Release notes
When you're watching the terminal (the black screen where you type commands) wait for long-running tasks, you no longer have to stare at a frozen screen, and switching between tasks is much more stable. Previously, when it ran a time-consuming tool command behind the scenes, the progress bar looked stuck; now the tool summary line features a live, ticking elapsed-time counter so you know it's still working. Meanwhile, the footer hint at the bottom of your agent list (agents are AI assistants that do work for you) clearly shows how many background sessions (tasks running silently behind the main screen) are waiting for your reply, briefly flashing with color when the count changes. Also, pressing the left arrow (←) to open the agents view and then returning to the original session won't cause the task tracker to vanish or leave overlapping ghost frames on your screen anymore. Furthermore, the claude attach command (used to reconnect to a background session) now patiently waits for the system to settle before connecting, instead of impatiently throwing a "job not found" error. For screen reader users, pressing Shift+Tab to cycle through permission modes now announces the new mode aloud. It's like taking a number at a bank: you used to stare at a frozen digital display wondering if the machine broke, but now the screen ticks the seconds clearly, flashes when it's your turn, and even if you step away to another counter and come back, your place in line is still securely on the board.
When you delete tasks or paste text, the system will no longer quietly leave behind annoying residues. Previously, if you force-killed a background session, it might leave a permanent git worktree lock (an administrative lock preventing other processes from concurrently using the same worktree) in your version control system, completely blocking your Git commands forever; now, the system regularly sweeps the area to release locks whose owning processes have died. Also, when you paste text from Claude into an external editor, it won't inexplicably come attached with weird garbage characters like È or É anymore. If a plugin fails to write to its cache (a place for temporary data), it will no longer leave behind useless temporary files, and a tricky locked-file rename error that plagued Windows users has been fixed. Visually, images pasted into abandoned reply drafts won't stubbornly haunt your agents dashboard after the session is deleted; and when you approve a plan without making any changes, the system won't falsely brand it "(edited by user)" or overwrite your plan file with a stale snapshot. It's like checking out of a hotel: a previous guest might have left the safe locked or left stubborn tape residue on the walls, but now the housekeeping staff unlocks the safe and scrubs the glue away, ensuring the room is completely spotless for the next guest.
Claude's brain for tracking execution states has gotten sharper, so it won't misjudge command results or quietly ignore data anymore. Previously, if it issued a change directory (cd) command that took too long and got shunted to the background, it would hallucinate that it was already inside the new folder; the system now explicitly tells it that the working directory is unchanged. Similarly, when a terminal command times out and is auto-backgrounded, the message given to the AI is much clearer, helping it distinguish whether the command is hopelessly hung or merely running in the background. Moreover, if your custom skills or commands use positional placeholders (like $1 or $2), the system used to treat them as garbage and silently devour them; they are now preserved exactly as written. When writing to the memory file (MEMORY.md, Claude's notebook for remembering important things) pushes the index past its read limit, it used to quietly truncate the overflowing parts leaving you thinking everything was saved; now it throws a loud, explicit error to force a cleanup. Even Grep (the tool for searching inside files) will no longer foolishly claim "No matches found" when you simply paginate past the end of the results. Also, when a hook (a script triggered by specific events) times out, it won't be falsely reported as a user rejection that freezes unattended sessions, and the bundled data visualization skill now uses scientifically calibrated color codes that are much friendlier to colorblind users. It's like sending an assistant to the library: previously, if you called him back because he took too long, he'd hallucinate that he had already checked the books out, or if his notebook was full he'd just rip up the remaining pages; now, he honestly reports he hasn't gotten the books yet, and the moment his notebook fills up, he immediately raises his hand to ask for a new one.
The subagents you spawn are now much better behaved, saving you from worrying about them going rogue, and the defensive net against external malicious content is thicker. Previously, when you configured an agent to work isolated inside its own worktree (a feature acting like a parallel universe copy of your project), it could somehow still reach out and run git-mutating commands on your main repository checkout; it's now strictly confined to playing in its own sandbox and cannot touch the main codebase. We've also hardened the agent's immune system to prevent it from being manipulated by indirect prompt injection (a trick where hackers hide sneaky commands inside articles to trick the AI) when it reads web pages or files. Additionally, the ultracode keyword used to opt into higher-effort processing used to accidentally trigger if a webhook payload or a GitHub comment merely mentioned the word; it now only activates when explicitly typed by a human. The bug where specifying --effort ultracode in terminal commands was silently ignored has also been fixed. For developers, plugin-provided MCP servers (bridges that let AI connect to external tools) will no longer be unfairly torn down if they resync mid-session; and SDK MCP servers registered via an initialize request won't foolishly wait until the next turn to start connecting. Also, the Fable advisor model has been temporarily removed from the picker while a server-side issue is being patched. It's like hiring temporary workers to help out: previously, they might accidentally wander into the CEO's office to alter documents or blindly follow instructions found on a scrap of paper in the street; now, they are assigned dedicated, locked workspaces and have been given anti-fraud training so they only listen to your direct orders.
You no longer have to worry about misconfigurations or unstable connections crashing the entire program. Now, if you mistakenly use permission rules like Write, NotebookEdit, or Glob in your configuration file, a warning will be issued right at startup, suggesting you use the more precise Edit or Read rules instead. For those using enterprise cloud channels (like Bedrock or Vertex) where auto mode is now enabled by default, the /doctor command (a diagnostic tool that checks your system health) will no longer redundantly suggest you opt-in; meanwhile, the permission classifier for external sessions has been upgraded by default to the smarter Sonnet 5 model to stand guard. On the security front, late-appearing symlinks (hidden shortcut links) will now be properly blocked by the sandbox to ensure they are properly reconciled into the sandbox deny-write list. We've also fixed three startling crash scenarios: one where a tool returning a plain number that the system couldn't parse caused a session crash; another where a stray text fragment accidentally leaked into crash telemetry reports when a UI component errored out; and a final one where a client resetting its connection threw background workers into an infinite crash-loop of death. It's like a car equipped with a next-gen safety system: previously, if you put the wrong gas in or a fuse blew, it would just break down in the middle of the highway; now, it flashes a warning light on the dashboard before you even start the engine, and even if the GPS suddenly disconnects, it keeps driving steadily in the background without spinning out of control.
Original changelog
Original changelogInterface stays smooth and tasks don't get lost
Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck
Fixed `claude attach` sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes
Fixed pressing ← to open the agents view dropping the task tracker when returning to the session
Fixed returning to the agents view from a session leaving overlapping ghost frames with `CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1`
Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab
The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes
Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection
Original changelogClosing tasks leaves no trash, and copy-pasting is much cleaner
Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text
Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems
Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted
Fixed killed background sessions leaving a permanent `git worktree lock` behind; the periodic sweep now releases locks whose owning process is gone
Original changelogAI no longer hallucinates command results, improving file reading and logging
Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait
Fixed Claude assuming a `cd` took effect after its command was moved to the background; the tool result now states the working directory is unchanged
Fixed Grep content mode claiming "No matches found" when paginating past the end of results
Fixed unmatched `$1`/`$2` positional placeholders in skills and commands being silently stripped; they are now preserved verbatim
Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request
Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds
Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation
Original changelogSubagents stay in bounds with hardened security and robust connections
Fixed `isolation: 'worktree'` subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree
Fixed the `ultracode` keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
Fixed `claude agents --effort ultracode` not reaching dispatched sessions; the value was silently dropped
Fixed SDK MCP servers registered via an `initialize` control request waiting until the next turn to start connecting
Hardened the Agent tool against indirect prompt injection via content a subagent read
Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed
Original changelogSmarter startup checks drastically reduce crashes and config conflicts
Added a startup warning for `Write(path)`, `NotebookEdit(path)`, and `Glob(path)` permission rules — use `Edit(path)` or `Read(path)` instead
Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element
Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element
Fixed `/doctor` skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in
Fixed background workers crash-looping when a client resets its connection to the background service
Fixed late-appearing `.claude/*` symlinks not being reconciled into the sandbox deny-write list
Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session