Release notes
If a company tool must read files on the computer but cannot freely connect to the internet, there is now a middle gate.
Open the settings file—use ~/.claude/settings.json to manage all your projects, or .claude/settings.json to manage only this project.
If the file is empty, paste in this entire switch:
{"sandbox": {"filesystem": {"disabled": true}}}
If the file already has settings, for example:
{
"model": "sonnet"
}
change it to this:
{
"model": "sonnet",
"sandbox": {"filesystem": {"disabled": true}}
}
You only make two changes:
1. Add a comma , to the end of the original last line ("model": "sonnet")
2. Paste the sandbox line below it
The comma means “another item follows,” like the comma between Alice and Bob in a list.
This turns off filesystem isolation (the safeguard that limits which files a program can see) while keeping network egress controls. It is like an office opening the file room for designated colleagues while guards still watch every exit; it does not tear down the entire sandbox (the protected environment that limits a program's range of activity).
A long-running chat used to get slower the longer it went: each new turn made message cleanup grow disproportionately, producing multi-second stalls and slow resumes. That quadratic buildup is fixed. /context now explicitly warns when the conversation exceeds its context window (how much of a conversation the AI can hold at once), and a failed /compact clearly appears as an error. It is like a desk where every added sheet once meant rereading a larger pile from the start; now sorting stays smoother, and an overfilled drawer shows a warning instead of pretending nothing is wrong.
If you answer “wait” or “explain first,” Claude will no longer hear it as “continue”: free-text AskUserQuestion replies now use neutral wording. When an OAuth token (a temporary pass proving your sign-in) expires or rotates mid-session, auto mode will not misclassify it as HTTP 401 and deny commands. The web app also stops asking the same question again after a few idle minutes and losing your answer. If a cloud session’s container restarts mid-turn, that interrupted turn reruns on resume rather than leaving the session unresponsive. Like a support desk, it now reads, keeps, and acts on your message without making you repeat it.
After modifying files, @-mentions, Vim’s repeated c operations, and pasted text no longer silently attach nothing. On resume, the statusline (the line of status at the bottom of your terminal) does not run twice, and a failed resume picker no longer hangs. In long-running work with background tasks, pressing Esc twice at an idle prompt still opens /rewind. Opening a GUI editor from /memory, /plan, /keybindings, or Ctrl+G no longer sprays mouse and focus control junk into the terminal, and /memory no longer waits for that editor to close. Think of a repaired desk: clips hold paper, drawers do not jam, and an open notebook beside it does not spill ink everywhere.
When Claude runs jobs in the background or splits work into a worktree (Git’s way to make parallel copies of one project), the isolation now holds. A resumed background agent gets back its original prompt and tool restrictions rather than reverting to the default agent, and a high-priority message during its startup window no longer cancels it. An isolated subagent cannot redirect Git into the shared checkout through git -C, --git-dir, or environment variables; a mismatched working directory also will not land in another project’s leftover worktree. Non-Git background worktrees can be deleted, Ctrl+X twice deletes a session, and a dead worker cannot resurrect it. Like a film set, each crew keeps its own stage, script, and equipment.
A seemingly ordinary .claude shortcut inside a project can no longer redirect workflow saves or scheduled-task writes outside that project. /rewind also will not restore or delete tracked files through symbolic or hard links, and reports how many paths it skipped. On Windows, read-only commands that access network paths now ask permission. Bash now splits non-ASCII text closer to real shell word boundaries; PowerShell validates commands with invisible Unicode characters; and permission checks no longer miss redirects inside && lists or negations. It is like security checking not only the door label but hidden passages and disguised notes in the hallway — every route outside gets your approval first.
If no client is attached to a background session, /mcp and /install-github-app no longer fail silently; they park a “needs input” request in the agent view. During MCP reauthentication (Model Context Protocol, the protocol that lets AI connect to external tools), working credentials are not revoked until the new sign-in succeeds, and its background reconnect message points to a usable command. Claude-in-Chrome no longer loops on 403 reconnects when an OAuth token lacks a required scope. Finally, claude daemon stop --any will not kill an unrelated process because of a stale legacy lockfile. Like a receptionist, it keeps the old access card until the new one works and leaves your note where you can see it.
Fullscreen dialogs no longer spill past the right panel, and /config keyboard hints plus the Ctrl+O footer on terminals narrower than 104 columns no longer get clipped. Skills and commands changed during a session appear in the slash menu without restart, and plugin skills keep their prefix even with a name field. Prometheus metrics (the numeric format used by monitoring systems) no longer emit invalid # UNIT lines; VSCode renders mixed Arabic, Hebrew, or Persian with English or code in the right order. /fork, ultrareview, empty diffs, and rejected spend-limit changes now give the name, limits, sizes, relevant files, base ref, or server reason you need. Like an airport board, it no longer cuts off the useful part of the message.
Telemetry (records sent back about product use) now separates permission events correctly: a request whose permission prompt failed no longer counts as your rejection, while an interruption you make is reported as a user abort. Validation of git and gh arguments in PowerShell is also stronger. The bundled dataviz skill (guidance for data visualization) reorders its default chart palette and corrects advice that suggested direct labels for four series. Like a support report, it now keeps “counter failed,” “customer left,” and “customer refused” in separate columns instead of blaming you for every one.
Original changelog
Original changelogKeep network controls while disabling file isolation
Added `sandbox.filesystem.disabled` setting to skip filesystem isolation while keeping network egress control
Original changelogLong chats run faster and tell you when context is full
Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
`/context` now shows an explicit warning when the conversation exceeds the context window, and a failed `/compact` displays as an error
Original changelogExpired sign-ins, questions, and web resumes stop losing your answer
Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording
Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes
Fixed cloud sessions dropping the in-flight message when the session's container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive
Original changelogEditing, resuming, and terminal controls lose a chain of small failures
Fixed @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of `c`-operators and paste, statusline running twice on resume, and resume-picker hangs on failure
Fixed Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks
Fixed mouse and focus garbage in the terminal while a GUI editor from `/memory`, `/plan`, `/keybindings`, or Ctrl+G is open; `/memory` no longer waits for the editor to close
Original changelogBackground agents and worktrees stop wandering into the wrong set
Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored
Fixed worktree-isolated subagents redirecting git into the shared checkout via `git -C`, `--git-dir`, or `GIT_DIR`/`GIT_WORK_TREE`
Fixed worktree sessions landing in another project's leftover worktree when the working directory did not match the selected project
Fixed background sessions whose worktree has no git repository being undeletable
Fixed pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died
Fixed background subagents getting cancelled when a high-priority message arrives during their startup window
Original changelogLinks, permissions, and command parsing get tighter safety boundaries
Fixed Bash command permission checking for compound statements with redirects inside `&&` lists or negations
Fixed workflow saves and scheduled-task writes following a symlink at `.claude`, which could redirect writes outside the project
Fixed read-only commands on Windows accessing network paths without a permission prompt
Fixed Bash command parsing of non-ASCII characters to match real shell word boundaries
Fixed PowerShell tool permission validation of commands containing invisible Unicode characters
`/rewind` no longer restores or deletes files through symlinks or hard links at tracked paths and reports how many paths it skipped
Original changelogAccounts, MCP, and background requests reconnect cleanly
Fixed `claude daemon stop --any` potentially terminating an unrelated process via a stale legacy daemon lockfile
Fixed Claude-in-Chrome 403-looping on reconnect when the session's OAuth token lacks a required scope
Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command
Background sessions: `/mcp` and `/install-github-app` now park a "needs input" request in the agent view when no client is attached
Original changelogScreens, menus, and diagnostics leave less guesswork
Fixed dialogs in fullscreen mode stretching past the right-hand edge of their panel
Fixed the `/config` settings list in fullscreen mode clipping its keyboard-hint footer
Fixed the transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns
Fixed the Prometheus metrics endpoint (`OTEL_METRICS_EXPORTER=prometheus`) emitting invalid `# UNIT` lines
Fixed skills and commands changed during a session not appearing in the slash menu until restart
Fixed plugin skills with a `name` frontmatter field losing their plugin prefix in slash-command autocomplete
Improved the `/fork` confirmation to one line with the new session's name, `claude attach` id, and a note when the copy shares your checkout
Improved the `/ultrareview` diff-too-large error to show configured limits, measured diff size, and largest contributing files
Improved `/code-review ultra` empty-diff message to name the exact base ref and suggest passing an explicit base
Improved the spend limit adjustment prompt to show the server's reason when a spend limit change is rejected
[VSCode] Fixed right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code
Original changelogPermission reporting and chart guidance stop mislabeling events
Fixed telemetry misreporting permission denials: failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections
Improved validation of `git` and `gh` command arguments in the PowerShell tool
Updated the bundled dataviz skill: reordered the default chart palette and fixed guidance that suggested direct labels for four-series charts