emojiCompletionEnabled setting
• Added: Warnings when transcript writes are failing (disk full, for instance) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently
• Fixed: A memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
• Security: Background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
• Fixed: Windows auto-update failures that could leave claude.exe missing; failed updates now restore the preserved executable automatically
• Fixed: Auto-compact never triggering for Claude Opus 4.8 on Bedrock, and /compact failing once over the limit
• Fixed: Corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions
• Fixed: Managed settings that set OTEL_EXPORTER_OTLP_ENDPOINT not governing all signals; lower-scope signal-specific overrides no longer redirect telemetry away from the managed endpoint
• Fixed: --resume/--continue and /resume failing with a TypeError when a transcript has a malformed attachment entry
• Fixed: Remote Control sessions not showing a pending permission prompt or dialog to viewers that connected after it appeared
• Fixed: Background shells sometimes becoming impossible to stop after a session is sent to the background (/background or ←) or when the session exits on a heavily loaded machine, most visible on Windows
• Fixed: A CLAUDE.md or SKILL.md paths frontmatter value with many brace groups OOM-killing or stalling the CLI at startup; brace expansion is now budget-bounded
• Fixed: Screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds
• Improved: Footer PR badge links are clickable hyperlinks even when terminal support can't be detected (over ssh or tmux); set FORCE_HYPERLINK=0 to opt out
• Changed: The login-expiry warning appears 3 days before expiry instead of 5, and the frontend-design plugin suggestion tip is capped at 3 lifetime impressions

v2.1.216 (2026-07-20)

• Added: sandbox.filesystem.disabled to skip filesystem isolation while keeping network egress control
• Fixed: A slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
• Fixed: Auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
• Fixed: AskUserQuestion telling Claude to continue even when the answer asked it to wait or explain first; free-text answers now get neutral wording
• Fixed: Claude Code on the web re-asking the same question and dropping the answer after the session sat idle for a few minutes

v2.1.215 (2026-07-19)

• Changed: Claude no longer runs the /verify and /code-review skills on its own; invoke them with /verify or /code-review when you want them

v2.1.214 (2026-07-18)

Security-heavy release. Eight separate Bash permission-check holes closed, plus a large sweep across background sessions, the PowerShell tool on Windows, and OpenTelemetry instrumentation.

• Security: Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
• Security: Bash permission checks now fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
• Security: Commands over 10,000 characters now always prompt instead of running automatically
• Security: zsh variable subscripts and modifiers in [[ ]] comparisons are no longer treated as inert text, so those commands prompt for approval
• Security: Certain help and man commands that could run unsafe options, command substitutions, or backslash paths are no longer auto-approved
• Security: Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
• Added: The EndConversation tool, letting Claude end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 (research post)
• Added: A periodic progress heartbeat for long-running tool calls that previously went silent
• Added: message.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenance
• Added: CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributes
• Added: Reasoning effort in the subagentStatusLine payload, so custom agent rows can render model and effort
• Added: An ISO modified timestamp to memory file frontmatter
• Fixed: Background sessions parked with ← or /background and left idle keeping the daemon and a worker process alive indefinitely, completed sessions being impossible to remove via claude rm, and a displaced daemon deleting its successor's control socket on shutdown
• Fixed: PowerShell tool commands hanging until timeout when a child process waited on standard input, Python scripts crashing with UnicodeDecodeError or UnicodeEncodeError, and >/>> writing UTF-16LE files that other tools couldn't read (Windows)
• Fixed: Hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation
• Fixed: Session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames
• Fixed: Plugins enabled via the --settings CLI flag not loading (regression since v2.1.181)
• Fixed: Streaming turns failing with "Socket is closed" behind corporate proxies on Windows, and stream-json output truncating at exit for slow-reading SDK consumers
• Fixed: Unbounded memory growth when --settings points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear error
• Fixed: /ultrareview refusing to run in repos with no merge base, and scheduled tasks refusing their own configured prompt as untrusted input
• Changed: Single-segment dir/** hook if: conditions match only <cwd>/dir; write **/dir/** for any-depth matching (deny/ask permission rules keep their any-depth match)
• Changed: file commands using -m/--magic-file or -f/--files-from require permission instead of being auto-allowed as read-only
• Changed: docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, Podman remote mode) now prompt for permission
• Changed: SessionStart hooks report source "fork" when a session begins as a fork instead of "resume"

v2.1.212 (2026-07-16)

Runaway-loop guardrails plus two security fixes: WebSearch and subagent spawns get session budgets, slow MCP calls auto-background, and /fork becomes a real conversation copy.

• ⭐ Changed: /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
• Added: A session-wide WebSearch cap (default 200, CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) and a per-session subagent-spawn cap (default 200, CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway loops; /clear resets the budget
• Added: claude auto-mode reset restores the default auto-mode configuration, with a confirmation prompt (--yes to skip)
• Improved: MCP tool calls running longer than 2 minutes move to the background automatically so the session stays usable (CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS)
• Improved: /resume in the agent view opens a picker of past sessions (including deleted ones) and resumes your pick as a background session
• Security: Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback
• Security: Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository
• Deprecated: The Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default

v2.1.211 (2026-07-15)

• Added: --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output
• Security: Permission previews relayed to chat channels now neutralize bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
• Security: Auto mode no longer overrides a PreToolUse hook's ask decision for unsandboxed Bash; a hook ask now floors the decision at a prompt
• Fixed: Subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
• Fixed: Nested .claude/rules/*.md files loading even when setting sources exclude project settings
• Fixed: Parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
• Fixed: Plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message

v2.1.210 (2026-07-14)

Broad maintenance release: 30+ fixes across the agent view, background sessions, worktree isolation, and plugin handling, plus two security hardenings.

• New: A live elapsed-time counter on the collapsed tool summary line, so long-running tool calls visibly tick instead of looking stuck
• New: The agents footer hint shows how many background agents are waiting on your input, with brief color emphasis when the count changes
• Security: The Agent tool is hardened against indirect prompt injection via content a subagent read
• Security: Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own worktree
• Security: Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
• Deprecated: Write(path), NotebookEdit(path), and Glob(path) permission rules now trigger a startup warning; use Edit(path) or Read(path) instead
• Improved: Auto mode's permission classifier defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session
• Improved: The Bash/PowerShell timeout message now lets the model distinguish a hang from an explicit background request
• Improved: Screen reader mode announces permission mode changes aloud when cycling with Shift+Tab
• Fixed: claude attach failing with "job not found" or "agent is still starting" during session transitions; attach now waits for the daemon to settle
• Fixed: A hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait
• Fixed: Claude assuming a cd took effect after its command was moved to the background; the tool result now states the working directory is unchanged
• Fixed: Plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
• Fixed: Plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
• Fixed: Unmatched $1/$2 positional placeholders in skills and commands being silently stripped; they are now preserved verbatim
• Fixed: claude agents --effort ultracode not reaching dispatched sessions; the value was silently dropped
• Fixed: Killed background sessions leaving a permanent git worktree lock behind; the periodic sweep now releases locks whose owning process is gone
• Fixed: Paste markers leaking into external editors opened from Claude Code, appearing as stray È/É characters around pasted text
• Fixed: Grep content mode claiming "No matches found" when paginating past the end of results
• Fixed: Late-appearing .claude/* symlinks not being reconciled into the sandbox deny-write list
• Changed: Fable temporarily shows as unavailable in the advisor picker while a server-side issue is fixed

v2.1.209 (2026-07-14)

• Fixed: /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard from 2.1.208)

v2.1.208 (2026-07-13)

• New: vimInsertModeRemaps setting, mapping two-key insert-mode sequences like jj to Escape in vim mode
• New: CLAUDE_CODE_PROCESS_WRAPPER, so the agent view and background service honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
• New: Mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
• Fixed: The context window and auto-compact indicator briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions
• Fixed: Very large markdown tables stalling rendering or using excessive memory; tables over 200 rows now show the first 200 with a "… N more rows" notice
• Fixed: Fast mode staying off after switching back to a model that supports it; it now restores automatically when enabled in settings
• Fixed: Replies typed to a background agent being lost when delivery fails; the text is saved and delivered when the session restarts
• Fixed: Background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from
• Fixed: Supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight
• Fixed: Truncated stream-json/JSON output and missing result message when piping large responses from claude -p
• Fixed: CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)
• Fixed: The Edit tool failing on files modified after reading when the target text still matches uniquely
• Fixed: Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex, Grep count mode under-reporting paginated totals, and Glob crashing on null bytes in the pattern or path
• Fixed: apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error now shows within 3 attempts
• Fixed: Bedrock streaming failing with a misleading "Truncated event message received" when a gateway transforms the response; the error now names the content-type and points at the proxy
• Fixed: /release-notes adding viewed notes to the model's context ("Show all" previously injected the entire changelog into every subsequent request)
• Fixed: The Agent tool launching with no tools when a subagent's tools list resolves to nothing; it now returns a clear error naming the unrecognized entries
• Fixed: The workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves
• Fixed: Headless stream-json sessions hanging permanently on a control_request with a non-string set_model payload

v2.1.207 (2026-07-11)

• Fixed: Terminal freezing and keystrokes lagging while streaming very long lists, tables, paragraphs, or code blocks
• Added: Auto mode now available without the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry (disable via disableAutoMode)
• Security: Remote managed settings from a non-interactive run (claude -p, the SDK) were being recorded as consented without ever showing the consent dialog, now fixed
• Breaking (plugins): ${user_config.*} in shell-form plugin hook/monitor/headersHelper commands is now rejected (shell-injection fix); use exec form or $CLAUDE_PLUGIN_OPTION_<KEY>
• Breaking (plugins): Plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json; only user, --settings, and managed settings are honored

v2.1.206 (2026-07-09)

• Added: A /doctor check that proposes trimming checked-in CLAUDE.md files by cutting content Claude can derive from the codebase
• Added: /cd directory path suggestions, matching /add-dir behavior
• Changed: /commit-push-pr now auto-allows git push to the repo's configured push remote (remote.pushDefault, or the sole remote), not just origin
• Changed: Background agents now upgrade in the background right after an update, instead of a slow stale-session upgrade on attach
• Improved: /code-review findings quality on claude-opus-4-8 across all effort levels
• Changed: EnterWorktree asks for confirmation before entering a git worktree outside .claude/worktrees/

v2.1.205 (2026-07-08)

• Improved: Agent view rows show a colored state word and a classifier-written headline instead of raw tool call text; blocked-session peeks open with the exact ask
• Security: Auto mode now blocks tampering with session transcript files, and asks before running rm -rf on a variable it can't resolve from context
• Fixed: --json-schema silently producing unstructured output when the schema was invalid, and schemas using the format keyword being rejected
• Changed: Background task notifications now state that no human input has occurred, preventing fabricated in-transcript approvals from being acted on

v2.1.204 (2026-07-08)

• Fixed: Hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook

v2.1.203 (2026-07-07)

Background-agent daemon hardening: macOS open/switch stalls, stale session tokens, crash-looping on deleted directories, and a silent auto-upgrade failure that killed every running session.

• New: A warning when your login is about to expire, so you can re-authenticate before background sessions are interrupted
• New: A grey ⏸ badge in the footer when in manual permission mode, making the active mode always visible
• New: The session's additional working directories are now sent to MCP roots/list, with notifications/roots/list_changed on changes
• Fixed: Opening or switching background agent sessions on macOS stalling 15-20 seconds due to a false low-memory detection (regression in 2.1.196)
• Fixed: Background sessions becoming permanently unresponsive to attach, replies, and stop when the daemon's session token went stale (they now recover automatically)
• Fixed: Returning to claude agents silently stopping running subagents and re-running the prompt from scratch, so their work now carries over
• Fixed: A memory and per-turn CPU regression where the context-usage indicator re-analyzed the entire transcript after every turn
• Fixed: Background agents inheriting a stale PATH from the daemon instead of the dispatching shell (missing tools on Windows)
• Fixed: Background and agent-view sessions dropping a shell-exported ANTHROPIC_BASE_URL, sending API keys to the default endpoint and failing with 401
• Fixed: Bash failing with "argument list too long" in repos with many git worktrees
• Fixed: Worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree
• Fixed: A background daemon auto-upgrade failure silently killing all running background sessions
• Fixed: TaskStop and TaskOutput failing to find background agents spawned by another agent (errors now list running agents by id and description)
• Improved: Subagent behavior, agents are now less likely to re-delegate their entire task to another subagent
• Improved: Binary size reduced by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily instead of inlining it
• Changed: Left arrow no longer closes the background tasks, diff, and workflow detail views (press Esc instead)

v2.1.202 (2026-07-06)

• New: A "Dynamic workflow size" setting in /config for controlling how large Claude generally makes dynamic workflows (small/medium/large agent counts), an advisory guideline, not an enforced cap
• New: workflow.run_id and workflow.name OpenTelemetry attributes on telemetry emitted by workflow-spawned agents, so a workflow run's activity can be reconstructed from OTel data
• Fixed: /rename on background sessions being reverted when the job restarts, which broke addressing the session by its new name
• Fixed: Commands sent from Remote Control (mobile/web) into an interactive session failing with "Unknown command"
• Fixed: Images and files sent from the Remote Control mobile or web app without a caption being silently dropped
• Fixed: Resuming a session by name, or opening the resume picker, taking minutes and using a large amount of memory in repositories with many git worktrees
• Changed: /review <pr> reverted to a fast single-pass review; use /code-review <level> <pr#> for the multi-agent review at a chosen effort level

v2.1.201 (2026-07-03)

• Fixed: Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders

v2.1.200 (2026-07-03)

Permission mode terminology cleanup: "default" is now called "Manual" everywhere in the UI, and AskUserQuestion dialogs stop auto-continuing unless you opt in.

• Changed: AskUserQuestion dialogs no longer auto-continue by default; opt into an idle timeout via /config
• Changed: The "default" permission mode is now labeled "Manual" across the CLI, --help, VS Code, and JetBrains; --permission-mode manual and "defaultMode": "manual" are accepted alongside default
• Fixed: Background sessions silently stopping mid-turn after sleep/wake or when reopening a stalled session
• Fixed: Background agents never starting again after a crash left a stale daemon.lock whose PID the OS reused
• Fixed: Subagents cut off by a rate limit before producing any text output returning an empty result instead of failing cleanly
• Fixed: Project-scoped plugins not loading correctly from git worktrees of the same repository
• Improved: Screen-reader output, decorative glyphs hidden, transcript symbols read as short labels, nested tables read as Header: value. lines

v2.1.199 (2026-07-02)

Retry hardening across the board: transient 429s retried automatically for subscribers, streaming partials preserved on mid-stream errors, and subagents now return partial work instead of failing silently.

• New: Stacked slash-skill invocations like /skill-a /skill-b do XYZ now load all leading skills (up to 5), not just the first
• New: Transient server rate-limit errors (429s unrelated to your usage limit) are now retried automatically with backoff for subscribers instead of failing the turn
• New: CLAUDE_CODE_RETRY_WATCHDOG now raises the default retry count for non-capacity transient errors to 300 and lifts the cap of 15 on CLAUDE_CODE_MAX_RETRIES
• Fixed: Streaming responses being discarded when the API emits a mid-stream overloaded/server error after partial output; the partial is now kept with an incomplete-response notice
• Fixed: Subagents cut off by a rate limit or server error silently failing instead of returning their partial work to the parent
• Fixed: Subagents reporting API errors (e.g. usage limit reached) as successful results; the error is now reported to the parent agent
• Fixed: SSL certificate errors (TLS-inspecting proxies, missing NODE_EXTRA_CA_CERTS, expired certs) burning retries before showing actionable guidance; they now fail immediately with the fix hint
• Fixed: The background-agent daemon on Linux killing itself and every running agent every ~50 seconds after an unclean shutdown left a corrupted worker record
• Fixed: Background agents failing to cold-start over SSH on macOS with "Could not switch to audit session" (regression in 2.1.196)
• Fixed: claude stop being silently undone when it raced a background-agent respawn; the respawn now honors the stop
• Fixed: SendMessage silently misrouting when a re-spawned agent reuses a previous agent's name; the tool now detects the mismatch and asks the caller to retarget
• Fixed: SessionStart, Setup, and SubagentStart hooks silently hiding stderr when exiting with code 2; the error is now shown in the transcript
• Fixed: Resetting a corrupted config file from the startup recovery dialog destroying it unrecoverably; it now backs up the file first
• Fixed: Plan mode not prompting for state-changing browser tool calls; read-only browser_batch calls are now correctly auto-allowed
• Improved: Idle subagents no longer vanish from the agent panel while others are still working; surplus idle agents collapse into an expandable summary row

---

v2.1.198 (2026-07-01)

• New: Background agent notifications in claude agents: sessions that need input or finish now fire the Notification hook (agent_needs_input / agent_completed)
• New: Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask
• New: /dataviz skill for chart and dashboard design guidance with a runnable color-palette validator
• New: Gateway: Claude Platform on AWS (anthropicAws) added as an upstream provider; model-not-found responses now advance the failover chain
• Improved: The built-in Explore agent now inherits the main session's model (capped at Opus) instead of running on Haiku
• Improved: Subagents and context compaction now inherit the session's extended thinking configuration, improving output quality on delegated tasks
• Improved: Subagents now treat messages from the agent that launched them as normal task direction; an agent's message is still never treated as the user's approval
• Fixed: Brief network drops mid-response aborting the turn; transient errors like ECONNRESET now retry with backoff instead of failing
• Fixed: Agent teams: a teammate that dies on an API error now reports "failed" to the lead, and messaging a stuck teammate wakes it to retry immediately
• Fixed: Background tasks in web, desktop, and VS Code task panels getting stuck on "Running" after they finish or after resuming a session
• Fixed: .claude/rules/ conditional rules not loading when the target file is reached via a symlinked path
• Fixed: Plan mode not auto-allowing read-only tool calls when a session starts in plan mode
• Removed: The /agents wizard; ask Claude to create or manage subagents, or edit .claude/agents/ directly

---

v2.1.197 (2026-06-30)

• New: Claude Sonnet 5 is now the default model, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31

---

v2.1.196 (2026-06-29)

Org default models in /model, clickable file attachments, security fix for self-approved .mcp.json servers, streaming idle watchdog on by default.

• New: Organization default models, set by admins in the org console; shows as "Org default" (or "Role default") in /model when you haven't picked one yourself
• New: Readable default names for sessions at start, making them easier to identify and message
• New: Clickable file attachments in chat (Cmd/Ctrl-click reveals the file in Finder/Explorer)
• Security: claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval
• Fixed: Waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
• Fixed: Rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests hit a usage limit at once
• Fixed: Duplicate recap lines after a background session's turn when a schema-rejected StructuredOutput attempt retried
• Fixed: PowerShell git diff/git grep, egrep/fgrep, and quoted search patterns containing | being reported as failures when they exit 1, matching Bash behavior
• Fixed: Multiple claude agents side panel issues: keyboard focus stuck when opening an agent, background jobs losing their subagent types on every open, sessions showing incorrect status while actively running
• Fixed: claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer
• Fixed: Mid-turn crash recovery for Remote sessions, so sessions interrupted by a server restart now auto-resume on the next worker
• Fixed: Sessions moved with /cd reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters
• Fixed: claude plugin validate skipping local plugins whose source is "." and stopping after the first error class
• Fixed: Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
• Fixed: MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs
• Fixed: /context showing 0 tokens for all tool groups on Bedrock
• Fixed: /deep-research misreporting verifier failures as "all claims refuted" instead of unverified
• Fixed: Plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
• Fixed: Voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
• Improved: Background session reliability, so long-running commands and workflows now survive the session's process being stopped, restarted, or updated, including on Windows where background shells are handed off instead of being killed
• Improved: Background agents killed by a daemon restart are automatically resumed from where they left off the next time the agents view opens
• Improved: /code-review workflow merged five cleanup finders into one, cutting token usage by roughly 25%
• Improved: Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
• Changed: The streaming idle watchdog is now on by default for all providers, aborting and retrying when a response stream produces no events for 5 minutes (set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable)
• Changed: Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY
• Changed: Opening the agents view from a foreground session now requires a single ← press instead of two, matching background sessions

---

v2.1.195 (2026-06-26)

Bug fixes: hook exact-match for hyphenated names, voice dictation, background agent daemons, plugin name mismatch; Remote provisioning checklist.

• Fixed: Hook matchers with hyphenated identifiers (e.g. code-reviewer, mcp__brave-search) accidentally substring-matching; they now exact-match. Use mcp__brave-search__.* to match all tools from a hyphenated MCP server
• Fixed: Voice dictation on macOS capturing silence in long sessions after default input device changes; auto-submit never firing for languages without spaces (Japanese, Chinese, Thai)
• Fixed: Linux voice mode now distinguishes "no microphone" from "SoX not installed" when SoX is present
• Fixed: External plugins enabled only by project .claude/settings.json not requiring install consent on every loader path
• Fixed: /plugin Enable/Disable not working when a plugin's plugin.json name differs from its marketplace entry name
• Fixed: Background jobs disappearing from claude agents or losing data when written by a newer Claude Code version; daemon socket failures blocking restarts
• Fixed: Reopening a crashed background task showing blank screen for up to 5 seconds instead of its restart
• Added: CLAUDE_CODE_DISABLE_MOUSE_CLICKS to disable mouse click/drag/hover in fullscreen mode while keeping wheel scroll
• Improved: Remote session startup shows a provisioning checklist while the container starts
• Improved: claude agents completed list fills available vertical space; short terminals compact the header so live sessions stay visible

---

v2.1.193 (2026-06-25)

• New: claude_code.assistant_response OpenTelemetry log event carries model response text; redacted unless OTEL_LOG_ASSISTANT_RESPONSES=1; deployments already logging prompt content start receiving response content on upgrade (set OTEL_LOG_ASSISTANT_RESPONSES=0 to keep prompts-only)
• New: autoMode.classifyAllShell setting routes all Bash/PowerShell commands through the auto-mode classifier (not just arbitrary-code-execution patterns)
• New: Auto-mode denial reasons added to the transcript, the denial toast, and /permissions recent denials
• New: Live file path autocomplete in bash mode (!) commands
• New: Startup notice when MCP servers need authentication, pointing to /mcp
• New: Automatic memory-pressure reaping for idle background shell commands (disable: CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1)
• Improved: Background agents: launch result no longer instructs Claude to "end your response"; Claude keeps working on other tasks while the agent runs
• Improved: MCP headersHelper auth: the helper re-runs and reconnects automatically when a tool call returns 401/403
• Improved: Plugin auto-rename: marketplace renames maps are followed automatically, updating settings to the new name
• Improved: /add-dir message when the directory is already a working directory
• Fixed: /model and other client-data-gated UI showing stale/empty state immediately after /login; backgrounding spuriously cancelling; pinned background agents re-prompted after auto-update; phantom "general-purpose (resumed)" subagent re-running main conversation; agent panel hiding sibling agents when viewing a subagent

---

v2.1.191 (2026-06-24)

• New: /rewind can now resume a conversation from before /clear was run
• Improved: CPU usage during streaming reduced by ~37% by coalescing text updates to 100ms intervals instead of per-token
• Improved: Sandbox network permission dialog: hosts allowed with "Yes" are remembered for the rest of the session (no re-prompting per connection)
• Improved: MCP server capability discovery (tools/list, prompts/list, resources/list) retries transient network errors with short backoff
• Improved: MCP OAuth: discovery and token requests retry once after transient errors; headless environments skip the browser popup and go straight to paste-the-URL prompt
• Improved: MCP error messages: HTTP 404 errors now show the URL and point to your MCP config
• Improved: Vim mode prompt-history search (NORMAL /) hints how to reach slash commands
• Fixed: Background agents resurrecting after being stopped from the tasks panel; stopping is now permanent
• Fixed: Scroll position jumping to the bottom while reading earlier output during a streaming response
• Fixed: /voice showing a generic "not available" message when disabled by org policy, with a proper explanation of the restriction
• Fixed: Welcome splash art overflowing the default 80×24 macOS Terminal window; /login URL truncated in Windows Terminal wrap; Cmd+click links in fullscreen Ghostty over ssh/tmux
• Fixed: Hooks with comma-separated matchers (e.g. "Bash,PowerShell") silently never firing
• Fixed: /permissions Recently-denied tab: approving a denial now persists on close
• Fixed: claude agents sending builtin slash commands like /usage to background sessions as prompt text; job rows showing full filesystem paths for pasted images instead of [Image #N]
• Fixed: Managed settings: forceRemoteSettingsRefresh now takes effect via MDM/file policy with Cache-Control: no-cache on fetch

---

v2.1.190 (2026-06-24)

Bug fixes and reliability improvements.

---

v2.1.187 (2026-06-23)

• New: sandbox.credentials setting: when enabled, blocks sandboxed commands from reading credential files (.aws/credentials, .ssh/, etc.) and secret environment variables
• New: Org-configured model restrictions enforced in the model picker, --model, /model, and ANTHROPIC_MODEL; shows "restricted by your organization's settings" when a restricted model is selected
• Fixed: Remote MCP tool calls hanging with no response for 5 minutes now abort with an error; override with CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT
• Fixed: --resume failing with "No conversation found" when the original -p run produced no model turns
• Fixed: --json-schema and workflow agent(\{schema\}) structured output: model can no longer re-call StructuredOutput indefinitely after a successful call; follow-up turns now reliably return structured output
• Fixed: Remote sessions (Remote Control) taking ~2.7s longer to start after CA system-trust install
• Fixed: Pasted Korean/CJK text turning into mojibake in terminals delivering paste as per-byte extended-key events
• Fixed: Background jobs in the agents view stuck in "working" indefinitely when the agent ended a turn without structured output
• Fixed: Channel connections dropping after navigating to agents view and back, and after /bg, /tui, or /update
• Fixed: Agent stop notifications wording improved to "finished"/"stopped"; subagent depth tracking restored on resume; leaked agent worktree registrations cleaned up automatically
• Fixed: claude --help not listing --bg/--background; Esc/Ctrl-C/Ctrl-D not working while /share is uploading
• Improved: /install-github-app: GitHub Actions workflow setup is now optional; install just the app and skip the workflow/secret steps
• Improved: /btw with ←/→ arrow navigation through earlier answers; /plugin surfaces recently-unused plugins for cleanup

---

v2.1.186 (2026-06-23)

• New: claude mcp login <name> and claude mcp logout <name> authenticate MCP servers directly from the CLI without opening the interactive /mcp menu; --no-browser flag supports stdin redirect for SSH sessions
• New: ! bash commands now trigger Claude to respond to the output automatically; set "respondToBashCommands": false in settings.json to keep the previous context-only behavior
• New: Status filtering (press f) in the /workflows agent detail view; "Skills" section added to /plugin Installed tab
• New: teammateMode: "iterm2" setting with warning when auto mode cannot find the it2 CLI; "Claude Platform on AWS - refresh credentials" option added to /login
• Changed: Background subagents now surface permission prompts in the main session instead of auto-denying; the dialog shows which agent is asking, and Esc denies just that tool
• Changed: /review <pr> now uses the same review engine as /code-review medium
• Changed: CLAUDE_CODE_MAX_RETRIES capped at 15; use CLAUDE_CODE_RETRY_WATCHDOG for unattended sessions
• Fixed: Agent(type) deny rules and Agent(x,y) allowed-types restrictions not being enforced for named subagent spawns
• Fixed: Streaming requests failing with "Content block not found" or JSON parse errors after machine wake from sleep
• Fixed: Workflow agent(\{schema\}) subagents looping forever on repeated schema validation failures instead of aborting after 5 attempts
• Fixed: Background session recaps being duplicated; background task previews flashing raw tool names before agent plan loaded
• Fixed: Esc and Ctrl+C not responding while background agents are still running after the main turn ends; 15+ additional UI bug fixes

---

v2.1.185 (2026-06-22)

Stream-stall hint UX improvement: clearer message and longer delay before triggering.

• Improved: Stream-stall hint now reads "Waiting for API response · will retry in …" instead of "No response from API · Retrying in …", and triggers after 20s of silence instead of 10s

---

v2.1.183 (2026-06-19)

• New: Auto mode now blocks destructive git commands (reset --hard, checkout -- ., clean -fd, stash drop) when you didn't ask to discard local work; git commit --amend is blocked when the commit wasn't made by the agent this session; terraform destroy/pulumi destroy/cdk destroy are blocked unless you asked for the specific stack
• New: Warning added when the requested model is deprecated or auto-updated to a newer model, shown on stderr in print mode (-p) and now covering models set in agent frontmatter
• New: attribution.sessionUrl setting omits the claude.ai session link from commits and PRs in web and Remote Control sessions
• New: /config --help lists all available shorthand keys for /config key=value
• Changed: /config toggle: Enter and Space both change the selected setting; Esc now saves and closes instead of reverting
• Changed: Startup "setup issues" line removed from under the logo; run /doctor or use --debug to surface configuration issues
• Fixed: thinking.disabled.display: Extra inputs are not permitted 400 errors on subagent spawns and session-title generation for affected configurations
• Fixed: WebSearch returning empty results in subagents
• Fixed: Terminal cursor stranded above the prompt after navigating history in vim mode with native cursor enabled
• Fixed: Fullscreen TUI corruption (statusline mid-screen, duplicated spinner rows, merged text) in Windows Terminal under heavy nested-subagent load
• Fixed: Turns silently completing with no visible output when the model returned only a thinking block; Claude now re-prompts once
• Fixed: User-level skills appearing multiple times in slash-command autocomplete when multiple plugins are enabled
• Fixed: MCP servers requiring authentication exposing auth-stub tools to the model in headless/SDK mode
• Fixed: tmux teammate panes failing to launch when the shell has slow rc-file initialization; keystrokes typed during agent spawn no longer leak into the new pane
• Fixed: Background tasks started by a teammate being killed when the teammate finishes a turn
• Fixed: Scheduled task and webhook trigger deliveries treated as keyboard input; they now classify as task notifications and can no longer approve a pending action or set the session title in auto mode
• Fixed: Focus mode showing "Ran N PostToolUse hooks" timing lines under each response

---

v2.1.181 (2026-06-18)

• New: /config key=value syntax sets any setting inline from the prompt (e.g. /config thinking=false), works in interactive, -p, and Remote Control
• New: sandbox.allowAppleEvents opt-in lets sandboxed commands send Apple Events on macOS; CLAUDE_CLIENT_PRESENCE_FILE suppresses mobile push notifications while at the machine
• Improved: Streaming: long paragraphs now appear line-by-line instead of waiting for the first line break
• Improved: Subagent panel: idle agents auto-hide after 30s, list caps at 5 rows with scroll hints, keyboard hints now show in the footer
• Improved: Auto-retry: API connection drops mid-thinking now automatically retry instead of showing "Connection closed while thinking"
• Changed: Fullscreen mode URL opening now requires Cmd+click (macOS) / Ctrl+click, matching native terminal behavior
• Fixed: Prompt caching not reading on custom ANTHROPIC_BASE_URL and Foundry due to per-request attestation token changing every turn
• Fixed: Write/Edit producing 0-byte or truncated files on network drives and cloud-synced folders
• Fixed: Startup regression (~120ms per launch in fresh environments, introduced in 2.1.169); startup no longer blocks up to 15 seconds on degraded networks
• Fixed: macOS TUI freezing at session start (Ctrl+C unresponsive) when Spotlight is busy reindexing
• Fixed: open, osascript, and browser-based auth flows failing with error -600 on macOS (added Apple Events entitlement)
• Fixed: Foreground subagents spawning unbounded nested chains; they now respect the same 5-level depth limit as background subagents
• Fixed: /recap and conversation forks using the previous model immediately after a model switch
• Fixed: 20+ additional fixes: long-running idle session history loss, AWS credential refresh loop, claude mcp get/list showing wrong status, /remote-control stale "connecting…" line, /stats timezone off-by-one, AskUserQuestion word-wrap and multi-select free-text, tab-indented code preview indentation

---

v2.1.179 (2026-06-17)

Bug fixes: mid-stream connection drops, WSL2 mouse-wheel scrolling, sandbox glob performance, feedback survey, welcome banner.

