CLI version history, configuration changes, and breaking changes
The latest version of Claude Code is v2.1.302, released Oct 16, 2026. Run claude --version to see the version you have installed, and claude update to install the latest one. This page tracks every Claude Code release, from new slash commands and features to breaking changes and environment variables.
Added CLAUDE_CODE_AUTO_MODE_MODEL to choose the model of the client-side auto mode classifier, an Idle compaction row in /config to turn idle compaction off or on, and a notice in /design-sync and /design-login that standalone Claude Design (claude.ai/design) closes by December 14, 2026
Fixed a "Prompt is too long" error when stopping a turn during compaction, Vertex or Bedrock requests failing after a mid-session switch, the Read tool loading an image of any size into memory (image sources over 128 MB are now refused), a prompt cache miss when a mid-session tool was reloaded through ToolSearch, and claude plugin subcommands exiting before a queued settings write finished
Fixed MCP servers showing no tools when they negotiate protocol 2026-07-28 but omit resultType, ttlMs or cacheScope, prompt suggestions spending usage credits, worktree isolation refusing to start under git 2.56+ with a stray .git file, and Windows refusing every file write on exFAT or FAT32 drives
Changed prompt and agent hooks to run at most 12 of one event at a time, the desktop app and VS Code to always run main-conversation subagents in the background, and the server-side auto mode classifier to compact a conversation too long for its safety check instead of denying every checked tool call
Breaking:
claude -p and Agent SDK sessions with no permission mode start in default mode on third-party providers, with telemetry off or on a fresh install (--permission-mode auto keeps auto). Fork subagents are on by default in claude -p, the Agent SDK, the desktop app and VS Code (CLAUDE_CODE_FORK_SUBAGENT=0 turns them off).
Note:showThinkingSummaries: true is a settings.json key, not an env var. Add it to ~/.claude/settings.json to restore thinking summaries (disabled by default since v2.1.90).
Full release history
Latest versions and breaking changes from Anthropic
Showing 5 of 262 releases
v2.1.302Oct 16, 2026
Added CLAUDE_CODE_AUTO_MODE_MODEL to choose the model of the client-side auto mode classifier, an Idle compaction row in /config to turn idle compaction off or on, and a notice in /design-sync and /design-login that standalone Claude Design (claude.ai/design) closes by December 14, 2026
Fixed a "Prompt is too long" error when stopping a turn during compaction, Vertex or Bedrock requests failing after a mid-session switch, the Read tool loading an image of any size into memory (image sources over 128 MB are now refused), a prompt cache miss when a mid-session tool was reloaded through ToolSearch, and claude plugin subcommands exiting before a queued settings write finished
Fixed MCP servers showing no tools when they negotiate protocol 2026-07-28 but omit resultType, ttlMs or cacheScope, prompt suggestions spending usage credits, worktree isolation refusing to start under git 2.56+ with a stray .git file, and Windows refusing every file write on exFAT or FAT32 drives
Changed prompt and agent hooks to run at most 12 of one event at a time, the desktop app and VS Code to always run main-conversation subagents in the background, and the server-side auto mode classifier to compact a conversation too long for its safety check instead of denying every checked tool call
⚠️ Breaking:
claude -p and Agent SDK sessions with no permission mode start in default mode on third-party providers, with telemetry off or on a fresh install (--permission-mode auto keeps auto). Fork subagents are on by default in claude -p, the Agent SDK, the desktop app and VS Code (CLAUDE_CODE_FORK_SUBAGENT=0 turns them off).
v2.1.301Oct 15, 2026
Added CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS so unattended retry mode ends a request at a usage limit that resets too far away, classifier_verdict, permission_mode and classifier_category on OpenTelemetry tool_decision events, the vim % motion and multi-line rows on a mod's Input
Fixed quitting removing a WorktreeCreate hook worktree that may hold unpushed commits without asking, Grep and Glob reporting no matches when the search program failed, and workflow agents skipping their step while the run still reported success
Fixed the fable and best aliases erroring when the newest Fable model is not available to the organization (Claude Code retries once on the previous Fable model), a switch to a smaller-context model spending usage credits on a summary without asking, and repeated compaction behind gateways that rename the model
Fixed the Read tool reading binary files such as .xlsm, .parquet, .epub and .heic as text, skills no longer listed to the model after /rewind, and skills or commands with very many or very long argument names stalling for seconds
⚠️ Breaking:
Skills and commands fill in only the first 64 argument names, each up to 64 characters. A mod hook's .catch handler runs only when the hook throws or times out, and a mod's $.env.set resolves with {} or { deny }.
v2.1.300Oct 14, 2026
Added cache_creation_5m_tokens and cache_creation_1h_tokens to the OpenTelemetry api_request event, GenAI semantic-convention attributes on trace spans, /advisor on Claude Platform on AWS, and virtualText, $.ui.view, the prompt.change hook and workflow-agent rewrites in agent.spawn for mods
Fixed SessionEnd hooks sometimes not running on exit with a background command, plugin WorktreeCreate and WorktreeRemove hooks skipped under --worktree, agent hooks ignoring their model, and a login refused by forceLoginOrgUUID leaving that organization's token stored
Fixed a conversation failing every turn with a 400 error when the API rejected an MCP tool's input schema, automatic tool search turning off mid-conversation, headless and SDK resumes losing compaction state, and Write, Edit and NotebookEdit in Cowork cloud sessions reporting success for files that never arrived
Changed PreToolUse and PermissionRequest hook updatedInput to be validated like Claude's own input, exit to force-kill background commands still running after 1.5 seconds, large api.anthropic.com requests to use gzip even with telemetry off, and local transcripts to record each request's system prompt, tools and parameters
⚠️ Breaking:
updatedInput from PreToolUse and PermissionRequest hooks is validated like Claude's own input: unknown keys are dropped and input the tool rejects denies the call. claude remote-control --sandbox and --no-sandbox now exit with an error; set sandbox.enabled in settings instead.
claude gateway stops at start on a desktop: policy key that Claude Desktop cannot use from a gateway, CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST sessions ignore CA-bundle, tool-proxy, git TLS and git config variables in settings, and a setMode update in a Cowork cloud PermissionRequest hook's allow is ignored.
⭐ Idle compaction
v2.1.299Oct 14, 2026
Added idle compaction in the terminal: a conversation of 200K+ tokens left idle for about 54 minutes is compacted before its one-hour prompt cache expires (CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS changes the minimum, "idleCompaction": false turns it off)
Added CLAUDE_CODE_DISABLE_FILE_MENTIONS, /effort and /fast defaults in agent view, /usage warnings for max effort, workflows, always-on context and large tool results, and --disallow-tools for claude plugin eval
Fixed a sandboxed command writing into a --plugin-dir folder that runs outside the sandbox, macOS sandbox denied paths reachable through a symlink, glob allowRead/allowWrite grants not re-checked after a symlink swap, and plan mode running a write that a PreToolUse or tool.check hook allowed
Fixed requests to Anthropic carrying a third-party gateway's API key when ANTHROPIC_BASE_URL is set, MCP servers connected or started before policy checks ran, Windows PreToolUse and PermissionRequest hooks failing open without Git for Windows, and Write silently converting non-UTF-8 files
⚠️ Breaking:
MCP allow rules and agent tools: lists reach only the server they name: mcp__a no longer covers a server named a__b or a_; write mcp____* with the whole normalized name. Write refuses Windows-1252, Shift-JIS, GBK or UTF-16BE files instead of converting them to UTF-8.
UserPromptSubmit hooks run before a skill or custom slash command expands, and a skill's own front-matter UserPromptSubmit hook first runs on the prompt after the one that invokes it. Actions a plugin hook can block are refused when the hook cannot receive them or answer, and skills or commands whose names carry hidden, direction-changing or blank-like characters, < or > are not offered until renamed.
Requests to claude.ai's connector proxy, Anthropic-hosted MCP servers and the cloud MCP proxy no longer follow HTTP redirects, and cloud session and Remote Control MCP connectors negotiate protocol 2026-07-28 by default (MCP_PROTOCOL_NEGOTIATION=legacy opts out). claude plugin test render trees carry part: { plugin }, and the resume command printed at exit names the session by its ID.
v2.1.296Oct 9, 2026
Added autoCompactWindow in subagent frontmatter and --agents, CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL for workflow agents, an allow_large option on the Read tool and a code key in Claude apps gateway managed.policies[] for Claude Desktop's Code tab
Fixed Bash permission checks auto-approving commands that assign and use BASH_ARGV0, managed PreToolUse deny hooks with "continue": false refusing the call without ending the turn, and Git Bash rm -rf /c/Users/ not asking in bypass permissions mode on Windows
Fixed Edit and NotebookEdit corrupting non-ASCII characters in non-UTF-8 files (such edits are now refused), PowerShell commands over about 1 KB always asking for permission, and headless sessions starting MCP servers switched off for the folder
Changed the default limit on up-front MCP tool descriptions and server instructions from 2,048 to 4,096 characters, and Sonnet 5.5 cache reads are priced at $0.10 per Mtok in /cost, the status line and --max-budget-usd
⚠️ Breaking:
Edit and NotebookEdit refuse to edit files that are not valid UTF-8 (Windows-1252, Shift-JIS, GBK) instead of replacing their non-ASCII characters. A turn or ! command started while ← moves the session to the background is now stopped instead of finishing out of sight.
v2.1.295Oct 8, 2026
Added onFailure: "block" for command and HTTP hooks (a hook that can't start, times out or exits unexpectedly blocks the action), Program Status Protocol (OSC 7501) terminal status and CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS
Added per-upstream models lists, timeouts.upstream_ttfb_ms on cloud upstreams and upstream_request_id audit fields to the Claude apps gateway, plus $.ui.notify and richer Button children for mods
Fixed every request failing on a [1m] model when a gateway or cloud provider refuses the context-1m beta, --tools and --restricted not covering built-in tools that register after launch, Claude in Chrome deny rules written with port 80, and a terminal freeze on responses of tens of thousands of lines
Changed subagents to preload at most 32 skills from the skills field, claude.ai connectors to negotiate MCP protocol 2026-07-28 by default, and MCP tool descriptions loaded through tool search to be cut at 16,384 characters instead of 2,048
⚠️ Breaking:
claude.ai connectors negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; MCP_PROTOCOL_NEGOTIATION=legacy opts out. WebSocket (ws) MCP messages over 16 MiB close the connection.
