Released: 2026-08-28
If you need to block, confirm, or annotate a model change, you can now use the PreModelSwitch and PostModelSwitch hooks. A hook is a small program triggered by a specific event. One acts before the switch and the other after it. When an old session resumes, its SessionStart hook also receives the session's staleness and estimated re-cache cost. Caching means keeping previously used material ready for reuse.
A foreground subagent's tool calls and results now stream live to Remote Control clients. A subagent is an AI helper handling part of the main agent's work. Remote viewers can see what it is doing before the whole task ends. Background subagents remain the default and still show status only, without exposing each tool action.
If you work through a Claude apps gateway with a spend limit, /usage now shows a Spend limit bar, so the distance to that limit is visible rather than buried in a total. Here, a gateway is the route a host app uses to relay Claude requests. The status line, the live information row at the bottom of the terminal, also gains rate_limits.spend_limit. Developers can use that field in their status-line scripts.
Within each session, /cost now lists the prompt-cache hit ratio, misses, tokens re-cached, and whether the cache is warm or cold. A token is a unit used to process and meter AI text. A prompt cache keeps previously used prompt material ready for reuse. Status-line scripts can read matching data from the new prompt_cache object and present it in their own layout.
When you forget how to manage a background session, claude --help now lists attach, logs, stop, respawn, and rm. There is no need to guess the command names. If --resume encounters a background session that is still running, its message now gives the exact claude attach <id> command. Replace <id> with the session identifier shown on screen.
Read, Write, and Edit used to check a location inside the working directory, then follow it later. If that symlink was swapped in between, the file tools could read or write beyond the approved location. A symlink is a shortcut file pointing somewhere else. The check-to-use gap is now closed, so a path cannot become a different destination after approval.
Grep searches text and Glob finds file names. When either reaches files through a symlinked search path, it now applies the same Read(...) deny rules. A symlink is a shortcut file pointing elsewhere. Previously, direct reading could be denied while searching through that shortcut still reached the same file; that detour no longer changes the decision.
When Workflow receives a scriptPath, it now checks whether the session may read that location before touching the file. A scriptPath identifies where a workflow script lives. Previously, the tool could read an out-of-scope script and even quote it in an error before the permission check ran. A later denial came too late to prevent that read.
A command declared by a marketplace plugin must now point inside that plugin's own directory. A plugin is an add-on that extends Claude. Previously, its path could travel outside the directory, so a command presented as part of the plugin could execute content elsewhere. Such a path is now rejected with a path-traversal error, meaning the path notation tried to escape its allowed folder.
Project settings can no longer enable detailed beta tracing or raw API-body logging. Beta tracing is an experimental way to record diagnostic activity; an API body is the original content sent to a service. A lower-scope beta tracing endpoint also cannot bypass an OTLP collector pinned by managed settings or the host app. An OTLP collector centrally receives telemetry data.
Server-managed settings that terminate sandbox TLS, route sandbox traffic through a custom proxy, inject credentials, or weaken sandbox isolation now require approval before applying. A sandbox confines program execution to a restricted area. Server ownership no longer makes these sensitive changes silent. Terminating sandbox TLS means unwrapping the encrypted connection partway; injecting credentials means attaching sign-in secrets to requests automatically.
When ANTHROPIC_CUSTOM_HEADERS in managed or project settings adds credential, organization or tenant, routing, or API-behavior headers, approval is now required. A header is an extra field sent with an API request. The named examples include Authorization and Host. This complete JSON can be placed in a settings file; Bearer example is only a sample value: {"env": {"ANTHROPIC_CUSTOM_HEADERS": "Authorization: Bearer example"}}.
When managed settings need approval, the dialog now lists only what changed since your last approval. It no longer repeats the full set of settings you already reviewed and that remain unchanged. Signing in again to the same Claude apps gateway also does not reopen the prompt if its settings are identical.
The env block in project-level .claude/settings.json can no longer set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, TMPDIR, TMP, or TEMP. Put these directory choices in the shell, user settings, or managed settings instead, so a project cannot relocate personal configuration or temporary storage. This complete JSON is suitable for user or managed settings; every path is only an example value: {"env": {"CLAUDE_CONFIG_DIR": "/example/config", "CLAUDE_CODE_TMPDIR": "/example/claude-tmp", "TMPDIR": "/example/tmp", "TMP": "/example/tmp", "TEMP": "/example/tmp"}}.
