發布日期：2026-08-06
公司管理者不必再替 GitHub 組織底下每個外掛市集逐一開名單。現在受管設定能用 "owner/*" 這種萬用字元，owner 換成組織名稱，星號代表它底下所有市集。想只准公司核可的來源，可在 strictKnownMarketplaces 加入它；若整個組織都不能用，則放進 blockedMarketplaces。例如 {"strictKnownMarketplaces":["acme/*"]} 會承認 acme 組織所有市集。這像大樓門禁直接認一整棟公司的識別證，不必替每位員工各登一筆。
你安排工作流程 agent（代理，能分頭處理工作的 AI 助手）、分叉的技能、斜線指令，或恢復背景代理時，可能替子代理指定某個模型；但組織政策若不准用它，原本很容易以為事情根本沒跑。現在 Claude 會跳出警告：子代理想要的模型受限，改由父代理模型執行。它沒有憑空換成別的任務，只是換了可用的腦袋。像劇團原定的演員臨時不能上台，舞台經理會明說由誰代演，觀眾不必對著陌生面孔猜半天。
在雲端 session（工作階段，一次連續的對話與工作紀錄）裡做到一半，想回自己電腦處理檔案時，畫面現在會提示 /teleport。照提示輸入 claude --teleport <session id>，就能在本機繼續那個工作階段；<session id> 要換成畫面給你的識別碼。這不是複製一份新對話，而是把同一段工作從雲端接到眼前。像把做到一半的拼圖從客廳桌搬到書房桌，仍接著拼同一幅圖。
按下核准前，權限對話框現在會更可靠地露出命令全貌。有人若在 Bash 指令裡做手腳，用 tab 或看不見的 Unicode 字元遮住一段內容，檢查不再會漏看；工作流程 script 也不能靠動態 import() 從 workflow sandbox（工作流程沙盒，限制程式活動範圍的隔離區）外執行程式。另一個缺口也補上了：代理定義裡略過權限的 bypassPermissions 模式不得違反組織政策。這像工廠品管驗貨，不只看箱面標籤，還會拆開包材查隱藏內容；流水線只能在劃定工作區操作，公司訂下免檢禁令後，也不能被某張作業單推翻。
你在對話中用過 /cd 換資料夾，之後再恢復 session（工作階段，一次連續的對話與工作紀錄），不會莫名回到空白位置。分叉的背景 agent 若在恢復時重建父提示詞失敗，也不會整場對話都被鎖成「already resuming」；歷史裡壞掉的 diagnostics attachment（診斷附件，記錄除錯資訊的附檔）則不再害每一回合失敗或讓互動程式停在沒反應的錯誤畫面。這像接力賽交棒時有三個容易掉棒的關卡：換跑道、找回前一棒的說明、檢查破損的紀錄；現在其中一關出錯，不會讓整隊永遠停在原地。
透過 gateway（閘道，替不同 AI 服務轉接請求的入口）找模型時，名稱前面帶供應商標記的 Claude 以前可能直接消失。例如 vertex_ai/claude-* 與 bedrock/anthropic.claude-* 現在都能被發現。同時，modelOverrides 裡不是 Anthropic 模型 ID 的鍵，不會再被誤當成這個 session 的正式模型 ID；文件說未知鍵應忽略，現在照做。像同名乘客在車票前多印了旅行社名稱：查票員會認出人，卻不會把旅行社名稱誤寫進護照欄位。
公司從伺服器發下 managed settings（受管設定，由管理者統一控制的設定）時，本機 managed-settings.json 或 MDM 裝置管理設定檔裡的 env 區塊以前可能整個失效。現在管理端的環境變數會按鍵名合併，本機設定不會因為收到另一份設定就被整段蓋掉。兩份名單都寫了不同開關時會並列保留。像總公司寄來新的值班表，不再把分店牆上原有、沒有衝突的聯絡電話全數撕掉。
在 Linux 把工作資料夾列入 sandbox.filesystem.denyWrite（沙盒禁止寫入的路徑清單）後，沙盒指令以前可能連啟動都失敗，現在能正常啟動。另一個少見但惱人的停滯也修掉了：解析某些不尋常的 git push 輸出時，不再偶爾掛住。像倉庫的輸送線：標示禁止封箱的貨仍可上線運送；遇到格式罕見的出貨單，站員也能繼續處理，不會讓整條線停住。禁止寫入照舊，指令與 Git 則能把工作做完。
工作階段越堆越長時，會啟用自動壓縮（auto-compaction，把前段內容濃縮以騰出空間）。它現在會更早守住模型的 context window（上下文視窗，模型一次能記住的內容容量）。CLAUDE_CODE_DISABLE_1M_CONTEXT 已改成：所有原生支援 1M 視窗的 Claude 模型都會透過壓縮維持在 200K，並在沒守住時於啟動時警告。遇到不認得的模型 ID，也會假定一個容量並在超限前壓縮，不再任它長過頭。若你要恢復後一項的舊行為，請在啟動 Claude 的環境變數加入 CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1。像行李箱裝滿前先整理衣物，而不是等拉鍊裂開才發現放不下。
準備送出改動或 PR（pull request，請人檢查並合併程式改動的請求）前，/review 現在就是 /code-review 的另一個名字。輸入 /code-review 可檢查目前 diff（差異，尚未合併的程式改動）或 PR；要指定深度可用 /code-review <level> <pr#>，例如 /code-review ultra 要求深入的雲端審查。第二次審查若不填 level，會沿用你上次選的程度；想改成 high，就輸入 /code-review high。像同一個洗衣店有兩個入口招牌，現在都通往同一張櫃台，店員還記得你上回選的是快洗還是精洗。
An administrator no longer has to list every marketplace under a GitHub organization one by one. Managed settings now accept an owner wildcard such as "owner/*": replace owner with an organization name, and the asterisk covers all of its marketplace repositories. Put it in strictKnownMarketplaces to allow that organization, or blockedMarketplaces to bar it. For example, {"strictKnownMarketplaces":["acme/*"]} recognizes every Acme marketplace. It is like a building pass that admits an entire company's badge series instead of registering every employee separately.