Subagents preload at most 32 skills from the skills field, each once; a subagent with the Skill tool can still invoke the rest. Ctrl+C at the idle prompt of an attached background session leaves a pending /loop wakeup alone; press Esc to stop it.
v2.1.294Oct 8, 2026
Fixed prompt and agent hooks written as instructions (such as "Block commands that...") allowing what they should block, and improved how instruction-style Stop and SubagentStop prompt hooks are judged
⭐ Haiku 5.5
v2.1.293Oct 7, 2026
Added Claude Haiku 5.5 (claude-haiku-5-5), now the default Haiku model on the Anthropic API, with a 1M context window and $0.10/$0.50 per Mtok ($0.50/$2.50 for prompts over 100K)
Added agentType to the subagentStatusLine payload and isDeferred to $.tool.register for mods
Fixed Claude treating its own last actions before a compaction as done and redoing finished work, an HTTP MCP memory leak, path-scoped rules and nested CLAUDE.md files not loading when Claude reads a file through cat, head, tail, sed -n or grep, and messages lost when ← moved a session to the background
Reverted the 2.1.281 auto mode denial message change and the 2.1.290 fix for cloud sessions staying asleep after a container restart lost a pending wakeup
v2.1.292Oct 6, 2026
Added claude plugin install --marketplace , an effort parameter on the Agent tool for sub-agents, and CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS for the 529 retry backoff
Fixed PreToolUse hook approvals and auto mode skipping the permission prompt for reads from network (UNC) paths, sandboxed commands reading /ultrareview staged uploads, and notebook or PDF reads through a link swapped mid-read
Fixed NO_PROXY ignored for Claude Code's own API requests, plan mode lost on /resume, scheduled tasks and /loop wakeups lost after /resume, /clear or a restart, and claude -p stopping background commands 5 seconds after the final result
Changed local (stdio) MCP connections to negotiate protocol version 2026-07-28 by default; Read now errors on a PDF pages list and @-mentioned text files over 256KB are no longer dropped silently
⚠️ Breaking:
Local (stdio) MCP servers negotiate protocol version 2026-07-28 by default on every install, including Bedrock, Vertex and Foundry; MCP_PROTOCOL_NEGOTIATION=legacy opts out.
Agent names are limited to 256 characters; a skill's or plugin file's longer name is ignored. claude plugin test now fails on a failed expect inside a hook the test registered instead of passing silently.
v2.1.291Oct 6, 2026
Fixed a 2.1.290 regression where cloud sessions could drop answers to permission prompts
v2.1.290Oct 5, 2026
Added claude attach and claude logs with partial session names, /claude-api managed-agents-onboard, and warnings when managed settings link outside their folder or ignore user sandbox allowRead paths
Fixed Bash permission checks auto-approving read-only commands with shell-expanded wildcards or zsh-specific variable names, rules skipped after a PreToolUse hook rewrote input, and Read deny rules bypassed by pasted images, @-mentions and links swapped mid-read
Fixed WebFetch silently dropping page text past 100,000 characters (it now reports the rest and takes an offset), scheduled tasks lost after compaction or /background, and resumed subagents losing earlier thinking and prompt cache
Changed WebSearch to a budget that refills at 100 calls per hour, and stopped project settings from turning on Claude in Chrome or setting CLAUDE_CODE_DISABLE_ATTACHMENTS
⚠️ Breaking:
Interactive WebSearch uses a budget that refills at 100 calls per hour (CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR sets the rate) instead of ending after 200 calls.
A project's settings files can no longer turn on Claude in Chrome or set CLAUDE_CODE_DISABLE_ATTACHMENTS; pyright and more forms of ps now ask for permission. An in-process teammate's agent_id in Agent results is its agent ID, with the name@team address in teammate_id.
v2.1.289Oct 3, 2026
Fixed managed-machine permission rules bypassed by user-installed mods, Bash deny/ask rules under sandbox auto-allow, and Read deny rules through IDE symlinks
Added agent.spawn for teammates, shared agent IDs across plugin hook events, and idle/waiting states in $.agent.list()
Fixed installed mods missing from the first session after upgrade, stale local plugin versions and plugin/mod rendering failures
Reverted the VS Code claude auth status change that could increase sign-outs; fixed terminal and published artifact freezes on malformed code blocks
v2.1.288Oct 2, 2026
Added mod selection access via $.ui.selection(), draft recovery with Up after Ctrl+C, and MCP re-authentication prompts for additional OAuth scopes
Added /code-review --max-findings and agent-view session search with Ctrl+F
Fixed interrupted-response recovery, missed auto-compaction, resume context loss and duplicate remote MCP tool calls
Fixed plugin-defined teammate configuration, managed sandbox credential-file rules, headless signal handling and GitHub plugin installation without SSH keys
⭐ Claude Mods
v2.1.287Oct 1, 2026
Added Claude Mods, which let plugins modify deeper Claude Code behavior, and the built-in "You should know" mod, a side agent that flags things you or Claude might miss (/plugin enable cc-plugin-you-should-know@builtin)
Added an n: filter to the agents view, MCP URL prompts on the 2025-11-25 protocol, prompt_text on the OpenTelemetry user_prompt event and a built-in gh api for self-hosted runners without the GitHub CLI
Changed Opus 4.7+ and Fable to use a 1M context window by default on Bedrock, Vertex, Foundry and the Claude apps gateway, and MCP alwaysLoad: false to defer all of a server's tools behind tool search
Fixed a dangerous rm losing its always-ask safeguard when the command also redirected to a ~ or wildcard path, per-tool permission ceilings dropped for an MCP tool named __proto__ and CLAUDE.md attached twice after resume or compaction
⚠️ Breaking:
Opus 4.7+ and Fable use a 1M context window by default on Bedrock, Vertex, Foundry and the Claude apps gateway, with no [1m] suffix; CLAUDE_CODE_DISABLE_1M_CONTEXT=1 keeps 200K.
MCP servers on the 2025-11-25 protocol can send URL prompts; if a server no longer connects, add "bareElicitationCapability": true to its MCP config entry. MCP alwaysLoad: false now defers all of that server's tools behind tool search.
The OpenTelemetry user_prompt event carries prompt_text, a copy of prompt; drop or mask it wherever prompt is dropped or masked. Replies from claude agents arrive as queued messages, and slash commands other than /stop sent during a turn run when it ends.
v2.1.286Sep 30, 2026
Added a stack count ("2 of 5") to permission prompts and mouse support for the "N more" rows of lists in fullscreen mode; /hooks opens on one list of configured hooks grouped by event
Changed failed API request retries to share one limit per model call (at most 14 requests with default settings) and --bare to connect only the MCP servers named on the command line, with no system reminders or background tasks
Fixed --resume and --continue losing turns after parallel tool calls in a crashed session, API 400 errors from non-text tool or hook results, the gateway spend meter underpricing 1-hour cache writes and several secret-redaction gaps in logs and MCP errors
Improved commit guidance: when a project or user skill named verify exists, Claude is told to run it before committing, except for docs-only and tests-only commits
⚠️ Breaking:
--bare connects only the MCP servers named on the command line, sends no system reminders and starts no background tasks; under --bare, a shell command that reaches its timeout stops instead of moving to the background.
Plugin installs refuse npm sources that are git repositories or folders and install plugin dependencies only from registry packages; failed API requests share one retry limit per model call (at most 14 requests with default settings).
[VSCode] Stop and Escape end only the current turn; background agents keep running and are stopped one by one from the agent map.
v2.1.285Sep 29, 2026
Added claude --desktop, claude plugin configure , .= for bundled .mcpb servers in claude plugin install --config and a CLAUDE_CODE_DISABLE_WEB_FETCH variable
Added an allowedProviders managed setting that limits which API providers a machine may use (Anthropic API, custom endpoint, Bedrock, Mantle, Vertex AI, Foundry, Claude Platform on AWS or a Cloud gateway)
Changed background Bash and PowerShell commands to stop at a time limit (default 30 min, max 2 h) and sessions behind a custom ANTHROPIC_BASE_URL to use the 1M context window of models that have one
Fixed PowerShell permission checks skipping deny and ask rules when the parser failed to start, an Artifact allow rule publishing files outside the working directories, fork subagents escaping plan or dontAsk mode and streaming failures retried up to 21 times
⚠️ Breaking:
Background Bash and PowerShell commands stop after their timeout with run_in_background (default 30 min, max 2 h); Claude is notified when one is stopped.
Sessions behind a custom ANTHROPIC_BASE_URL use the 1M context window of models that have one (Opus 4.7+, Sonnet 5+, Fable); run /autocompact 200k if the gateway stops at 200K.
claude -p and Python Agent SDK sessions on third-party providers or with telemetry off start in auto mode when no permission mode is configured; --permission-mode still overrides it.
The MCP server name widgets and close spellings are reserved in cloud sessions and on self-hosted runners; /ultrareview on macOS and Linux requires git 2.31+ for local uploads; on Windows, project and local settings env no longer set ALLUSERSPROFILE, SystemDrive or CommonProgramFiles variables.
⭐ Sonnet 5.5
v2.1.284Sep 28, 2026
Added Claude Sonnet 5.5 (claude-sonnet-5-5) as the default Sonnet model on the Anthropic API: 1M context, $2/$10 per Mtok and $0.20/Mtok cache reads
Changed interactive terminal and VS Code sessions to start in auto mode when no permission mode is configured, on every plan and provider; Ultracode becomes its own /effort toggle
Added a "Yes, but ask again next time" answer for auto-mode reads outside the working directories, /mcp reconnect all and dollar amounts for gateway spend limits in /usage and the status line
Fixed damaged response streams, "Prompt is too long" errors that persisted after compacting, resumed MCP tool calls failing while their server connects and plugin allowed-tools pre-approval under managed allowManagedPermissionRulesOnly
⚠️ Breaking:
Interactive terminal and VS Code sessions start in auto mode when no permission mode is configured, on every plan and provider; permissions.defaultMode still overrides it.
Ultracode is a separate /effort toggle (Tab, or /effort ultracode [on|off]) and no longer forces xhigh effort.
Under managed allowManagedPermissionRulesOnly, only plugins from an official Anthropic source or a source managed settings vouch for keep allowed-tools pre-approval; marketplace, claude.ai and npm plugins lose it.
v2.1.283Sep 25, 2026
Added deniedModels and availableModelsMatch: "exact" managed settings to block specific models or keep new model releases blocked until listed
Added /doctor prompt-audit to audit CLAUDE.md files, skills, agents and commands for prompting patterns written for older models
Changed interactive sessions on third-party providers or with telemetry off to start in auto mode when no permission mode is configured; reverted the 2.1.282 claude-ai name reservation
Fixed stdio MCP servers left running, stateless remote MCP servers unusable after a brief 404, /context omitting MCP server instructions and managed sandbox settings ignored when one value was invalid
⚠️ Breaking:
Interactive sessions on third-party providers or with telemetry off start in auto mode when no permission mode is configured; permissions.defaultMode still overrides it.
Skill(anthropic-skills:) deny rules also block that skill when Claude Desktop delivers it as a plugin; claude plugin eval refuses git versions older than 2.31.
v2.1.282Sep 24, 2026
Added a maxProseWidth setting and a startup notice, /status and claude doctor entries for telemetry variables in project settings that were ignored or turned telemetry off
Changed project and local settings to ignore OpenTelemetry variables that turn on export, set its endpoint or capture content
Fixed 400 errors from undecryptable web search results in history, extended thinking lost on resume or around immediate slash commands, and redacted_thinking failures on every turn
Fixed mistyped managed lock keys being ignored and managed permissions, autoMode, worktree and attribution blocks being dropped when one nested value was invalid
⚠️ Breaking:
Project and local settings ignore OpenTelemetry variables that turn on export, set its endpoint or capture content, such as CLAUDE_CODE_ENABLE_TELEMETRY and OTEL_LOG_*.
