發布日期：2026-06-15
想讓多隻 Claude 互相合作，現在不用先開團隊了。只要把環境變數（開程式前預先塞給它的隱藏開關）CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS 設成 1，每個工作階段就自動帶一個內建團隊，你直接用 Agent 工具的 name 參數（指定名字的設定值）派隊友出來就行，省掉以前先建團隊的步驟；舊的 TeamCreate、TeamDelete 工具已移除，而 Agent 工具上那個 team_name 參數雖然還能填、但會被忽略不生效。就像以前要組讀書會得先去教務處登記社團，現在只要你舉手說一聲，同班同學直接就是你的內建讀書會，不用再跑行政流程。
管權限跟管子代理的兩個安全缺口補上了。權限規則（permission rule，規定哪些動作要問你、哪些直接放行的設定）現在多了 Tool(param:value) 寫法，可以針對某個工具的輸入參數（你呼叫工具時塞給它的內容）來比對設限，還支援 * 萬用字元；例如寫 Agent(model:opus) 就能擋掉用 Opus 模型的子代理。另外在自動模式（auto mode，讓 Claude 不逐一問你就自己執行的模式）下，以前派子代理（subagent，Claude 分身去辦小事的代理）出去時，它可能在沒被審查的情況下就要求執行一個被擋住的動作；現在子代理在起飛前會先被分類器（classifier，自動判斷動作風險的機制）評估過，補上這個漏洞。就像安檢，以前只能整個人放行或擋下，現在能精確到「可以帶水、但不能帶超過 100ml」；而且以前外包工人可能沒過安檢就溜進管制區，現在每個人都得先掃描才上工。
你在專案深處放的設定現在更容易生效。巢狀（nested，一層包一層）的 .claude/skills 目錄裡的技能（skill，Claude 能叫出來用的能力包），當你在那層資料夾工作時會自動載入；如果跟別層撞名，內層的會顯示成 <dir>:<name>（目錄名:技能名）讓兩個都還能用。整個巢狀 .claude/ 目錄來說，當代理、工作流（workflow）、輸出風格撞名時，離你目前工作資料夾最近的那一份會勝出；而專案層級的工作流存檔，現在也會存進最接近的現有 .claude/workflows/ 裡。還修了一個毛病：巢狀技能那種帶目錄前綴的名字，以前在非互動模式（non-interactive run，像 SDK 不跳提示直接跑的模式）下會被權限提示擋住，現在正常。就像住飯店，每層樓都放一份客房指南、二樓的撞名時就標成「2F:指南」，而且你人住在哪一層，那一層的指南就說了算。
幾個介面與回報的小改進。/doctor（健康檢查功能）現在每個區塊都是一致的平面樹狀排版（flat tree，不縮排、攤平的樹狀圖）、狀態圖示更清楚、指令名稱會被標出來。技能清單如果太長被截斷，現在的截斷警告會明確告訴你有幾則技能描述受影響。工作流（workflow，預先定好的多步驟任務）的觸發關鍵字現在用紫色閃亮高亮顯示，而且只有你明確說「run a workflow」或「workflow:」這類字眼才會觸發，不再是你隨口提到「workflow」這個字就被啟動。最後，/bug（回報問題的功能）現在送出前一定要先寫描述，而且不再把模型拒絕回答的那段文字拿來當 GitHub issue（問題單）的標題。就像醫院健檢報告改用清楚的樹狀表、聽到特定暗號才會啟動的緊急按鈕變得更顯眼、而客訴單不再接受只寫「壞掉了」三個字就送出。
遠端遙控（Remote Control，用手機控桌機的功能）出問題時，現在不會再讓你瞎猜。連線失敗時，底部會一直顯示一條紅色的「/rc failed」（遠端遙控失敗）標記，而不是一閃即逝。而當你看到「not yet enabled」（尚未啟用）這個錯誤時，它現在會明確告訴你到底是卡在哪一種原因：是 gate（功能開關門，還沒被開放）、check failure（檢查沒過）、stale entitlement（過期的使用權限），還是 org policy（組織政策，公司設的規定）。就像打電話客服，以前忙線只響一聲就斷、問為什麼不能用只回「尚未開通」，現在會持續亮著未接來電、而且明確告訴你是欠費、設備故障、權限過期、還是公司政策擋著。
一批會害你連不上或當機的授權問題修好了。CLI（命令列介面）以前如果從父行程（parent process，把它叫起來的那個程式）繼承到一個過期的 websocket／OAuth 檔案描述子（file-descriptor，程式存取檔案或連線用的編號）環境變數，會直接記憶體用爆崩潰，現在撐得住。Claude in Chrome（瀏覽器版）以前當 OAuth token（授權令牌）屬於另一個帳號、跟 Claude Code 登入帳號不同時，會默默連不上，現在會正常處理。claude agents 的 worker（幹活的子程序）以前如果背景服務（daemon，常駐在背後跑的程式）是從一個設了自訂 API 閘道（API gateway，自架的 API 接點）的 shell 啟動的（透過 ANTHROPIC_BASE_URL 和 ANTHROPIC_AUTH_TOKEN），會報「401 Invalid bearer token」（無效的授權令牌），現在修好了。另外，壓縮（compaction，把舊對話摘要精簡的功能）以前不遵守 --fallback-model（備援模型，主模型忙不過來時退而求其次用的模型），現在在過載或模型不可用時會照設定的備援鏈退換；而憑證（credentials，證明你是合法使用者的金鑰）在對話外被刷新後，以前還會卡在舊的快取設定繼續報授權錯誤，現在會跟著更新。就像一間公司，以前某個員工帶了過期的門禁卡就把整層樓的系統當機、外賣送到錯樓層就默默丟包、代班制度形同虛設；現在過期卡不會搞垮系統、地址對得上才收件、代班真的會上工。