When a workflow agent, forked skill, slash command, or resumed background agent requests a particular subagent model, an organization policy may forbid it. Previously that could look as though nothing had happened. Claude now warns that the requested model is restricted and that the parent model is running instead. The agent has not quietly become a different task; it is using an available brain. It is like a theater manager announcing a substitute actor when the scheduled performer cannot go on, rather than leaving the audience to guess why someone else appeared.
If you are halfway through a cloud session and need to return to your computer to work with local files, Claude now shows a /teleport hint. Run claude --teleport <session id> locally, replacing <session id> with the identifier shown in the cloud session, and continue that session on your machine. This is not a copied new chat; it carries the same work from the cloud to your computer. Like moving a half-finished puzzle from the coffee table to a desk and continuing the same picture.
Before you approve a command, the permission dialog can now show its full shape more reliably. A crafted Bash command cannot hide pieces from checking, and tabs or invisible Unicode characters cannot conceal part of a command from the approval dialog. Workflow scripts also cannot use dynamic import() to run code outside the workflow sandbox, and an agent definition's bypassPermissions mode must obey an organization policy that disables permission bypasses. Think of factory quality control: inspectors open the packaging rather than checking only its label, work stays within its marked area, and no work order can override a company ban on skipping inspection.
If you used /cd to change folders during a conversation, resuming that session will no longer come back empty. A forked background agent whose parent prompt cannot be rebuilt during resume also will not remain stuck as “already resuming” for the rest of the session. And a malformed diagnostics attachment in the history will no longer make every turn fail or leave the interactive app frozen on an error screen. These are three handoff points in a relay race: changing lanes, recovering the previous runner's instructions, and checking a damaged record. One bad handoff no longer stops the team forever.
When a gateway discovers models, Claude names with a provider prefix no longer disappear. IDs such as vertex_ai/claude-* and bedrock/anthropic.claude-* are now found. Also, a key in modelOverrides that is not an Anthropic model ID will no longer be mistaken for the session's canonical model ID; unknown keys are ignored as the documentation says. It is like a ticket inspector recognizing a passenger whose ticket starts with a travel-agency label, without copying the agency name into the passenger's passport field.
When a company delivers managed settings from its server, the env block in a machine-local managed-settings.json or an MDM profile used to risk being disabled altogether. It now merges administrator environment variables by key, so receiving another settings source does not replace the whole local block. Different switches from both lists remain present; the rules still decide what happens when the same key appears. It is like headquarters sending a new duty roster without tearing down every non-conflicting phone number already posted in a branch office.
On Linux, putting the working directory under sandbox.filesystem.denyWrite used to make a sandboxed command fail before it could start. It can now launch normally. Another rare but irritating stall is fixed too: parsing unusual git push output no longer occasionally hangs. Think of a warehouse conveyor: a parcel marked “do not seal” can still go onto the line, and staff can process an unusually formatted shipping slip without stopping it. Writes remain forbidden, while the command and Git can finish their work.
As a conversation grows, auto-compaction now more consistently protects a model's context window: the amount of conversation it can hold at once. CLAUDE_CODE_DISABLE_1M_CONTEXT now keeps every Claude model with a native 1M window at 200K through compaction, and startup warns if that limit is not being held. For an unrecognized model ID, Claude now assumes a window and compacts before it is exceeded rather than allowing unchecked growth. To restore the old behavior for unrecognized IDs, add CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to the environment that launches Claude. It is like folding clothes before a suitcase is full, not waiting for the zipper to split.
Before submitting changes or a PR, /review is now another name for /code-review. Run /code-review to review the current diff or a PR; use /code-review <level> <pr#> to choose a depth, and /code-review ultra for a deep cloud review. If you omit the level next time, it reuses the level you last chose. To switch to high, type /code-review high. It is like two signs for one laundry counter: both lead to the same service, and the clerk remembers whether you chose a quick wash or careful cleaning last time.
Added owner wildcard entries (`"owner/*"`) to the `strictKnownMarketplaces` and `blockedMarketplaces` managed settings for allowing or blocking all marketplace repos under a GitHub orgAdded a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs insteadAdded a `/teleport` hint in cloud sessions showing how to continue locally with `claude --teleport <session id>`Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks
Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
Fixed workflow scripts being able to use dynamic `import()` to run code outside the workflow sandbox
Fixed a permission gap where an agent definition's `bypassPermissions` mode ignored the org bypass-permissions disable policyFixed resuming a session after a mid-session `/cd` coming back empty
Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachmentFixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as `vertex_ai/claude-*` or `bedrock/anthropic.claude-*`
Fixed `modelOverrides` keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documentedFixed managed settings: server-delivered settings no longer disable the env block of a machine-local `managed-settings.json` or MDM profile; admin env now merges per keyFixed sandboxed commands failing to start on Linux when `sandbox.filesystem.denyWrite` covers the working directory
Fixed a rare hang when parsing unusual `git push` outputChanged `CLAUDE_CODE_DISABLE_1M_CONTEXT` to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K
Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set `CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1` to restore the previous behaviorChanged `/review` to be an alias of `/code-review`, which reviews the current diff or a PR (`/code-review <level> <pr#>`); use `/code-review ultra` for a deep cloud review
Changed `/code-review` with no effort level to reuse the level you typed last; type a level like `/code-review high` to change it