Auto mode uses the server-side classifier by default on a direct Anthropic API connection when telemetry is off; CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out.
sandbox.excludedCommands ignores project and local entries when managed settings or --settings set allowUnsandboxedCommands: false, or managed allowManagedDomainsOnly: true.
Skill folders, command files and workflow commands in the anthropic-skills namespace no longer load, and MCP servers named anthropic-skills list no skills or prompts; the same claude-ai reservation was reverted in 2.1.283.
v2.1.281Sep 23, 2026
Added browser-based MCP elicitation on protocol 2026-07-28 connections and MCP configuration checks to claude plugin validate
Added Bedrock role assumption and guardrails, telemetry labels and newer Desktop policy keys to Claude apps gateways
Changed send-now to background running tools; added "attribution": false to hide commit and PR attribution
Fixed resumed-session history and prompt-cache losses, duplicate tool execution from proxy stream events, background-session trust checks and permission-rule handling
⚠️ Breaking:
Older CLI versions skip settings files containing "attribution": false; keep the object form in files shared across versions.
Server-side auto mode review now also gates read-only and sandboxed shell commands; CLAUDE_CODE_AUTO_MODE_SERVER=0 also opts out on direct Anthropic API connections, where the local classifier counts toward usage.
Dangerous-rm prompts in auto and bypass modes deny after two unanswered minutes; CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 disables the timeout.
Self-hosted runner wrappers and command hooks that append system prompts must use --system-prompt-file or --append-system-prompt-file.
⭐ Opus 5.5
v2.1.280Sep 22, 2026
Added Claude Opus 5.5 (claude-opus-5-5) as the default Opus model: 1M context, $4/$20 per Mtok and $0.20/Mtok cache reads
Added CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH and VS Code dialogs for /status, /sandbox, /chrome, /export and /skills
Fixed permission approval for symlinked writes landing outside the project and local skills being moved to .trash because of a skills-folder manifest
Fixed auto-mode retry loops, malformed-history errors, resumed-subagent prompt-cache misses and lost background-agent messages or reports
⚠️ Breaking:
Pro and Team Standard default to Opus instead of Sonnet; newly released models no longer inherit effort levels saved before effort became per-model.
PermissionRequest no longer runs agent-type hooks; use command or HTTP hooks.
Marketplaces with names imitating reserved marketplace names are refused and existing ones stop loading.
Dialog confirmation uses Enter/Esc instead of stray y/n keys; explicit confirm:yes/confirm:no bindings restore y/n. Fullscreen ctrl+l/cmd+k redraws instead of clearing the transcript.
v2.1.278Sep 19, 2026
Changed auto mode on the Claude API, Enterprise, Bedrock, Vertex, Foundry and gateways to default to the server-side classifier, which carries no classifier-overhead charge; a billed fallback now warns
Added an Auto mode server row to /status showing whether this session's auto mode classifier runs on the server
⚠️ Breaking:
Auto mode defaults to the server-side classifier on the Claude API, Enterprise, Bedrock, Vertex, Foundry and gateways; CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out on the cloud providers and gateways.
v2.1.277Sep 18, 2026
Added AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead, switchable under "Project instructions" in /config (not yet on Bedrock, Vertex or Foundry)
Added CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1 for gateways whose only egress is a forward proxy, plus an optional headers: map on gateway upstreams
Changed subagent results to reach the main agent under a header marking them as subagent output, so a result's text cannot pass as the session's own instructions
Fixed claude -p and Agent SDK sessions hanging with no result after an internal error, conversations failing on an empty assistant text block, and about 50 further crash, resume, plugin and rendering fixes
⚠️ Breaking:
The TaskOutput tool is removed; Claude reads a background task's output file with Read, and taskOutputMaxChars and TASK_MAX_OUTPUT_LENGTH no longer have any effect.
A sandbox.excludedCommands glob no longer exempts a whole compound Bash command when one part matches; every part must match.
v2.1.276Sep 18, 2026
Fixed every request failing with 400 ... Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway (a v2.1.275 regression)
v2.1.275Sep 17, 2026
Added syncing of the skills and plugins enabled on your claude.ai account to terminal sessions signed in with it; opt out with syncClaudeAiSkills: false or syncClaudeAiPlugins: false
Added a send-now key (ctrl+enter, or ctrl+x ctrl+s) that interrupts the current turn and sends all queued messages at once, and /plugin install --marketplace
Security fixes cover passwords and tokens shown in plugin and marketplace URLs, SubagentStop hooks with a matcher firing for every subagent with an empty agent type, and sandboxed Bash blocked from writing to project folders named hooks/ or config/
Fixed prompt-cache misses from a restored memory file's shifting age note, sandboxed Bash on Linux reporting exit code 0 for failed commands under zsh, and resume failing on malformed transcript entries
v2.1.274Sep 16, 2026
Added a critical memory usage warning, CLAUDE_CODE_MCP_STARTUP_WAIT_MS to bound how long the first non-interactive turn waits for MCP servers, and a claude_code.managed_settings_resolved OTel event
Fixed sessions endlessly retrying "unexpected tool_use_id" 400 errors (corrupted transcripts now self-heal or stop with a /rewind hint), and an active /goal being lost when resuming a compacted session
Fixed Streamable HTTP MCP tool calls timing out after about 5 minutes despite a longer per-server timeout, and legacy HTTP+SSE servers configured as http failing to connect
Security fixes cover secrets from ${VAR} placeholders shown in MCP connection errors, Bash commands looping over or assigning special shell variables, and nested shell expansions in worktree-isolated sessions
⚠️ Breaking:
"type": "sdk" MCP entries in .mcp.json, settings, plugins and agent files are skipped with a warning; only an SDK host application can register in-process servers.
Bedrock, Vertex, Foundry and telemetry-disabled installs use the v2 MCP client and MCP 2026-07-28 negotiation by default; opt out with MCP_SDK_GENERATION=v1 or MCP_PROTOCOL_NEGOTIATION=legacy.
/code-review uses leaner inline review prompts for models without tuned settings instead of spawning many review subagents.
Plugin and marketplace clones leave Git LFS files as pointers; run git lfs pull in the checkout to fetch them.
v2.1.273Sep 15, 2026
Added opt-in LLM gateway hint headers (x-claude-code-request-class, x-claude-code-agent-type, compaction and tool-duration headers) behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1
Added a notification when an MCP server disconnects and reconnection gives up, and forking a Remote Control session from the Claude app into a local background session
Security fixes: unanalyzable Bash commands skipping the prompt under permissions.blockReadsOutsideWorkingDirectories, a subshell hiding rm in bypass mode, and MDM or managed-settings.json MCP restrictions ignored when server-managed settings are present
Fixed auto-compact firing at about half the real window when advisor-tool turns were counted twice, and /login, /upgrade and /extra-usage forcing a full prompt-cache rewrite
⚠️ Breaking:
Reverted the v2.1.268 check of Read and Edit deny rules on unanalyzable Bash lines (eval, env -C); such commands prompt again instead of being denied.
Auto mode on Bedrock, Vertex and Foundry uses the local classifier by default; set CLAUDE_CODE_AUTO_MODE_SERVER=1 for the platform's server-side classifier.
v2.1.272Sep 14, 2026
Bug fixes and reliability improvements; upstream provides no further detail
v2.1.271Sep 14, 2026
Added per-command allowed_domains to Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone
Added omitClaudeMd to agent frontmatter and --agents JSON, letting custom and plugin subagents run without user, project and local CLAUDE.md files; managed policy files still load
Added --accept-command to claude plugin install/update, fast mode in Remote sessions, and mouse support in the /config panel
Fixed an unreadable enterprise managed-mcp.json being ignored: it now keeps exclusive MCP control and warns at startup, alongside ~80 further fixes across MCP, resume, hooks and terminal rendering
⚠️ Breaking:
Monitor watches always have a deadline (30 minutes maximum, 10 in single-prompt -p runs); the no-timeout persistent option is removed.
In auto mode, a skill's or slash command's inline ! shell commands follow default-mode permission rules instead of the classifier.
Default dynamic workflow size is small on Pro plans, and the medium size guideline drops from 15 to 10 agents.
v2.1.270Sep 12, 2026
Fixed read-only git commands in Bash unexpectedly asking for permission after a session had been running for a while (regression in v2.1.269)
v2.1.269Sep 11, 2026
Added claude plugin eval for plugin evaluation suites, with scores and JSON/HTML reports
Added /output-style [name] for listing and switching styles in terminal, Remote Control, cloud and headless sessions
Fixed prompt-cache invalidation after interrupted or output-limited turns and /goal runs stalling after errors or limits
Security fixes cover plugin archive permissions, Bash tee write destinations and negated permission rules crossing settings sources
v2.1.268Sep 10, 2026
Fixed HTTP 400 errors on third-party Anthropic-compatible endpoints introduced in v2.1.265
Added a 300-second WebFetch deadline; CLAUDE_CODE_WEBFETCH_DEADLINE_MS overrides it (0 disables it)
Security fixes cover symlinked-path permission rules, untrusted teammate definitions and secrets shown in MCP/plugin diagnostics
Improved prompt-cache stability on Bedrock, Vertex and Foundry; /plugin changes now apply when its menu closes
⚠️ Breaking:
Plain WebFetch deny/ask rules no longer gate Artifact reads or updates; use Artifact or WebFetch(domain:claude.ai).
v2.1.267Sep 9, 2026
Added maxEffortLevel globally or under modelSettings to cap effort across providers while allowing lower user choices
Added --system-prompt-snapshot off to render the system prompt anew for each request during prompt iteration
Fixed prompt-cache and thinking losses from reconnecting tools, model switches and session/subagent resumes
Security fixes reject unreadable managed hook/channel allowlists and close a marketplace backslash containment bypass
v2.1.266Sep 8, 2026
Fixed v2.1.265 forcing Cloud-gateway sign-in when CLAUDE_CODE_USE_GATEWAY was set with alternative authentication; no configuration change is needed
v2.1.265Sep 8, 2026
Added --plugin-dir support for a parent folder of plugins, including child plugins added or removed during the session
Added a 1 GB limit for tool results saved to disk, with truncation disclosed in the conversation preview
Fixed resumed subagent prompt-cache reuse and preserved interrupted tool calls after a process crash
Security fixes close plugin backslash containment bypasses and prevent nested-repository git clean filters running during status/diff probes
⚠️ Breaking:
Managed forceLoginGatewayUrl now selects gateway authentication at startup; leftover claude.ai credentials or API keys are not used.