這批修了看子代理、背景任務、跟環境設定的一大堆毛病。查看子代理（subagent，Claude 分身去辦小事的代理）的對話紀錄（transcript，逐字留下的完整對話）現在會顯示工具結果跟即時進度；它還在跑的那輪裡你送的訊息以前會被丟掉，現在會留著；而把跑中的子代理按 ctrl+b 丟到背景，以前會從頭重來，現在保持原狀繼續。用 /bg 或 ←← 在一輪結束後建的背景工作階段，以前在代理清單裡會永遠顯示「Working」（工作中）卡著不動，現在狀態會更新。Linux 上沙盒（sandbox，把程式關在限制範圍裡跑的安全機制）以前在 .claude/skills 或 .claude/hooks 是符號連結（symlink，像捷徑指向別處）時會啟動失敗，現在正常。環境變數 CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1（外掛市集失敗時保留的開關）以前反而會害新的市集安裝無法複製下來，現在修好了。還有，子代理的 disallowedTools（禁用工具清單）裡寫的 MCP 伺服器層級規則（mcp__server、mcp__server__*、mcp__* 這類）以前會被默默忽略、形同沒設，現在會生效。就像一個部門，以前交辦進度看不到、放著的專案永遠亮「進行中」、而且某些門禁卡和採購設定形同虛設；現在進度透明、狀態老實、規則真的會被遵守。
三個影響鍵盤操作的小毛病修好了。vim 模式（vim，一種講究不碰滑鼠的編輯器操作風格）下按 u 復原（undo，把剛做的動作退回去），以前你連續好幾個動作會被合併成一次復原、一次只能退一大步，現在會一次退一個 NORMAL／VISUAL 模式的指令。claude agents 畫面裡，狀態列（statusline，底部顯示狀態的那一行）上用自訂 URI scheme（像 vscode:// 這種自訂的網址協定）的連結以前點了沒反應、開不了，現在點得開。VSCode 外掛裡，你按 Esc 關掉中日韓輸入法（CJK IME，打中日韓文時跳出候選字的小視窗）的候選窗時，以前會順手把正在跑的 Claude 任務也取消掉，現在不會了。就像打字機的退格鍵以前一次吃掉一整句、而桌上某張便利貼連結撕不下來、按掉輸入法的小提醒竟會取消正在印的文件；現在退格一次一個字、便利貼撕得下、關提醒也不影響列印。
If you want several Claude instances to collaborate, you no longer have to create a team first. Just set the environment variable (a hidden switch you set before launching) CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS to 1, and every session automatically gets one built-in team — you spawn teammates directly with the Agent tool's name parameter (a setting that assigns a name), skipping the old setup step. The old TeamCreate and TeamDelete tools are gone, and while the Agent tool's team_name parameter can still be filled in, it's now ignored. Like how forming a study group used to require registering a club at the academic affairs office, but now you just raise your hand and your classmates instantly form your built-in study group, no paperwork required.
Two safety gaps in permissions and subagent management are closed. Permission rules (settings that decide which actions ask you first and which go through automatically) now support a Tool(param:value) syntax that matches against a tool's input parameters (what you hand the tool when you call it), with * wildcard support; for instance Agent(model:opus) can block Opus-model subagents. And in auto mode (the mode where Claude acts without asking step by step), spawning a subagent (an agent Claude splits off for small chores) used to let it potentially request a blocked action without review; now the subagent is evaluated by a classifier (a mechanism that judges an action's risk automatically) before it ever launches, closing that gap. Like airport security that used to wave whole people through or block them, but now goes precise — "water is fine, but not over 100ml" — and where contractors could once slip into the secure zone unscanned, now everyone gets scanned before starting work.
