Release notes
When a VS Code chat answer is buried under a long trail of tool activity, switch to Focus view. It folds each turn's activity into an expandable summary while still showing which tool is currently running. Toggle it from the chat menu, with Ctrl+Alt+F, or through the “Claude Code: Toggle Focus view” command. It is like closing the kitchen doors while keeping the menu on the table: open them when you need to inspect the cooking, but do not let the pots block dinner.
On Linux and WSL, sandboxed commands can now read a masked stand-in for a credential file when it uses mode: "mask". The stand-in can cover the whole file or regions selected by an extract regex, while the sandbox proxy restores the real value only on egress. macOS falls back to denying the read. Large uploads through that proxy also no longer fail with TLS errors. Think of a shipping desk handing you a redacted copy, then having the clerk insert the real details only when the package leaves.
Before publishing a plugin or revising API prompts, there are now two earlier warnings. claude plugin validate flags marketplace or plugin names that Claude Desktop's managed marketplace sync would reject. The claude-api skill also adds prompt-audit, which looks for prompt and tool-description patterns written for older models. It is like checking whether a shop sign and its artwork fit the printer before sending them to press, instead of discovering the problem after distribution fails.
A command that looks like a condition but hides another command inside it can no longer slip past permission checks. zsh previously could execute hidden commands in Bash tool [[ ]] regex conditionals without prompting; affected commands now require permission. On Windows, PowerShell checks also now correctly ask for approval when a path contains quote characters. It is like security finally checking a bag's inner pocket rather than just its label, even when the ID includes unusual punctuation.
If a session began with thinking off, turning it on now affects the rest of that session as intended. An MCP server disabled while it is connecting also no longer silently comes back. Another fix targets claude -p: servers supplied with --mcp-config connect before the first turn, so the model does not print its tool calls as literal text instead of using them. It is like a control panel that no longer reconnects a machine after you deliberately unplugged it.
When you retract a prompt with Esc and submit it again, files mentioned with @ no longer vanish silently. SDK MCP tools whose names match built-in object properties such as constructor also stop crashing while an API request is prepared. And WebSearch at xhigh or max effort with thinking disabled no longer returns a 400 error. It is like resubmitting an application with its attachments intact, having the clerk recognize an unusual surname, and finally letting a difficult query reach the archive.
When Team or Enterprise users hit a spend limit, the message now correctly points to their individual limit instead of blaming the organization's monthly limit. In desktop-managed Windows sessions, Bedrock authentication with an AWS SSO named profile no longer fails merely because the machine has a stray HOME environment variable. One is like a credit-card alert naming the card that hit its limit; the other is like a security desk no longer following an address note left in the wrong drawer.
Setting CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 now truly disables automatic resumption of an interrupted turn; other falsy values are honored too. After waking from sleep, two Claude Code processes could rarely refresh the same MCP connector or WIF OAuth token at once, forcing another sign-in. That race is avoided now. It is like a handover note saying “do not reopen automatically” finally being followed, while two staff members stop trying to replace the same lock at once.
Rename a session in Claude Code Desktop or claude.ai and the CLI now follows, with names sanitized from every rename surface. In non-interactive sessions, plugin- or organization-delivered skills that happen to be named like terminal built-ins such as /help and /feedback can now be invoked. The “Plugins changed” notification also clears after plugins reload. It is like one itinerary keeping the same clean title on your phone, the web, and the desk, while a finished alert takes itself down.
In Vim mode, the yank register no longer empties just because you opened a dialog, searched history, or viewed the transcript. There is also a small but important navigation fix: after undoing back to an empty prompt, the first left-arrow press arms the “press again to return to the agent view” confirmation instead of immediately taking you away. It is like a clipboard that does not empty when you browse papers, plus a warning light at the door before you leave the desk.
Tool search is available again on Google Vertex AI for Claude 4.5-generation and newer models. In auto mode, permission checks for parallel tool calls use the cache more efficiently; if you switch modes while a check is pending, it reliably asks again instead of applying a stale result. Reusing the cached conversation prefix also reduces prompt-cache costs. The Stats panel now includes cache tokens in totals and breaks them down by input, output, cache read, and cache write. It is like a paid car park reusing a verified plate record and printing every kind of charge on the receipt.
When /ultrareview compares a repository with a base that shares no Git history, its errors now point to the useful next step. A checkout with no branches is refused up front with advice to create one, while a complete clone is no longer incorrectly told to run git fetch --unshallow. It is like a map noticing that the starting point is not connected to any road, telling you to choose a road first rather than ordering you to dig a tunnel that already exists.
When Claude Code starts on Windows, it now reads process creation times through the native kernel32 call rather than spawning PowerShell for the job. Endpoint security tools that gate powershell.exe therefore stop prompting unnecessarily. The same information is still read; it simply uses Windows' own service counter instead. It is like checking a building meter without calling an outside technician through the lobby every time.