A background session or its subagents can now edit files inside a worktree they created with git worktree add. A worktree is Git's way to open parallel working copies of one project. Separately, if another Claude Code process refreshes the plugin marketplace at the same moment, a background session no longer starts with no plugin skills and stays that way.
When you open a background session in tmux over SSH and select text, it now copies to the tmux buffer just as a foreground session does instead of falling back to OSC 52. The tmux buffer is the terminal multiplexer's own place for copied text. Editors that open /dev/tty, including emacs -nw and micro, also no longer make Ctrl+G fail with Emacs quit unexpectedly in background sessions.
After an interactive session moves to the background with ←, /background, or --bg, it now keeps Vertex or Bedrock gateway environment variables exported by the shell. Environment variables are settings supplied by the shell before a program starts. These include ANTHROPIC_*_BASE_URL and CLAUDE_CODE_SKIP_*_AUTH; losing them previously made every request fail. On Max plans, claude --bg --model fable also no longer stops for usage credits while the interactive session on the same account still has Fable allowance.
While you are typing, plugin or LSP installation suggestions and the offer to make auto mode the default now wait until the input is sent or cleared. LSP is a language service that helps an editor understand code. The Enter key used to send your prompt can no longer answer a newly appeared suggestion by accident. Unattended sessions, such as agent-team teammate panes, also no longer show the one-time auto-mode offer, where a stray keypress could accept it unread.
On the first launch after a fresh install, an account whose startup default is auto mode now actually starts there rather than in default mode. Auto mode lets Claude act without asking about each step. If managed setting disableAutoMode arrives while a session is already in auto mode, that running session moves back to default mode without needing a restart.
When thinking is disabled, Opus 5 requests with xhigh or max effort used to fail with effort … is not supported when thinking is disabled. They now send high instead. Effort is the level of reasoning work assigned to the model, so this unsupported combination no longer stops the request. /effort also saves a separate default for each model and restores that model's own setting when you switch back.
If a model turn produces only thinking and no text, the conversation no longer gets stuck on text content blocks must be non-empty. Thinking is the model's reasoning work before an answer, and its absence of a text block no longer blocks what follows. If a tool call is malformed, retry now removes the broken output from context rather than retrying with the same bad material. This applies on Bedrock, Vertex, and Foundry.
A teammate's final answer now reaches the team lead in the idle notification rather than being replaced by an empty available notice. Background subagents can also reply to messages from unnamed sibling or parent agents. Previously, from held an agent type rather than a deliverable address.
After Claude Desktop delivers a message from another session, SendMessage replies to that session ID now travel back through Claude Desktop instead of failing with not reachable. Claude is also told that the sender is a worker inside the current session, meaning a subagent assigned part of this work, not an unrelated Claude session. While viewing a background-subagent or fork transcript opened from the subagent panel or /tasks, the input placeholder now reads Message @name….
With many parallel subagents, each per-second progress tick now replaces its predecessor instead of adding another transcript line and making the TUI lag. A TUI is a text interface operated inside the terminal, and it now keeps only the latest progress view. Interactive sessions also cut redundant UI redraws during turns, reducing CPU use. Neither change hides final work; both avoid repainting transient information that need not remain.
In GNU screen and tmux sessions whose terminal type is screen, Claude Code used to render italic text as highlighted blocks, including the session recap line. This fixes the existing display without changing the text itself, so the intended visual hierarchy remains readable in the terminal.
Text shown while managing MCP (Model Context Protocol, the standard that connects AI to external tools) is now more trustworthy. The menu's copy shortcut explains how the sign-in URL was copied instead of always claiming success, while claude mcp add --header and claude mcp add-json now name the correct transports. MCP server names are also sanitized before appearing in errors, menus, and command results, keeping unwanted content out of those surfaces.
additionalDirectories is the list of extra folders a session may use. An entry containing a null byte (a non-text marker that does not belong inside a normal path) could previously crash startup. If it came from an SDK host, IDE, or hook (a small program triggered by an event), it could also break /add-dir and later settings updates. Only that malformed entry is now ignored, so one bad value no longer derails the following operations.
Changing directories during a session can relocate its transcript (the file that preserves the conversation). If the destination already held a transcript with the same session ID, the incoming one used to overwrite it silently. There was no warning, and the loss might remain hidden until you searched for the older conversation. That collision no longer overwrites the existing record.
This fixes a storage risk during directory changes; it does not introduce a separate transcript system.
With --input-format stream-json, a client can inject assistant tool calls. Calls without a message ID used to be merged into the first call, causing their tool results to disappear. The same failure could occur while resuming older sessions. Missing IDs no longer let later calls and results get swallowed by the first one, preserving the intended mapping in streaming integrations.
SDK and cloud sessions wait for an acknowledgment while connecting to an MCP server. MCP is the protocol that connects AI to external tools. If that acknowledgment was lost, the whole session could wait forever; it now times out after 70 seconds and marks only the unresponsive server as failed, without inventing a fallback or rerouting the work. In Remote Control, /mcp reconnect also shows the actual remedy when another session disabled that server instead of hiding it behind a generic error.
On a self-hosted runner (a machine you operate to execute jobs), a stuck Claude Code session may need to be force-stopped. Previously the session could disappear while Bash tool processes it started kept running in the background, still consuming the machine or touching the work. The fix terminates those Bash processes with the stuck session, so the stopped state now reaches the work underneath.
When Bash runs in a sandbox (an isolated environment that limits what a program can touch), Claude Code creates an output file and reads it back for display. The creation and readback path has changed: a sandboxed command can no longer redirect that output elsewhere or replace the file before Claude Code reads it. This strengthens the existing isolation. It does not change the intended Bash output; it makes sure the displayed content truly came from that command.
Bash permission checks (the step that decides whether a command needs your consent) used to auto-approve commands assigning arithmetic expressions to integer shell variables, including OPTIND and RANDOM. The expression can still contain behavior that should not be skipped merely because its outer form looks like an assignment. Such commands now prompt for approval so you can inspect them first. This tightens an existing decision; it does not ban every integer-variable assignment.
When the current Opus model already has a 1M context window (the amount of material a model can consider at once), Claude Code no longer suggests switching to Opus 1M for “5x more context.” You are already using that capacity, so the tip was both redundant and misleading. A second false announcement affected cloud sessions: merely choosing the initial model at session creation caused Claude to be told that its model had changed. Initial selection is no longer described as a mid-session switch.
CLAUDE_CODE_SUBAGENT_MODEL now sets the default subagent model instead of overriding everything. Both an agent definition's model: and a model explicitly chosen for each spawn take precedence over the environment variable; this release does not state which of those two wins over the other. A complete JSON shape is {"env": {"CLAUDE_CODE_SUBAGENT_MODEL": "opus"}}; opus is only an example value. Seat-based Enterprise subscriptions now default to Opus 5, matching other premium plans.
When the active model is not a recognized Claude model, a Git commit (a versioned record of code changes) should not guess a specific model identity. This commonly happens with a third-party model behind a custom ANTHROPIC_BASE_URL. The default commit trailer is now the exact Co-Authored-By: Claude Code, crediting the tool that performed the work instead of inventing who sits behind it.
Recognized Claude models are outside this change's condition.
When Team and Enterprise members run /usage-credits under an organization limit of $0, the old message said the cap had been reached, which sounded like ordinary consumption. It now suggests asking the admin. The command neither raises the limit nor bypasses organization policy; it correctly identifies this as an administrative setting and gives the member an appropriate next action.
A Claude apps gateway session (one whose requests pass through a central relay) may coexist with a stored Anthropic profile, such as a Console sign-in. Requests never use that profile, yet Claude Code used to list it as active in /status. When the gateway returned 401, it also retried with the unused profile. Stored but inactive profiles are now omitted from status and from those 401 retries.
The change aligns displayed and retry state with the credentials the gateway session actually uses.
Under CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST (where the host manages provider connectivity for Claude Code), such as Claude Desktop, an Amazon Bedrock session may receive a Bedrock model ID or ARN directly. With that identifier already supplied, the session no longer waits for inference-profile discovery. The change is limited to host-managed sessions given a model ID or ARN; it does not say that every Bedrock flow skips discovery.
/radio is now available on Bedrock, Vertex AI, Foundry, Claude Platform on AWS, and when telemetry (product-usage data sent back to the service) is disabled. On Bedrock, Vertex, Foundry, or with telemetry disabled, the footer PR badge (the small marker showing GitHub pull-request status) no longer runs gh pr view. It gets credentials through gh auth token, GH_TOKEN, or GITHUB_TOKEN and calls the GitHub API directly.
If a session's network proxy drops during a Bash command, the tool result names the host and reason instead of only connection reset. A transient GitHub failure during cloud-session creation now tells you to retry rather than redo GitHub setup. /schedule also explains that MCP servers configured in Claude Code cannot be attached to cloud routines, instead of merely reporting that no MCP connectors exist.
When organization policy disables Remote Control (the feature for operating a current session from another device), Claude Code now shows one quiet notice instead of reporting the policy decision as a failure. Disabling /bug or /share no longer produces a message claiming that /feedback was disabled. When policy or an environment variable truly disables /feedback, tips, /help, and refusal messages also stop recommending it, so users are not sent toward a command that cannot work.
Running claude ultrareview or /ultrareview requires a cloud session to start behind the command. If that session failed to start, the command could still wait the full 30 minutes while the user watched it hang. It now stops early and reports the reason. This improves the failure path; when the cloud session starts normally, the existing ultrareview flow proceeds as before.
The Claude Code native binary (a program file the operating system can run directly) is now about 5 MB smaller. A separate trim removes syntax highlighting for six rarely used languages and makes the binary another 2.5 MB smaller: 1c, gml, isbl, mathematica, maxima, and sqf. Syntax highlighting colors text according to code structure, so the stated removal concerns colored display for those languages; it does not announce removal of every form of language support.
Browser actions from Claude in Chrome now always pass through Claude Code's permission checks (the step that decides whether an action needs your consent). In sessions with telemetry disabled, those actions previously switched to the Chrome extension's own prompts, so identical actions could present a different approval path. They no longer detour to extension prompts when telemetry is off. This unifies the existing permission process; it does not make browser actions run without review.
For a repository whose origin is gitlab.com, a merge-request number with --worktree --tmux opens a worktree (Git's feature for making a parallel working copy). Claude Code now fetches the GitLab ref directly; a ref names a particular Git revision. It previously tried a GitHub-style fetch first, but that attempt was doomed because the origin was GitLab. Removing the known-bad attempt lets the existing feature use a fetch method that matches the source from the start.
Analytics (data used to understand product usage) could previously turn off before sign-in solely because managed settings required gateway login. The same happened when managed settings could not be read. Neither pre-sign-in condition now disables analytics by itself. Analytics stay off after signing in to the gateway or through DISABLE_TELEMETRY. A complete JSON example is {"env": {"DISABLE_TELEMETRY": "true"}}; true is an example value.
Its footer pill appears only while Remote Control is on or has failed. Clicking it opens that session at claude.ai/code, and /remote-control turns the feature on or off. On the sign-in screen, the Bedrock, Foundry, or Vertex button now opens the third-party provider setup section rather than the top of the documentation. One change reduces persistent visual weight; the other lands users at the relevant setup instructions.
Added `PreModelSwitch` and `PostModelSwitch` hook events (block, confirm, or annotate a model switch); `SessionStart` resume hooks now receive session staleness and the estimated re-cache costAdded live streaming of a foreground subagent's tool calls and results to Remote Control clients (background subagents, the default, still show status only)Added a Spend limit bar to `/usage` and a `rate_limits.spend_limit` status line field for developers behind a Claude apps gateway with spend limitsAdded a per-session prompt-cache line to `/cost` (hit ratio, misses, tokens re-cached, warm/cold) and a matching `prompt_cache` object for status line scriptsAdded `attach`, `logs`, `stop`, `respawn`, and `rm` to `claude --help`; the `--resume` message for a running background session now names the exact `claude attach <id>` commandFixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved locationFixed Grep and Glob not applying `Read(...)` deny rules to files reached through a symlinked search pathFixed the Workflow tool reading (and quoting in errors) a `scriptPath` outside what the session may read before the permission check ranFixed plugin commands declared in a marketplace entry being able to point outside the plugin directory; such paths are now rejected with a path-traversal errorFixed project settings being able to enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint bypassing an OTLP collector pinned by managed settings or a host appChanged server-managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials, or weaken sandbox isolation to require approval before they applyChanged `ANTHROPIC_CUSTOM_HEADERS` from managed or project settings to require approval when it sets a credential, org/tenant, routing, or API-behavior header (e.g. `Authorization`, `Host`)Improved the managed settings approval dialog to list only the settings that changed since you last approved them
Fixed the managed-settings approval prompt re-appearing after signing in again to the same Claude apps gateway when the settings are unchangedChanged project-level `.claude/settings.json` `env` to no longer set `CLAUDE_CONFIG_DIR`, `CLAUDE_CODE_TMPDIR`, or `TMPDIR`/`TMP`/`TEMP`; set them in your shell, user, or managed settings insteadFixed background sessions and their subagents being unable to edit files inside a git worktree they created with `git worktree add`
Fixed background sessions occasionally starting without any plugin skills (and staying that way) when another Claude Code process was refreshing the plugin marketplace at the same momentFixed selecting text in an opened background session inside tmux over SSH: it now copies to the tmux buffer like a foreground session instead of falling back to OSC 52
Fixed Ctrl+G failing with "Emacs quit unexpectedly" in background sessions for editors that open `/dev/tty`, such as `emacs -nw` and `micro`Fixed backgrounded sessions (`←`, `/background`, `--bg`) losing a Vertex/Bedrock gateway (`ANTHROPIC_*_BASE_URL` + `CLAUDE_CODE_SKIP_*_AUTH`) exported in the shell, so every request failed
Fixed `claude --bg --model fable` on Max plans stopping to ask for usage credits while the interactive session on the same account still had Fable allowanceFixed the one-time "make auto mode your default" offer appearing in unattended sessions (e.g. agent-team teammate panes), where a stray keypress could accept it unread
Changed plugin/LSP install suggestions and the auto-mode default offer to wait until you've sent or cleared what you're typing, so the Enter that sends your prompt can't answer themFixed the first launch on a fresh install starting in default mode instead of auto mode for accounts whose startup default is auto mode
Fixed managed-settings `disableAutoMode` arriving mid-session not moving an already-running auto-mode session back to default modeFixed Opus 5 requests failing with "effort … is not supported when thinking is disabled" when effort was xhigh/max and thinking was turned off; effort is now sent as `high` in that case
Changed `/effort` to save your default effort level per model, so each model keeps its own setting when you switchFixed conversations getting stuck on "text content blocks must be non-empty" errors after a turn where the model produced only thinking
Improved retry when the model's tool call is malformed: the broken output is now dropped from the retry context, including on Bedrock, Vertex, and FoundryFixed agent teams: a teammate's final answer not reaching the team lead — it now arrives in the idle notification instead of a content-free "available" notice
Fixed background subagents being unable to reply to a message from an unnamed sibling or parent agent (`from` was the agent type, which is not an address)Fixed replying to a message Claude Desktop delivered from another session: `SendMessage` to that session id now delivers through Claude Desktop instead of failing with "not reachable"
Improved framing of messages from your own subagents: Claude is told the sender is a worker inside this session, not an unrelated Claude session
Improved the prompt placeholder to read "Message @name…" while viewing a background subagent or fork transcript opened from the subagent panel or `/tasks`Fixed TUI lag with many parallel subagents: per-second progress ticks now replace their predecessor instead of piling up in the transcript