• Fixed: Mid-stream connection drops now preserve partial responses instead of showing a raw error; the spinner no longer gets stuck at "running tool"
• Fixed: Mouse-wheel scrolling in WSL2 under Windows Terminal and VS Code (regression introduced in 2.1.172)
• Fixed: Sandbox denyRead/allowRead glob over a large directory tree making the Bash tool description enormous and the session unusable on Linux
• Fixed: Feedback survey capturing a single-digit reply as a session rating immediately after a turn completes
• Fixed: Welcome screen stacking multiple promotional banners; at most one promo now shows per session
• Fixed: Ctrl+O not showing the subagent's transcript when viewing a subagent
• Fixed: Clicking the prompt input not returning focus from the subagent/footer panel
• Fixed: Remote session background tasks appearing stuck as "still running" between turns
• Improved: Plugin loading performance in remote sessions

---

v2.1.178 (2026-06-17)

• New: Tool(param:value) syntax for permission rules to match a tool's input parameters (with * wildcard), e.g. Agent(model:opus) to block Opus subagents
• New: Skills in nested .claude/skills directories now load when working on files there; on a name clash, the nested skill appears as <dir>:<name> so both stay available
• New: Nested .claude/ directories: the agent, workflow, and output-style closest to the working directory wins on name collision; project-scope workflow saves now target the closest existing .claude/workflows/
• Improved: Auto mode: subagent spawns are now evaluated by the classifier before launch, closing a gap where a subagent could request a blocked action without review
• Improved: /doctor with consistent flat tree layout across all sections, clearer section status icons, and highlighted command names
• Improved: Skill listing truncation warning now shows how many skill descriptions are affected
• Changed: Workflow prompt keyword uses a purple shimmer highlight and triggers only on explicit phrases like "run a workflow" or "workflow:", not on any mention of the word
• Improved: Remote Control error messages: connection failures now show a persistent red "/rc failed" indicator in the footer; "not yet enabled" error explains whether it's a gate, check failure, stale entitlement, or org policy
• Changed: /bug now requires a description before submitting; no longer uses model-refusal text as the GitHub issue title
• Fixed: Crash (out-of-memory) when the CLI inherits a stale websocket/OAuth file-descriptor environment variable from a parent process
• Fixed: Claude in Chrome silently failing to connect when the OAuth token belongs to a different account than Claude Code
• Fixed: Nested .claude/skills with directory-qualified names blocked by permission prompts in non-interactive runs
• Fixed: Subagent transcript view now shows tool results and live progress; messages sent while it finishes are no longer dropped; backgrounding a running subagent (ctrl+b) no longer restarts it from scratch
• Fixed: claude agents workers failing with 401 Invalid bearer token when started from a shell with a custom API gateway via ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN
• Fixed: Compaction not honoring --fallback-model: compaction now falls back to the configured fallback model chain on overload or model-availability errors
• Fixed: Model requests continuing to fail with auth errors after credentials were refreshed outside the session (stale cached request configuration)
• Fixed: Background sessions created with /bg or ←← after a turn finished showing "Working" forever in the agents list
• Fixed: Linux sandbox failing to start when .claude/skills or .claude/hooks is a symlink
• Fixed: CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1 preventing fresh marketplace installs from cloning
• Fixed: MCP server-level specs (mcp__server, mcp__server__*, mcp__*) in subagent disallowedTools being silently ignored
• Fixed: Vim mode undo: u now steps through NORMAL/VISUAL-mode commands one at a time instead of merging quick-succession commands into a single undo step
• Fixed: Statusline links with custom URI schemes (e.g. vscode://) not opening when clicked in claude agents
• Fixed: [VSCode] Pressing Esc to dismiss a CJK IME candidate window canceling the running Claude task

---

v2.1.176 (2026-06-15)

• New: Session titles are now generated in the language of your conversation; set the language setting to pin a specific language
• New: footerLinksRegexes setting for regex-matched link badges in the footer row, configurable via user or managed settings
• Improved: Bedrock credential caching: credentials from awsCredentialExport are now cached until their Expiration instead of a fixed 1 hour
• Fixed: availableModels enforcement: alias model picks can no longer be redirected to a blocked model via ANTHROPIC_DEFAULT_*_MODEL env vars; /fast now refuses to toggle when it would switch to a blocked model
• Fixed: Auto mode failing on Fable 5 for organizations without Opus 4.8 enabled (the classifier now falls back to the best available Opus model)
• Fixed: Hook if conditions for Read/Edit/Write tool paths: patterns like Edit(src/**), Read(~/.ssh/**), and Read(.env) now match correctly
• Fixed: Linux sandbox failing to start when .claude/settings.json is a symlink with an absolute target
• Fixed: /copy and mouse-selection copy not reaching the system clipboard inside tmux over SSH; tmux paste buffer not loading on versions older than 3.2
• Fixed: Remote Control connecting from web/mobile silently switching the session's model
• Fixed: Remote Control disconnect notifications showing a bare numeric code instead of a human-readable reason; connection failures adding a duplicate line to the transcript
• Fixed: Remote Control sessions not disconnecting when signing in to a different account
• Fixed: /cd and worktree moves leaving the session reporting the previous directory's git branch
• Fixed: claude agents: pressing back in one window no longer detaches other windows attached to the same session
• Fixed: Backgrounded sessions showing "Working" forever when /bg mid-turn had nothing left to continue
• Fixed: Background agent search by PR URL for PRs opened during scheduled wakeups or while a job was blocked
• Fixed: Agents view input showing no text cursor on Windows
• Fixed: claude --bg -cn <name> not seeding the session name
• Fixed: Background sessions to neutralize Windows network paths in persisted state before respawn
• Fixed: Background-session respawn rejecting malformed resume IDs from corrupted state files
• Fixed: Windows background-service daemon not starting when ~/.claude/daemon has the ReadOnly attribute set
• Fixed: Cloud sessions failing with "Could not resolve authentication method" when idle for too long before being claimed
• Improved: Background sessions now show clearer guidance when a window left open across an auto-update can't submit a reply; claude daemon status explains version-skew behavior

---

v2.1.175 (2026-06-15)

• New: enforceAvailableModels managed setting: when enabled, the availableModels allowlist also constrains the Default model (a Default that would resolve to a disallowed model now falls back to the first allowed model), and user or project settings can no longer widen a managed availableModels list

---

v2.1.174 (2026-06-15)

wheelScrollAccelerationEnabled setting, improved /model picker, VS Code usage attribution, 8+ bug fixes.

• New: wheelScrollAccelerationEnabled setting to disable mouse-wheel scroll acceleration in fullscreen mode
• Fixed: /model picker hiding the model family that Default resolves to. Opus now appears as its own row on Max/Team Premium/Enterprise plans, Sonnet on Pro/Team plans, and Opus on pay-as-you-go API accounts
• Fixed: /model picker showing a hardcoded Sonnet version label when ANTHROPIC_DEFAULT_SONNET_MODEL pins a different Sonnet
• Fixed: "Fable 5 is now consuming usage credits" banner incorrectly showing for enterprise accounts with usage-based billing
• Fixed: Bedrock GovCloud regions (us-gov-*) deriving the wrong inference profile prefix (global instead of us-gov), causing 400 errors on derived model IDs
• Fixed: Background sessions inheriting another session's ANTHROPIC_* provider env (gateway URL, custom headers, /model aliases) from the shell that started the background daemon
• Fixed: 1-2 second pause when exiting Claude Code shortly after a shell command was interrupted or killed on macOS and Linux
• Fixed: Git commit co-author attribution showing an incorrect model name for some models
• Fixed: /advisor dialog pre-selecting a saved advisor model that is blocked by the availableModels allowlist
• Fixed: Skill hot-reload re-sending the entire skill listing when a single skill changed (only changed skills are now re-announced)
• Fixed: Workflow tool agent() subagents missing per-agent attribution headers
• Fixed: Pre-warmed background workers failing with "Could not resolve authentication method" when claimed after sitting idle
• New [VSCode]: Usage attribution in the Account & usage dialog (/usage) showing cache misses, long context, subagents, and per-skill/agent/plugin/MCP breakdowns over the last 24h or 7d

---

v2.1.173 (2026-06-11)

Bug fixes: Fable 5 [1m] suffix normalization, Windows sandbox warning fix.

• Fixed: Fable 5 model names with a [1m] suffix not being normalized (Fable 5 includes 1M context by default, suffix now stripped automatically)
• Fixed: Spurious "sandbox dependencies missing" startup warning on Windows when sandbox was enabled in settings

---

v2.1.172 (2026-06-11)

• New: Sub-agents can now spawn their own sub-agents up to 5 levels deep
• New: Amazon Bedrock now reads the AWS region from ~/.aws config files when AWS_REGION isn't set, matching AWS SDK precedence; /status shows where the region came from
• New: Added a search bar when browsing a marketplace's plugins in /plugin
• New: Added model attribute to the claude_code.lines_of_code.count OTEL metric
• Fixed: Sessions using 1M context without usage credits getting permanently stuck; the session now automatically compacts back under the standard context limit
• Fixed: Repeating "an image in the conversation could not be processed and was removed" error when the conversation contained multiple images
• Fixed: Agents view keeping a session under "Working" with a busy spinner for up to 30 seconds after the worker replied
• Fixed: Background agents potentially reading another directory's project settings when dispatched onto a pre-warmed worker
• Fixed: Background-session attach failing with EAUTH for sessions started on an older version after the daemon auto-updated
• Fixed: A background sub-agent staying stuck as "active" in the agent panel after a nested agent it spawned was stopped
• Fixed: /model suggestions rendering with a misleading slash prefix and showing models disabled for your org
• Fixed: availableModels restrictions not being applied to subagent model overrides, the agent dispatch model picker, and the advisor model
• Fixed: availableModels allowlists hiding the /model picker's Opus and Sonnet 1M rows when entries use version-specific IDs like claude-opus-4-8
• Fixed: /model picker on Bedrock offering models the provider doesn't serve: selecting one silently switched the session model and lit the selection marker on multiple rows
• Fixed: Model IDs getting a doubled 1M-context suffix (e.g. [1M][1m]) when ANTHROPIC_DEFAULT_OPUS_MODEL already includes one
• Fixed: opusplan model setting not shipping with 1M context in plan mode for entitled users; the opusplan[1m] workaround now also correctly switches to Opus in plan mode
• Fixed: WebFetch(domain:*.example.com) wildcard domain rules never matching subdomains; file permission rules with mid-pattern wildcards (e.g. Read(secrets-*/config.json)) rejected at startup
• Fixed: Up-arrow prompt history showing the main agent's prompts while a subagent's chat tab is open
• Fixed: Memory recall not finding mounted team memory stores (CLAUDE_MEMORY_STORES) in remote sessions
• Fixed: Workflow validation rejecting scripts whose prompt strings or comments mention Date.now()/Math.random()
• Fixed: Mouse tracking on Windows consoles that don't fully support it
• Fixed: /plugin marketplace list losing its cursor after backing out of a long list; Esc from the plugin browser returning to the wrong tab
• Improved: Performance in long conversations (removed redundant message normalization, fewer full message-history transforms)
• Improved: Reduced idle CPU usage: /goal status chip no longer re-renders the terminal at 5 Hz while idle
• Improved: Claude in Chrome browser tools now load in a single batched call instead of one per tool
• Improved: Non-interactive Usage Policy refusal message suggests starting a new session or changing the model
• Improved: /code-review keeps the ultra option visible when not signed in to claude.ai, with an explanation
• Improved: Remote Control footer indicator shortened to "/rc active", hidden on narrow terminals
• Improved: Stopped promoting /loop in remote sessions, where pending loops don't keep the container alive
• Fixed [VSCode]: PowerShell tool calls rendered as raw JSON instead of a proper command display; ANSI escape codes stripped from displayed shell output

---

v2.1.170 (2026-06-09)

• New: Claude Fable 5 is now available: a Mythos-class model exceeding the capabilities of any previously generally available Anthropic model. See announcement.
• Fixed: Sessions launched from the VS Code integrated terminal (or any shell that inherited Claude Code environment variables) were not saving transcripts and not appearing in --resume

---

v2.1.169 (2026-06-09)

• New: --safe-mode flag (and CLAUDE_CODE_SAFE_MODE env var): starts Claude Code with all customizations disabled (CLAUDE.md, plugins, skills, hooks, MCP servers) for troubleshooting
• New: /cd command: move a session to a new working directory without breaking the prompt cache mid-session
• New: disableBundledSkills setting and CLAUDE_CODE_DISABLE_BUNDLED_SKILLS env var to hide built-in skills, workflows, and slash commands from the model
• Fixed: Arrow keys jumping to command history past wrapped rows of a long input line; they now move through each visual row first
• Fixed: Enterprise managed MCP policies (allowedMcpServers/deniedMcpServers) not enforced on reconnect, IDE-typed configs, --mcp-config servers during first session after install, or before remote settings loaded
• Fixed: ~30-50ms UI stall at the start of each turn for macOS users logged in with claude.ai credentials
• Fixed: claude -p slow or hanging on Windows while waiting for slash-command/skill scan (regression since 2.1.161)
• Fixed: Remote Control getting stuck on "reconnecting" after OAuth token refresh during session resume
• Fixed: Git Credential Manager "Connect to GitHub" popup on Windows at startup
• Fixed: Footer hints (e.g. "esc to interrupt") not showing for users with a custom statusline
• Fixed: claude agents --json omitting blocked and just-dispatched background sessions; added --all to include completed sessions plus new id and state fields
• Fixed: Background agents ignoring project-level env values (e.g. ANTHROPIC_MODEL) when dispatched onto a pre-warmed worker
• Improved: TaskCreate reliability: malformed inputs are repaired automatically; validation errors for unloaded tools include the schema
• Improved: Reduced CPU usage while responses stream and during spinner animations
• Improved: /workflows now opens immediately even while a turn is in progress

---

v2.1.168 (2026-06-06)

Bug fixes and reliability improvements.

---

v2.1.167 (2026-06-06)

Bug fixes and reliability improvements.

---

v2.1.166 (2026-06-06)

fallbackModel setting, deny rule glob patterns, thinking disable on default-thinking models, hardened SendMessage, 15+ bug fixes.

• New: fallbackModel setting: configure up to 3 fallback models tried in order when the primary model is overloaded or unavailable; --fallback-model also works in interactive sessions
• New: Glob pattern support in deny rule tool-name position ("*" denies all tools); allow rules reject non-MCP globs; unknown tool names in deny rules warn at startup
• Security: Hardened cross-session messaging: messages relayed via SendMessage no longer carry user authority; receivers refuse relayed permission requests and auto mode blocks them
• Changed: MAX_THINKING_TOKENS=0, --thinking disabled, and per-model thinking toggle now disable thinking on models that think by default via the Claude API (3P providers unchanged)
• Changed: Claude Code retries a turn once on the fallback model when the API rejects unexpected non-retryable errors; auth, rate-limit, request-size, and transport errors still surface immediately
• Changed: claude update now announces the target version before downloading
• New: claude agents: typing a URL into the list filters to the session whose first prompt contained it
• Fixed: Background sessions becoming stuck when a backend disruption occurred during worker registration at startup
• Fixed: JetBrains IDE terminal flickering (IntelliJ, PyCharm, WebStorm) on 2026.1+, synchronized output enabled
• Fixed: Shift+non-ASCII characters (e.g. Shift+ä → Ä) dropped in terminals using the Kitty keyboard protocol (WezTerm, Ghostty, kitty)
• Fixed: PowerShell command validation hanging on Windows when a killed process's children held output pipes
• Fixed: Orphaned claude --bg-pty-host processes spinning at 100% CPU on macOS after daemon death
• Fixed: Managed settings with an invalid entry silently disabling remaining valid policies
• Fixed: allowedMcpServers/deniedMcpServers predicates not matching with ${VAR} references
• Fixed: Background agent sessions in git worktrees crash-looping with "No conversation found" when reopened
• Fixed: Duplicated thinking text in the Ctrl+O transcript view while streaming

---

v2.1.165 (2026-06-05)

Bug fixes and reliability improvements.

---

v2.1.163 (2026-06-04)

requiredMinimumVersion/requiredMaximumVersion managed settings, /plugin list, Stop hook additionalContext, 10+ bug fixes.

• New: requiredMinimumVersion and requiredMaximumVersion managed settings: Claude Code refuses to start if its version is outside the allowed range and directs the user to an approved version
• New: /plugin list command to list installed plugins, with --enabled/--disabled filters
• New: Added "c to copy" shortcut to /btw, copies the raw markdown answer to the clipboard
• Changed: Stop and SubagentStop hooks can now return hookSpecificOutput.additionalContext to give Claude feedback and keep the turn going without being labeled a hook error
• Changed: Skills: added \$ escape syntax to include a literal $ before a digit in command bodies
• Changed: stdio MCP servers now receive the same CLAUDE_CODE_SESSION_ID as hooks/Bash on --resume
• Fixed: claude -p hanging forever after its final result when a backgrounded command never exits; background shells stopped ~5s after result once stdin closes
• Fixed: claude -p failing with "ANTHROPIC_API_KEY required" on Bedrock/Vertex/Foundry when CI=true and no Anthropic API key is set
• Fixed: Bash commands failing under bazel and EDR-protected Go workflows: $TMPDIR was overridden to /tmp/claude-\{uid\} for all commands, not just sandboxed ones (regression since 2.1.154)
• Fixed: Bash commands failing on Windows with "EEXIST: file already exists" on the session-env directory when inside OneDrive or with read-only attribute
• Fixed: Org-managed permission rules not applying when managed settings fetch completed during startup on a fresh config directory
• Fixed: Background sessions losing running background tasks when reattached after a Claude Code update
• Fixed: Terminal misalignment and multi-second hang when exiting the agent view with Esc
• Fixed: Hook if: "Bash(...)" conditions firing on every Bash command containing $() or $VAR

---

v2.1.162 (2026-06-03)

Quieter startup, agents waitingFor, slash-command fill-in, Windsurf renamed to Devin Desktop, 25+ bug fixes.

• New: claude agents --json now includes waitingFor showing what a waiting session is blocked on (e.g. permission prompt)
• New: --tools: explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search
• New: /effort now confirms when your chosen level will persist as the default for new sessions
• Changed: Clicking a slash command in the autocomplete menu fills it into the prompt instead of running it immediately; press Enter to run
• Changed: Remote Control now shows as a persistent footer pill (with a link to the session) instead of a startup message
• Changed: Renamed Windsurf to Devin Desktop in /ide, /terminal-setup, and /scroll-speed, following the editor's rebrand
• Fixed: Silent startup hang when config directory is read-only; Claude Code now starts with in-memory config and surfaces errors
• Fixed: WebFetch permission rules not applied to built-in preapproved domains; explicit deny/ask/allow rules now take precedence
• Fixed: Windows permission rules never matching backslash-spelled paths (~\, \\server\share) or case-variant paths
• Fixed: MCP per-server timeout values below 1000 ms being floored to a 1-second watchdog that aborted every tool call
• Fixed: LSP workspaceSymbol operation returning no results; now accepts a query parameter
• Fixed: claude agents cutting live status text at 60-120 columns on wide terminals; truncating session names at 40 columns
• Fixed: claude agents Ctrl+V image paste doing nothing in dispatch input and session reply box
• Fixed: Cross-session messaging (SendMessage) silently breaking with deep CLAUDE_CODE_TMPDIR or $TMPDIR paths
• Improved: Quieter startup: notices group by severity, session info and announcements share a single line per launch
• Improved: Background service startup and claude update verification wait out endpoint-security scanning instead of failing after 5 seconds
• Removed: "Claude in Chrome enabled" and "marketplace installed" startup messages; model auto-updates and team-onboarding tip now show as quiet notices

---

v2.1.161 (2026-06-02)

OTEL custom dimensions, done/total in agents view, parallel tool-call isolation, 20+ bug fixes.

• New: OTEL_RESOURCE_ATTRIBUTES values included as labels on metric datapoints for custom dimensions (team, repo)
• New: claude agents rows show done/total before the detail when work is fanned out; peek shows the longest-running item
• New: /mcp collapses claude.ai connectors you've never signed in to behind a "Show unused connectors" row
• Changed: Parallel tool calls: a failed Bash command no longer cancels other calls in the same batch; each tool returns its own result independently
• Improved: Fullscreen mode clipboard on Linux uses wl-copy/xclip/xsel when available; copies to clipboard and PRIMARY selection for middle-click paste
• Improved: Terminal rendering performance by stabilizing the layout engine's JIT compilation profile; rendering performance for large file writes
• Fixed: /effort dialog, workflow animations, and prompt keyword shimmer not honoring "Reduce motion" setting
• Fixed: forceLoginOrgUUID/forceLoginMethod managed-settings policies blocking third-party provider sessions (regression in 2.1.146)
• Fixed: Background subagent output corrupting claude -p stdout with --output-format text or json
• Fixed: claude mcp list/get/add printing secrets to terminal; ${VAR\} references no longer expanded, credential headers and URL secrets redacted
• Fixed: Workflow agents with isolation: "worktree" in background sessions blocked from editing files inside their own worktree
• Fixed: Background sessions dispatched from claude agents booting on stale model from daemon environment instead of settings.json
• Fixed: OpenTelemetry log events dropped when emitted before telemetry initialization completed
• Fixed: Completed subagents getting stuck showing as running when an error occurs while finalizing their result
• Added: [VSCode] Tip suggesting disabling terminal GPU acceleration (or running /terminal-setup) to fix garbled glyphs

---

v2.1.160 (2026-06-01)

ultracode replaces workflow keyword, security prompts for startup files, Edit after grep, 20+ bug fixes.

Breaking: The dynamic-workflow trigger keyword changed from workflow to ultracode. The word "workflow" no longer triggers a run; asking for one in your own words still works. The trigger keyword is highlighted in violet in the prompt input.

• Changed: Renamed dynamic-workflow trigger keyword from workflow to ultracode; violet shimmer in prompt input; asking in your own words still works
• Security: Added prompt before writing to shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/, which could otherwise lead to unintended command execution
• Security: acceptEdits mode now prompts before writing build-tool config files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/)
• Improved: Edit no longer requires a separate Read after viewing a file with grep; single-file grep/egrep/fgrep commands now satisfy the read-before-edit check
• Improved: Auto mode classifier latency reduced by lowering reasoning on routine actions; fewer "could not evaluate this action" blocks
• Improved: Background-session teardown sends SIGTERM to running shell subprocesses before SIGKILL so cleanup handlers run
• Removed: CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE (deprecated in 2.1.154; now a no-op)
• Removed: JetBrains plugin install suggestion from startup
• Fixed: 20+ bug fixes: WSL clipboard via PowerShell interop, completed sessions from claude agents dropping chat history, overnight retired sessions losing conversation, voice mode with non-ASCII project/branch names, auto mode unavailability message on third-party providers, past replies disappearing on brief mode resume, vim mode p paste position

---

v2.1.159 (2026-05-31)

Internal infrastructure improvements (no user-facing changes).

