Claude Code 2.1.219

新的 Claude Opus 5 接手成為預設的 Opus 模型，代號是 claude-opus-5。它一次能讀進一百萬 context（模型一次記得住的文字量），快速模式的計價是每百萬文字單位進 10 美元、出 50 美元。連帶兩件事也跟著調整：/fast 這個快速模式不再適用 Opus 4.7，改成套用在 Opus 5 和 Opus 4.8 上；claude-api 這份技能檔的預設模型也換成 Opus 5，並附上從 Opus 4.8 搬過來的做法。像學校換了新版教科書，開學領到的自動就是新版；但你書單上如果寫死舊版書號，訂起來就會撲空。你什麼都不用改就會用到新模型，只有手邊寫死舊模型代號的腳本，得回頭檢查。

派一個助手去做事，它做到一半發現該再找兩個人分頭查——以前它做不到，只能自己吞下去。現在子代理預設可以往下再開子代理，最多疊到三層（原本只有一層）。不想要這種層層轉包，在環境變數設 CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 就關掉。同時，第二層以下開出來的子代理不再是黑箱：只要加上 --forward-subagent-text，它們的輸出會出現在 stream-json 裡，並掛在當初叫出它的那個代理底下，看得出誰是誰派的。像工班分包，以前只准分一層，現在准到三層，但每一層是誰發包的都要登記在同一張表上。

交給系統自動編排的工作流程，以前沒有規模上的建議，一個任務可能被拆成幾十個代理各跑各的，你既看不出全貌也算不出成本。現在預設是中等規模，也就是「盡量少於 15 個代理」，這只是建議不是硬限制。想換規模有兩條路。臨時改：在 /config 裡選 Dynamic workflow size，可以挑別的大小或不設限。想固定下來：在設定檔加一行 workflowSizeGuideline，這樣任何設定檔都能指定，例如

{"workflowSizeGuideline": "medium"}

設定檔一旦寫了這個鍵，/config 裡那一列就會自動隱藏，避免兩邊講不一樣的話。另外，工作流程跑起來時，狀態列會直接顯示目前用的是哪個規模，旁邊附上去 /config 改的指路。像旅行團有沒有規定團員人數上限——沒規定不代表比較自由，只是你到了現場才知道來了幾個人。

在沙箱（把指令關在受限環境裡跑的隔離區）裡執行的指令想連某個網站，而那個網站不在你的允許清單上時，以前會跳出來問你要不要放行。跑自動化的場合沒人在鍵盤前，這一問就是整條流程停住。新的 sandbox.network.strictAllowlist 讓你選擇直接拒絕、連問都不問。要開的話，在設定檔加上這段：

{"sandbox": {"network": {"strictAllowlist": true}}}

這裡的巢狀寫法是「一層包一層」：sandbox 裡有 network，network 裡才是 strictAllowlist。像大樓門禁改成沒登記就是進不來，警衛不再打電話上樓問你要不要放行——訪客會吃閉門羹，但半夜也不會有人被吵醒。

MCP（Model Context Protocol，讓 AI 接上外部工具的協定）伺服器連不上，以前只知道失敗，不知道為什麼。這版三處補上線索。claude mcp list 和 /mcp 現在會附上 HTTP 狀態碼和錯誤內容，是憑證過期還是位址打錯，一看就分得出來；設定值前後藏著看不見的空白時，也會出聲警告——那種錯最折磨人，因為畫面上看起來完全正常。沒有畫面的 stream-json 啟動事件則多了 mcp_server_errors，把 --mcp-config 裡因為驗證不通過而被略過的項目列出來，終端機執行時也會在開頭印警告。像寄信被退回，以前只收到一張「無法投遞」，現在退件單上寫了地址哪一行有問題。

公司統一派發的 MCP 允許與拒絕清單，裡面常寫 ${VAR} 這種變數，等實際執行時再換成真正的值。問題是以前它從設定檔裡的環境變數區塊取值——而設定檔就在使用者手上，等於管理者訂的規則，可以被本機的一行設定改掉。現在改成從啟動時的環境和受管理設定自己的環境取值，設定檔那份不再參與。像醫院的用藥規定，以前各護理站自己抄一份貼在白板上，誰都擦得掉；現在改成每次掃碼直接讀系統裡的正本。

同一個工作階段聊到一半，才想起另一個資料夾也得一起看，於是你把它加了進來。新的 DirectoryAdded 掛鉤（特定事件發生時自動觸發的小程式）就在這一刻醒過來，向周邊工具發出通知。只要輸入 /add-dir 指令，或是透過 SDK 發出 register_repo_root 控制請求來註冊新目錄，Claude Code 就會自動觸發這個掛鉤，讓周邊工具第一時間掌握目錄變更。像展覽館在展覽進行中臨時加設新展位，廣播室與服務台隨即收到連線通知，周邊服務就能馬上配合跟上。

