Release notes
An administrator no longer has to list every marketplace under a GitHub organization one by one. Managed settings now accept an owner wildcard such as "owner/*": replace owner with an organization name, and the asterisk covers all of its marketplace repositories. Put it in strictKnownMarketplaces to allow that organization, or blockedMarketplaces to bar it. For example, {"strictKnownMarketplaces":["acme/*"]} recognizes every Acme marketplace. It is like a building pass that admits an entire company's badge series instead of registering every employee separately.
When a workflow agent, forked skill, slash command, or resumed background agent requests a particular subagent model, an organization policy may forbid it. Previously that could look as though nothing had happened. Claude now warns that the requested model is restricted and that the parent model is running instead. The agent has not quietly become a different task; it is using an available brain. It is like a theater manager announcing a substitute actor when the scheduled performer cannot go on, rather than leaving the audience to guess why someone else appeared.
If you are halfway through a cloud session and need to return to your computer to work with local files, Claude now shows a /teleport hint. Run claude --teleport <session id> locally, replacing <session id> with the identifier shown in the cloud session, and continue that session on your machine. This is not a copied new chat; it carries the same work from the cloud to your computer. Like moving a half-finished puzzle from the coffee table to a desk and continuing the same picture.
Before you approve a command, the permission dialog can now show its full shape more reliably. A crafted Bash command cannot hide pieces from checking, and tabs or invisible Unicode characters cannot conceal part of a command from the approval dialog. Workflow scripts also cannot use dynamic import() to run code outside the workflow sandbox, and an agent definition's bypassPermissions mode must obey an organization policy that disables permission bypasses. Think of factory quality control: inspectors open the packaging rather than checking only its label, work stays within its marked area, and no work order can override a company ban on skipping inspection.
If you used /cd to change folders during a conversation, resuming that session will no longer come back empty. A forked background agent whose parent prompt cannot be rebuilt during resume also will not remain stuck as “already resuming” for the rest of the session. And a malformed diagnostics attachment in the history will no longer make every turn fail or leave the interactive app frozen on an error screen. These are three handoff points in a relay race: changing lanes, recovering the previous runner's instructions, and checking a damaged record. One bad handoff no longer stops the team forever.
When a gateway discovers models, Claude names with a provider prefix no longer disappear. IDs such as vertex_ai/claude-* and bedrock/anthropic.claude-* are now found. Also, a key in modelOverrides that is not an Anthropic model ID will no longer be mistaken for the session's canonical model ID; unknown keys are ignored as the documentation says. It is like a ticket inspector recognizing a passenger whose ticket starts with a travel-agency label, without copying the agency name into the passenger's passport field.
When a company delivers managed settings from its server, the env block in a machine-local managed-settings.json or an MDM profile used to risk being disabled altogether. It now merges administrator environment variables by key, so receiving another settings source does not replace the whole local block. Different switches from both lists remain present; the rules still decide what happens when the same key appears. It is like headquarters sending a new duty roster without tearing down every non-conflicting phone number already posted in a branch office.
On Linux, putting the working directory under sandbox.filesystem.denyWrite used to make a sandboxed command fail before it could start. It can now launch normally. Another rare but irritating stall is fixed too: parsing unusual git push output no longer occasionally hangs. Think of a warehouse conveyor: a parcel marked “do not seal” can still go onto the line, and staff can process an unusually formatted shipping slip without stopping it. Writes remain forbidden, while the command and Git can finish their work.
As a conversation grows, auto-compaction now more consistently protects a model's context window: the amount of conversation it can hold at once. CLAUDE_CODE_DISABLE_1M_CONTEXT now keeps every Claude model with a native 1M window at 200K through compaction, and startup warns if that limit is not being held. For an unrecognized model ID, Claude now assumes a window and compacts before it is exceeded rather than allowing unchecked growth. To restore the old behavior for unrecognized IDs, add CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to the environment that launches Claude. It is like folding clothes before a suitcase is full, not waiting for the zipper to split.
Before submitting changes or a PR, /review is now another name for /code-review. Run /code-review to review the current diff or a PR; use /code-review <level> <pr#> to choose a depth, and /code-review ultra for a deep cloud review. If you omit the level next time, it reuses the level you last chose. To switch to high, type /code-review high. It is like two signs for one laundry counter: both lead to the same service, and the clerk remembers whether you chose a quick wash or careful cleaning last time.
Original changelog
Original changelogAllow or block an entire GitHub organization's marketplaces
Added owner wildcard entries (`"owner/*"`) to the `strictKnownMarketplaces` and `blockedMarketplaces` managed settings for allowing or blocking all marketplace repos under a GitHub org
Original changelogA warning explains when parent model takes over for a restricted subagent
Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead
Original changelogContinue a cloud session on your own machine
Added a `/teleport` hint in cloud sessions showing how to continue locally with `claude --teleport <session id>`
Original changelogPermission checks can no longer be fooled by hidden commands
Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks
Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
Fixed workflow scripts being able to use dynamic `import()` to run code outside the workflow sandbox
Fixed a permission gap where an agent definition's `bypassPermissions` mode ignored the org bypass-permissions disable policy
Original changelogResumed sessions are less likely to come back blank or stuck
Fixed resuming a session after a mid-session `/cd` coming back empty
Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment
Original changelogClaude models with provider-prefixed names are recognized correctly
Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as `vertex_ai/claude-*` or `bedrock/anthropic.claude-*`
Fixed `modelOverrides` keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented
Original changelogAdmin and local environment settings now merge instead of replacing each other
Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local `managed-settings.json` or MDM profile; admin env now merges per key
Original changelogLinux sandboxes and unusual Git output no longer stall commands
Fixed sandboxed commands failing to start on Linux when `sandbox.filesystem.denyWrite` covers the working directory
Fixed a rare hang when parsing unusual `git push` output
Original changelogAuto-compaction now respects model context limits more consistently
Changed `CLAUDE_CODE_DISABLE_1M_CONTEXT` to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K
Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set `CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1` to restore the previous behavior
Original changelogCode review commands are unified and remember your chosen depth
Changed `/review` to be an alias of `/code-review`, which reviews the current diff or a PR (`/code-review <level> <pr#>`); use `/code-review ultra` for a deep cloud review
Changed `/code-review` with no effort level to reuse the level you typed last; type a level like `/code-review high` to change it