---

v2.1.158 (2026-05-30)

Auto mode on Bedrock, Vertex, and Foundry for Opus 4.7/4.8.

• New: Auto mode is now available on Bedrock, Vertex, and Foundry for Opus 4.7 and Opus 4.8; opt in by setting CLAUDE_CODE_ENABLE_AUTO_MODE=1

---

v2.1.157 (2026-05-29)

Plugin auto-loading from .claude/skills (no marketplace), claude plugin init, mid-session worktree switching, 20+ bug fixes.

• New: Plugins in .claude/skills directories are now automatically loaded, no marketplace required
• New: claude plugin init <name> scaffolds a new plugin directly in .claude/skills
• New: Autocomplete for /plugin arguments: subcommands, installed plugin names, and plugins from known marketplaces
• New: claude agents: the agent field in settings.json is now honored for dispatched sessions; use --agent <name> to override it
• New: EnterWorktree can now switch between Claude-managed worktrees mid-session
• New: tool_decision telemetry events now include tool_parameters (bash commands, MCP/skill names) when OTEL_LOG_TOOL_DETAILS=1
• Improved: Worktrees managed by Claude are left unlocked after the agent finishes, so git worktree remove/prune can clean them up
• Improved: Long and resumed conversations are faster due to eliminated redundant message-rendering recomputations
• Improved: /terminal-setup now disables GPU acceleration in VS Code/Cursor/Windsurf integrated terminals to prevent garbled-text rendering
• Fixed: Unprocessable images (zero-byte, corrupt) attached via paste, MCP, or dialog no longer crash the request; they become text placeholders
• Fixed: Sandbox network permission prompts no longer appear in auto and bypass-permissions mode for desktop app, IDE extensions, and SDK
• Fixed: Background agent worktrees under .claude/worktrees/ no longer get orphaned after the 30-day job retention sweep
• Fixed: Background sessions re-attached after sleep/wake now report the correct date to the model
• Fixed (regression 2.1.153): Copy-on-select in claude agents now reaches the system clipboard inside tmux with set-clipboard on
• Fixed: --resume now reports background subagents that were running when the previous Claude Code process exited
• Fixed: --worktree and --worktree --tmux now return to the correct linked worktree instead of the canonical repo root
• Fixed: /model picker no longer shows an incorrect "Newer version available" hint when the selected model is already the newest in its family
• Fixed: Right-click paste no longer duplicates the clipboard in VS Code, Cursor, and Windsurf integrated terminals
• Fixed (WSL): Image paste (alt+v), screenshot paste on Windows 11, and dragging images from Windows Explorer now work correctly
• Fixed: Several claude agents issues: completed sessions not retiring, pressing Esc not cancelling "opening…", terminal freeze after managed-settings dialog
• Fixed: Literal markdown markers (backticks, asterisks) no longer appear in in-progress message text in fullscreen mode

---

v2.1.156 (2026-05-28)

Hotfix: Opus 4.8 API crash from modified thinking blocks.

• Fixed: An issue where thinking blocks were modified when using Opus 4.8, leading to API errors

---

v2.1.154 (2026-05-28)

Opus 4.8, dynamic workflows orchestrating hundreds of background agents, lean system prompt as default, 30+ bug fixes.

• New (Model): Opus 4.8 is available and defaults to high effort; use /effort xhigh for your hardest tasks
• New (Model): Fast mode on Opus 4.8 at 2x the standard rate for 2.5x the speed
• New: Dynamic workflows: Claude can orchestrate work across tens to hundreds of background agents in one session; run /workflows to monitor runs
• New: The lean system prompt is now the default for all models except Haiku, Sonnet, and Opus 4.7 and earlier
• Changed: /simplify now runs a cleanup-only review (reuse, simplification, efficiency, altitude) and applies the fixes, instead of running the full /code-review --fix bug-hunting review
• Changed: /effort slider labels renamed from "Speed"/"Intelligence" to "Faster"/"Smarter"
• New: claude agents: type ! <command> to run a shell command as a background session you can attach and detach from; also available as claude --bg --exec '<command>'
• New: claude agents: /logout now signs you out instead of being sent to a background session
• New: ←← to open the agents view now works on Bedrock, Vertex, Foundry, and with telemetry disabled
• New: Claude in Chrome: pick which connected browser to use via /chrome → "Select browser…", or in-chat when multiple browsers are connected
• New: Plugins can declare defaultEnabled: false in plugin.json or a marketplace entry; enable with /plugin or claude plugin enable
• New: The /plugin Discover tab pins plugins matching the current directory with a "suggested for this directory" annotation
• New: Streaming tool execution always enabled, including on Bedrock/Vertex/Foundry (previously behind a feature flag)
• New: Stdio MCP server subprocesses receive CLAUDE_CODE_SESSION_ID and CLAUDECODE=1 in their environment
• New: claude mcp list/get now show unapproved .mcp.json servers as ⏸ Pending approval instead of auto-approving
• Improved: Auto-mode classifier detection of data exfiltration improved, particularly for bulk repository transfers
• Deprecated: CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE (removed 2026-06-01); use /model claude-opus-4-6[1m] then /fast on
• Fixed (VSCode): Claude Code processes not shutting down cleanly when VS Code closed on Windows
• Fixed: 30+ fixes including orphaned --bg-pty-host processes spinning at 100% CPU after daemon exit, number key shortcuts not working below the divider in option dialogs, worktree.baseRef: "head" resolving to wrong HEAD when spawning subagents from inside a linked worktree, intermittent rendering corruption in VS Code from thinking spinner colors, plan file names containing [Image #N]/[Pasted text #N] placeholders, phantom expand affordance on short ANSI-colored lines, invalid allowedMcpServers/deniedMcpServers entry discarding all managed-settings policy, API 400 errors on models without effort parameter when CLAUDE_CODE_ALWAYS_ENABLE_EFFORT is set, Windows update failure showing generic error, auto mode blocking actions when safety classifier ran out of output tokens while reasoning
• Breaking: CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE deprecated (removed 2026-06-01)
• Breaking: /simplify behavior changed: now cleanup-only review, not full code-review fix

---

v2.1.153 (2026-05-28)

/model saves as default by default (IDE parity), skipLfs for plugin marketplace, claude agents autocomplete improvements, 25+ bug fixes.

• Changed: /model now saves your selection as the default for new sessions (matching IDE behavior); press s in the picker to switch current session only, reversing the 2.1.144 behavior where session-only was the default and d set the default
• New: skipLfs option for github/git plugin marketplace sources to skip Git LFS downloads during clone and update
• New: Status line commands receive COLUMNS and LINES environment variables so scripts can size output to the terminal width
• New: claude agents dispatch input autocomplete now suggests native slash commands and bundled skills, not just project skills
• New: claude agents PR column shows PR #N for a single PR or N PRs for multiple
• New: claude doctor shows the result of your last update attempt; one-time notice when npm global install can't auto-update (with /doctor listing fixes)
• Changed (macOS): Background agents now appear as "Claude Code" in Privacy & Security, keeping permission grants across upgrades
• Fixed: 25+ fixes including stateful MCP servers without optional GET SSE reconnect-looping (regression from 2.1.147), API gateway receiving user's Anthropic OAuth credential instead of gateway token, subagent Agent tool frontmatter MCP servers ignoring --strict-mcp-config/enterprise managed policies, Agent tool with subagent_type: 'claude' silently discarding outputs written to gitignored paths, Windows PowerShell installer reporting success when installation actually failed, claude update installing latest instead of configured release channel's version, excessive memory when resuming sessions by transcript file path, stream-json mode hang on stdin closed without EOF, malformed file:// links not clickable, --help unwrapped on narrow terminals, MCP tool progress in collapsed view, /bg response continuing in background instead of dropping, multiple background session fixes (clipboard/copy in tmux, /rename immediate update, IME candidate window position, 256-color terminal background bleed, zombie session entries after exiting claude agents with Remote Control), Windows update rollback restoration
• Breaking: modelPicker:setAsDefault keybinding renamed to modelPicker:thisSessionOnly in keybindings.json (the d action was replaced by s)

---

v2.1.152 (2026-05-27)

/code-review --fix, disallowed-tools frontmatter for skills, MessageDisplay hook, auto mode opt-in removed, 35+ bug fixes.

• New: /code-review --fix now applies review findings to your working tree after the review; /simplify now invokes /code-review --fix
• New: Skills and slash commands can set disallowed-tools in frontmatter to remove tools from the model while the skill is active
• New: /reload-skills command re-scans skill directories without restarting the session
• New: SessionStart hooks can return reloadSkills: true to make newly installed skills available in the same session, and can set the session title via hookSpecificOutput.sessionTitle on startup and resume
• New: MessageDisplay hook event lets hooks transform or hide assistant message text as it is displayed
• New: pluginSuggestionMarketplaces managed setting so admins can allowlist org marketplaces whose plugins may be suggested via context-aware tips
• New: --fallback-model switches to a configured fallback for the rest of the session when the primary model is not found, instead of failing every request
• New (Vim): / in NORMAL mode opens reverse history search (like Ctrl+R), matching bash/zsh vi-mode behavior
• Improved: /usage breakdown now includes large session files; files scanned with a streaming read so memory usage stays flat
• Improved: Thinking summaries in the collapsed group stay readable for at least 3 seconds, render as markdown, and cap at 10 lines (Ctrl+O shows full thinking)
• Improved: Fullscreen mode "Thinking for Ns" indicator counts up live while the model is thinking
• Changed: Auto mode no longer requires opt-in consent
• Fixed: 35+ fixes including terminal styling degrading in long sessions, sandbox warning missing in condensed startup, loading spinner state across tool calls, focus mode spurious hidden-message count, link click inside tool result collapsing the section, markdown table cell border color bleeding from inline code, plugin MCP servers with same command but different env vars being deduplicated, /doctor errors for stale enabledPlugins entries, plugin git-branch updates silently stopping, remote MCP servers failing with egress proxy, effort-change dialog appearing with no messages or same effective effort, Agent tool description with --bare, background worker crash after stale permission prompt cancellation, cache_creation_input_tokens reporting as 0 when API uses nested breakdown, PushNotification false negative in SDK-hosted sessions, sessions stuck after model/login switch left stale thinking-block signatures in history

---

v2.1.150 (2026-05-23)

Internal infrastructure improvements: no user-facing changes.

---

v2.1.149 (2026-05-23)

/usage per-category breakdown, GFM task list checkboxes, two security fixes, 20+ bug fixes.

• New: /usage now shows a per-category breakdown of what drives your limits usage: skills, subagents, plugins, and per-MCP-server cost
• New: Markdown output renders GFM task list checkboxes (- [ ] todo / - [x] done) natively instead of plain bullets
• New (Enterprise): allowAllClaudeAiMcps managed setting to load claude.ai cloud MCP connectors alongside managed-mcp.json
• Security: PowerShell permission bypass fixed: built-in cd functions (cd.., cd\, cd~, X:) changed the working directory undetected, letting later commands read outside the workspace
• Security: Sandbox write allowlist in git worktrees was covering the entire main repository root instead of only the shared .git directory (with hooks/ and config denied)
• Fixed: /diff detail view can now be scrolled with keyboard (arrows, j/k, PgUp/PgDn, Space, Home/End)
• Fixed: PowerShell prefix/wildcard allow rules (e.g. PowerShell(dotnet.exe build *)) now pre-approve native executables and scripts
• Fixed: Permission-analysis gap where parser trusted stale variable-tracking values for PWD/OLDPWD/DIRSTACK across cd/pushd/popd
• Fixed: find in Bash tool exhausting the macOS system file/vnode table on large directory trees
• Fixed: Managed-settings approval dialog leaving the terminal frozen after accepting at startup
• Fixed: /ultraplan and remote session creation failing with "Could not capture uncommitted changes" when the working tree has no real changes
• Fixed: otelHeadersHelper failing silently when the script path contains spaces; failures now reported in /doctor and debug log
• Fixed: Thinking spinner staying amber across tool calls and onto fresh thinking bursts
• Fixed: Collapsed Bash output reporting the wrong hidden-line count for outputs with many short lines
• Fixed: Slash-command argument-hint clipping trailing typed characters when the hint overflows the input box
• Fixed: Argument-hint and progressive arg suggestions not appearing after Tab-completing a skill whose frontmatter name: differs from its directory basename
• Fixed: Status bar showing the user's baseline /effort setting instead of the effort level applied by skill/agent effort: frontmatter
• Fixed: Ctrl+O transcript view freezing at the moment it was opened instead of tailing new messages
• Fixed: Editing a recalled prompt-history entry losing the edit when navigating further up/down
• Fixed: /config exit summary reporting phantom changes to auto-compact and theme when toggling unrelated settings
• Fixed: /insights crashing when cached session-meta files are missing optional fields
• Fixed: Renaming a Remote Control session from claude.ai or the Claude mobile app not updating the local session name for claude --resume
• Fixed: Race where a just-submitted prompt could appear twice in up-arrow history
• Fixed: "Jump to bottom" pill in fullscreen mode not dismissing immediately after tap
• Improved: /feedback reports now include the conversation before context compaction, making issues from earlier in long sessions easier to triage

---

v2.1.148 (2026-05-22)

Hotfix: Bash tool exit code 127 regression from 2.1.147.

• Fixed: Bash tool returning exit code 127 on every command (regression introduced in 2.1.147)

---

v2.1.147 (2026-05-22)

Pinned background sessions (Ctrl+T), /code-review --comment for inline GitHub PR comments, improved auto-updater, 30+ bug fixes.

• New: Pinned background sessions: Ctrl+T in claude agents pins a session so it stays alive when idle, auto-restarts in place to apply CC updates, and is shed under memory pressure only after non-pinned sessions
• New: /code-review --comment: post findings as inline GitHub PR comments
• Improved: Auto-updater now retries transient network failures, reports specific error categories and OS error codes on failure, and shows the current version when an update fails
• Fixed: Prompt history no longer records consecutive duplicate entries
• Fixed: Hook if conditions like PowerShell(git push*) now match correctly (only PowerShell(*) worked before)
• Fixed: Pasted text now delivered as actual content instead of [Pasted text #N] placeholder
• Fixed: Plugin component counts in claude plugin details and /plugin were doubled when paths overlapped default directories
• Fixed: Slash commands followed by a tab or newline no longer treated as unknown commands
• Fixed: Shell snapshot no longer drops user functions whose names start with a single underscore
• Fixed: Plugin agents declaring multiple Agent(...) types in tools: frontmatter now retain all entries
• Fixed: PowerShell tool no longer drops output for commands relying on the default formatter
• Fixed: Windows "Yes, and don't ask again" for PowerShell script invocations now writes a rule that matches on subsequent runs
• Fixed: Full-screen strobing in attached background sessions on Windows Terminal while streaming
• Fixed: On Windows, removing a background-job worktree no longer follows NTFS junctions into the main repo
• Fixed: /effort slider now opens at the current effort level (was always starting at wrong level)
• Fixed: Several spacing and layout glitches in /plugin, /status, /mobile, /sandbox, /permissions menus
• Fixed: 10+ additional fixes: stale/doubled rows in agent view with CJK on Windows, stripped images prompting repeated re-reads, rare scroll-settle hang on Windows, & in ! command output, unknown slash commands now show an error in headless/SDK mode, /help rendering on small terminals

---

v2.1.146 (2026-05-21)

/code-review command (renamed from /simplify), AskUserQuestion restored in auto mode, 15+ bug fixes.

• Changed: /simplify renamed to /code-review with optional effort level (e.g. /code-review high)
• Fixed: Auto mode no longer suppresses AskUserQuestion when the user or a skill explicitly relies on it
• Fixed: Windows PowerShell tool failing with "command line is invalid" when pwsh is installed via winget or Microsoft Store (regression in v2.1.124)
• Fixed: MCP resources/list, resources/templates/list, and prompts/list now return all pages on paginating servers
• Fixed: /background no longer refuses sessions whose only typed input was a skill or custom slash command
• Fixed: Backgrounded sessions no longer re-prompt for tool permissions already granted with "don't ask again"
• Fixed: /theme color editor and "New custom theme" dialogs now respond to Esc
• Fixed: CLAUDE_CODE_SUBAGENT_MODEL now forwarded to child processes in multi-agent sessions
• Fixed: forceLoginOrgUUID and forceLoginMethod managed-settings policies enforced against third-party-provider and API-key sessions
• Fixed: 10+ additional fixes: Windows GNOME Terminal paste, background daemon spawn fallback, Windows background session worktree removal, Agent SDK uncaught exception at end of streaming, diff rendering performance for large file edits

---

v2.1.145 (2026-05-20)

claude agents --json for scripting, /plugin previews before install, tab title shows awaiting-input count, security fix for Bash permission-prompt bypass, 20+ bug fixes.

• New: claude agents --json: list all live Claude sessions as JSON for scripting (tmux-resurrect, status bars, session pickers)
• New: agent_id and parent_agent_id attributes added to claude_code.tool OTEL spans; background subagent spans now nest under dispatching Agent tool span
• New: /plugin Discover and Browse screens now preview a plugin's commands, agents, skills, hooks, and MCP/LSP servers before installation
• New: claude agents terminal tab title shows awaiting-input count so an alt-tabbed window indicates when an agent needs attention
• New: Slash command and @-mention suggestion list supports mouse hover and click in fullscreen mode
• New: Stop and SubagentStop hook input now includes background_tasks and session_crons fields
• New: Status line JSON input now includes GitHub repo and PR information when detected
• Security: Fixed permission-prompt bypass where bare variable assignments to non-allowlisted environment variables in Bash commands were auto-approved
• Fixed: MCP paginated resources/list, resources/templates/list, and prompts/list dropping items past page 1
• Fixed: MCP prompt slash commands now show the missing argument name and expected usage instead of raw server validation errors
• Fixed: Read tool now returns a truncated first page with "PARTIAL view" notice instead of a hard error when whole-file read exceeds token limit
• Fixed: Task lists no longer rendered in random order when several tasks are created at once
• Fixed: Agent Teams teammates with non-ASCII names no longer fail every API call (invalid header encoding)
• Fixed: /review no longer errors on repos with Classic Projects (deprecated projectCards GraphQL query removed)
• Fixed: claude plugin validate now flags skills: entries pointing at a file instead of a directory
• Fixed: Skill with context: fork no longer repeatedly re-invokes itself in an infinite loop

---

v2.1.144 (2026-05-19)

/resume lists background sessions, /model session-only (d for default), usage credits rename, fixed 75s startup hang, terminal rendering fixes, 40+ bug fixes.

• New: /resume now lists background sessions started via claude --bg or agent view alongside interactive ones, marked with bg
• New: Elapsed duration shown in background subagent completion notifications (e.g. "Agent completed · 3h 2m 5s")
• Changed: /model now changes the model for the current session only: press d in the picker to set a default for new sessions
• Changed: "extra usage" renamed to "usage credits" across CLI copy; /extra-usage is now /usage-credits (old name still works)
• Fixed: Startup no longer hangs up to 75s when api.anthropic.com is unreachable: side-channel API calls now time out after 15s
• Fixed: Terminal rendering corruption self-heals on missed window-resize events; progressive glitch in long sessions cleared; VS Code spinner uses fewer colors to reduce glitches
• Fixed: macOS background sessions crashing with "exit 1 before init" under Full Disk Access-protected folders (regression in 2.1.143)
• Fixed: MCP servers with paginated tools/list now return all pages (was silently dropping tools past page 1)
• Fixed: File descriptor exhaustion in skill directories: non-.md files no longer trigger skill reloads
• Fixed: 40+ additional fixes: /branch after worktree entry, Escape in AskUserQuestion notes field, Bedrock/Vertex Opus 1M context picker, remote login with forceLoginMethod, background session scroll on Windows, and more

---

v2.1.143 (2026-05-16)

Plugin dependency enforcement, projected context cost in /plugin marketplace, worktree.bgIsolation: "none", PowerShell -ExecutionPolicy Bypass by default, stop hook block cap, 30+ bug fixes.

• New: Plugin dependency enforcement: claude plugin disable refuses when another enabled plugin depends on the target, with a copy-pasteable disable-chain hint; claude plugin enable force-enables transitive dependencies
• New: Projected context cost (per-turn and per-invocation token estimates) in the /plugin marketplace browse pane
• New: worktree.bgIsolation: "none" setting: lets background sessions edit the working copy directly without EnterWorktree (useful for repos where worktrees are impractical)
• New: PowerShell tool now passes -ExecutionPolicy Bypass by default: opt out with CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY=1
• Improved: Background sessions now preserve the model and effort level set after waking from idle
• Improved: Shift+Tab in attached agent sessions now includes auto mode in the cycle
• Fixed: Stop hooks that block repeatedly no longer loop forever: turn ends with a warning after 8 consecutive blocks (override via CLAUDE_CODE_STOP_HOOK_BLOCK_CAP)
• Fixed: Esc/Ctrl+C now cancels a pending /loop wakeup while Claude is idle between iterations
• Fixed: /goal evaluator no longer fires while background shells or delegated subagents are still running
• Fixed: NO_COLOR/FORCE_COLOR in settings.json env now apply to subprocesses only (no longer strips Claude Code's own UI colors)
• Fixed: claude agents --allow-dangerously-skip-permissions now makes bypass mode available in the permission cycle (was incorrectly defaulting sessions to bypass mode)
• Fixed: 20+ additional fixes: background session model+effort preservation after retire/wake, Windows event-loop with network-drive working directories, claude --bg --dangerously-skip-permissions persisting across retire/wake, background color bleed on 256-color terminals, stale fragment rendering on Windows Terminal

---

v2.1.142 (2026-05-15)

Fast mode upgraded to Opus 4.7 by default, new claude agents dispatch flags, root-level SKILL.md plugin support, /plugin shows LSP servers, MCP_TOOL_TIMEOUT fix, 25+ bug fixes.