Configs you tuck deep inside a project now take effect more easily. Skills (a skill, a capability bundle Claude can pull up to use) inside a nested (nested, one layer wrapping another) .claude/skills directory now auto-load when you're working on files in that folder; on a name clash with another layer, the inner one shows up as <dir>:<name> (directory:skill-name) so both stay available. Across the whole nested .claude/ setup, when agents, workflows (workflow), or output styles collide in name, the one nearest to your current working directory wins; and project-scope workflow saves now land in the closest existing .claude/workflows/. Also fixed: nested skills' directory-qualified names used to get blocked by permission prompts in non-interactive runs (non-interactive run, a mode like the SDK that runs straight through without prompting); they work now. Like staying at a hotel where every floor keeps a guest guide, a clash on the 2nd floor is labeled "2F:guide," and whichever floor you're staying on, that floor's guide is the one that governs.
A few small interface and reporting improvements. /doctor (the health-check feature) now uses a consistent flat tree (flat tree, an unindented, flattened-out tree diagram) layout across every section, with clearer status icons and highlighted command names. When the skill list gets too long and is truncated, the truncation warning now tells you exactly how many skill descriptions are affected. The workflow (workflow, a predefined multi-step task) trigger keyword now glows with a purple shimmer, and only fires on explicit phrases like "run a workflow" or "workflow:" — not on any casual mention of the word. Finally, /bug (the bug-report feature) now requires a description before submitting, and no longer uses the model's refusal text as the GitHub issue title. Like a hospital health-check report switching to a clear tree layout, an emergency button that only arms on a specific code getting more visible, and a complaint form that no longer accepts just the three words "it's broken."
When Remote Control (steering the desktop app from your phone) goes wrong, you no longer have to guess. On a connection failure, the footer now shows a persistent red "/rc failed" marker instead of flashing and vanishing. And when you hit the "not yet enabled" error, it now spells out exactly which cause is blocking you: a gate (a feature gate that hasn't been opened), a check failure, a stale entitlement (an expired usage right), or org policy (a rule your company set). Like calling customer service where a busy line used to ring once and cut off and "why can't I use it" got only "not activated yet" — now the missed-call indicator stays lit and it tells you plainly whether it's unpaid bills, equipment failure, expired permissions, or a company policy block.
A batch of authorization issues that left you disconnected or crashed are fixed. The CLI (command-line interface) used to crash from running out of memory if it inherited a stale websocket/OAuth file-descriptor (file-descriptor, the number a program uses to access a file or connection) environment variable from its parent process (the program that launched it); it survives now. Claude in Chrome (the browser edition) used to silently fail to connect when the OAuth token belonged to a different account than the Claude Code login; it handles that properly now. claude agents workers (the child processes that do the work) used to fail with "401 Invalid bearer token" when the daemon (a program that stays resident in the background) had been started from a shell with a custom API gateway (API gateway, a self-hosted API endpoint) via ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN; that's fixed. Also, compaction (the feature that summarizes and shrinks old conversation) used to ignore --fallback-model (a fallback model, the lesser model it falls back to when the main one is swamped); it now follows the configured fallback chain on overload or model-availability errors. And when credentials (the keys proving you're a legitimate user) were refreshed outside the session, the app used to keep failing with auth errors due to a stale cached request config; it updates now. Like a company where one employee's expired badge used to crash the whole floor's systems, a misaddressed delivery was silently dumped, and the backup-staff system existed in name only — now an expired badge can't take the system down, packages are only accepted at the right address, and backups actually show up to work.
This batch fixes a pile of issues around viewing subagents, background tasks, and environment config. Viewing a subagent's (an agent Claude splits off for small chores) transcript (the verbatim full conversation) now shows tool results and live progress; messages you sent while it was still finishing its turn used to get dropped, and now they're kept; and backgrounding a running subagent with ctrl+b used to restart it from scratch, and now it keeps going as-is. Background sessions created with /bg or ←← after a turn used to read "Working" forever in the agents list; their status updates now. On Linux, the sandbox (the mechanism that traps a program in a restricted zone) used to fail to start when .claude/skills or .claude/hooks was a symlink (a file pointing elsewhere, like a shortcut); it starts fine now. The environment variable CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1 (a switch to preserve the plugin marketplace on failure) used to actually block fresh marketplace installs from cloning; that's fixed. And MCP server-level rules (mcp__server, mcp__server__*, mcp__*) written in a subagent's disallowedTools (the forbidden-tools list) used to be silently ignored — as if you'd never set them — and now they take effect. Like a department where delegated progress used to be invisible, shelved projects glowed "in progress" forever, and certain badges and procurement settings were dead letters; now progress is transparent, status is honest, and the rules actually stick.
