Claude Code 2.1.251

Read、Write 與 Edit 檔案工具以前先檢查工作目錄內的位置，之後若那個符號連結（指向另一個位置的捷徑檔）才被換掉，工具可能跟著新指向讀寫核准範圍外。現在這段先檢查、後使用的空檔已補上；通過權限檢查的路徑不能靠事後抽換而變成另一處。

搜尋文字的 Grep 與找檔名的 Glob，現在沿著符號連結（指向另一個位置的捷徑檔）進入搜尋路徑。這時也會套用 Read(...) 拒絕規則。以前直接讀某檔案會被擋，但若從連結路徑搜尋到同一檔案，規則可能沒有跟上；這個繞路差異已消失。

Workflow 工具遇到 scriptPath 時，現在先確認該工作階段能不能讀，再碰檔案內容。scriptPath 是工作流程腳本所在的位置。以前權限檢查尚未執行，工具就可能先讀取範圍外腳本，甚至把內容引用進錯誤訊息；即使最後拒絕，資料也已先被碰到。

從市集項目安裝外掛（擴充 Claude 功能的附加元件）時，裡面宣告的指令現在只能指向自己的外掛目錄。以前那條路徑可以繞到目錄外，讓看似屬於外掛的指令實際執行別處內容。現在會直接回報 path-traversal error（用路徑寫法繞出允許資料夾的錯誤）並拒絕。

專案設定不再能開啟詳細 beta tracing 或記錄原始 API body。beta tracing 是測試中的追蹤資料功能，API body 則是送往服務的原始內容。較低範圍的 beta tracing endpoint（追蹤資料送達的網址）也不能繞過受管設定或主機應用程式指定的 OTLP collector。OTLP collector 是集中接收遙測資料的服務。

背景工作階段或它的子代理，用 git worktree add 自己建立工作樹（讓同一專案平行開多份副本的 Git 功能）後，現在能在裡面改檔，不會被自己建的工作區擋住。另一個 Claude Code 程序若剛好同時重整外掛市集，背景工作階段也不會偶爾以完全沒有外掛技能的狀態啟動，並一直缺到結束。

你透過 SSH 在 tmux 裡打開背景工作階段並選取文字時，現在會像前台工作階段一樣複製到 tmux 緩衝區，不再退回 OSC 52。tmux 緩衝區（終端多工工具自己保存複製文字的地方）因此能收到內容。emacs -nw、micro 等會開 /dev/tty 的編輯器，也不再讓背景工作階段中的 Ctrl+G 失敗並顯示 Emacs quit unexpectedly。

把互動工作階段用 ←、/background 或 --bg 轉到背景後，shell 匯出的 Vertex 或 Bedrock gateway 環境變數（程式啟動前從 shell 帶入的設定）不再遺失。相關變數包含 ANTHROPIC_*_BASE_URL 與 CLAUDE_CODE_SKIP_*_AUTH；以前一丟失，每個請求都會失敗。Max 方案執行 claude --bg --model fable 時，若同帳戶的互動工作階段仍有 Fable allowance，也不再停下索取 usage credits。

你正在輸入時，外掛或 LSP 安裝建議，以及「把 auto mode 設成預設」的詢問，現在會等到文字已送出或清空才出現。LSP（讓編輯器理解程式碼的語言服務）提示不會再搶在送出鍵旁邊，避免送提示的 Enter 順手回答彈出的問題。沒有使用者看顧的工作階段，例如 agent-team 隊友窗格，也不再顯示那則一次性 auto mode 詢問，避免游離按鍵在沒人讀過時接受它。

全新安裝第一次啟動時，帳號的啟動預設若是 auto mode（Claude 不逐項詢問就自行執行的模式），現在就會直接進 auto mode，不再錯進 default mode。工作階段已在 auto mode 運作時，若中途收到受管設定 disableAutoMode，也會立刻退回 default mode，不必重開工作階段才生效。

Opus 5 在 thinking 關閉時若收到 xhigh 或 max effort，過去會以 effort … is not supported when thinking is disabled 失敗；現在這種請求改送 high。effort（模型願意投入多少推理工作的等級）因此不會因組合不支援而卡住。/effort 也改成每個模型各存自己的預設值，切換模型再切回來時，會找回該模型原本的設定。

代理團隊中，隊友的最終答案現在放進閒置通知送達 team lead，不再只送一則沒有內容的 available 通知。背景子代理收到未具名手足或上層代理的訊息時，也能正常回覆；以前 from 放的是代理類型，不是可投遞的位址，因此回信失敗。

