Release notes

BUGFIX

Terminal stops lagging and transcripts stop jumping on long responses

When Claude spits out massive tables or code blocks, typing and scrolling will now stay buttery smooth. Previously, streaming (responses appearing word by word as they generate) very long lists or paragraphs would freeze the terminal, and when the answer finished, the screen would inexplicably jump back to the top; these display glitches are now fixed. Like a news ticker at the bottom of a TV screen — it used to stutter or reset when the headline was too long, but now it scrolls steadily no matter how much text you feed it.

FEATURE

Auto mode is open to all platforms, and its settings no longer roam with the project

Auto mode (the mode where Claude acts without asking you step by step) has always been there, but now it's available by default on Bedrock, Vertex AI, and Foundry (channels where enterprises rent Claude through cloud services like AWS or Google Cloud). Previously, you had to manually set an environment variable (a hidden switch stuffed into the program before it opens, which regular users never see) to enable it. Meanwhile, this toggle now only reads from the global settings file that follows you across all projects, and no longer reads from project-level settings that follow the folder (where someone else's project might hide a copy), ensuring the mode doesn't accidentally turn on just because you switched repositories. It's like a security robot that always knew how to patrol, but now comes with the feature enabled out of the box, and takes orders solely from your master remote, refusing to change behaviors just because it walked into a different warehouse.

BUGFIX

AWS connections speed up, models upgrade, and Windows stops hanging forever

For people using Bedrock, Vertex, or the Claude Platform on AWS, the system now defaults to the latest Opus 4.8 model, and it no longer frantically begs IAM Identity Center for fresh credentials (the keys proving you're a valid user) on every single API request, speeding things up significantly. For Windows users, if AWS credential fetching stalls (like a stuck background process), the app now bails out after 60 seconds instead of hanging indefinitely. It's like visiting a theme park: you used to have to show your ID at every single ride, and if the scanner broke, you just stood there forever; now one ticket covers the whole park, and if a scanner hangs for a minute, a worker waves you through.

FEATURE

Agent views and Deep Research are much more readable, skipping blank screens and forgotten names

The agent task list is a lot smarter about what it shows you. Pasting the exact same text a second time now just expands the existing folded placeholder instead of printing a redundant duplicate; tasks blocked waiting for you now prioritize the question holding them up and display a friendly "waiting 3m" clock instead of two robotic timestamps. Deep research (the feature where Claude heavily crawls the web for information) also now explicitly badges which website hostname it is reading, instead of tagging everything "unknown". Furthermore, background sessions won't forget the name they got from a plan, and reopening sessions that entered a git worktree (a Git feature that gives one project several parallel working copies) will no longer pop up completely blank. Like a hospital waiting room display upgrading from cryptic "Patient Unknown, 14:00" codes to "John Doe, Room 3, waiting 5 mins," making everything instantly readable.

BUGFIX

Remote Control stays solid, and agent teams survive toxic messages

Agent teams that collaborate on tasks are much more robust. Previously, a single malformed message ending up in a teammate's mailbox (the file agents use to pass notes to each other) would throw the entire team into a catastrophic crash loop, tossing an error every second until you manually deleted the file; they now know how to shrug it off and keep working. For Remote Control users, task status updates no longer drop into the void when your network hiccups or your credentials (the keys proving you're a valid user) refresh, and mobile/web clients now correctly mirror the background agent and workflow progress hosted on your desktop app. It's like a bustling office that used to freeze completely if it received a single unreadable fax — now they just toss it in the bin and keep working, while the boss traveling abroad can still perfectly see the progress whiteboard back at headquarters.

BUGFIX

Plugin settings are battened down to stop sneaky injections and auto-consents

We've battened down the security hatches for plugins (add-ons that extend Claude's capabilities). Previously, if plugin configs lived in a project folder, a malicious repository could use variable syntax to sneak nasty commands straight into your terminal (a shell injection attack); this syntax is now completely rejected, and plugin settings are no longer read from project-level files at all, only user, --settings, and managed settings are honored. Furthermore, non-interactive runs (like SDKs that run without prompting the user) will no longer silently record you as "consented" to security policies without actually showing you the dialog. Like a corporate security gate that used to occasionally accept a visitor's home-printed badge or let back-door VIPs bypass the sign-in sheet; now it strictly honors only HQ-issued cards, and everyone signs the book.

