Released: 2026-08-13
When a long conversation needs another agent, a subagent_type: "fork" subagent now starts with the full conversation and prompt cache, rather than needing the background repeated. In interactive sessions, non-teammate agents also start in the background by default. It is like handing a colleague a notebook already marked at the right page, then letting them work at the next desk instead of taking over yours.
With several Claude sessions on one machine, type @ and a session name in the prompt to send it a SendMessage. A bare name that exactly matches one live session no longer needs a ref confirmation. Duplicate names receive a name-word-word variant. /config also adds Dialog expiry and Messages from your other sessions, where inbound cross-session messages can be accepted, held, or refused.
GitLab is now safer and easier to use as a plugin source. The listed GitLab token families are redacted, and routable glpat- and gldt- tokens are fully redacted. The glab CLI config store gets the same sandbox and credential-path protection as gh. Plugin marketplaces can clone bare gitlab.com repository URLs, including nested subgroups, and authentication-failure hints name the real Git host.
Marketplace settings now accept additionalMarketplaces for extraKnownMarketplaces and allowedMarketplaces for strictKnownMarketplaces. A URL-typed blockedMarketplaces policy entry still blocks a bare repository URL when the CLI treats it as a Git clone. /plugin install plugin@marketplace refreshes the marketplace first, so newly published plugins do not require a manual marketplace update.
Gateway now accepts every released Desktop setting in the desktop: overlay and validates it against Desktop's schema at boot; unknown or invalid keys fail boot. Empty managed.policies[].match.groups or admin.admin_groups, and malformed email_domain values, also fail boot instead of silently matching nobody or granting admin access.
Organizations with Fable access can again choose Fable 5 in /advisor, with usage-credits consent set through /model fable. The consent message for interactive --advisor fable launches no longer tells you to run /model fable in an interactive session that has just exited.
Permission checks now cover routes that can redirect file access. PowerShell parameters that write variables can no longer silently overwrite $PSDefaultParameterValues and redirect later commands. Git Bash writes through Cygwin-style symlinks on Windows require approval, and Bash input redirections (< file) are permission-checked on every platform.
A Git repository inside another Git repository no longer inherits trust from its parent directory. Each repository now needs its own trust confirmation. Trusting the outer project still means trusting that project; it does not automatically extend to a separate project inside it.
When an MCP server does not answer, or gives a malformed reply to the protocol-version probe, a connection no longer waits through the full 30-second connect timeout. MCP is the protocol that connects AI to external tools. It is like ringing a doorbell and getting either silence or an unreadable note; you find out sooner that this door cannot be used now.
Remote Control sessions started from Claude Desktop or an IDE now reattach to the existing claude.ai session when resumed, rather than appearing new each time. Newly attached clients remain reachable while idle, and bridge-session history is restored after its worker restarts. If the original session was deleted from claude.ai or the app, resuming starts a replacement instead of reporting a login problem.
After a network blip, Remote Control keeps reconnecting for about 30 minutes and no longer drops after a few blips spread across an hour. Resuming does not silently take control from another Claude Code on the same machine; run /remote-control there to move it. The terminal now says whether another device took over, another app ended, or deleted the session, and stops suggesting a reconnect that would undo that state.
When managed settings fail to load, Cloud gateway /login no longer exits silently or leaves an unresponsive terminal after “Press Enter to continue”; it shows the reason. On native builds, voice mode no longer stays on “listening…” when the voice service rejects its connection; that rejection appears immediately.
After an mTLS client certificate rotation, Claude Code now reloads the certificate and key on connection errors instead of requiring a restart. Bedrock, Vertex, and gateway deployments recover from stream idle timeout errors rather than failing the request. Malformed AWS or Vertex region values no longer build request URLs and fall back to the default region.
A content-sized overlay no longer renders one column too wide when its text is truncated, and text truncated at the start no longer collapses to an ellipsis. A long shell-command or agent-description preview cut mid-emoji also no longer leaves a stray garbled character. These are fixes for displaying only part of a string without distorting what remains.
A startup race caused by concurrent writes to known_marketplaces.json could silently unregister a plugin marketplace. That race is fixed, so a registered marketplace no longer disappears when startup work writes the file at the same time.
/update and /tui no longer refuse to restart just because work that survives the relaunch is running. That work is not being stopped; the update or text interface can restart while it continues to survive the relaunch.
In SDK and remote sessions, usage-limit guidance no longer suggests slash commands that are unavailable in that environment. It does not change the limit or add commands; it makes the guidance point only to actions that the current session can actually use.
A Remote Control session hosted by a bridge inside a cloud session no longer inherits that cloud session’s transcript or credentials. The bridge can still host Remote Control, but the hosted session does not receive the cloud session’s conversation record or login proof.
Fullscreen streaming stays responsive in long sessions because each update no longer re-normalizes the whole conversation. Pasted and clipboard images are read without blocking the event loop, the main loop that processes interface and input events. Incoming content no longer has to stop the rest of the interface to be handled.
The managed-settings approval dialog now shows endpoint URLs and explains telemetry-only changes more clearly. Routine OpenTelemetry options are skipped, while server-managed sandbox binary overrides still need approval: sandbox.bwrapPath, sandbox.socatPath, and sandbox.ripgrep. It distinguishes routine telemetry settings from changes that replace a sandbox tool.
/feedback and /bug now open immediately even while Claude is responding. /code-review at high, xhigh, and max effort now runs in a background agent like other effort levels. One action opens the reporting form without waiting; the other moves the longer review work off the interactive conversation.
Completed background subagents now hide immediately in the agent panel with a /tasks footer hint, and “↓ N more” moved left. The resume message for a completed background agent is shorter. The startup tip about creating custom subagents and the matching /powerup nudge are removed. These changes tidy status information rather than change how agents work.
Cowork sessions no longer inline external @-imports from user-scope memory files. This is about external imports being expanded into the current session, not about Cowork ceasing to read the memory file itself. Referenced external content no longer automatically enters the session through that route.
The auto-generated cross-session messaging socket directory in shared /tmp now refuses a planted symlink or another user’s directory. The Linux filesystem sandbox is hardened against a protected-path bypass. sandbox.ripgrep is honored only from user, managed, and --settings settings; project settings cannot override the sandbox’s ripgrep binary.
Subagent forking is now on by default: a `subagent_type: "fork"` subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by defaultType `@` in the prompt to mention another Claude session by name; Claude then uses `SendMessage` to reach that session directly
`SendMessage` now delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first
Interactive sessions on one machine now keep unique names: starting or renaming a session to a name another live session already uses gives it a `name-word-word` variant and tells you
Added `/config` rows for "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse)Added secret redaction for GitLab token families (`glrt-`, `gloas-`, `glptt-`, `glagent-`, `glimt-`, `glsoat-`, `glcbt-`, `glft-`, `glffct-`) and full redaction of routable `glpat-`/`gldt-` tokens; the `glab` CLI config store gets the same sandbox and credential-path protection as `gh`
Added GitLab support to plugin marketplaces: bare `gitlab.com` repo URLs (including nested subgroups) now clone like `github.com` URLs, and clone auth-failure hints name your actual git hostSettings: `additionalMarketplaces` and `allowedMarketplaces` are now accepted as friendlier aliases for `extraKnownMarketplaces` and `strictKnownMarketplaces`
Enterprise policy: a url-typed `blockedMarketplaces` entry for a bare repo URL keeps blocking that URL when the CLI classifies it as a git clone
`/plugin install plugin@marketplace` now refreshes the marketplace first, so newly published plugins install without a manual marketplace updateGateway: the `desktop:` overlay now accepts every released Desktop setting (was 11 hand-listed keys), validated at boot against Desktop's own schema; unknown or invalid keys fail boot
Gateway: empty `managed.policies[].match.groups`/`admin.admin_groups` entries and malformed `email_domain` values (empty, or containing `@`, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin accessFable 5 is offered as an advisor in `/advisor` again for organizations with Fable access, with usage-credits consent set up through `/model fable`
Fixed the consent message for interactive `--advisor fable` launches, which told you to run `/model fable` in an interactive session that had just exitedFixed a PowerShell permission bypass where variable-writing parameters could silently overwrite `$PSDefaultParameterValues` and redirect later commands' file access
Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approval
Bash input redirections (`< file`) are now permission-checked like their argument spellings on all platformsFixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmationFixed MCP connections hanging for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probeFixed Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed; they now reattach to the existing one
Fixed Remote Control sessions appearing unreachable to newly attached clients while idle
Fixed Remote Control bridge sessions not restoring conversation history when the session worker restarts
Remote Control: resuming a conversation whose session was deleted from claude.ai or the app now starts a replacement instead of failing with a message about your login (regressed in v2.1.227)Remote Control now keeps reconnecting for about 30 minutes after a network blip and no longer drops after a few blips spread across an hour
Remote Control: resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that still has it; run `/remote-control` there to move it
Remote Control: the terminal now says whether a session was taken over by another device, ended from another app, or deleted, and stops suggesting a reconnect that would undo itFixed Cloud gateway `/login` exiting silently or leaving an unresponsive terminal after "Press Enter to continue" when managed settings failed to load; the reason is now shown
Fixed voice mode on native builds getting stuck on "listening…" when the voice service rejected the connection; the rejection is now shown immediatelyFixed mTLS client certificate rotation requiring a restart; Claude Code now reloads the rotated cert and key automatically on connection errors
Fixed malformed AWS or Vertex region values being used to build request URLs; they now fall back to the default region
Fixed stream idle timeout errors failing the request instead of recovering on Bedrock, Vertex, and gateway deploymentsFixed content-sized overlays containing truncated text rendering one column too wide, and start-truncated text collapsing to an ellipsis
Fixed a stray garbled character where a long shell-command or agent-description preview was cut off mid-emojiFixed a startup race that could silently unregister a plugin marketplace due to concurrent writes to `known_marketplaces.json`Fixed `/update` and `/tui` refusing to restart while work that survives the relaunch was runningFixed usage-limit guidance suggesting unavailable slash commands in SDK and remote sessionsFixed Remote Control sessions hosted by a bridge inside a cloud session inheriting that session's transcript or credentialsImproved fullscreen streaming: long sessions stay responsive because the whole conversation is no longer re-normalized on every update
Pasted and clipboard images are read without blocking the event loopImproved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (`sandbox.bwrapPath`, `sandbox.socatPath`, `sandbox.ripgrep`)`/feedback` and `/bug` now open immediately when invoked while Claude is responding, instead of waiting for the turn to finish
`/code-review` at high, xhigh, and max effort now runs in a background agent like the other levelsUpdated agent panel: completed subagents hide immediately with a `/tasks` footer hint, and the "↓ N more" overflow indicator moved left for visibility
Shortened the message shown when resuming a completed background agent
Removed the startup tip suggesting you create custom subagents, and the matching nudge in the `/powerup` tourCowork sessions no longer inline external @-imports from user-scope memory filesHardened the auto-generated cross-session messaging socket directory on shared `/tmp`: a pre-planted symlink or another user's directory is now refused instead of used
Hardened the Linux filesystem sandbox against a protected-path bypass
Changed `sandbox.ripgrep` to be honored only from user, managed, and `--settings` settings; project settings can no longer override the sandbox's ripgrep binary