Background sessions now commit and push to preserve their work. They open a draft PR only when the task calls for one, follow the repository's CLAUDE.md Git instructions, and always finish by reporting where the work lives. This changes a collaboration habit: picture a colleague filing the finished work and telling you where it is, without sending a review request unless that was part of the assignment.
If /plugin install cannot find a plugin, it now refreshes a stale marketplace catalog and retries before saying it is unavailable. Plugins installed through /plugin activate immediately when safe instead of always requiring /reload-plugins. A plugin may also use "." as its skills path; if root-level SKILL.md validation fails, the message tells you to use the plugin root. It is like a clerk updating stock before declaring an item absent, then fitting a safe new part straight away and finding its manual at the top of the box.
/status now says whether a session is interactive or a background job that is attached or unattended. Emoji completion also accepts common alternate shortcodes such as :thumbsup:, :thumbsdown:, and :love:. And a session created with /fork receives its own worktree rather than working in the original session's checkout. It is like a roster showing who is on duty, a messenger understanding several familiar abbreviations, and a newly assigned colleague receiving a desk of their own.
Claude in Chrome now closes tabs it opened once it no longer needs them. If fast mode runs out of usage credits mid-session, the stream reports that fact instead of failing silently. And when a Monitor watch exits without producing output, it says so rather than merely reporting “stream ended.” It is like an assistant closing borrowed reference pages, telling you directly when the budget is gone, and a patrol officer reporting that nothing happened during the round.
When Gateway receives a non-string model field, it now rejects it with a 400 rather than forwarding it onward. That stops malformed data at the entrance. Separately, approval prompts no longer repeat the notice about a permission-mode change while an auto-mode classifier call was queued. It is like a post-office counter returning a photo placed in the address field instead of sending it to sorting, while a notice posted once does not cover the wall again for every person in line.
Original changelog
Original changelogVS Code chats can fold away tool details
[VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with `Ctrl+Alt+F` or the "Claude Code: Toggle Focus view" command
Original changelogThe sandbox protects credentials and handles large uploads
Added `mode: "mask"` for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an `extract` regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to `deny`
Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
Original changelogPlugins and prompts get a compatibility checkup
Added warnings to `claude plugin validate` when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
Added a `prompt-audit` subcommand to the `claude-api` skill for auditing prompts and tool descriptions for patterns written for older models
Original changelogPermission checks close Bash and PowerShell gaps
Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in `[[ ]]` regex conditionals; affected commands now prompt for permission
Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
Original changelogThinking and MCP connections stop quietly reverting
Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
Fixed MCP servers from `--mcp-config` not being connected before the first turn in print mode (`-p`), which made the model emit tool calls as literal text
Original changelogResent prompts, SDK tools, and search are more reliable
Fixed @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as `constructor`
Fixed WebSearch failing with a 400 error at effort `xhigh`/`max` when thinking is disabled
Original changelogSpend-limit messages and AWS sign-in on Windows are corrected
Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray `HOME` environment variable
Original changelogAuto-resume and re-authentication avoid surprises
Fixed `CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0` not disabling interrupted-turn auto-resume; falsy values are now honored
Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
Original changelogSession names and plugin status stay in sync
Fixed renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
Fixed plugin- and org-delivered skills named after terminal-only built-ins (e.g. `/help`, `/feedback`) being un-invocable in non-interactive sessions
Fixed the "Plugins changed" notification lingering after plugins were reloaded instead of clearing
Original changelogVim mode keeps yanks and knows when to return
Fixed Vim mode: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied
Fixed Vim mode: undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
Original changelogAuto-mode permissions reuse cache, and usage is visible
Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
Original changelog/ultrareview explains missing shared history up front
Improved `/ultrareview` error messages when a repo shares no history with its base: a checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest `git fetch --unshallow` on clones that are already complete
Original changelogWindows startup no longer launches PowerShell just to read times
Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate `powershell.exe` no longer prompt
Original changelogBackground work preserves results and opens PRs only when asked
Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
Original changelogPlugin installs retry and can activate immediately
Changed `/plugin install` to refresh a stale marketplace catalog and retry before reporting a plugin not found
Changed plugins installed from `/plugin` to activate immediately when safe, instead of always requiring `/reload-plugins`
Changed plugins to accept `"."` as a `skills` path, and the root-level `SKILL.md` validation error now suggests using the plugin root
Original changelogSession types, emoji, and /fork get clearer behavior
Changed `/status` to show the session kind: `interactive`, or a background job that is `attached` or `unattended`
Changed emoji autocomplete to accept common alternate shortcodes like `:thumbsup:`, `:thumbsdown:`, and `:love:`
Changed sessions forked with `/fork` to create a new worktree of their own instead of working in the original session's checkout
Original changelogBrowser, fast mode, and Monitor all report their endings
Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
Changed Monitor: a watch that exits without producing any output now says so instead of reporting "stream ended"
Original changelogGateway validation tightens and stale permission notices disappear
Changed the Gateway `model` field validation: non-string values are rejected with a 400 instead of being forwarded
Removed the repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts