發布日期：2026-07-18
你叫 Claude 改檔、跑終端機時，最怕它把看似無害的指令當成安全通行證。這次把權限檢查補成像大樓門禁：dir/** 不會再誤認整棟樓任何同名資料夾都能寫入；PowerShell、Bash 的重新導向、超長指令、zsh 比較式；help、man 的危險用法，以及使用 -m／--magic-file 或 -f／--files-from 的 file 指令，都會在有風險時停下來問你。Docker 或 Podman 若改連別台 daemon（背景服務程式）也得先確認。遠端工作階段更不會在你本機按同意前搶跑。原本該只限目前資料夾的 hook 規則，也不再意外套到更深處。
遇到持續辱罵或越獄（jailbreak，誘導 AI 逃避安全規則）的對話，Claude 現在可以主動結束工作階段，不必被困在拉扯裡。另一頭，長時間工具呼叫會定期送出進度心跳，讓你知道它還活著。幾個容易讓工作半途斷線的問題也補好了：feature flag（功能開關）的空值或壞資料不再讓程式崩潰或清空快取；設定檔指到裝置檔可能造成記憶體持續增加；超過 2 MiB 的設定檔則會在啟動時清楚拒絕；公司 proxy（代理伺服器）、慢速 SDK 管線、排程任務、Linux 的 pkill -f，以及 shell 設定路徑誤填成資料夾，都不再把工作悄悄弄壞。顧問思考時也不會誤跳網路警告，從家目錄執行 claude rc 則會說清楚信任設定不會被保存。像客服櫃台能請搗亂者離開，後台也會定時亮燈報平安。
當你想查「這則訊息到底叫了哪個工具、花了多少資源」，紀錄不該像散落的收據。memory 檔案（讓 Claude 留下跨工作階段筆記的檔案）現在有 ISO modified 時間戳；OpenTelemetry（把程式執行紀錄送進監控工具的標準）則替每則訊息加上 UUID、請求編號和工具來源，也可設定內容欄位原本 60 KB 的截斷上限。自訂 agent 列表能顯示模型與 reasoning effort（推理投入程度）。串流重複送出的累積訊息不會再把成本和 token（模型處理文字的計量單位）重複算，非同步紀錄也會帶上正確追蹤脈絡。最後，memory 裡行內 # 不會再害後面內容被截掉。像把每張收據編號、蓋章、釘回同一份帳本。
你在 Windows 用 PowerShell 跑工具，子程序等著標準輸入時，過去可能一路卡到逾時；現在能正常收尾。Python 讀到非 UTF-8 資料，或輸出非 ASCII 字元，也不會因編碼錯誤崩掉；PowerShell 7 的錯誤訊息不再夾著 ANSI escape sequence（控制終端機顏色等格式的隱藏碼）。where.exe、fc.exe 和 diff.exe 回報「沒找到差異」這類正常否定答案，也不會被誤報成錯誤。最後，Windows PowerShell 5.1 的 >、>> 會寫出其他工具讀得懂的 UTF-8，而非 UTF-16LE。像同一條傳送帶終於統一箱子標籤，既不塞車也不讀錯字。
把工作放到 background 工作階段（背景執行，不佔著你眼前終端機）後，最煩的是它明明停了卻還佔著資源，或想清掉卻找不到。這版修了整條收尾流程：舊 daemon（背景常駐程式）退場時不會刪掉接班者的 control socket（用來溝通的本機通道）；用 ← 或 /background 暫停的工作不會無限養著 worker；服務閒置、從非 Git 資料夾送出、或重新開啟時遇到不可讀目錄，都不會讓刪除或還原對話失敗。像夜班交接不再把新值班員的鑰匙丟掉，完成的工作階段也能確實清掉。
你在手機或網頁看 Remote Control（遠端控制，從別台裝置查看 Claude 工作）時，不會再收到根本沒開啟功能的「session ready」通知。agent view（代理工作清單畫面）裡的 /install-github-app 和 /mcp 設定選單，也不會一律被封鎖；只有沒有連接終端機的背景工作階段才會被拒絕。透過 --settings 啟用的 plugin（外掛，擴充 Claude 功能的元件）會正常載入，OAuth token（登入用的授權令牌）輪替後，久開工作階段的功能開關也會刷新。像遙控器只對真正配對的設備響應，設定選單只有在背景工作階段沒有連接終端機時才會鎖住。
當你更新 MCP（讓 Claude 連接外部工具的協定）的提示與資源時，偶發錯誤不再把伺服器現有的斜線指令和資源清空，像工具箱短暫斷電，裡面的工具仍留在原位。hooks（特定事件發生時自動執行的指令）傳回 exit code 2 而 stdout JSON 未通過 schema validation（檢查資料格式是否合規）時，現在仍會如文件所說阻擋。/ultrareview 在沒有 merge base（兩條 Git 分支共同起點）的 Git repository 裡，不再拒絕執行，會提供審查所有 tracked files（Git 正在追蹤的檔案）。若 keep-alive connection pooling（重複使用連線的方式）遇到 stale-connection error，之後會停用它，重試改開新 socket（網路連線通道）。
When Claude edits files or runs terminal commands, lookalike commands should not get a free pass. Permission checks now treat dir/**, PowerShell, Bash redirects, very long commands, zsh comparisons, risky uses of help and man, and file commands using -m/--magic-file or -f/--files-from more cautiously. Docker or Podman commands aimed at another daemon also ask first, and remote sessions wait for local confirmation. Think of it as fixing badge readers that once mistook a hallway sign for building-wide access.
Claude can now end a session with persistently abusive users or jailbreak attempts, while long tool calls send periodic heartbeats so they no longer look dead. Several quiet failure paths are fixed too: bad feature flags, settings files pointing to device files that could cause unbounded memory growth, oversized settings files that now fail clearly at startup when over 2 MiB, corporate proxies, slow SDK consumers, scheduled tasks, Linux pkill -f, and shell-config paths that are directories. The advisor no longer raises a false network warning while thinking, and claude rc explains why trust cannot persist in the home directory. It is like a help desk that can end an abusive call while its back room keeps a status light on.
Tracing one job should not mean sorting scattered receipts. Memory files now carry an ISO modified timestamp, while OpenTelemetry events get message IDs, request IDs, and tool provenance, with a configurable 60 KB content limit. Custom agent rows can show model and reasoning effort; streaming telemetry no longer double-counts costs or tokens, and async logs retain trace context. Inline # no longer chops off saved memory values. It is a ledger where every receipt is numbered and filed together.
On Windows, PowerShell commands no longer wait until timeout when a child process needs standard input. Python now survives non-UTF-8 input and non-ASCII output, PowerShell 7 errors lose their raw terminal control codes, and valid “not found” answers from where.exe, fc.exe, and diff.exe are not treated as failures. PowerShell 5.1 redirects now write UTF-8 instead of UTF-16LE. It is one conveyor belt with labels every tool can read.
Background work should not keep a desk forever or become impossible to remove. A departing daemon no longer deletes its successor’s control socket; parked jobs no longer keep workers alive indefinitely; and deletion or restore no longer breaks because the service is idle, work came from outside Git, or the session store has an unreadable folder. Like a night shift that hands over the right keys, every finished session can be removed cleanly.
Remote Control no longer sends “session ready” notifications for sessions where you never enabled it. In agent view, /install-github-app and /mcp settings are available unless a background session has no terminal attached. Plugins enabled with --settings load again, and long-running sessions refresh feature flags after an OAuth token rotates. It is a remote control that responds only to paired devices, with settings blocked only when a background session has no terminal attached.
A transient error while refreshing MCP prompts and resources no longer clears a server's existing slash commands and resources, like a brief power flicker that leaves tools in their box. Hooks returning exit code 2 still block as documented when their stdout JSON fails schema validation. /ultrareview no longer refuses to run in a Git repository with no merge base: it offers to review all tracked files. After a stale-connection error, keep-alive connection pooling is disabled so retries open a fresh socket.
Fixed single-segment `dir/**` allow rules like `Edit(src/**)` auto-approving writes to nested `dir/` directories anywhere in the tree instead of only `<cwd>/dir`
Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically
Fixed Bash permission checks treating zsh variable subscripts and modifiers in `[[ ]]` comparisons as inert text — these commands now prompt for approval
Fixed Bash permission checks to no longer auto-approve certain `help` and `man` commands that could run unsafe options, command substitutions, or backslash paths
Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
Added permission prompts for `docker` commands (including the Podman `docker` shim) carrying daemon-redirect flags (`--url`, `--connection`, `--identity`, and Podman's remote mode) that previously ran without one
Changed single-segment `dir/**` hook `if:` conditions to match only `<cwd>/dir`; write `**/dir/**` for any-depth matching. `deny`/`ask` permission rules keep their any-depth match.
Changed `file` commands using `-m`/`--magic-file` or `-f`/`--files-from` to require permission instead of being auto-allowed as read-onlyAdded the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations
Added a periodic progress heartbeat for long-running tool calls that previously went silent
Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags
Fixed Bash tool killing the Claude session when a `pkill -f` pattern accidentally matched the CLI's own process (Linux)
Fixed unbounded memory growth when `--settings` points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear error
Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows
Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap
Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task
Fixed `claude update` and `claude doctor` hanging silently, and the `/status` System diagnostics section going blank, when a shell-config path is a directory
Fixed a spurious "check your network" warning that appeared while the advisor was thinking
Improved the `claude rc` workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directoryAdded an ISO `modified` timestamp to memory file frontmatter
Added `message.uuid`, `client_request_id`, and `tool_source` attributes to OpenTelemetry log events for message-level correlation and tool provenance
Added `CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH` to configure the 60 KB truncation limit on OpenTelemetry content attributes
Added reasoning effort to the `subagentStatusLine` payload, so custom agent rows can render model and effort
Fixed memory frontmatter values being silently truncated at an inline `#` when memory files are saved
Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative `message_delta` frames
Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace contextFixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)
Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)
Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)
Fixed the PowerShell tool reporting `where.exe`, `fc.exe`, and `diff.exe` as errors when they return a valid negative answer (Windows)
Fixed `>` and `>>` under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon
Fixed background sessions parked with `←` or `/background` and left idle keeping the background daemon and a worker process alive indefinitely
Fixed completed background sessions being impossible to remove via `claude rm` or the agent view once the background service had gone idle
Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view
Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session storeFixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled
Fixed `/install-github-app` and the `/mcp` settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached
Fixed plugins enabled via the `--settings` CLI flag not loading (regression since v2.1.181)
Fixed feature flags going stale in long-running sessions after the OAuth token rotates
Changed SessionStart hooks to report source `"fork"` when a session begins as a fork instead of `"resume"`Fixed `/ultrareview` refusing to run in repos with no merge base — it now offers to review all tracked files
Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation
Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources
Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket