Release notes

FEATURE

Open a worktree straight from a GitLab merge request

When a teammate sends a GitLab merge-request URL, you can now give that URL to --worktree and recognize it in the claude agents view. A worktree is a parallel copy of a Git project, so you can inspect changes somewhere separate from current work.

Merge requests appear as !N, making their GitLab identity visible in the list.

FEATURE

Gateway can pass user identity to proxy accounting

If your company connects to Anthropic upstreams through an apps gateway and needs to assign spending to people, it can opt into forward_user_identity. This setting puts the signed-in user's identity into request headers for a proxy behind the gateway.

Leave it off and that identity is not forwarded.

FEATURE

Linux Bash can cap memory for a runaway build

When a build runs through the Bash tool on Linux, you can opt into CLAUDE_CODE_TOOL_MEMORY_LIMIT if a runaway build might stall the session. It enables a memory cgroup, Linux's boundary for the memory available to a group of programs.

The optional limit keeps a runaway build from stalling the session.

FEATURE

Set WebFetch URL cache lifetime yourself

Within one WebFetch session, you can now set CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS to choose how long its URL cache lasts. A cache keeps a URL lookup result for direct reuse during the session; this variable controls that lifetime.

The default remains 15 minutes.

BUGFIX

Cloud shutdown during a permission wait no longer loses session

If Claude was waiting at a permission prompt and the cloud environment shut down, a cloud session could occasionally be marked as lost. This fix covers that exact overlap: waiting for permission while the environment closes.

In that situation, the session is no longer wrongly marked lost.

BUGFIX

MCP long connections stop reopening after timeouts

With a serverless host that ends long-held streams at a fixed timeout, an MCP v2 connection could keep reopening its subscriptions/listen stream. MCP is the protocol that connects AI to outside tools, and this stream receives subscription information.

Such servers no longer trigger endless stream reopening.

BUGFIX

Permission prompts trigger notification hooks in Desktop and VS Code

If you use a Notification hook while working in Claude Desktop or VS Code, it may previously have stayed silent for a permission prompt. A Notification hook is a small program triggered by an event and should notify you when permission is needed.

The fix covers permission prompts in those two environments.

BUGFIX

Idle Linux sandbox stops filling one CPU core

On Linux, an idle session could keep one CPU core at 100% even when sandboxing was enabled. A sandbox is a restricted environment that limits what a program can touch, and it should sit quietly when unused.

Idle sandboxed sessions no longer hit that single-core saturation.

BUGFIX

Bundled aliases still work when same-named skills shadow them

In -p mode, or after loading plugins or MCP, entering /checkup or /review could produce “Unknown command” if a user or project skill had the same name. A skill is a set of instructions that teaches Claude a particular job, and a name collision should not hide bundled aliases.

The fix covers -p and the loaded plugin or MCP cases.

BUGFIX

Command arguments no longer get re-read as template markers

After a skill or command received an argument, its value could be expanded again as template markers: special symbols the program replaces. That treated input text as another instruction to process.

Now an argument keeps its value after substitution instead of becoming template markers again.

BUGFIX

Windows device paths cannot bypass network-path checks

On Windows, a path spelled with the NT \??\ device prefix could bypass UNC path validation and expose an NTLM credential-leak vector. UNC validation is the safety check for network-share path spelling and should catch such paths.

The fix closes the leak route created through that special prefix.

FEATURE

Self-hosted runner starts without rewriting worktree

When starting claude self-hosted-runner, the session branch is now created without rewriting the worktree. A session is the connection and state for one continuous stretch of work, and its start no longer waits for two server round trips that blocked the agent launch.

The runner's session starts faster because those two round trips no longer block the agent.

FEATURE

Gateway forwards upstream error message itself

When an apps gateway receives a 400 or 413 error from Vertex, Foundry, or Claude Platform on AWS, it now carries the upstream service's own message. An upstream is the service the request was meant to reach, so its message tells you why it rejected the request.

FEATURE

Apps gateway auto-compact bug is fixed

A bug in auto-compact on apps gateway is fixed. Auto-compact condenses earlier conversation to make room for more content in a session.

Auto-compact through apps gateway is no longer affected by this bug.

FEATURE

Plugin validation finds malformed skill description files

When checking a plugin, claude plugin validate now examines a bare .claude/skills directory. It reports SKILL.md files whose frontmatter, the fields at a file's beginning for tools to read, cannot be parsed.

Validation includes .claude/skills even when it stands alone rather than inside a full structure.

FEATURE

Screen readers can choose effort with numbers

When using a screen reader to change /effort, the selector now appears as a numbered list and asks for a typed number. A screen reader is an assistive tool that reads screen content aloud and needs an ordered way to convey choices.

Hint text and dialog text are no longer clipped either.

FEATURE

Print mode flags unrecognized model IDs

If print mode sends a model ID Claude Code does not recognize, stderr, the program's text channel for reporting problems, now writes [claude-code:unrecognized_model]. The diagnostic line tells you the request went out with an unknown model ID.

Map that ID with modelOverrides to silence the line.