在 GNU screen 與終端機類型設為 screen 的 tmux 工作階段裡，Claude Code 先前會把斜體文字畫成反白方塊，例如工作階段回顧那一行。這是既有顯示的修正；文字內容沒變，但重點不會再被錯誤色塊淹沒，在終端機裡也較容易讀出層次。

additionalDirectories 是額外允許使用的資料夾清單；若其中一項含空位元組（字串裡不能當一般文字處理的空字元），過去可能讓程式啟動崩潰。若內容來自 SDK 主機、IDE 或掛鉤（特定事件發生時被觸發的小程式），還可能連帶弄壞 /add-dir 與之後的設定更新。現在只略過那一項，不再讓單筆壞資料拖垮後續操作。

你在工作階段中變更目錄後，逐字稿（保存整段對話內容的紀錄檔）也可能跟著搬到另一個位置。以前若目的地已經有一份相同工作階段 ID 的逐字稿，新搬來的內容會無聲蓋掉舊檔；你既看不到警告，也可能直到回頭找對話才發現少了一份。現在這種碰撞不再造成覆蓋。

這修的是改目錄時的保存風險，不是新增另一套逐字稿功能。

使用 --input-format stream-json 時，用戶端可注入助理的工具呼叫。這些呼叫若沒有訊息 ID，過去會被併進第一則呼叫，回來的工具結果因而遺失；續接較舊的工作階段也會發生。修正後，缺少訊息 ID 不再讓後續呼叫與結果被第一則吞掉，串流整合可以維持原本的對應關係。

SDK 或雲端工作階段連接 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器時，要先等對方回覆握手確認。若確認遺失，過去整個工作階段可能無限等候；現在等 70 秒便逾時，而且只把沒回應的那台伺服器標為失敗，不會假裝有備援或改派。Remote Control 裡執行 /mcp reconnect 時，若伺服器在另一個工作階段被停用，畫面也會顯示真正的處理方式，不再只丟出隱去細節的籠統錯誤。

在自架 runner（由自己管理、負責執行工作的機器）上，卡住的 Claude Code 工作階段可能需要被強制停止。過去畫面上的工作階段雖然結束，它啟動的 Bash 工具程序仍可能留在背景執行，繼續占用機器或動到工作內容。修正後，強制停止卡住的工作階段也會清掉這些 Bash 程序，結束狀態不再只停在外層。

Bash 權限檢查（執行指令前判斷是否需要你同意的步驟）先前會自動核准一類指令：把算術式指定給整數 shell 變數，例如 OPTIND 或 RANDOM。問題在於，算術式本身仍可能帶來不該略過的行為，不能只因為外層看起來是變數指派就視為安全。現在這類指令會顯示核可提示，讓你先看過再決定是否執行；這是收緊既有判斷，不是禁止所有整數變數指派。

目前的 Opus 模型已經有 1M 上下文視窗（模型一次能參考的內容範圍）時，Claude Code 不會再提示你「切到 Opus 1M 可得 5x more context」。你本來就在那個容量上，提示既多餘也可能讓人誤以為還有另一個選項。另一個誤報發生在雲端工作階段：主機只是在建立時指定初始模型，Claude 過去卻會被告知模型已經換過。現在初始選擇不再被說成中途切換。

Team 與 Enterprise 成員執行 /usage-credits 時，若管理員把組織用量額度上限設為 $0，過去訊息會說已達上限，容易讓人以為是自己用光額度。現在畫面改為提議詢問管理員。它沒有自行提高額度，也沒有繞過組織限制；只把原因與處理方向說對，讓成員知道這是管理設定，而非一般消耗到頂。

透過 Claude apps gateway（集中轉送 Claude 請求的通道）開工作階段時，電腦裡可能還存著另一份 Anthropic 設定檔，例如 Console 登入資料。實際請求根本不使用那份設定，Claude Code 過去卻把它列為使用中，放進 /status；gateway 回覆 401 時，還會拿它再試一次。現在存著但未使用的設定檔不再出現在狀態，也不再參與 401 重試。

組織政策若關閉 Remote Control（從其他裝置操作目前工作階段的功能），Claude Code 現在只顯示一則安靜提示，不再把政策決定回報成執行失敗。停用 /bug 或 /share 時，訊息也不會誤說成 /feedback 被停用。若組織政策或環境變數真的關閉 /feedback，相關提示、/help 與拒絕訊息便不再建議使用它，避免把你引到同樣走不通的指令。

執行 claude ultrareview 或 /ultrareview 時，背後需要啟動雲端工作階段。過去只要這個工作階段起不來，指令仍可能等滿 30 分鐘才停止，使用者只能看著它懸著。現在會提早停下並報告真正原因。這是失敗路徑的改善；雲端工作階段能正常啟動時，原有的 ultrareview 流程照常進行。

在 gitlab.com 來源的專案裡，可用合併請求編號搭配 --worktree --tmux 開工作樹（Git 讓同一專案平行開工作副本的功能）。Claude Code 現在會直接抓 GitLab ref；ref 是 Git 指向特定版本的名稱。過去它會先照 GitHub 的方式嘗試抓取；因為來源明明是 GitLab，這一步注定失敗，之後才走正確流程。修正移除了這段無效嘗試，讓既有功能從一開始就採用與來源相符的抓取方式。

膠囊只在 Remote Control 開啟或失敗時顯示，點擊會到 claude.ai/code 開啟該工作階段，並可用 /remote-control 開關。登入畫面的 Bedrock, Foundry, or Vertex 按鈕也改為直達第三方供應商設定章節，不再只開文件頂端。兩項調整都在 VSCode 介面：一項縮小持續提示，一項讓設定入口落在真正有用的位置。

Read, Write, and Edit used to check a location inside the working directory, then follow it later. If that symlink was swapped in between, the file tools could read or write beyond the approved location. A symlink is a shortcut file pointing somewhere else. The check-to-use gap is now closed, so a path cannot become a different destination after approval.

Grep searches text and Glob finds file names. When either reaches files through a symlinked search path, it now applies the same Read(...) deny rules. A symlink is a shortcut file pointing elsewhere. Previously, direct reading could be denied while searching through that shortcut still reached the same file; that detour no longer changes the decision.

When Workflow receives a scriptPath, it now checks whether the session may read that location before touching the file. A scriptPath identifies where a workflow script lives. Previously, the tool could read an out-of-scope script and even quote it in an error before the permission check ran. A later denial came too late to prevent that read.

A command declared by a marketplace plugin must now point inside that plugin's own directory. A plugin is an add-on that extends Claude. Previously, its path could travel outside the directory, so a command presented as part of the plugin could execute content elsewhere. Such a path is now rejected with a path-traversal error, meaning the path notation tried to escape its allowed folder.

Project settings can no longer enable detailed beta tracing or raw API-body logging. Beta tracing is an experimental way to record diagnostic activity; an API body is the original content sent to a service. A lower-scope beta tracing endpoint also cannot bypass an OTLP collector pinned by managed settings or the host app. An OTLP collector centrally receives telemetry data.

A background session or its subagents can now edit files inside a worktree they created with git worktree add. A worktree is Git's way to open parallel working copies of one project. Separately, if another Claude Code process refreshes the plugin marketplace at the same moment, a background session no longer starts with no plugin skills and stays that way.

When you open a background session in tmux over SSH and select text, it now copies to the tmux buffer just as a foreground session does instead of falling back to OSC 52. The tmux buffer is the terminal multiplexer's own place for copied text. Editors that open /dev/tty, including emacs -nw and micro, also no longer make Ctrl+G fail with Emacs quit unexpectedly in background sessions.

After an interactive session moves to the background with ←, /background, or --bg, it now keeps Vertex or Bedrock gateway environment variables exported by the shell. Environment variables are settings supplied by the shell before a program starts. These include ANTHROPIC_*_BASE_URL and CLAUDE_CODE_SKIP_*_AUTH; losing them previously made every request fail. On Max plans, claude --bg --model fable also no longer stops for usage credits while the interactive session on the same account still has Fable allowance.

While you are typing, plugin or LSP installation suggestions and the offer to make auto mode the default now wait until the input is sent or cleared. LSP is a language service that helps an editor understand code. The Enter key used to send your prompt can no longer answer a newly appeared suggestion by accident. Unattended sessions, such as agent-team teammate panes, also no longer show the one-time auto-mode offer, where a stray keypress could accept it unread.

On the first launch after a fresh install, an account whose startup default is auto mode now actually starts there rather than in default mode. Auto mode lets Claude act without asking about each step. If managed setting disableAutoMode arrives while a session is already in auto mode, that running session moves back to default mode without needing a restart.

When thinking is disabled, Opus 5 requests with xhigh or max effort used to fail with effort … is not supported when thinking is disabled. They now send high instead. Effort is the level of reasoning work assigned to the model, so this unsupported combination no longer stops the request. /effort also saves a separate default for each model and restores that model's own setting when you switch back.

A teammate's final answer now reaches the team lead in the idle notification rather than being replaced by an empty available notice. Background subagents can also reply to messages from unnamed sibling or parent agents. Previously, from held an agent type rather than a deliverable address.