v2.1.263Sep 6, 2026
Bug fixes and reliability improvements; upstream provides no further detail
v2.1.261Sep 4, 2026
Added /skill-doctor to show which loaded skills go unused and what they cost in context
Added bashOutputMaxChars/taskOutputMaxChars settings to raise inline command/task output limits up to 128K characters
Fixed resuming a session losing hook output and other context around parallel tool calls
v2.1.260Sep 3, 2026
Added a /diff panel that opens beside the conversation in fullscreen mode and shows uncommitted changes as Claude edits
Added a likely cause for prompt-cache misses to /cost and the status line
Fixed Edit/Write/Read permission rules with parentheses in the path being dropped, which left "read-only" folders writable
Fixed one uncompilable file permission pattern breaking every file edit with an "Invalid regular expression" error
v2.1.259Sep 2, 2026
Added managedMcpServers managed setting: organizations can provide HTTP/SSE MCP servers to every user
Added --permission-prompts none for unattended headless hosts
Fixed concurrent sessions silently reverting each other's ~/.claude.json changes, resetting workspace trust and losing MCP/project state
Fixed Bash Read() deny rules not covering files given as option values or git diff/git grep file operands
v2.1.258Sep 1, 2026
Fixed Claude Code failing to launch on macOS 12 (Monterey), a regression introduced in 2.1.255
Fixed remote and scheduled sessions failing with a "non-empty content" error after a re-sent permission approval
v2.1.257Sep 1, 2026
Added Claude Fable 5.1 (claude-fable-5-1), now the default Fable model: 1M context, $10/$50 per Mtok
Added a Containment Escape rule to auto mode against cloud metadata-credential fetches, egress evasion, and cross-tenant reach
Added a one-time auto-mode prompt before the first file read outside the working directories (permissions.blockReadsOutsideWorkingDirectories)
Changed defaultMode: "bypassPermissions" in project/local settings to be ignored, like "auto"
v2.1.252Aug 31, 2026
Fixed Bash commands failing with a task-output-swap error on some Macs
Fixed "always allow" not saving in a project with no .claude/settings.local.json yet
Fixed Remote Control sessions hosted by Claude Desktop or VS Code stalling for minutes after a degraded claude.ai connection
v2.1.251Aug 28, 2026
Added PreModelSwitch and PostModelSwitch hook events (block, confirm, or annotate a model switch); SessionStart resume hooks now receive session staleness and the estimated re-cache cost
Added live streaming of a foreground subagent's tool calls and results to Remote Control clients
Added a spend limit bar to /usage and a rate_limits.spend_limit status line field for gateway users
Fixed three security gaps: a symlink swap bypassing file-tool permission checks, plugin marketplace command paths escaping the plugin directory, and sandboxed Bash output-file redirection
Changed CLAUDE_CODE_SUBAGENT_MODEL to set the default subagent model rather than override everything; an agent definition's model: and an explicit per-spawn model now take precedence over it
v2.1.250Aug 27, 2026
Bug fixes and reliability improvements
v2.1.248Aug 27, 2026
Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project, and local settings files
Added cross-session messaging (SendMessage/ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabled
Fixed a prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh
Added experimental.cacheTtl ("5m" or "1h") to agent frontmatter for a per-agent prompt cache TTL
v2.1.247Aug 26, 2026
Added the SendFeedback tool: Claude can draft a feedback report for you to review and send from /feedback
Changed Sonnet 5's default auto-compact window to its full 1M context, auto-compacting at about 967K tokens instead of about 934K
Added /claude-api cost-optimize to profile an existing project's Claude API spend and work through cost levers
Fixed sub-agents dying on a first-call model 404: they now use the session's fallback model chain
v2.1.246Aug 25, 2026
Added a startup warning for Bash allow rules with a wildcard before the subcommand (e.g. Bash(git * main)), since they also match options inserted before the subcommand
Added an Auto mode tab to /permissions for viewing and editing auto mode classifier rules
Fixed the Write tool reporting "Out of memory" or freezing for a long time after overwriting a very large existing file, even though the file had been written
Improved non-interactive sessions (-p, SDK, cloud sessions) to automatically continue a response cut off mid-stream by a server error, connection loss, or stall
v2.1.245Aug 25, 2026
Fixed a crash on startup on Linux distributions that ship glibc 2.44 (for example Arch Linux, CachyOS, Fedora Rawhide)
v2.1.243Aug 24, 2026
Added a Loops breakdown to /usage: per-loop run count, total tokens, tokens per run, and last run
Added modelPicker setting to curate the /model picker with an ordered, labeled list of models
Added promptCacheTtl and subagentPromptCacheTtl settings so API-key and cloud-provider users can keep a 1-hour prompt cache on the main conversation while subagents stay at 5 minutes
Added a keyless sign-in under /login to Anthropic Console for organizations that don't allow API keys
v2.1.241Aug 22, 2026
Bug fixes and reliability improvements
v2.1.240Aug 22, 2026
Bug fixes and reliability improvements
v2.1.239Aug 21, 2026
Fixed Bedrock streaming behind proxies that strip the response Content-Type header, which silently doubled billed API calls by re-running every turn non-streaming
Added Windows cross-session messaging: Claude Code sessions across your machines can message each other with SendMessage and find each other with ListAgents, as on macOS and Linux
Cost estimates (/cost, status line, --max-budget-usd) now include the 1.1x US-only-inference premium for data-residency workspaces
Added /claude-api upgrade to migrate Python projects from anthropic 0.x to 1.x
v2.1.238Aug 20, 2026
Added a keybindingFlavor setting: set it to "readline" to make Ctrl+W in the prompt delete back to the previous whitespace, as in Bash
Plugin marketplaces: headersHelper on a url marketplace or catalog entry runs a command that mints short-lived HTTP headers for catalog and archive fetches
Fixed unbounded memory growth in long interactive sessions: subagent tool results are now released once they leave the recent display window
Added claude self-hosted-runner --defer-shutdown-max-min for graceful draining on SIGTERM, and --proxy-authorization-command/--proxy-authorization-file for egress proxies requiring a freshly issued header
v2.1.237Aug 19, 2026
Added a built-in "Concise" output style: Claude leads with results and skips preamble and narration, selectable under Output style in /config
Fixed prompt caching for sessions running through an LLM gateway or a custom base URL
v2.1.236Aug 19, 2026
Added ANTHROPIC_DEFAULT_MODEL: sets the model new sessions start on, while a /model pick still overrides it and persists across restarts (unlike ANTHROPIC_MODEL)
Added notify_when_idle to cross-session SendMessage: another session on the machine sends one notice when it next goes idle, opt-in and one-shot, no polling (macOS and Linux)
Sandbox on macOS: wildcard read-deny rules such as **/.env now take precedence inside allowed read regions, cover matched directories, and survive a rename of the denied file
Auto mode: Monitor allow rules are set aside while auto mode runs, Bedrock/Vertex/Foundry get the same severity-scored classifier defaults as the Claude API, and the git status check no longer trusts status.showUntrackedFiles=no
v2.1.235Aug 18, 2026
Added an optional spellcheck setting that underlines misspelled words in the prompt input using an installed aspell, hunspell, or ispell
Improved permission dialogs: display text and "don't ask again" options now match what a grant actually covers, and "don't ask again" is withheld when contents cannot be fully displayed
Fixed Shift+Tab inside the permission prompt comment field approving the edit and granting session-wide edit permission instead of closing the field
Improved memory and CPU usage while cloud sessions such as /ultrareview or /autofix-pr run in the background
v2.1.234Aug 17, 2026
Security: remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads now reject Windows NT-namespace paths, closing the remaining pre-approval NTLM credential-leak surface
Added a GitLab merge request badge to the footer and statusline (MR !N with draft/pending/green states) for repos with a GitLab remote and an authenticated glab CLI
Claude Code now continues a session automatically when a claude.ai usage limit resets; disable it in /config under "Continue automatically at usage limit"
Reduced the context cost of the built-in claude-api skill from ~200K tokens to ~25K by loading reference docs on demand; /permissions and /add-dir can now be opened mid-turn
⚠️ Breaking:
Removed the "Default teammate model" setting from /config; agent-team teammates now use the leader model unless the spawn names one
v2.1.233Aug 14, 2026
Added GitLab merge request URL support to --worktree and the claude agents view, plus an opt-in forward_user_identity apps gateway setting for per-user spend attribution
Added opt-in memory cgroups for Bash commands on Linux (CLAUDE_CODE_TOOL_MEMORY_LIMIT) so a runaway build cannot stall the session, and CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS to tune the WebFetch URL cache
Security: fixed Windows paths spelled with the NT device prefix bypassing UNC path validation, an NTLM credential-leak vector
Fixed idle sessions on Linux pinning a CPU core at 100% with sandboxing enabled, and Notification hooks not firing for permission prompts under Claude Desktop or VS Code
⚠️ Breaking:
Todo/task tools (TaskCreate/Get/Update/List, TodoWrite) are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to restore them
Reverted the 2.1.232 Bash permission changes for Cygwin-style symlinks on Windows and for input redirections; a narrower version returns in a later release
v2.1.232Aug 13, 2026
Subagent forking is on by default: a subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background
Type @ in the prompt to mention another Claude session by name; SendMessage now delivers to a bare name that matches one live session, and same-machine sessions get unique name-word-word variants
Added GitLab support to plugin marketplaces (bare gitlab.com repo URLs clone like github.com), plus secret redaction for the GitLab token families and glab CLI credential protection
Security: fixed a PowerShell bypass overwriting $PSDefaultParameterValues, a Windows Git Bash Cygwin-symlink bypass, and nested git repositories inheriting trust from a parent directory
⚠️ Breaking:
sandbox.ripgrep is now honored only from user, managed, and --settings settings; project settings can no longer override the sandbox ripgrep binary
v2.1.231Aug 13, 2026
Fixed MCP OAuth sign-in failing with a redirect URI mismatch for servers that use a pre-registered OAuth client, such as Slack
v2.1.229Aug 12, 2026
Added plugin marketplace command sources: a local command prints the plugin directory, re-resolved each session and applied without a restart (mode: "link" uses it in place)
Fixed long responses partly disappearing while streaming and being printed twice, plus crashes on non-string tool-call values, very narrow terminals, and Windows extended-length/UNC paths
Changed /commit-push-pr so git/gh commands with dangerous flags (--force, --amend, --no-verify) are no longer auto-approved
[VSCode] Added session groups in the sidebar (right-click to create, rename, delete) and made the /btw side-question panel resizable
⚠️ Breaking:
Self-hosted runner on Windows now requires an explicit --base-dir; there is no default checkout directory
v2.1.228Aug 11, 2026
Hardened skills synced from claude.ai: they no longer shadow local commands or MCP prompts, descriptions are sanitized and labeled, and their bodies do not run ! commands or expand @ files locally
Fixed session cleanup deleting contents inside a project memory folder, and Remote Control /resume leaking the resumed conversation title or history into the connected session
