新功能
分身代理接手完整脈絡，也改在背景工作
你正和 Claude 討論一個長問題，又想找另一個代理分頭處理，現在不用先把前情重講一遍。subagent_type: "fork" 的子代理（由目前對話分出的工作幫手）會帶著完整對話和 prompt cache，先前提示內容的暫存結果，出發。互動工作階段裡，非團隊代理的啟動預設也改為背景執行，不會把眼前對話卡在等待畫面。像把同一本已夾好書籤的筆記交給同事，他從你停下的段落開始讀，並到隔壁桌處理，不必佔著你的座位。
繁體中文
新功能
跨工作階段傳話，直接叫名字就能找到人
同一台電腦開著幾個 Claude 工作階段時，你可以在提示裡輸入 @ 加上另一個工作階段名稱，Claude 會用 SendMessage 直接傳話。名稱剛好只對應一個正在運作的工作階段時，SendMessage 也不再先要你用 ref（工作階段參照）確認。若新建或改名時撞名，程式會改給 name-word-word 形式的名稱並告知你。/config 還新增 Dialog expiry 與 Messages from your other sessions，可設定跨工作階段訊息要接受、暫留或拒絕。像辦公室分機有各自號碼，接線台替你避免重號，也讓你決定別人來電要接、稍後看，或不接。
新功能
GitLab 憑證遮住，外掛市集也認得 GitLab
把 GitLab 當成外掛來源時，現在連線和保護都補齊了。GitLab 的 glrt-、gloas-、glptt-、glagent-、glimt-、glsoat-、glcbt-、glft-、glffct- token（登入授權令牌）會遮蔽；可路由的 glpat- 與 gldt- 會完整遮蔽。glab CLI 的設定儲存位置也取得與 gh 相同的 sandbox（限制程式可碰範圍的隔離區）和憑證路徑保護。外掛市集則可直接複製 gitlab.com 倉庫網址，含巢狀子群組；複製驗證失敗時，提示會指出實際 Git 主機。像市集同時換了能讀 GitLab 地址的物流單，也替倉庫鑰匙加上遮套。
新功能
外掛市集名稱好記，更新後就能安裝新外掛
管理外掛市集時，設定名稱不必死背舊名字。additionalMarketplaces 可以當 extraKnownMarketplaces 的別名，allowedMarketplaces 可以當 strictKnownMarketplaces 的別名；原有設定仍是同一件事。企業政策裡，blockedMarketplaces 將純倉庫網址標為要封鎖時，即使 CLI 把它當成 Git 複製來源，封鎖仍會生效。執行 /plugin install plugin@marketplace 前，程式也會先更新市集，所以剛發布的外掛不用手動更新市集才裝得到。這像採購目錄換了容易懂的欄位名，黑名單不因貨品改走物流單就失效，櫃台也會先翻到最新版目錄再下單。
問題修復
Gateway 設定先驗證，不再悄悄套錯規則
公司透過 Gateway 管理 Claude Desktop 設定時，錯的設定不會再表面啟動成功、背後卻沒套用。desktop: overlay（覆蓋 Desktop 設定的設定層）現在接受所有已發布的 Desktop 設定，並在啟動時依 Desktop 自己的 schema 驗證。schema 就是設定格式的規則，未知或無效的鍵會讓啟動失敗。政策中空的 managed.policies[].match.groups 或 admin.admin_groups，以及空白、含 @、空白字元或逗號的 email_domain，也會在啟動時失敗，避免誰都沒比對到或意外取得管理權。像門禁名冊先逐欄檢查，缺欄或寫壞就不開門，不讓錯誤名單默默決定誰能進來。
問題修復
Fable 5 顧問回來了，離開互動模式也不會拿錯指示
組織有 Fable 存取權時，現在可在 /advisor 再次選到 Fable 5。要使用額度時，先透過 /model fable 設好 usage-credits consent（使用額度的同意）。若你在互動模式用 --advisor fable 啟動，舊訊息曾叫你回互動工作階段執行 /model fable，但那個工作階段剛好已結束，指示根本走不通。現在同意訊息已修正，不會把你指向已關閉的門。像顧問重新列進預約名單，櫃台也不再叫你回已打烊的窗口辦手續。
問題修復
命令改寫檔案與輸入重導，都重新要過同意
權限確認不是只看命令表面長相。PowerShell 的會寫入變數參數原本可悄悄覆寫 $PSDefaultParameterValues，再把後續命令的檔案存取導向別處，這條繞過已封住。Windows 上 Git Bash 把 Cygwin-style symlink（Cygwin 格式的符號連結，指向另一位置的捷徑檔）當一般檔案看，卻會跟著它寫入；現在這類寫入需要權限同意。所有平台的 Bash 輸入重導 < file 也和一般參數拼法一樣納入權限檢查。像保全不只查門牌，也會看通往後門的暗道和代收指示；能把手伸到別處的路，都先要你點頭。
問題修復
巢狀 Git 專案各自確認信任
一個 Git 專案裡如果再放另一個 Git 專案，內層專案不會再因為外層資料夾已被信任，就自動繼承並通過。現在每個巢狀 repository（程式碼版本管理專案）都需要各自獲得獨立的信任確認。這項修正保留了你已信任外層資料夾的意思，同時不會把那份信任自動擴張到裡面包含的另一份專案。像你同意朋友進大樓大門，不等於也同意他打開大樓內的每一戶房門；每扇內門仍需要各自獨立確認。
問題修復
MCP 伺服器不回話時，連線不再久等
外部工具連不上時，Claude 不會再傻等完整的連線逾時。MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器若沒有回覆，或回覆 protocol-version probe，確認雙方協定版本的詢問，時格式壞掉，舊行為會一路等到完整的 30-second connect timeout。現在這種失敗會及早結束。它像按門鈴後對方完全沒回應，或從門縫遞出看不懂的紙條；你不用站在門前一直等，能早點知道這扇門暫時進不去。
問題修復
遠端控制續接回原對話，歷史也能復原
你從 Claude Desktop 或 IDE 用 Remote Control（遠端控制，把本機工作階段接到另一端使用）後暫停再回來，現在會重新接到原本的 claude.ai 工作階段，不會每次都被當成新工作階段。新接上的用戶端在閒置時也不會顯示連不到，bridge（連接兩端的橋接程式）工作階段的 worker，實際處理工作的程序，重啟後，對話歷史會恢復。若 claude.ai 或應用程式已刪掉原工作階段，恢復對話則會開始替代工作階段，不會錯說是登入問題。像遠端回辦公桌時，能找回原本抽屜與筆記；抽屜真被清空才換一張新桌，而不是誤說你的門禁卡失效。
問題修復
遠端控制斷線會重連，也會說清楚控制權去哪了
網路一晃、或同一台機器上另一個 Claude Code 接手時，Remote Control 不再默默把你留在猜測裡。網路短暫中斷後，它會持續嘗試重連約 30 minutes，也不會因為跨 1 hour 出現幾次短暫中斷就放棄。若另一個 Claude Code 仍握有控制權，恢復對話不會悄悄搶走它；要移轉請在那裡執行 /remote-control。終端機也會明說工作階段被別台裝置接手、從其他應用程式結束，或已刪除，並停止建議會把變更撤銷的重連。像接力棒還在別人手上時，裁判會告訴你原因與交棒位置，而不是讓兩個人同時伸手搶。
問題修復
雲端登入與語音被拒，現在會直接告訴你原因
按下 Cloud gateway 的 /login，看到「Press Enter to continue」後卻沒反應，舊版可能直接離開或留下無回應的終端機；原因是受管理設定載入失敗。現在它會顯示原因。原生版本的 voice mode（語音模式）若被語音服務拒絕，以前可能卡在「listening…」，現在也會立即顯示拒絕。兩件事都把原本沉默的失敗變成可讀訊息：像櫃台不能替你辦理時，會說明缺哪張資料，而不是把你晾在寫著「請稍候」的牌子前。
問題修復
雲端連線可換新憑證，也能從逾時接回工作
mTLS client certificate（mTLS 用戶端憑證，雙向驗證連線身分的證明）輪替後，舊版要重啟 Claude Code 才會讀到新憑證與金鑰；現在遇到連線錯誤會自動重新載入。Bedrock、Vertex 與 gateway 部署遇到 stream idle timeout（串流閒置逾時）時，舊版會讓請求失敗，現在會嘗試恢復。AWS 或 Vertex 的 region（服務區域）值格式壞掉時，也不再拿它拼出請求網址，會改回 default region。像長途電話遇到換發的新識別證或短暫靜音，接線員會重讀證件、改撥預設區域並嘗試接回通話。
問題修復
被截斷的文字不再撐寬畫面或冒出亂碼
畫面上的 overlay（覆蓋在主畫面上的小面板）依內容決定寬度時，文字被截斷會不再多畫出一欄；從開頭截斷的文字也不會縮成只有省略號。很長的 shell command（殼層命令）或 agent description，代理描述，預覽在 emoji，表情符號，中間被切斷時，先前還可能留下一個亂碼字元，現在已修好。這些都是同一個「文字只顯示一部分」的邊角：像招牌裁短字句時，不會多做一格空白，也不會把圖案切成一塊看不懂的碎片。
問題修復
外掛市集同時寫入時，不會被意外取消登記
剛啟動 Claude Code 時，若多個工作同時寫入 known_marketplaces.json，原本有一個競爭時機，可能悄悄把已登記的外掛市集取消登記。現在這個 startup race（啟動時的競爭狀況）已修好，市集不會因為同時寫檔而消失。你不必看到外掛來源忽然不見，卻找不到錯誤訊息。這如同幾位店員同時更新同一本供應商名冊時，現在不會有人把另一人剛寫好的店名抹掉。
問題修復
可繼續的工作在跑，更新介面也能重啟
你要執行 /update 或 /tui，同時又有重啟後仍會存活的工作正在跑，先前這兩個指令可能拒絕重啟。現在它們不會因為那類工作還在運作就擋住。這不是把工作中止，而是承認它能跨過重新啟動繼續存在，讓更新或文字介面能照常重新開始。像一棟大樓有獨立供電的設備仍在運轉時，管理員可以重開大廳的顯示面板，不必把整棟樓的工作都先關掉。
問題修復
額度用完時，只推薦目前真的能用的指令
在 SDK 或遠端工作階段遇到 usage limit（使用額度上限）時，Claude 的說明以前可能建議你一個該環境根本沒有的 slash command，以 / 開頭的指令，。現在建議會避開不可用指令。這項修正不改變你的額度，也不憑空增加指令；它只讓卡住時的說明符合你手邊能操作的介面。像車站告示不再指你去一個已封閉的月台，而是只指向目前能走的出口。
問題修復
遠端控制不再帶走雲端工作階段的內容與憑證
雲端工作階段裡的 bridge（連接兩端的橋接程式）若主持 Remote Control，遠端控制，把本機工作階段接到另一端使用，，以前遠端控制工作階段可能繼承那個雲端工作階段的 transcript，對話逐字紀錄，或 credentials，登入身分證明，。現在這份繼承關係已移除。遠端控制還是能由橋接程式主持，但不會把主持它的雲端工作階段內容或登入證明一起帶進去。這像在共享會議室接通投影設備，不會順便把上一場會議的筆記和門禁卡交給下一位使用者。
新功能
長對話串流與貼圖，不再堵住畫面反應
全螢幕看著長對話持續更新時，畫面現在能維持回應，因為每次更新不再把整段對話重新 normalise（整理成一致格式）。貼上或從剪貼簿讀取 image（圖片）時，也不再阻塞 event loop，負責依序處理畫面與輸入事件的主迴圈，。兩項改動都在避免一件正在進來的內容，堵住其他操作。像書記收到新紙張時，不再每次都把整疊文件重整一次；同事遞來一張照片，也不必讓接待櫃台停擺才能收下。
新功能
受管理設定的核准視窗，標出來源也分清風險
看到受管理設定的核准對話框時，現在可先看到 endpoint URL（服務連線網址），也會用更清楚的文字說明只改 telemetry，遙測資料，時的意義。一般的 OpenTelemetry 選項不再每次都要求核准，但伺服器管理的 sandbox binary override（替換隔離區使用程式的設定）仍會要求同意，包含 sandbox.bwrapPath、sandbox.socatPath、sandbox.ripgrep。這不是把所有設定放行，而是把例行資料選項和會換掉隔離區工具的設定分開。像簽收單略過普通的聯絡欄更新，卻在有人要更換保險箱鑰匙時，清楚列出地址並請你簽名。
新功能
回報與程式審查，不必等眼前回覆結束
Claude 還在回覆時，你現在可立刻開啟 /feedback 或 /bug，不用等這一輪結束。/code-review 選 high、xhigh、max effort（投入較多推理工作的層級）時，也和其他層級一樣改在背景代理執行。前者讓你在想到問題的當下就能開回報入口，後者讓較高工作量的審查不佔住互動對話。像演講還沒結束時，你能先拿到意見卡；需要較久的審稿則交給旁邊的助理處理，講台仍可繼續使用。
新功能
代理完成後更好收納，不再催你建立自訂代理
背景代理完成後，agent panel（顯示代理工作的面板）會立刻把它隱藏，底部留下 /tasks 提示；「↓ N more」溢出指示也移到左邊，較容易看見。恢復已完成背景代理的訊息改短。啟動時建議建立自訂子代理的提示，以及 /powerup 導覽裡相同的催促，也一併移除。這些不改代理怎麼做事，而是整理它完成後留下的資訊與干擾。像待辦牆把完成紙條收進抽屜、把剩餘數量貼到看得見處，也不再每次經過都催你另開一本待辦簿。
新功能
Cowork 不再把外部記憶匯入直接塞進對話
Cowork 工作階段讀取使用者範圍的 memory file（記憶檔）時，外部 @-import，用 @ 引入另一份內容，不再直接 inline，展開後塞入目前內容，。這項改動限定在外部匯入與使用者範圍記憶檔的組合，不是說 Cowork 不再讀取記憶檔本身。它避免一份記憶檔引用的外部內容自動混進目前工作階段。像你借閱一本索引冊時，現在只看到索引指向哪裡，不會把它引用的每本外部書都倒進桌上。
新功能
沙盒只信指定來源，跨工作階段插槽也拒絕假路徑
共用 /tmp 裡自動建立的跨工作階段訊息 socket directory（插槽資料夾，讓程式彼此傳訊的位置），若遇到預先放好的 symlink，符號連結，指向另一個位置的捷徑檔，或其他使用者的資料夾，現在會拒絕使用。Linux filesystem sandbox（限制程式可碰檔案範圍的隔離區）也補上受保護路徑的繞過防護。sandbox.ripgrep 則只接受 user、managed、--settings 設定來源，project settings 不再能覆寫沙盒所用的 ripgrep。三項都在收緊檔案與工具的來源邊界。
English
FEATURE
Forked subagents keep the context and work in the background
When a long conversation needs another agent, a subagent_type: "fork" subagent now starts with the full conversation and prompt cache, rather than needing the background repeated. In interactive sessions, non-teammate agents also start in the background by default. It is like handing a colleague a notebook already marked at the right page, then letting them work at the next desk instead of taking over yours.
FEATURE
Cross-session messages can go straight to a session name
With several Claude sessions on one machine, type @ and a session name in the prompt to send it a SendMessage. A bare name that exactly matches one live session no longer needs a ref confirmation. Duplicate names receive a name-word-word variant. /config also adds Dialog expiry and Messages from your other sessions, where inbound cross-session messages can be accepted, held, or refused.
FEATURE
GitLab credentials are redacted and GitLab repositories work in marketplaces
GitLab is now safer and easier to use as a plugin source. The listed GitLab token families are redacted, and routable glpat- and gldt- tokens are fully redacted. The glab CLI config store gets the same sandbox and credential-path protection as gh. Plugin marketplaces can clone bare gitlab.com repository URLs, including nested subgroups, and authentication-failure hints name the real Git host.
FEATURE
Plugin marketplace settings get friendlier names and installs refresh first
Marketplace settings now accept additionalMarketplaces for extraKnownMarketplaces and allowedMarketplaces for strictKnownMarketplaces. A URL-typed blockedMarketplaces policy entry still blocks a bare repository URL when the CLI treats it as a Git clone. /plugin install plugin@marketplace refreshes the marketplace first, so newly published plugins do not require a manual marketplace update.
BUGFIX
Gateway validates Desktop settings and policies before it starts
Gateway now accepts every released Desktop setting in the desktop: overlay and validates it against Desktop's schema at boot; unknown or invalid keys fail boot. Empty managed.policies[].match.groups or admin.admin_groups, and malformed email_domain values, also fail boot instead of silently matching nobody or granting admin access.
BUGFIX
Fable 5 returns to Advisor with a corrected consent message
Organizations with Fable access can again choose Fable 5 in /advisor, with usage-credits consent set through /model fable. The consent message for interactive --advisor fable launches no longer tells you to run /model fable in an interactive session that has just exited.
BUGFIX
Commands that can redirect file access now require permission approval
Permission checks now cover routes that can redirect file access. PowerShell parameters that write variables can no longer silently overwrite $PSDefaultParameterValues and redirect later commands. Git Bash writes through Cygwin-style symlinks on Windows require approval, and Bash input redirections (< file) are permission-checked on every platform.
BUGFIX
Nested Git repositories now earn trust separately
A Git repository inside another Git repository no longer inherits trust from its parent directory. Each repository now needs its own trust confirmation. Trusting the outer project still means trusting that project; it does not automatically extend to a separate project inside it.
BUGFIX
MCP connections stop waiting so long for a broken server reply
When an MCP server does not answer, or gives a malformed reply to the protocol-version probe, a connection no longer waits through the full 30-second connect timeout. MCP is the protocol that connects AI to external tools. It is like ringing a doorbell and getting either silence or an unreadable note; you find out sooner that this door cannot be used now.
BUGFIX
Remote Control reconnects to the right conversation and restores its history
Remote Control sessions started from Claude Desktop or an IDE now reattach to the existing claude.ai session when resumed, rather than appearing new each time. Newly attached clients remain reachable while idle, and bridge-session history is restored after its worker restarts. If the original session was deleted from claude.ai or the app, resuming starts a replacement instead of reporting a login problem.
BUGFIX
Remote Control reconnects after a blip and explains who has control
After a network blip, Remote Control keeps reconnecting for about 30 minutes and no longer drops after a few blips spread across an hour. Resuming does not silently take control from another Claude Code on the same machine; run /remote-control there to move it. The terminal now says whether another device took over, another app ended, or deleted the session, and stops suggesting a reconnect that would undo that state.
BUGFIX
Cloud login and rejected voice connections now show the reason
When managed settings fail to load, Cloud gateway /login no longer exits silently or leaves an unresponsive terminal after “Press Enter to continue”; it shows the reason. On native builds, voice mode no longer stays on “listening…” when the voice service rejects its connection; that rejection appears immediately.
BUGFIX
Cloud connections reload rotated certificates and recover from idle timeouts
After an mTLS client certificate rotation, Claude Code now reloads the certificate and key on connection errors instead of requiring a restart. Bedrock, Vertex, and gateway deployments recover from stream idle timeout errors rather than failing the request. Malformed AWS or Vertex region values no longer build request URLs and fall back to the default region.
BUGFIX
Truncated text no longer widens overlays or leaves a garbled character
A content-sized overlay no longer renders one column too wide when its text is truncated, and text truncated at the start no longer collapses to an ellipsis. A long shell-command or agent-description preview cut mid-emoji also no longer leaves a stray garbled character. These are fixes for displaying only part of a string without distorting what remains.
BUGFIX
A plugin marketplace no longer disappears during simultaneous startup writes
A startup race caused by concurrent writes to known_marketplaces.json could silently unregister a plugin marketplace. That race is fixed, so a registered marketplace no longer disappears when startup work writes the file at the same time.
BUGFIX
Update and TUI can restart while surviving work is running
/update and /tui no longer refuse to restart just because work that survives the relaunch is running. That work is not being stopped; the update or text interface can restart while it continues to survive the relaunch.
BUGFIX
Usage-limit guidance now recommends only available slash commands
In SDK and remote sessions, usage-limit guidance no longer suggests slash commands that are unavailable in that environment. It does not change the limit or add commands; it makes the guidance point only to actions that the current session can actually use.
BUGFIX
Remote Control no longer inherits a cloud session’s transcript or credentials
A Remote Control session hosted by a bridge inside a cloud session no longer inherits that cloud session’s transcript or credentials. The bridge can still host Remote Control, but the hosted session does not receive the cloud session’s conversation record or login proof.
FEATURE
Long streaming and pasted images no longer block responsiveness
Fullscreen streaming stays responsive in long sessions because each update no longer re-normalizes the whole conversation. Pasted and clipboard images are read without blocking the event loop, the main loop that processes interface and input events. Incoming content no longer has to stop the rest of the interface to be handled.
FEATURE
Managed-settings approval shows endpoints and separates higher-risk overrides
The managed-settings approval dialog now shows endpoint URLs and explains telemetry-only changes more clearly. Routine OpenTelemetry options are skipped, while server-managed sandbox binary overrides still need approval: sandbox.bwrapPath, sandbox.socatPath, and sandbox.ripgrep. It distinguishes routine telemetry settings from changes that replace a sandbox tool.
FEATURE
Feedback, bug reports, and higher-effort code review no longer hold up the turn
/feedback and /bug now open immediately even while Claude is responding. /code-review at high, xhigh, and max effort now runs in a background agent like other effort levels. One action opens the reporting form without waiting; the other moves the longer review work off the interactive conversation.
FEATURE
Finished agents are tidier and custom-agent nudges are gone
Completed background subagents now hide immediately in the agent panel with a /tasks footer hint, and “↓ N more” moved left. The resume message for a completed background agent is shorter. The startup tip about creating custom subagents and the matching /powerup nudge are removed. These changes tidy status information rather than change how agents work.
FEATURE
Cowork stops inlining external imports from user memory
Cowork sessions no longer inline external @-imports from user-scope memory files. This is about external imports being expanded into the current session, not about Cowork ceasing to read the memory file itself. Referenced external content no longer automatically enters the session through that route.
FEATURE
Sandbox paths trust only approved sources and reject planted directories
The auto-generated cross-session messaging socket directory in shared /tmp now refuses a planted symlink or another user’s directory. The Linux filesystem sandbox is hardened against a protected-path bypass. sandbox.ripgrep is honored only from user, managed, and --settings settings; project settings cannot override the sandbox’s ripgrep binary.
原始 CHANGELOG
Original changelog分身代理接手完整脈絡，也改在背景工作
Subagent forking is now on by default: a `subagent_type: "fork"` subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by defaultOriginal changelog跨工作階段傳話，直接叫名字就能找到人
Type `@` in the prompt to mention another Claude session by name; Claude then uses `SendMessage` to reach that session directly
`SendMessage` now delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first
Interactive sessions on one machine now keep unique names: starting or renaming a session to a name another live session already uses gives it a `name-word-word` variant and tells you
Added `/config` rows for "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse)Original changelogGitLab 憑證遮住，外掛市集也認得 GitLab
Added secret redaction for GitLab token families (`glrt-`, `gloas-`, `glptt-`, `glagent-`, `glimt-`, `glsoat-`, `glcbt-`, `glft-`, `glffct-`) and full redaction of routable `glpat-`/`gldt-` tokens; the `glab` CLI config store gets the same sandbox and credential-path protection as `gh`
Added GitLab support to plugin marketplaces: bare `gitlab.com` repo URLs (including nested subgroups) now clone like `github.com` URLs, and clone auth-failure hints name your actual git hostOriginal changelog外掛市集名稱好記，更新後就能安裝新外掛
Settings: `additionalMarketplaces` and `allowedMarketplaces` are now accepted as friendlier aliases for `extraKnownMarketplaces` and `strictKnownMarketplaces`
Enterprise policy: a url-typed `blockedMarketplaces` entry for a bare repo URL keeps blocking that URL when the CLI classifies it as a git clone
`/plugin install plugin@marketplace` now refreshes the marketplace first, so newly published plugins install without a manual marketplace updateOriginal changelogGateway 設定先驗證，不再悄悄套錯規則
Gateway: the `desktop:` overlay now accepts every released Desktop setting (was 11 hand-listed keys), validated at boot against Desktop's own schema; unknown or invalid keys fail boot
Gateway: empty `managed.policies[].match.groups`/`admin.admin_groups` entries and malformed `email_domain` values (empty, or containing `@`, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin accessOriginal changelogFable 5 顧問回來了，離開互動模式也不會拿錯指示
Fable 5 is offered as an advisor in `/advisor` again for organizations with Fable access, with usage-credits consent set up through `/model fable`
Fixed the consent message for interactive `--advisor fable` launches, which told you to run `/model fable` in an interactive session that had just exitedOriginal changelog命令改寫檔案與輸入重導，都重新要過同意
Fixed a PowerShell permission bypass where variable-writing parameters could silently overwrite `$PSDefaultParameterValues` and redirect later commands' file access
Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approval
Bash input redirections (`< file`) are now permission-checked like their argument spellings on all platformsOriginal changelog巢狀 Git 專案各自確認信任
Fixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmationOriginal changelogMCP 伺服器不回話時，連線不再久等
Fixed MCP connections hanging for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probeOriginal changelog遠端控制續接回原對話，歷史也能復原
Fixed Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed; they now reattach to the existing one
Fixed Remote Control sessions appearing unreachable to newly attached clients while idle
Fixed Remote Control bridge sessions not restoring conversation history when the session worker restarts
Remote Control: resuming a conversation whose session was deleted from claude.ai or the app now starts a replacement instead of failing with a message about your login (regressed in v2.1.227)Original changelog遠端控制斷線會重連，也會說清楚控制權去哪了
Remote Control now keeps reconnecting for about 30 minutes after a network blip and no longer drops after a few blips spread across an hour
Remote Control: resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that still has it; run `/remote-control` there to move it
Remote Control: the terminal now says whether a session was taken over by another device, ended from another app, or deleted, and stops suggesting a reconnect that would undo itOriginal changelog雲端登入與語音被拒，現在會直接告訴你原因
Fixed Cloud gateway `/login` exiting silently or leaving an unresponsive terminal after "Press Enter to continue" when managed settings failed to load; the reason is now shown
Fixed voice mode on native builds getting stuck on "listening…" when the voice service rejected the connection; the rejection is now shown immediatelyOriginal changelog雲端連線可換新憑證，也能從逾時接回工作
Fixed mTLS client certificate rotation requiring a restart; Claude Code now reloads the rotated cert and key automatically on connection errors
Fixed malformed AWS or Vertex region values being used to build request URLs; they now fall back to the default region
Fixed stream idle timeout errors failing the request instead of recovering on Bedrock, Vertex, and gateway deploymentsOriginal changelog被截斷的文字不再撐寬畫面或冒出亂碼
Fixed content-sized overlays containing truncated text rendering one column too wide, and start-truncated text collapsing to an ellipsis
Fixed a stray garbled character where a long shell-command or agent-description preview was cut off mid-emojiOriginal changelog外掛市集同時寫入時，不會被意外取消登記
Fixed a startup race that could silently unregister a plugin marketplace due to concurrent writes to `known_marketplaces.json`Original changelog可繼續的工作在跑，更新介面也能重啟
Fixed `/update` and `/tui` refusing to restart while work that survives the relaunch was runningOriginal changelog額度用完時，只推薦目前真的能用的指令
Fixed usage-limit guidance suggesting unavailable slash commands in SDK and remote sessionsOriginal changelog遠端控制不再帶走雲端工作階段的內容與憑證
Fixed Remote Control sessions hosted by a bridge inside a cloud session inheriting that session's transcript or credentialsOriginal changelog長對話串流與貼圖，不再堵住畫面反應
Improved fullscreen streaming: long sessions stay responsive because the whole conversation is no longer re-normalized on every update
Pasted and clipboard images are read without blocking the event loopOriginal changelog受管理設定的核准視窗，標出來源也分清風險
Improved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (`sandbox.bwrapPath`, `sandbox.socatPath`, `sandbox.ripgrep`)Original changelog回報與程式審查，不必等眼前回覆結束
`/feedback` and `/bug` now open immediately when invoked while Claude is responding, instead of waiting for the turn to finish
`/code-review` at high, xhigh, and max effort now runs in a background agent like the other levelsOriginal changelog代理完成後更好收納，不再催你建立自訂代理
Updated agent panel: completed subagents hide immediately with a `/tasks` footer hint, and the "↓ N more" overflow indicator moved left for visibility
Shortened the message shown when resuming a completed background agent
Removed the startup tip suggesting you create custom subagents, and the matching nudge in the `/powerup` tourOriginal changelogCowork 不再把外部記憶匯入直接塞進對話
Cowork sessions no longer inline external @-imports from user-scope memory filesOriginal changelog沙盒只信指定來源，跨工作階段插槽也拒絕假路徑
Hardened the auto-generated cross-session messaging socket directory on shared `/tmp`: a pre-planted symlink or another user's directory is now refused instead of used
Hardened the Linux filesystem sandbox against a protected-path bypass
Changed `sandbox.ripgrep` to be honored only from user, managed, and `--settings` settings; project settings can no longer override the sandbox's ripgrep binary