In GNU screen and tmux sessions whose terminal type is screen, Claude Code used to render italic text as highlighted blocks, including the session recap line. This fixes the existing display without changing the text itself, so the intended visual hierarchy remains readable in the terminal.

additionalDirectories is the list of extra folders a session may use. An entry containing a null byte (a non-text marker that does not belong inside a normal path) could previously crash startup. If it came from an SDK host, IDE, or hook (a small program triggered by an event), it could also break /add-dir and later settings updates. Only that malformed entry is now ignored, so one bad value no longer derails the following operations.

Changing directories during a session can relocate its transcript (the file that preserves the conversation). If the destination already held a transcript with the same session ID, the incoming one used to overwrite it silently. There was no warning, and the loss might remain hidden until you searched for the older conversation. That collision no longer overwrites the existing record.

This fixes a storage risk during directory changes; it does not introduce a separate transcript system.

With --input-format stream-json, a client can inject assistant tool calls. Calls without a message ID used to be merged into the first call, causing their tool results to disappear. The same failure could occur while resuming older sessions. Missing IDs no longer let later calls and results get swallowed by the first one, preserving the intended mapping in streaming integrations.

SDK and cloud sessions wait for an acknowledgment while connecting to an MCP server. MCP is the protocol that connects AI to external tools. If that acknowledgment was lost, the whole session could wait forever; it now times out after 70 seconds and marks only the unresponsive server as failed, without inventing a fallback or rerouting the work. In Remote Control, /mcp reconnect also shows the actual remedy when another session disabled that server instead of hiding it behind a generic error.

On a self-hosted runner (a machine you operate to execute jobs), a stuck Claude Code session may need to be force-stopped. Previously the session could disappear while Bash tool processes it started kept running in the background, still consuming the machine or touching the work. The fix terminates those Bash processes with the stuck session, so the stopped state now reaches the work underneath.

Bash permission checks (the step that decides whether a command needs your consent) used to auto-approve commands assigning arithmetic expressions to integer shell variables, including OPTIND and RANDOM. The expression can still contain behavior that should not be skipped merely because its outer form looks like an assignment. Such commands now prompt for approval so you can inspect them first. This tightens an existing decision; it does not ban every integer-variable assignment.

When the current Opus model already has a 1M context window (the amount of material a model can consider at once), Claude Code no longer suggests switching to Opus 1M for “5x more context.” You are already using that capacity, so the tip was both redundant and misleading. A second false announcement affected cloud sessions: merely choosing the initial model at session creation caused Claude to be told that its model had changed. Initial selection is no longer described as a mid-session switch.

When Team and Enterprise members run /usage-credits under an organization limit of $0, the old message said the cap had been reached, which sounded like ordinary consumption. It now suggests asking the admin. The command neither raises the limit nor bypasses organization policy; it correctly identifies this as an administrative setting and gives the member an appropriate next action.

A Claude apps gateway session (one whose requests pass through a central relay) may coexist with a stored Anthropic profile, such as a Console sign-in. Requests never use that profile, yet Claude Code used to list it as active in /status. When the gateway returned 401, it also retried with the unused profile. Stored but inactive profiles are now omitted from status and from those 401 retries.

The change aligns displayed and retry state with the credentials the gateway session actually uses.

When organization policy disables Remote Control (the feature for operating a current session from another device), Claude Code now shows one quiet notice instead of reporting the policy decision as a failure. Disabling /bug or /share no longer produces a message claiming that /feedback was disabled. When policy or an environment variable truly disables /feedback, tips, /help, and refusal messages also stop recommending it, so users are not sent toward a command that cannot work.

Running claude ultrareview or /ultrareview requires a cloud session to start behind the command. If that session failed to start, the command could still wait the full 30 minutes while the user watched it hang. It now stops early and reports the reason. This improves the failure path; when the cloud session starts normally, the existing ultrareview flow proceeds as before.

For a repository whose origin is gitlab.com, a merge-request number with --worktree --tmux opens a worktree (Git's feature for making a parallel working copy). Claude Code now fetches the GitLab ref directly; a ref names a particular Git revision. It previously tried a GitHub-style fetch first, but that attempt was doomed because the origin was GitLab. Removing the known-bad attempt lets the existing feature use a fetch method that matches the source from the start.

Its footer pill appears only while Remote Control is on or has failed. Clicking it opens that session at claude.ai/code, and /remote-control turns the feature on or off. On the sign-in screen, the Bedrock, Foundry, or Vertex button now opens the third-party provider setup section rather than the top of the documentation. One change reduces persistent visual weight; the other lands users at the relevant setup instructions.