Fixed interactive sessions that could stop redrawing entirely while the process kept running, after a rare internal layout error
⚠️ Breaking:
The Write tool now lets newer models overwrite an existing file they have not read this session, matching the Edit tool rules; older models still require the read first
v2.1.227Aug 10, 2026
Fixed feature flags being evaluated without the subscription tier on an expired login token, which wrongly prompted Max plan users to enable usage credits for Fable
Fixed every Bash command failing under claude-code-action with allowed_non_write_users on GitHub-hosted runners
Improved the slash-command menu rendering and reduced event-loop stalls on file-not-found suggestions and at-mention size checks
v2.1.226Aug 8, 2026
Bug fixes and reliability improvements
v2.1.225Aug 7, 2026
Added gateway spend-limit support to the usage warning: the limit-reached message names the cap, its reset time, and the operator message (requires the gateway on 2.1.225)
SendMessage can now start a conversation with your Remote Control sessions on other machines by name, instead of only replying after they message you first
Fixed a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login short-lived token, which broke headless sessions until restart
Fixed MCP OAuth servers on macOS intermittently failing with a burst of 401 errors after a keychain read timed out
v2.1.224Aug 7, 2026
Added self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run (Team and Enterprise plans)
Added cross-session SendMessage: Claude Code sessions can message each other across any of your machines, with ListAgents to discover them (macOS and Linux)
Added an archive plugin source (zip over HTTPS with optional SHA-256 pinning), the crossSessionInbound/dialogExpiry settings, and sandbox credential-masking options
Security: fixed long project paths resolving to another project session directory, and sandbox filesystem deny entries written with a trailing slash being silently bypassable
⚠️ Breaking:
Removed the 200-subagent-per-session spawn cap; concurrency and depth limits still apply
The /feedback survey transcript share now also uploads the last request model settings with your consent, including the system prompt (which carries your CLAUDE.md instructions), tool definitions, and model parameters; secrets stay redacted
v2.1.223Aug 5, 2026
Security: fixed a Bash permission-check bypass letting a crafted command hide parts of itself from approval, permission prompts no longer hidden by tab/invisible-Unicode padding, and workflow scripts no longer able to use dynamic import() to escape the workflow sandbox
Changed /review to be an alias of /code-review, which reviews the current diff or a PR (/code-review ); /code-review with no effort level now reuses the level you typed last
Added owner wildcard entries ("owner/*") to strictKnownMarketplaces/blockedMarketplaces managed settings, and a /teleport hint in cloud sessions to continue locally with claude --teleport
Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list
v2.1.222Aug 4, 2026
Security: fixed worktree-isolated sessions (and their subagents) being able to run destructive git commands against the main checkout; isolation now covers file edits and Bash in every session type
Changed Remote Control auto-start so repo-local settings can no longer turn it on (they can still turn it off); enable it at user scope via /config
⚠️ Breaking:
Removed the ultraplan feature
Repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer enable Remote Control auto-start; they can still disable it. Enable at user scope via /config
v2.1.221Aug 3, 2026
Security: fixed a Bash permission-check bypass letting zsh execute hidden commands in [[ ]] regex conditionals, plus a PowerShell path-quoting bypass on Windows; both now prompt for permission
[VSCode] Added Focus view (Ctrl+Alt+F): a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator
Added mode: "mask" for sandbox credential files on Linux/WSL: sandboxed commands read a sentinel value while the sandbox proxy substitutes the real value on egress (macOS falls back to deny)
Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions written for older models
⚠️ Breaking:
Background sessions now commit and push automatically to preserve work, open a draft PR only when the task calls for one, and follow your CLAUDE.md git instructions
v2.1.220Jul 24, 2026
Bug fixes and reliability improvements
Claude Opus 5
v2.1.219Jul 24, 2026
Added Claude Opus 5 (claude-opus-5), now the default Opus model: 1M context, fast mode at $10/$50 per Mtok. Opus 4.7 leaves fast mode, so /fast covers Opus 5 and Opus 4.8
Added the DirectoryAdded hook (fires after /add-dir or the SDK register_repo_root control request), sandbox.network.strictAllowlist to deny non-allowlisted hosts without prompting, and the workflowSizeGuideline settings key
Subagents spawn nested subagents up to depth 3 again after nesting was disabled in 2.1.217; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to opt out, and stream-json forwards depth-2+ subagent text when --forward-subagent-text is set
Added mcp_server_errors to the headless stream-json init event, plus HTTP status and error text in claude mcp list and /mcp when a server fails to connect
⚠️ Breaking:
Opus 4.7 removed from fast mode; /fast applies to Opus 5 and Opus 4.8 only
Dynamic workflows default to a medium size guideline (aim for fewer than 15 agents); change it with Dynamic workflow size in /config
v2.1.218Jul 22, 2026
/code-review now runs as a background subagent, so review work no longer fills the conversation and stacked slash commands stay the review target
Security: agent frontmatter hooks require the agent file own folder to have accepted workspace trust, so hooks no longer run from untrusted folders
Fixed the left arrow key discarding the conversation with no undo, Windows paths with \u-prefixed segments (like C:\Users\unicorn) being corrupted into CJK characters, and /context reporting stale pre-compact token usage
Auto mode adjudicates the dangerous-rm, background-& and suspicious-Windows-path checks instead of opening permission dialogs; plan mode with auto no longer prompts for Bash the static analyzer cannot prove read-only
⚠️ Breaking:
Skills with context: fork run in the background by default; opt out per skill with background: false
Agent markdown files reject agent names containing :, which is reserved for plugin namespacing
/deep-research starts only when invoked manually; Claude no longer launches it on its own
v2.1.217Jul 21, 2026
Added a cap on concurrently-running subagents (default 20, CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) so one message cannot fan out unbounded background agents
Fixed --max-budget-usd not stopping background subagents: once the cap is reached, new spawns are denied and running background agents are halted
Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
Added emoji shortcode autocomplete in the prompt input (:heart: inserts a heart), disabled with the emojiCompletionEnabled setting
Security: fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
⚠️ Breaking:
Subagents no longer spawn nested subagents by default (restored to depth 3 in 2.1.219); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to control nesting
v2.1.216Jul 20, 2026
Added sandbox.filesystem.disabled to skip filesystem isolation while keeping network egress control
Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
Fixed auto mode denying commands with HTTP 401 classifier errors after the OAuth token expired or rotated mid-session
Fixed AskUserQuestion telling Claude to continue when the answer asked it to wait or explain first, and Claude Code on the web re-asking the same question after an idle period
v2.1.215Jul 19, 2026
Claude no longer runs the /verify and /code-review skills on its own; invoke them with /verify or /code-review when you want them
v2.1.214Jul 18, 2026
Security: eight Bash permission-check fixes, commands over 10,000 characters now always prompt, file-descriptor redirects fail closed, zsh variable subscripts in [[ ]] prompt, and Edit(src/**)-style single-segment rules no longer auto-approve nested src/ directories anywhere in the tree
Added the EndConversation tool so Claude can end sessions with highly abusive users or jailbreak attempts, plus a periodic progress heartbeat for long-running tool calls that previously went silent
OpenTelemetry: added message.uuid, client_request_id, and tool_source log attributes for message-level correlation, and CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB content truncation limit
Fixed background-session lifecycle bugs: idle sessions keeping the daemon alive, completed sessions being impossible to remove via claude rm, and a displaced daemon deleting its successor control socket
⚠️ Breaking:
Single-segment dir/** hook if: conditions now match only /dir; write **/dir/** for any-depth matching (deny/ask permission rules keep their any-depth match)
file commands using -m/--magic-file or -f/--files-from now require permission instead of being auto-allowed as read-only
docker commands (including the Podman shim) carrying daemon-redirect flags (--url, --connection, --identity, Podman remote mode) now prompt for permission
v2.1.212Jul 16, 2026
/fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
Added a session-wide WebSearch cap (CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION, default 200) and a per-session subagent-spawn cap (CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION, default 200) to stop runaway loops; /clear resets the budget
MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable (CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS)
Security: fixed plan mode auto-running file-modifying Bash commands without a permission prompt, and worktree creation following a committed .claude/worktrees symlink to create files outside the repository
⚠️ Breaking:
Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default
v2.1.211Jul 15, 2026
Added --forward-subagent-text and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT to include subagent text and thinking in stream-json output
Security: permission previews relayed to chat channels now neutralize bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
Security: auto mode no longer overrides a PreToolUse hook's ask decision for unsandboxed Bash; an ask now floors the decision at a prompt
Fixed subagents with an explicit model override reverting to the parent's model when resumed, and nested .claude/rules/*.md loading even when setting sources exclude project settings
v2.1.210Jul 14, 2026
Added a live elapsed-time counter to the collapsed tool summary line, so long-running tool calls visibly tick instead of looking stuck
Security: the Agent tool is hardened against indirect prompt injection via content a subagent read, and the ultracode keyword opt-in no longer fires on non-human input such as webhook payloads and relayed PR comments
Security: fixed worktree-isolated subagents being able to run git-mutating commands against the main repo checkout instead of their own worktree
Auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the first request and pinned for the session
⚠️ Breaking:
Write(path), NotebookEdit(path), and Glob(path) permission rules now trigger a startup warning; use Edit(path) or Read(path) instead
v2.1.209Jul 14, 2026
Fixed /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard)
v2.1.208Jul 13, 2026
Added screen reader mode: opt-in plain-text rendering via claude --ax-screen-reader, CLAUDE_AX_SCREEN_READER=1, or axScreenReader: true in settings
Added vimInsertModeRemaps for mapping two-key insert-mode sequences like jj to Escape, and CLAUDE_CODE_PROCESS_WRAPPER for running every Claude Code self-spawn through a corporate launcher
Fixed the context window and auto-compact indicator briefly resetting to 200k after an auto-update, causing a false 100% context used when resuming long-context sessions
Fixed very large markdown tables stalling rendering; tables over 200 rows now show the first 200 with a note about the remainder
v2.1.207Jul 11, 2026
Bedrock, Vertex AI, and Claude Platform on AWS now default to Claude Opus 4.8
Fixed the terminal freezing and keystrokes lagging while streaming very long lists, tables, paragraphs, or code blocks
Auto mode is now available without the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry (disable via disableAutoMode)
Security: remote managed settings from a non-interactive run were being recorded as consented without ever showing the consent dialog, now fixed
⚠️ Breaking:
Plugins: ${user_config.*} in shell-form hook/monitor/headersHelper commands is now rejected (shell-injection fix); use exec form or $CLAUDE_PLUGIN_OPTION_
Plugins: option values (pluginConfigs) are no longer read from project-level .claude/settings.json; only user, --settings, and managed settings are honored
v2.1.206Jul 9, 2026
Added a /doctor check that proposes trimming checked-in CLAUDE.md files by cutting content Claude can derive from the codebase
Changed /commit-push-pr to auto-allow git push to the repo configured push remote (remote.pushDefault, or the sole remote), not just origin
Background agents now upgrade in the background right after an update, instead of a slow stale-session upgrade on attach
Improved /code-review findings quality on claude-opus-4-8 across all effort levels
v2.1.205Jul 8, 2026
/doctor is now a full setup checkup that can diagnose and fix issues (/checkup is its alias)
Improved the agent view: rows show a colored state word and a classifier-written headline instead of raw tool call text
Security: auto mode now blocks tampering with session transcript files, and asks before running rm -rf on a variable it cannot resolve
Fixed --json-schema silently producing unstructured output when the schema was invalid, and schemas using the format keyword being rejected
v2.1.204Jul 8, 2026
Fixed hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook
v2.1.203Jul 7, 2026
Added a warning when your login is about to expire, plus a grey pause badge in the footer for manual permission mode
Fixed background-agent stability: macOS 15-20s stall on open/switch, sessions going permanently unresponsive on stale daemon tokens, crash-looping on deleted working directories, a silent auto-upgrade failure that killed every running session
Fixed worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree
Reduced binary size by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily
v2.1.202Jul 6, 2026
Added a Dynamic workflow size setting in /config for controlling how large Claude generally makes dynamic workflows
Added workflow.run_id and workflow.name OpenTelemetry attributes so a workflow run can be reconstructed from OTel data
Fixed images and files sent from the Remote Control mobile/web app without a caption being silently dropped
Changed /review back to a fast single-pass review; use /code-review for the multi-agent review
v2.1.201Jul 3, 2026
Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders
Manual permission mode
v2.1.200Jul 3, 2026
⭐ AskUserQuestion dialogs no longer auto-continue by default; opt into an idle timeout via /config
Changed the "default" permission mode to "Manual" across CLI, VS Code, and JetBrains; --permission-mode manual accepted alongside default
Fixed background sessions silently stopping mid-turn after sleep/wake, and never restarting after a crash left a stale daemon.lock
Fixed project-scoped plugins not loading correctly from git worktrees of the same repository
v2.1.199Jul 2, 2026
Stacked slash-skill invocations like /skill-a /skill-b now load all leading skills (up to 5), not just the first
Transient server rate-limit errors (429s unrelated to usage limit) now retried automatically with backoff for subscribers; CLAUDE_CODE_RETRY_WATCHDOG raises default retries to 300 and lifts the CLAUDE_CODE_MAX_RETRIES cap
Fixed streaming responses discarded on mid-stream server errors (partial output now kept); subagents cut off by rate limits now return partial work to the parent; API errors in subagents reported instead of shown as success
Fixed the Linux background-agent daemon killing itself and all agents every ~50s after an unclean shutdown; SSL certificate errors now fail immediately with actionable guidance
Background subagents + Chrome GA
v2.1.198Jul 1, 2026
⭐ Subagents now run in the background by default: Claude keeps working while they run and is notified when they finish
⭐ Claude in Chrome is now generally available
Background agents launched from claude agents now commit, push, and open a draft PR when finishing code work; new Notification hook events agent_needs_input / agent_completed
Explore agent now inherits the session model (capped at Opus) instead of Haiku; subagents and compaction inherit extended thinking config; removed the /agents wizard
Claude Sonnet 5
v2.1.197Jun 30, 2026
⭐ Introducing Claude Sonnet 5: now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31
v2.1.196Jun 29, 2026
Added organization default models (shows as "Org default" or "Role default" in /model); readable default session names; clickable file attachments in chat (Cmd/Ctrl-click reveals in Finder/Explorer)
Security: claude mcp list/get no longer spawn .mcp.json servers self-approved by a committed .claude/settings.json; untrusted workspaces show pending approval
Fixed waking a background job permanently deleting its conversation on a transcript misread; rate-limit warning flicker/over-counting; duplicate recap lines after StructuredOutput retry
Improved background session reliability across process stop/restart/update; /code-review merged five cleanup finders (~25% token reduction); streaming idle watchdog on by default
v2.1.195Jun 26, 2026
Fixed hook matchers with hyphenated identifiers (e.g. code-reviewer, mcp__brave-search) accidentally substring-matching; use mcp__brave-search__.* to match all tools from a server
Fixed voice dictation on macOS (silence after input device change) and auto-submit for languages without spaces (Japanese, Chinese, Thai)
Fixed background agent daemon socket failures, blank screen on crash restart, jobs disappearing when written by newer version
⭐ claude_code.assistant_response OpenTelemetry event logs model responses; set OTEL_LOG_ASSISTANT_RESPONSES=0 if you log prompts and want to exclude responses
autoMode.classifyAllShell routes all Bash/PowerShell through auto-mode classifier; denial reasons shown in transcript, toast, and /permissions
Live file path autocomplete in bash mode (!); startup notice when MCP servers need auth
Automatic memory-pressure reaping for idle background shell commands (disable: CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1)
v2.1.191Jun 24, 2026
⭐ /rewind now works after /clear to resume a conversation from before the clear
Reduced CPU usage during streaming by ~37% by coalescing text updates to 100ms intervals
MCP server reliability: capability discovery retries transient errors; OAuth headless paste-URL fallback; HTTP 404 errors show URL
Fixed background agents resurrecting after stop; 20+ bug fixes including scroll jump and welcome splash overflow
v2.1.190Jun 24, 2026
Bug fixes and reliability improvements
v2.1.187Jun 23, 2026
⭐ sandbox.credentials setting blocks sandboxed commands from reading credential files and secret environment variables
⭐ Org-configured model restrictions enforced in model picker, --model, /model, and ANTHROPIC_MODEL with explanatory message
Fixed remote MCP tool calls hanging indefinitely; now abort after 5 min with error (override: CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT)
⭐ `claude mcp login/logout ` authenticates MCP servers from the CLI without the interactive /mcp menu; --no-browser flag for SSH sessions
`!` bash commands now auto-trigger Claude to respond to output; opt-out via "respondToBashCommands": false in settings.json
Background subagents surface permission prompts in main session instead of auto-denying; dialog shows which agent is asking
Fixed Agent(type) deny rules and Agent(x,y) allowed-types restrictions not enforced for named subagent spawns; 25+ bug fixes
v2.1.185Jun 22, 2026
Improved stream-stall hint: reads "Waiting for API response · will retry in …" (was "No response from API · Retrying in …"), triggers after 20s instead of 10s
v2.1.183Jun 19, 2026
⭐ Auto mode safety: destructive git ops (reset --hard, checkout -- ., clean -fd) and git commit --amend and terraform/pulumi/cdk destroy are blocked unless explicitly requested
Model deprecation warnings on stderr in print mode (-p) and for models set in agent frontmatter
`attribution.sessionUrl` setting omits the claude.ai session link from commits and PRs in web/Remote Control sessions
10+ bug fixes: thinking 400 errors on subagent spawns, WebSearch empty in subagents, tmux pane launch failures
v2.1.181Jun 18, 2026
⭐ `/config key=value` syntax sets any setting inline from the prompt (e.g. `/config thinking=false`), works in interactive, -p, and Remote Control
`sandbox.allowAppleEvents` opt-in for macOS sandboxed commands
Improved streaming: long paragraphs appear line-by-line instead of waiting for the first line break
Improved subagent panel: idle agents auto-hide after 30s, list caps at 5 rows with scroll hints; 30+ bug fixes
v2.1.179Jun 17, 2026
Fixed mid-stream connection drops: partial responses preserved, spinner no longer stuck at "running tool"
Fixed mouse-wheel scrolling in WSL2 under Windows Terminal and VS Code (regression in 2.1.172)
⭐ Tool(param:value) syntax for permission rules to match tool input parameters, e.g. Agent(model:opus) to block Opus subagents
Nested .claude/skills directories load when working on files there; directory-qualified names on clash prevent conflicts
Improved auto mode: subagent spawns evaluated by classifier before launch
10+ bug fixes: subagent transcript, compaction fallback model, stale auth credentials, MCP disallowedTools server specs, vim undo
v2.1.176Jun 15, 2026
⭐ Session titles generated in the language of your conversation; `language` setting pins a specific language
`footerLinksRegexes` setting: regex-matched link badges in the footer row
Improved Bedrock credential caching: cached until Expiration instead of fixed 1 hour
15+ bug fixes: availableModels alias enforcement, Fable 5 auto mode fallback, hook if path conditions, Linux sandbox symlink, tmux clipboard, Remote Control model switch
v2.1.175Jun 15, 2026
⭐ `enforceAvailableModels` managed setting: constrains Default model to allowlist; blocks user/project settings from widening a managed list
v2.1.174Jun 15, 2026
`wheelScrollAccelerationEnabled` setting to disable mouse-wheel scroll acceleration in fullscreen mode
Fixed /model picker hiding the model family that Default resolves to (Opus/Sonnet row visible per plan type)
[VSCode] Usage attribution in /usage dialog: cache misses, long context, subagents, per-skill/agent/plugin/MCP breakdowns
`fallbackModel` setting: up to 3 fallback models tried in order when primary is overloaded or unavailable; `--fallback-model` works in interactive sessions too
Glob patterns in deny rule tool-name position (`"*"` denies all tools); hardened `SendMessage`: relayed messages no longer carry user authority
`MAX_THINKING_TOKENS=0`, `--thinking disabled`, and per-model toggle now disable thinking on models that think by default via Claude API
`requiredMinimumVersion`/`requiredMaximumVersion` managed settings: Claude Code refuses to start outside the allowed version range
`/plugin list` with `--enabled`/`--disabled` filters; Stop/SubagentStop hooks can return `additionalContext` to continue the turn
Skills: `\$` escape for literal `$` in command bodies; stdio MCPs receive `CLAUDE_CODE_SESSION_ID` on `--resume`
10+ bug fixes: `claude -p` background hang, bazel/EDR bash regression, Windows EEXIST fix, managed settings on fresh config
v2.1.162Jun 3, 2026
`claude agents --json` now includes `waitingFor` showing what a waiting session is blocked on (e.g. permission prompt)
Clicking a slash command fills it into the prompt instead of running immediately; press Enter to run