• New: Fast mode now uses Opus 4.7 by default (previously Opus 4.6): set CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE=1 to pin to Opus 4.6
• New: claude agents gains dispatch flags: --add-dir, --settings, --mcp-config, --plugin-dir, --permission-mode, --model, --effort, and --dangerously-skip-permissions to configure background sessions
• New: Plugins with a root-level SKILL.md and no skills/ subdirectory are now automatically surfaced as a skill
• New: /plugin details pane and claude plugin details now show LSP servers a plugin provides
• New: /web-setup warns before replacing an existing GitHub App connection
• Fixed: MCP_TOOL_TIMEOUT now correctly raises the per-request fetch timeout for remote HTTP and SSE MCP servers (was capped at 60 seconds regardless of the configured value)
• Fixed: Background sessions now recognize pre-existing git worktrees (was blocking Edit while EnterWorktree refused to create a duplicate)
• Fixed: Daemon now exits cleanly after binary upgrade (e.g. brew upgrade): was causing dispatched agents to crash-loop on the deleted path
• Fixed: Background agents no longer crash-loop when Claude-in-Chrome extension is connected without a shared tab
• Fixed: Clicking links in an attached claude agents session: headless browser shim no longer applies while attached
• Fixed: claude agents "v to open in editor" now uses your shell's $EDITOR/$VISUAL instead of the daemon's default editor
• Fixed: claude agents deadlock on Windows with network-drive working directories; Ctrl+C now works during startup
• Fixed: claude --bg --dangerously-skip-permissions now persists across retire/wake
• Fixed: Plugins using skills: ["./"] no longer show a false "path escapes plugin directory" error
• Fixed: Plugin cache cleanup no longer deletes the active plugin version directory when no installation metadata is present
• Improved: Reactive compaction: first summarize attempt seeds from the original request's overflow size, avoiding a wasted near-full-context retry
• Improved: Hook configuration error: configuring a prompt- or agent-type hook for SessionStart/Setup/SubagentStart now shows a clear "use a command-type hook instead" message

---

v2.1.141 (2026-05-14)

Hook terminalSequence output field, claude agents --cwd, Rewind "Summarize up to here", 50+ bug fixes.

• New: Hook terminalSequence field in JSON output: emit desktop notifications, window titles, and bells from hooks without needing a controlling terminal
• New: CLAUDE_CODE_PLUGIN_PREFER_HTTPS: clones GitHub plugin sources over HTTPS instead of SSH (useful in environments without a GitHub SSH key)
• New: ANTHROPIC_WORKSPACE_ID environment variable for workload identity federation: scopes the minted token to a specific workspace
• New: claude agents --cwd <path>: scope the session list to a specific directory
• New: /feedback can now include recent sessions (last 24h or 7 days) for issues spanning more than the current session
• New: Rewind menu: "Summarize up to here": compress earlier context while keeping recent turns intact
• Improved: Auto mode permission dialog now explains when a permissions.ask rule caused the prompt
• Improved: "View diff in your IDE" option restored on file-edit permission prompts when an IDE is connected
• Improved: Background agents launched via /bg or ←← now preserve current permission mode instead of reverting to default
• Improved: claude agents: agents that finish work but leave a background shell running now move to Completed
• Improved: Spinner warms to amber after 10 seconds to signal Claude is still working during long thinking periods
• Improved: Plugin menu navigation: →/Tab switch tabs, ↑ moves to the tab strip, tab headers and search box clickable in fullscreen
• Fixed: Bedrock awsCredentialExport now always runs when configured (was skipped when ambient AWS credentials resolved), fixing cross-account access
• Fixed: Plugin MCP servers with unset config variables now show a "config issue" message with a fix-it hint instead of a generic connection failure
• Fixed: MCP HTTP/SSE servers returning 403 on connect now show "needs auth" instead of "failed"
• Fixed: Remote MCP servers no longer disconnect unnecessarily when the optional server-events stream fails to reconnect: tool calls continue over POST
• Fixed: Remote Control MCP connectors failing with 401 when worker session token rotated mid-session
• Fixed: Remote Control no longer re-enrolls a trusted device when the server rejects a stale token: loops through /login properly
• Fixed: 40+ additional fixes: markdown table cell-wrap regression, Ctrl+C in vim INSERT/VISUAL mode, alternative chat:submit keybindings, voice:pushToTalk custom keybindings, Windows Alt+V image paste, /tui with running background shells, /model changing autocompact threshold in other sessions, transcript view letter shortcuts after mouse click

---

v2.1.140 (2026-05-13)

Agent tool subagent_type case-insensitive matching, plugin folder warnings, targeted bug fixes.

• Improved: Agent tool subagent_type matching now case- and separator-insensitive: "Code Reviewer" resolves to code-reviewer, "backend_architect" to backend-architect
• Improved: Updated agent color palette
• Improved: Plugins now warn when a default component folder (e.g. commands/) is silently ignored because plugin.json sets the matching key: shown in /doctor, claude plugin list, and /plugin
• Fixed: /goal silently hanging when disableAllHooks or allowManagedHooksOnly is set: now shows a clear message
• Fixed: Symlinked settings hot-reload regression: symlinked files caused misattributed change events and spurious ConfigChange hooks
• Fixed: claude --bg failing with "connection dropped mid-request" when the background service was about to idle-exit
• Fixed: Background service startup failing on machines with enterprise endpoint security (allows more startup time)
• Fixed: Remote managed settings not retrying on 401: now retries once with a force-refreshed token
• Fixed: Managed extraKnownMarketplaces auto-update policy not being persisted to known_marketplaces.json
• Fixed: /loop scheduling redundant wakeups to poll for background tasks that already notify on completion
• Fixed: Windows event-loop stall when a missing executable (e.g. gh) triggered synchronous where.exe re-spawns on every check
• Fixed: Read tool calls failing validation when offset is passed as a whitespace-padded or +-prefixed string
• Fixed: Native terminal cursor not staying at the input caret when the terminal loses focus

---

v2.1.139 (2026-05-12)

Agent view (Research Preview), /goal command, hook exec form + continueOnBlock, 40+ bug fixes.

• New: Agent view (Research Preview): claude agents opens a single list of all sessions (running, blocked on you, or done). Each row shows the session status, last response preview, and time since last interaction. Navigate with left arrow from any session or launch directly from the terminal. Select a session to peek at the last turn and reply inline without fully attaching; press Enter to attach. Background any session with /bg, or launch directly to the background with claude --bg [task]. Available on Pro, Max, Team, Enterprise, and API plans.
• New: /goal command: set a completion condition; Claude keeps working across turns until met, with live elapsed/turns/tokens overlay panel
• New: /scroll-speed command to tune mouse wheel scroll speed with live preview
• New: claude plugin details <name>: shows plugin component inventory and projected per-session token cost
• New: Transcript view navigation: ? for shortcuts, \{/\} to jump between user prompts, v to toggle shortcut panel
• New: Hook args: string[] field (exec form): spawns command directly without a shell, path placeholders need no quoting
• New: Hook continueOnBlock config option for PostToolUse: set true to feed rejection reason back to Claude and continue the turn
• New: MCP stdio servers now receive CLAUDE_PROJECT_DIR in environment; plugin configs can reference ${CLAUDE_PROJECT_DIR} in commands
• Improved: Compaction prompt now asks the model to preserve sensitive user instructions
• Fixed: /mcp Reconnect picks up .mcp.json edits without a restart; shows HTTP status + URL when reconnect fails
• Fixed: Deadlock where expired credentials + forceRemoteSettingsRefresh blocked claude auth login/logout/status
• Fixed: autoAllowBashIfSandboxed not auto-approving commands with shell expansions like $VAR and $(cmd)
• Fixed: Unbounded MCP SSE memory growth: response bodies now capped at 16 MB per SSE frame
• Fixed: Skill(name *) wildcard permission rules now work as prefix match (matching Bash(ls *) behavior)
• Fixed: Settings hot-reload not detecting edits to symlinked ~/.claude/settings.json
• Fixed: 30+ additional fixes: hook terminal corruption, plugin dependency stale count, mouse wheel speed in Cursor/VS Code, MCP resources from disconnected servers in autocomplete, CJK/emoji border overflow, bash history up-arrow, multi-image paste

---

v2.1.138 (2026-05-11)

Internal fixes.

• Fixed: Internal fixes (no user-visible changes)

---

v2.1.137 (2026-05-11)

[VSCode] Fixed extension failing to activate on Windows.

• Fixed: VS Code extension failing to activate on Windows

---

v2.1.136 (2026-05-11)

settings.autoMode.hard_deny, CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL, MCP /clear disappear fix, 40+ UI/terminal bug fixes.

• New: settings.autoMode.hard_deny: auto mode classifier rules that block unconditionally regardless of user intent or allow exceptions
• New: CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL to re-enable the session quality survey for enterprises capturing responses via OpenTelemetry
• Fixed: MCP servers (.mcp.json, plugins, claude.ai connectors) silently disappearing after /clear in VS Code extension, JetBrains plugin, and Agent SDK
• Fixed: MCP OAuth refresh tokens lost when multiple servers refresh concurrently: no more daily re-authentication for multi-server setups
• Fixed: Rare login loop where a concurrent credential write could overwrite a freshly-rotated OAuth token and force re-login
• Fixed: API error (400) when extended thinking emitted a redacted thinking block after a tool call
• Fixed: --resume / --continue not finding sessions when the project path contains underscores
• Fixed: Plan mode not blocking file writes when a matching Edit(...) allow rule exists
• Fixed: WSL2: image paste from Windows clipboard now works via PowerShell fallback when xclip/wl-paste cannot read image data
• Fixed: Plugin Stop/UserPromptSubmit hooks failing when cache cleanup deletes a version still in use
• Improved: Visual consistency across slash command dialogs: standardized footer hints, spacing, arrow-key styling; dialog frame appears immediately during loading
• Fixed: Colors appearing at wrong positions in bash command output and markdown code blocks
• Fixed: ReasonML diffs rendering corrupted "undefined" text artifacts at word-diff boundaries
• Fixed: @ file picker not matching files created mid-session, and not finding files in directories with 100+ entries
• Fixed: 30+ additional UI/terminal fixes: failed tool calls expand in fullscreen, Backspace/Ctrl+Backspace swap fix, /usage weekly reset date display, CJK terminal overflow, /insights crash on malformed tool calls, renderer crash on collapsibility change, shell-integration lock files not respecting CLAUDE_CONFIG_DIR, trailing whitespace in copied output, plugin uninstall case-insensitivity, AskUserQuestion multi-select array fix, CronList missing qualifiers, MCP tool results invisible on content-block returns

---

v2.1.133 (2026-05-08)

worktree.baseRef setting, effort level in hooks, subagent skills fix, 15+ bug fixes.

Breaking: worktree.baseRef defaults to fresh (branches from origin/<default>), reverting 2.1.128 behavior where EnterWorktree used local HEAD. Set worktree.baseRef: "head" in settings to restore prior behavior.