FEATURE

Non-GitHub repositories stop getting wrong app setup tip

If a repository's origin remote is on gitlab.com or bitbucket.org, the GitHub app setup tip no longer appears. An origin remote is the repository's destination for its remote source, so a non-GitHub destination should not ask for GitHub app setup.

The enterprise marketplace tip now covers internal Git hosts that are not GitHub.

FEATURE

Newer models hide todo tools by default, with an opt-in return

On Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models, the task-tracking tools TaskCreate, TaskGet, TaskUpdate, TaskList, and TodoWrite are no longer available. This changes the availability of existing tools; it does not add a new tool.

Set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to restore them.

BUGFIX

Windows Bash permission change narrows back overly broad rules

On Windows, auto mode repeatedly stopped for manual approval on ordinary cd <dir> && <command> > file Bash commands; that 2.1.232 regression is fixed. At the same time, 2.1.232 Bash permission changes for Cygwin-style symlinks and input redirection < file have been reverted.

A narrower version will arrive in a later release.

Original changelog

Original changelogOpen a worktree straight from a GitLab merge request
Added GitLab merge request URL support to the `--worktree` flag and the `claude agents` view (where MRs display as `!N`)
Original changelogGateway can pass user identity to proxy accounting
Added an opt-in `forward_user_identity` apps gateway setting on Anthropic upstreams that sends the signed-in user's identity as headers, so a proxy behind the gateway can attribute spend per user
Original changelogLinux Bash can cap memory for a runaway build
Added opt-in memory cgroup support for Bash tool commands on Linux (`CLAUDE_CODE_TOOL_MEMORY_LIMIT`) so a runaway build can't stall the session
Original changelogSet WebFetch URL cache lifetime yourself
Added `CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS` environment variable to configure the WebFetch session URL cache TTL (default unchanged: 15 minutes)
Original changelogCloud shutdown during a permission wait no longer loses session
Fixed cloud sessions occasionally being marked as lost when the environment shut down while Claude was waiting on a permission prompt
Original changelogMCP long connections stop reopening after timeouts
Fixed MCP v2 connections endlessly reopening the subscriptions/listen stream against servers that terminate long-held streams on a fixed timeout (e.g. serverless hosts)
Original changelogPermission prompts trigger notification hooks in Desktop and VS Code
Fixed Notification hooks not firing for permission prompts when running under Claude Desktop or VS Code
Original changelogIdle Linux sandbox stops filling one CPU core
Fixed idle sessions on Linux sometimes keeping one CPU core at 100% when sandboxing is enabled
Original changelogBundled aliases still work when same-named skills shadow them
Fixed bundled skill aliases like `/checkup` and `/review` reporting "Unknown command" in `-p` mode or with plugins/MCP loaded when a user or project skill shadows the bundled skill
Original changelogCommand arguments no longer get re-read as template markers
Fixed skill/command argument substitution to prevent argument values from being re-expanded as template markers
Original changelogWindows device paths cannot bypass network-path checks
Fixed Windows paths spelled with the NT `\??\` device prefix bypassing UNC path validation, closing an NTLM credential-leak vector
Original changelogSelf-hosted runner starts without rewriting worktree
Improved `claude self-hosted-runner` session start time: the session branch is now created without rewriting the working tree, and two server round trips no longer block the agent's launch
Original changelogGateway forwards upstream error message itself
Improved apps gateway error forwarding: 400/413 errors from Vertex, Foundry, and Claude Platform on AWS upstreams now carry the upstream's own message; fixes a bug with auto-compact on apps gateway
Original changelogApps gateway auto-compact bug is fixed
Improved apps gateway error forwarding: 400/413 errors from Vertex, Foundry, and Claude Platform on AWS upstreams now carry the upstream's own message; fixes a bug with auto-compact on apps gateway
Original changelogPlugin validation finds malformed skill description files
Improved `claude plugin validate` to check a bare `.claude/skills` directory, reporting SKILL.md files whose frontmatter fails to parse
Original changelogScreen readers can choose effort with numbers
Improved screen reader mode: the `/effort` selector renders as a numbered list with a typed-number prompt, and hint and dialog text is no longer clipped
Original changelogPrint mode flags unrecognized model IDs
Improved print mode diagnostics: a `[claude-code:unrecognized_model]` line is written to stderr when a request goes out for a model ID Claude Code doesn't recognize; map it with `modelOverrides` to silence
Original changelogNon-GitHub repositories stop getting wrong app setup tip
Changed the GitHub app setup tip to no longer appear in repositories whose origin remote is on gitlab.com or bitbucket.org; the enterprise marketplace tip now covers non-GitHub internal git hosts
Original changelogNewer models hide todo tools by default, with an opt-in return
Todo/task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; set `CLAUDE_CODE_ENABLE_TODO_TOOLS=1` to bring them back
Original changelogWindows Bash permission change narrows back overly broad rules
Windows: fixed auto mode repeatedly stopping for manual approval on ordinary `cd <dir> && <command> > file` Bash commands (a 2.1.232 regression)
Reverted the 2.1.232 Bash permission changes for Cygwin-style symlinks on Windows and for input redirections (`< file`); a narrower version will return in a later release