BUGFIX

Clearing out Git residue and stopping oversensitive command prompts

Your other Git tools and everyday commands no longer trip over a setting Claude Code left behind. When you completely removed your last worktree (a Git feature that gives one project several parallel working copies), a stray line of configuration used to be left behind in your Git config, breaking other third-party Git tools; it now sweeps up after itself. Also, when parsing malformed brackets in ignore files (lists telling the system which files to skip) or path rules, or dealing with commands that just harmlessly piped output into the /dev/null void, the system used to panic, break file reads, or stop everything to ask for permission. Now it accurately assesses these safe scenarios. Like a moving crew that used to leave glue residue on the walls ruining the next tenant's paint job, or a security guard who jumped out to ask for ID just because you tossed a crumpled napkin into the trash can — they now leave the place spotless and let you throw away garbage in peace.

BUGFIX

Safe top-ups, preserved custom launchers, and no more false alarms

A few startling system behaviors have been smoothed out. If you accidentally pasted a timestamp while topping up your credits, the system used to blindly strip it down to digits and charge some random amount; it now halts with an error, and any amount over $1,000 requires you to explicitly type a confirmation to save your wallet from a catastrophic slip. If you customized the launcher script that opens Claude, the auto-updater will stop rudely overwriting it on every release. Also, totally normal internal system chat updates will no longer falsely trigger the "prompt injection attack" alarms. It's like going to an ATM: mashing the keypad won't randomly withdraw a weird amount of cash, the bank's software update won't erase the custom PIN shortcuts you set up, and the burglar alarm stops screaming every time a bank teller legitimately refills the money tray.

Original changelog

Original changelogTerminal stops lagging and transcripts stop jumping on long responses
Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks
Fixed the transcript jumping above the start of the answer when a response finishes streaming (2.1.207)
Original changelogAuto mode is open to all platforms, and its settings no longer roam with the project
Auto mode is now available without `CLAUDE_CODE_ENABLE_AUTO_MODE` opt-in on Bedrock, Vertex AI, and Foundry; disable via `disableAutoMode` in settings
Changed auto mode to no longer read `autoMode` from `.claude/settings.local.json` (repo-resident); use `~/.claude/settings.json` instead (2.1.207)
Original changelogAWS connections speed up, models upgrade, and Windows stops hanging forever
Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request
Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8
Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck `credential_process`): the 60-second stall guard now fires instead of waiting forever. (2.1.207)
Original changelogAgent views and Deep Research are much more readable, skipping blank screens and forgotten names
Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row
Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list
Fixed Deep research runs labeling every Fetch-phase agent "unknown" — chips now show the source hostname
Improved agent view: pasting the same text again now expands the collapsed `[Pasted text #N]` placeholder instead of adding a second one
Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (`waiting 3m`) instead of the same timestamp twice (2.1.207)
Original changelogRemote Control stays solid, and agent teams survive toxic messages
Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted
Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh
Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web (2.1.207)
Original changelogPlugin settings are battened down to stop sneaky injections and auto-consents
Fixed remote managed settings from a non-interactive run (`claude -p`, the SDK) being permanently recorded as consented without ever showing the security consent dialog
Plugin hooks/monitors/MCP headersHelper: `${user_config.*}` in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (`args` array) or `$CLAUDE_PLUGIN_OPTION_<KEY>`; monitors and headersHelper: read the value inside the script (config file or the server's `env` block).
Plugin option values (`pluginConfigs`) are no longer read from project-level `.claude/settings.json`; only user, `--settings`, and managed settings are honored (2.1.207)
Original changelogClearing out Git residue and stopping oversensitive command prompts
Fixed compound commands with `cd` prompting for permission when the only output redirect was to `/dev/null`
Fixed `extensions.worktreeConfig` being left in the repo's `.git/config` (breaking go-git tools like `tea`) after the last `worktree.sparsePaths` worktree was removed
Fixed malformed bracket patterns in rules globs, skill paths, `.ignore`, and `.worktreeinclude` breaking file reads, file suggestions, and worktree creation (2.1.207)
Original changelogSafe top-ups, preserved custom launchers, and no more false alarms
Fixed the auto-updater overwriting a custom launcher script or symlink at `~/.local/bin/claude` on every release; `/doctor` now reports an externally managed launcher
Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates
Fixed `/usage-credits` amount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation (2.1.207)