隔著一台裝置操作，最怕畫面上寫的跟實際狀況對不上。這版把遠端控制（Remote Control）的三處落差補起來。首先修復了遠端控制用戶端在切換模型、斷線重連或組織權限檢查失敗後，快速模式仍殘留舊狀態的問題；其次，當跳出「遠端控制僅支援 api.anthropic.com」的錯誤時，錯誤訊息會直接點名是哪一個設定項導致衝突；最後，執行 claude --teleport 遇到手邊 checkout 的專案庫與工作階段不一致時，現在會明確印出你目前 checkout 指向的是哪一個專案庫。像遠端駕駛艙的儀表板，開關狀態即時同步、故障時精準亮起對應燈號，定位不符時也會清楚顯示你實際停在哪個車庫。

Claude Opus 5 (claude-opus-5) takes over as the default Opus model, with a 1M context window and fast-mode pricing of $10 in and $50 out per million tokens. Two things move with it: /fast no longer covers Opus 4.7 and now applies to Opus 5 and Opus 4.8, and the claude-api skill defaults to Opus 5 with a documented path over from Opus 4.8. A school switching to a new edition of a textbook works the same way: what you are handed at the start of term is the new one, but a reading list with the old ISBN written into it will order nothing. You get the new model without changing anything; only scripts with an older model id hard-coded need a second look.

You send one assistant off to do a job; halfway through it realises the work should be split between two more people — and until now it could not do that, it had to swallow the whole thing itself. Subagents can now spawn their own subagents, three levels deep by default, up from one. If you would rather not have work subcontracted down a chain, set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to switch nesting off. The deeper ones are no longer a black box either: with --forward-subagent-text, subagents spawned at depth two and below show up in stream-json, keyed to the agent tool_use id that spawned them, so you can see who dispatched whom. Building trades subcontract the same way — one level used to be the limit, three is now allowed, and every level is logged against whoever hired it.

Workflows the system plans for you had no size guidance, so one task could fan out into dozens of agents running in parallel, leaving you unable to see the shape of it or estimate the cost. The default is now a medium guideline — aim for fewer than 15 agents — and it is advisory, not a hard cap. There are two ways to change it. Ad hoc: pick Dynamic workflow size in /config for another size or unrestricted. Permanently: set workflowSizeGuideline in any settings file, for example

{"workflowSizeGuideline": "medium"}

While a settings file specifies that key, the /config row hides itself so the two cannot disagree. A running workflow also shows the current size in its status line, with a pointer to /config if you want to change it. Think of a tour with no stated cap on group size: the absence of a limit is not freedom, it just means you find out how many people showed up when you get there.

When a command running inside the sandbox — the restricted area commands are confined to — tries to reach a host that is not on your allowlist, you used to get a prompt asking whether to permit it. In an automated run there is nobody at the keyboard, so that prompt is where the whole pipeline stops. The new sandbox.network.strictAllowlist setting lets you deny outright, without asking. To turn it on, add this to a settings file:

{"sandbox": {"network": {"strictAllowlist": true}}}

The nesting reads as one box inside another: sandbox contains network, and network contains strictAllowlist. It is a building switching to strict door policy — unregistered visitors simply do not get in, and the guard stops phoning upstairs to ask. Some visitors are turned away, but nobody gets woken at three in the morning.

When an MCP server would not connect, you knew it had failed and nothing more. Three additions here. claude mcp list and /mcp now report the HTTP status and error text, so an expired credential looks different from a mistyped address; and config values with hidden leading or trailing whitespace now raise a warning — the most maddening class of error, because the screen looks entirely correct. The headless stream-json init event gained mcp_server_errors, listing the --mcp-config entries that config validation skipped, and terminal runs print a startup warning too. A returned letter used to come back stamped only "undeliverable"; now the slip tells you which line of the address is wrong.

Centrally managed MCP allowlists and denylists often contain ${VAR} entries that get substituted at run time. The catch was where the substitution read from: the env block of a settings file — a file that sits in the user's own hands, which meant a rule set by an administrator could be rewritten by one local line. Those entries now resolve from the startup environment and the managed-settings env instead, and the settings-file env no longer participates. Think of dosage rules in a hospital: they used to be copied onto a whiteboard at each nurses' station, where anyone could rub a figure out. Now they are scanned straight from the system's master copy each time.

Halfway through a conversation you remember that another folder needs to be in scope, so you bring it in. The new DirectoryAdded hook wakes up at exactly that moment and notifies the tools around you. A new DirectoryAdded hook fires whenever a new working directory is registered mid-session — whether you type the /add-dir command or issue a register_repo_root control request via the SDK. Secondary tools learn right away that the folder list has changed. Think of an exhibition hall opening an extra booth mid-event: the moment the new space is registered, the information desk and public address system get an instant update so services can adjust without delay.

Operating something through another device, the thing you dread is the screen disagreeing with reality. Three such gaps in Remote Control are closed here. Remote Control clients no longer hold onto a stale fast-mode status after switching models, reconnecting, or failing an organization check. When the error "Remote Control is only available via api.anthropic.com" appears, the diagnostic text now explicitly names the specific setting that triggered it. Finally, running claude --teleport when your current checkout repository differs from the session's repository now prints which repository your current checkout actually points to. Like a remote cockpit dashboard: switch toggles update in real time, error lights pinpoint the exact faulty breaker, and location mismatches show the actual hanger where your vessel is parked.