Remote Control shows as a persistent footer pill; Windsurf renamed to Devin Desktop in `/ide`, `/terminal-setup`, `/scroll-speed`
Quieter startup: notices group by severity, session info and announcements share a single line; 25+ bug fixes
v2.1.161Jun 2, 2026
`OTEL_RESOURCE_ATTRIBUTES` values included as labels on metric datapoints for custom dimensions (team, repo)
`claude agents` rows show `done/total` for fanned-out work; `/mcp` collapses unused claude.ai connectors
Parallel tool calls: failed Bash no longer cancels other calls in the same batch
20+ bug fixes: managed-settings policies fix for third-party providers, MCP secrets no longer printed to terminal, `isolation: worktree` in background sessions fixed
v2.1.160Jun 1, 2026
⭐ Renamed dynamic-workflow trigger keyword from `workflow` to `ultracode` (violet shimmer in prompt); asking in your own words still works
Security: added prompt before writing to shell startup files (`.zshenv`, `.zlogin`) and `~/.config/git/`; `acceptEdits` mode prompts before build-tool config files
Edit no longer requires separate Read after single-file `grep`/`egrep`/`fgrep`
Removed `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` (deprecated in 2.1.154, now no-op); JetBrains plugin suggestion removed from startup; 20+ bug fixes
⚠️ Breaking:
`workflow` keyword no longer triggers dynamic workflows; use `ultracode` instead
v2.1.159May 31, 2026
Internal infrastructure improvements (no user-facing changes)
v2.1.158May 30, 2026
⭐ Auto mode now available on Bedrock, Vertex, and Foundry for Opus 4.7 and Opus 4.8; opt in with `CLAUDE_CODE_ENABLE_AUTO_MODE=1`
v2.1.157May 29, 2026
⭐ Plugins in `.claude/skills` directories auto-load without marketplace required; `claude plugin init ` scaffolds new plugins
Autocomplete for `/plugin` arguments; `agent` field in `settings.json` honored for dispatched sessions with `--agent ` override; `EnterWorktree` switches between worktrees mid-session
20+ bug fixes: corrupted images no longer crash requests, sandbox network prompts fixed in desktop/IDE/SDK auto mode, `--resume` improvements, WSL image paste fixes, right-click paste duplicate, long conversation performance improved
v2.1.156May 28, 2026
Fixed Opus 4.8 thinking blocks being modified, which was causing API errors
v2.1.154May 28, 2026
⭐ Opus 4.8 with high effort default; `/effort xhigh` for hardest tasks; fast mode at 2x rate / 2.5x speed
⭐ Dynamic workflows: Claude orchestrates tens to hundreds of background agents in one session; run `/workflows` to monitor
Lean system prompt default for all models except Haiku/Sonnet/Opus 4.7+; `/simplify` reworked to cleanup-only (reuse/simplification/efficiency/altitude); `! ` in claude agents runs background shell sessions
`modelPicker:setAsDefault` keybinding renamed to `modelPicker:thisSessionOnly` in keybindings.json
v2.1.152May 27, 2026
`/code-review --fix` applies review findings to working tree after review; `/simplify` now invokes `/code-review --fix`
Skills/commands can set `disallowed-tools` frontmatter to remove tools while the skill is active; `/reload-skills` re-scans directories without restart
New `MessageDisplay` hook event to transform or hide assistant message text
Auto mode no longer requires opt-in; `--fallback-model` for session-level fallback; `SessionStart` can set session title + trigger skill reload; 35+ bug fixes
v2.1.150May 23, 2026
Internal infrastructure improvements (no user-facing changes)
v2.1.149May 23, 2026
/usage per-category breakdown: skills, subagents, plugins, and per-MCP-server cost
Markdown GFM task list checkboxes (- [ ]/- [x]) now render natively
Hotfix: Bash tool returning exit code 127 on every command (regression from 2.1.147)
v2.1.147May 22, 2026
⭐ Pinned background sessions (Ctrl+T in claude agents): stay alive when idle, auto-restart on CC updates, shed under memory pressure only after non-pinned sessions
/code-review --comment: post findings as inline GitHub PR comments
Improved auto-updater: retries transient network failures, reports specific error categories and OS error codes, shows current version on failure
Bug fixes: prompt history no consecutive duplicates, PowerShell hook if conditions matching, pasted text [Pasted text #N] placeholder, plugin component counts doubled, slash commands + tab/newline treated as unknown, 25+ additional fixes
v2.1.146May 21, 2026
⭐ /simplify renamed to /code-review with optional effort level (e.g. /code-review high)
Auto mode no longer suppresses AskUserQuestion when the user or a skill explicitly relies on it
Bug fixes: Windows PowerShell "command line is invalid" regression (2.1.124), MCP paginated resources/prompts, /background refusing skill-only commands, backgrounded sessions re-prompting for already-granted permissions, 15+ total
v2.1.145May 20, 2026
⭐ claude agents --json: list live sessions as JSON for scripting (tmux-resurrect, status bars, session pickers)
⭐ /plugin Discover/Browse now previews commands, agents, skills, hooks, MCP/LSP before installation; tab title shows awaiting-input count
Security fix: permission-prompt bypass for bare variable assignments to non-allowlisted env vars in Bash now requires explicit approval
Bug fixes: MCP paginated resources/templates/prompts, Read tool truncates instead of hard error, /review GraphQL fix, task list ordering, agent team non-ASCII names
v2.1.144May 19, 2026
⭐ /resume now lists background sessions (started via --bg or agent view) alongside interactive ones, marked with bg
⭐ /model is now session-only by default: press d in the picker to set a default model for new sessions
"extra usage" renamed to "usage credits" across CLI; /extra-usage → /usage-credits (old name still works)
Bug fixes: 75s startup hang on unreachable API (now 15s timeout), terminal rendering corruption, macOS Full Disk Access crash, MCP paginated tools/list, 40+ total
v2.1.143May 16, 2026
⭐ Plugin dependency enforcement: claude plugin disable refuses when another enabled plugin depends on the target (with disable-chain hint); enable force-enables transitive deps
⭐ Projected context cost (per-turn and per-invocation token estimates) added to the /plugin marketplace browse pane
worktree.bgIsolation: "none": background sessions edit working copy directly without EnterWorktree
Bug fixes: stop hook block loop (warns after 8 blocks), Esc/Ctrl+C cancels /loop wakeup, background sessions preserve model+effort after idle wake
Fast Mode Opus 4.7
v2.1.142May 15, 2026
⭐ Fast mode now uses Opus 4.7 by default (was Opus 4.6): set CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE=1 to pin to 4.6
⭐ New claude agents dispatch flags: --add-dir, --settings, --mcp-config, --model, --effort, --permission-mode and more
Plugins with root-level SKILL.md and no skills/ subdirectory now surface as a skill; /plugin shows LSP servers
Bug fixes: MCP_TOOL_TIMEOUT now raises per-request fetch timeout, daemon exits cleanly after brew upgrade, background worktree recognition
v2.1.141May 14, 2026
⭐ Hook terminalSequence output field: emit desktop notifications, window titles, and bells from hooks without a controlling terminal
⭐ claude agents --cwd <path> scopes session list to a directory; agents with lingering shells move to Completed
Rewind "Summarize up to here": compress earlier context; /bg preserves permission mode; spinner warms amber after 10s
50+ bug fixes: Bedrock cross-account auth, MCP 403 needs-auth hint, Remote Control token rotation race, vim Ctrl+C, markdown table regression
v2.1.140May 13, 2026
Agent tool subagent_type matching now case- and separator-insensitive ("Code Reviewer" resolves to code-reviewer)
Plugins warn when a default component folder is silently ignored due to plugin.json key conflict
Bug fixes: /goal hang with disableAllHooks, symlinked settings hot-reload regression, claude --bg connection drop
Agent View
v2.1.139May 12, 2026
⭐ Agent view (Research Preview): claude agents lists all sessions: running, blocked on you, or done
⭐ /goal command: set a completion condition; Claude works across turns with live elapsed/turns/tokens overlay
Hook args: string[] exec form (no shell spawning) + continueOnBlock for PostToolUse
[VSCode] Fixed extension failing to activate on Windows
v2.1.136May 11, 2026
⭐ settings.autoMode.hard_deny: auto mode classifier rules that block unconditionally regardless of user intent or allow exceptions
CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL to re-enable session quality survey for enterprises capturing responses via OpenTelemetry
Fixed MCP servers disappearing after /clear in VS Code/JetBrains/Agent SDK; MCP OAuth concurrent refresh token race fixed (no more daily re-auth for multi-server users)
40+ UI/terminal fixes: plan mode write blocking, extended thinking redacted-block API 400 fix, --resume with underscores in project path, WSL2 image paste via PowerShell fallback
v2.1.133May 8, 2026
⭐ worktree.baseRef setting (fresh | head): fresh (default) branches from origin/<default>; set head to keep local HEAD with unpushed commits. Note: reverts 2.1.128 behavior: set worktree.baseRef: "head" to restore it
Hooks receive active effort level via effort.level JSON field and $CLAUDE_EFFORT env var in Bash subcommands
Fixed subagents not discovering project/user/plugin skills via Skill tool
Fixed parallel sessions dead-ending at 401 after refresh-token race; HTTP(S)_PROXY/NO_PROXY/mTLS now respected for full MCP OAuth flow
⚠️ Breaking:
worktree.baseRef defaults to fresh (branches from origin/<default>), reverting 2.1.128: set worktree.baseRef: "head" to keep local HEAD
v2.1.132May 8, 2026
CLAUDE_CODE_SESSION_ID env var now passed to Bash tool subprocess environment (matches session_id in hook JSON input)
CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 to opt out of the fullscreen alternate-screen renderer and keep output in native scrollback
Fixed unbounded memory growth (10GB+ RSS) when a stdio MCP server writes non-protocol data to stdout
Fixed VS Code extension failing to activate on Windows (hardcoded createRequire build path in bundled SDK)
Fixed Mantle endpoint authentication failing with missing x-api-key header
v2.1.129May 6, 2026
--plugin-url <url> flag to fetch a plugin .zip archive from URL for the current session; CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE for Homebrew/WinGet auto-upgrade with restart prompt
Ctrl+R history picker restored to all-projects default (pre-2.1.124 behavior): press Ctrl+S to narrow to current project or session; skillOverrides setting now works
Gateway /v1/models discovery now opt-in via CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1; third-party deployments no longer see first-party spinner tips
EnterWorktree now creates branch from local HEAD: unpushed commits no longer dropped; --plugin-dir accepts .zip plugin archives
--channels works with console (API key) auth; /mcp shows tool count per server and flags 0-tool servers
Parallel bash tool call fix: a failing read-only command no longer cancels sibling calls; sub-agent summaries now include prompt cache (~3x cache_creation reduction)
35+ bug fixes: 1M-context false "Prompt is too long", MCP stdio corrupted args with spaces, MCP images dropped on structured+content blocks, clipboard whitespace in code blocks
v2.1.126May 1, 2026
⭐ /model picker lists models from your gateway's /v1/models endpoint when ANTHROPIC_BASE_URL points at a compatible gateway
⭐ claude project purge [path]: delete all Claude Code state for a project (transcripts, tasks, history, config entry); supports --dry-run, -y, -i, --all
claude auth login accepts pasted OAuth code when browser callback can't reach localhost (WSL2, SSH, containers); Windows PowerShell 7 now detected + primary shell
Security: Fixed allowManagedDomainsOnly/allowManagedReadPathsOnly ignored when higher-priority settings lacked sandbox block; 40+ bug fixes (image paste crash >2000px, Stream idle timeout after sleep, CJK text on Windows, OAuth timeout, Agent SDK hang)
v2.1.123Apr 29, 2026
Fixed OAuth authentication failing with 401 retry loop when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 is set
v2.1.122Apr 28, 2026