Three small keyboard-related bugs are fixed. In vim mode (vim, an editor style built around not touching the mouse), pressing u to undo (undo, retracting a just-made action) used to merge several consecutive actions into a single undo — so one press wiped out a whole chunk; it now steps back one NORMAL/VISUAL-mode command at a time. In the claude agents view, statusline (statusline, the row showing status at the bottom) links using a custom URI scheme (a self-defined web-address protocol like vscode://) used to do nothing when clicked; they open now. And in the VSCode extension, pressing Esc to dismiss a CJK IME (CJK IME, the little candidate window that pops up when typing Chinese/Japanese/Korean) candidate window used to also cancel the Claude task currently running; it no longer does. Like a typewriter whose backspace key used to gobble a whole sentence at once, a sticky-note link on your desk that wouldn't peel off, and dismissing an input-method reminder accidentally canceling a document mid-print — now backspace eats one character, the note peels, and dismissing the reminder leaves the print job alone.
Agent teams: removed the `TeamCreate` and `TeamDelete` tools. With `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` set, every session now has one implicit team — spawn teammates directly with the Agent tool's `name` parameter, no setup step needed. The `team_name` parameter on the Agent tool is still accepted but ignored.Added `Tool(param:value)` syntax for permission rules to match a tool's input parameters (with `*` wildcard), e.g. `Agent(model:opus)` to block Opus subagents
Improved auto mode: subagent spawns are now evaluated by the classifier before launch, closing a gap where a subagent could request a blocked action without reviewSkills in nested `.claude/skills` directories now load when working on files there; on a name clash, the nested skill appears as `<dir>:<name>` so both stay available
Nested `.claude/` directories: the agent, workflow, and output-style closest to the working directory now wins when names collide; project-scope workflow saves now target the closest existing `.claude/workflows/`
Fixed nested `.claude/skills` skills with directory-qualified names being blocked by permission prompts in non-interactive runsImproved `/doctor` with consistent flat tree layout across all sections, clearer section status icons, and highlighted command names
Improved the skill listing truncation warning to show how many skill descriptions are affected
Changed the workflow prompt keyword to use a purple shimmer highlight and trigger only on explicit phrases like "run a workflow" or "workflow:", not on any mention of the word
`/bug` now requires a description before submitting, and no longer uses model-refusal text as the GitHub issue titleImproved Remote Control error messages: connection failures now show a persistent red "/rc failed" indicator in the footer, and the "not yet enabled" error now explains whether it's a gate, a check failure, stale entitlement, or org policyFixed a crash (out-of-memory) when the CLI inherits a stale websocket/OAuth file-descriptor environment variable from a parent process
Fixed Claude in Chrome silently failing to connect when the OAuth token belongs to a different account than the Claude Code login
Fixed `claude agents` workers failing with `401 Invalid bearer token` when the daemon was started from a shell with a custom API gateway via `ANTHROPIC_BASE_URL` and `ANTHROPIC_AUTH_TOKEN`
Fixed compaction not honoring `--fallback-model`: compaction now falls back to the configured fallback model chain on overload or model-availability errors
Fixed model requests continuing to fail with auth errors after credentials were refreshed outside the session, due to a stale cached request configurationFixed several subagent issues: viewing a subagent's transcript now shows tool results and live progress, messages sent while it finishes its turn are no longer dropped, and backgrounding a running subagent (ctrl+b) no longer restarts it from scratch
Fixed background sessions created with `/bg` or `←←` after a turn finished showing "Working" forever in the agents list
Fixed Linux sandbox failing to start when `.claude/skills` or `.claude/hooks` is a symlink
Fixed `CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE=1` preventing fresh marketplace installs from cloning
Fixed MCP server-level specs (`mcp__server`, `mcp__server__*`, `mcp__*`) in subagent `disallowedTools` being silently ignoredFixed vim mode undo: `u` now steps through NORMAL/VISUAL-mode commands one at a time instead of merging commands in quick succession into a single undo step
Fixed statusline links with custom URI schemes (e.g. `vscode://`) not opening when clicked in `claude agents`
[VSCode] Fixed pressing Esc to dismiss a CJK IME candidate window canceling the running Claude task