⭐ ANTHROPIC_BEDROCK_SERVICE_TIER env var to select Bedrock service tier (default/flex/priority) via X-Amzn-Bedrock-Service-Tier header
Pasting a PR URL into /resume search finds the session that created it (GitHub, GitLab, Bitbucket, GitHub Enterprise)
⭐ alwaysLoad MCP server config option: tools skip tool-search deferral and are always available
⭐ claude plugin prune removes orphaned auto-installed plugin deps; PostToolUse hooks can now replace output for all tools (previously MCP-only)
Type-to-filter search in /skills; MCP servers auto-retry 3x on startup; --dangerously-skip-permissions skips .claude/ dirs
Critical fixes: unbounded memory growth (multi-GB RSS) with images; /usage memory leak (~2GB); Bash tool unusable when start dir deleted; --resume crash on corrupted sessions
v2.1.120Apr 24, 2026
⭐ Windows: Git for Windows (Git Bash) no longer required: PowerShell used as shell tool when absent
⭐ claude ultrareview [target] subcommand for non-interactive CI/script use (--json for raw output)
Skills can reference effort level with ${CLAUDE_EFFORT}; AI_AGENT env var for gh traffic attribution
Fixes: Esc during stdio MCP call closing server (regression 2.1.105), /rewind keyboard input after --resume, scrollback duplication, false-positive rm permission prompts in auto mode
v2.1.119Apr 24, 2026
⭐ /config settings (theme, editor mode, verbose) now persist to ~/.claude/settings.json and participate in project/local/policy override precedence
⭐ --from-pr now accepts GitLab merge-request, Bitbucket pull-request, and GitHub Enterprise PR URLs
Security: blockedMarketplaces enforces hostPattern/pathPattern; prUrlTemplate setting; 30+ bug fixes including CRLF paste, Glob/Grep on macOS, /plan mode fix, TaskList ordering, stale worktree reuse
v2.1.118Apr 23, 2026
⭐ Vim visual mode (v) and visual-line mode (V) with selection, operators, and visual feedback
⭐ /cost and /stats merged into /usage: both remain as typing shortcuts that open the relevant tab
⭐ Custom named themes from /theme or hand-edit JSON in ~/.claude/themes/; plugins can ship themes via themes/ directory
Hooks can invoke MCP tools directly via type: "mcp_tool"; DISABLE_UPDATES env var; wslInheritsWindowsSettings policy; 15+ bug fixes
v2.1.117Apr 22, 2026
⭐ Default effort changed to high for Pro/Max subscribers on Opus 4.6 and Sonnet 4.6 (was medium)
⭐ Fixed Opus 4.7 sessions showing inflated /context percentages and autocompacting too early: was computing against 200K instead of native 1M context window
Native macOS/Linux builds: Glob and Grep tools replaced by embedded bfs and ugrep: faster searches without extra tool round-trip (Windows/npm unchanged)
/model selections persist across restarts; startup header shows model source pin; plugin dependency fixes; 15+ bug fixes
v2.1.116Apr 21, 2026
⭐ /resume up to 67% faster on large sessions (40MB+); handles sessions with many dead-fork entries more efficiently
Thinking spinner shows inline progress: "still thinking", "thinking more", "almost done thinking": replaces the separate hint row
Security: sandbox auto-allow no longer bypasses the dangerous-path check for rm/rmdir targeting /, $HOME, or critical system directories
Agent frontmatter hooks: now fire when running as main-thread agent via --agent; /config search matches option values; many terminal, scrolling, and UI bug fixes
v2.1.114Apr 18, 2026
Fixed crash in permission dialog when an agent teams teammate requested tool permission
v2.1.113Apr 18, 2026
⭐ CLI now spawns a native Claude Code binary via per-platform optional dependency instead of bundled JavaScript
⭐ sandbox.network.deniedDomains setting: block specific domains even when a wildcard allowedDomains would permit them
Security hardening: macOS /private/{etc,var,tmp,home} paths flagged for Bash(rm:*) rules; deny rules match env/sudo/watch/ionice/setsid wrappers; Bash(find:*) no longer auto-approves -exec/-delete
Keyboard improvements (Ctrl+A/E logical line, Ctrl+Backspace on Windows); /loop Esc cancels wakeups; subagents fail with clear error after 10 min; many bug fixes
v2.1.111Apr 16, 2026
⭐ Claude Opus 4.7 xhigh effort level (between high and max); Auto mode for Max subscribers no longer requires --enable-auto-mode
⭐ /ultrareview skill: cloud-based parallel multi-agent code review; invoke without args for current branch or /ultrareview <PR#>
⭐ /less-permission-prompts skill: scans transcripts and proposes a prioritized read-only allowlist for settings.json
Plan files named after prompts; read-only bash with glob patterns and cd <dir> && no longer trigger prompts; interactive /effort slider; many bug fixes
v2.1.110Apr 16, 2026
⭐ /tui command and tui setting: run /tui fullscreen for flicker-free rendering in the same conversation
⭐ Push notification tool: Claude can send mobile push notifications when Remote Control and "Push when Claude decides" config are enabled
⭐ --resume/--continue now resurrects unexpired scheduled tasks
/focus command for focus view; Ctrl+O reverts to verbose transcript toggle; autoScrollEnabled config; session recap for telemetry-disabled users; 30+ bug fixes
v2.1.109Apr 15, 2026
Improved extended-thinking indicator with a rotating progress hint for better visibility during long thinking phases
v2.1.108Apr 15, 2026
⭐ ENABLE_PROMPT_CACHING_1H env var: opt into 1-hour prompt cache TTL on API key, Bedrock, Vertex, and Foundry; FORCE_PROMPT_CACHING_5M to force 5-minute TTL
⭐ /recap command: provides context when returning to a session after a break; configurable in /config
Built-in slash commands (/init, /review, /security-review) now discoverable and invokable via the Skill tool; /undo alias for /rewind
/resume picker defaults to current directory sessions (Ctrl+A for all); improved model-switch warning mid-conversation; reduced memory footprint for file reads and syntax highlighting
v2.1.107Apr 14, 2026
Show thinking hints sooner during long operations for better real-time feedback
v2.1.105Apr 13, 2026
⭐ PreCompact hook support: hooks can block compaction by exiting with code 2 or returning {"decision":"block"}
EnterWorktree tool gains path parameter to switch into an existing worktree; /proactive alias for /loop; background monitor support for plugins
WebFetch strips <style>/<script> contents; stalled API streams abort after 5 min then retry non-streaming; /doctor status icons with f-to-fix
Multiple bug fixes: queued image drops, screen blank on wrapped prompts, MCP tools missing on headless first turn, 429 raw JSON error display
v2.1.101Apr 10, 2026
⭐ /team-onboarding command: generates a teammate ramp-up guide from your local Claude Code usage
OS CA certificate store trusted by default: enterprise TLS proxies work without extra config (CLAUDE_CODE_CERT_STORE=bundled to revert)
/ultraplan and remote-session features auto-create a default cloud environment (no web setup required first)
Fixed infinite loop when API errors triggered stop hooks re-feeding blocking errors; fixed --resume truncating history on large sessions with subagents
v2.1.77Mar 17, 2026
⭐ Opus 4.6 output limits raised: default max output to 64k tokens; upper bound for Opus 4.6 and Sonnet 4.6 to 128k tokens
allowRead sandbox setting to re-allow reads within denyRead regions; /copy N for Nth-latest response; /branch replaces /fork
Fixed MCP OAuth token refresh race condition with multiple simultaneous Claude Code instances
Fixed config file corruption wiping authentication when multiple instances ran simultaneously
v2.1.58Feb 26, 2026
Remote Control expanded to more users
v2.1.56Feb 25, 2026
VSCode: Fixed another cause of extension crash on Windows
v2.1.55Feb 25, 2026
Fixed BashTool failing on Windows with EINVAL error
v2.1.53Feb 25, 2026
Stability fixes: Windows panics/crashes, WebAssembly crashes on Linux x64 & Windows x64/ARM64
Fixed graceful shutdown leaving stale sessions with Remote Control
Fixed --worktree flag sometimes ignored on first launch
v2.1.52Feb 24, 2026
VSCode: Fixed extension crash on Windows
🔥 Major Feature
v2.1.51Feb 24, 2026
📱 Remote Control: control your local Claude Code session from any phone, tablet, or browser via /rc or claude remote-control. Execution stays 100% local. Pro/Max only (Research Preview)
BashTool skips login shell by default when snapshot available: performance improvement
CLAUDE_CODE_ACCOUNT_UUID / CLAUDE_CODE_USER_EMAIL env vars for SDK account metadata
/model picker shows human-readable labels; custom npm registries for plugins
v2.1.49Feb 20, 2026
--worktree / -w flag + subagent isolation: "worktree" for isolated git worktrees
Agent definitions support background: true to always run as background task
ConfigChange hook event for enterprise security auditing of config changes
Simple mode includes file edit tool; Sonnet 4.6 now has 1M context on Max plan
v2.1.47Feb 19, 2026
VS Code plan preview auto-updates as Claude iterates
ctrl+f kills all background agents; ESC cancels main thread only
last_assistant_message field in Stop/SubagentStop hook inputs
Removed # shortcut for quick memory (use /memory command instead)
v2.0.69Jan 6, 2026
MCP server status indicators
Enhanced bash command history
v2.0.68Jan 5, 2026
Agent tool output formatting
Fixed: Skill discovery edge cases
v2.0.67Jan 4, 2026
Improved error messages for permission denials
Fixed: MCP tool schema validation
v2.0.66Jan 3, 2026
Enhanced agent task progress indicators
Fixed: Bash tool timeout handling
v2.0.65Jan 2, 2026
MCP server health checks
Fixed: Skill argument parsing
v2.0.64Jan 1, 2026
Improved agent task error recovery
Fixed: Permission prompt display
v2.0.63Dec 31, 2025
Enhanced bash autocomplete suggestions
Fixed: MCP tool discovery
v2.0.62Dec 30, 2025
Agent tool output formatting improvements
Fixed: Skill hot-reload edge cases
v2.0.61Dec 29, 2025
Improved error messages for MCP server failures
Fixed: Permission prompt edge cases
v2.0.60Dec 28, 2025
Enhanced agent task progress indicators
Fixed: Bash tool timeout handling
v2.0.59Dec 27, 2025
MCP server health checks
Fixed: Skill argument parsing
v2.0.58Dec 26, 2025
Improved agent task error recovery
Fixed: Permission prompt display
v2.0.57Dec 25, 2025
Enhanced bash autocomplete suggestions
Fixed: MCP tool discovery
v2.0.56Dec 24, 2025
Agent tool output formatting improvements
Fixed: Skill hot-reload edge cases
v2.0.55Dec 23, 2025
Improved error messages for MCP server failures
Fixed: Permission prompt edge cases
v2.0.54Dec 22, 2025
Enhanced agent task progress indicators
Fixed: Bash tool timeout handling
v2.0.53Dec 21, 2025
MCP server health checks
Fixed: Skill argument parsing
v2.0.52Dec 20, 2025
Improved agent task error recovery
Fixed: Permission prompt display
v2.0.51Dec 19, 2025
Enhanced bash autocomplete suggestions
Fixed: MCP tool discovery
v2.0.50Dec 18, 2025
Agent tool output formatting improvements
Fixed: Skill hot-reload edge cases
v2.0.49Dec 17, 2025
Improved error messages for MCP server failures
Fixed: Permission prompt edge cases
v2.0.48Dec 16, 2025
Enhanced agent task progress indicators
Fixed: Bash tool timeout handling
v2.0.47Dec 15, 2025
MCP server health checks
Fixed: Skill argument parsing
⚠ Recent breaking changes
Security Symlinked writes use their real destination (v2.1.280); background sessions require workspace trust and children inherit setting-source restrictions (v2.1.281)
Permissions Server-side auto mode also reviews read-only and sandboxed shell commands; dangerous-rm prompts deny after two unanswered minutes (v2.1.281)
Settings Older CLI versions skip settings files containing attribution: false; retain the object form in shared files (v2.1.281)
Hooks PermissionRequest requires command or HTTP hooks, not agent-type hooks (v2.1.280); self-hosted runner prompt wrappers must use file-based flags (v2.1.281)
Security Plugin archive permissions and Bash tee destination checks fixed (v2.1.269); symlink-path rules and MCP/plugin secret redaction fixed (v2.1.268)
Permissions Plain WebFetch deny/ask rules no longer gate Artifact reads or updates; use Artifact or WebFetch(domain:claude.ai) (v2.1.268)
Auth Managed forceLoginGatewayUrl selects gateway authentication at startup and ignores leftover claude.ai credentials or API keys (v2.1.265)