Improved CPU usage during turns in interactive sessions by cutting redundant UI re-rendersFixed italic text (such as the session recap line) rendering as highlighted blocks in GNU screen and in tmux sessions using a `screen` terminal typeFixed the MCP server menu's copy shortcut: it now says how the sign-in URL was copied instead of always claiming success
Fixed `claude mcp add --header` and `claude mcp add-json` help text naming the wrong transports
Improved sanitization of MCP server names in error messages, menus, and command resultsFixed an `additionalDirectories` entry containing a null byte crashing startup, or breaking `/add-dir` and later settings updates when it came from an SDK host, IDE, or hook; it is now skippedFixed session transcripts being silently overwritten when a directory change relocated a session onto an existing same-ID transcriptFixed `--input-format stream-json`: client-injected assistant tool calls sent without a message id were merged into the first one and their results lost, including when resuming older sessionsFixed SDK and cloud sessions hanging indefinitely when an SDK MCP server's handshake acknowledgment was lost; the wait now times out after 70 seconds and marks only that server failed
Fixed `/mcp reconnect` on Remote Control showing a generic withheld-detail error instead of the real remedy when a server was disabled in another sessionFixed self-hosted runner leaving a stuck session's Bash tool processes running after the session was force-stoppedChanged how Bash command output files are created and read back when commands run in the sandbox, so a sandboxed command cannot redirect or replace themFixed Bash permission checks auto-approving commands that assign an arithmetic expression to an integer shell variable (e.g. `OPTIND=1/0`, `RANDOM=2+2`); these now prompt for approvalFixed a "switch to Opus 1M for 5x more context" tip that appeared even when the current Opus model already has a 1M context window
Fixed cloud sessions telling Claude the model had changed when the host was only setting the session's initial modelChanged `CLAUDE_CODE_SUBAGENT_MODEL` to set the default subagent model rather than override everything: an agent definition's `model:` and an explicit per-spawn model now take precedence over it
Changed the default model for seat-based Enterprise subscriptions to Opus 5, matching other premium plansChanged the default commit trailer to `Co-Authored-By: Claude Code` when the active model isn't a recognized Claude model (e.g. third-party models behind a custom `ANTHROPIC_BASE_URL`)Fixed `/usage-credits` for Team and Enterprise members whose admin set the org's usage-credit limit to $0: it now offers to ask the admin instead of saying a cap was reachedFixed Claude apps gateway sessions treating a stored Anthropic profile (e.g. a Console sign-in) as active: listing it in `/status` and retrying gateway 401s with it, though requests never use itImproved Amazon Bedrock session start under `CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST` (e.g. Claude Desktop): a session given a Bedrock model ID or ARN no longer waits for inference-profile discoveryChanged `/radio` to be available on Bedrock, Vertex AI, Foundry, and Claude Platform on AWS, and when telemetry is disabled
Changed the footer PR badge on Bedrock, Vertex, and Foundry, and when telemetry is off, to call the GitHub API directly (via `gh auth token`, `GH_TOKEN`, or `GITHUB_TOKEN`) instead of `gh pr view`Improved cloud sessions: when the session's network proxy drops a connection during a Bash command, the tool result now names the host and reason instead of only "connection reset"
Fixed cloud session creation advising GitHub setup after a transient GitHub connection failure — the message now says to retry instead
Improved `/schedule` to explain that MCP servers configured in Claude Code can't be attached to cloud routines, instead of a bare "No MCP connectors" messageFixed Remote Control reporting a failure when an organization's policy disables it; it now shows a single quiet notice instead
Fixed disabled `/bug` and `/share` reporting that `/feedback` was disabled; tips, `/help`, and refusal messages no longer suggest `/feedback` when an org policy or env var turns it offFixed `claude ultrareview` and `/ultrareview` waiting the full 30 minutes when the cloud session fails to start; they now stop early and report the reasonImproved install size: the native binary is about 5 MB smaller
Removed syntax highlighting for six rarely used languages (1c, gml, isbl, mathematica, maxima, sqf); the binary is 2.5 MB smallerChanged Claude in Chrome so browser actions always go through Claude Code's permission checks, including in sessions with telemetry disabled, which previously used the Chrome extension's own promptsFixed `--worktree --tmux` with a merge-request number on a gitlab.com origin trying a doomed GitHub-style fetch first instead of fetching the GitLab ref directlyChanged analytics to no longer turn off before sign-in solely because managed settings force gateway login (or cannot be read); they stay off once signed in to the gateway or via `DISABLE_TELEMETRY`[VSCode] Fixed the sign-in screen's "Bedrock, Foundry, or Vertex" button opening the docs at the top of the page instead of the third-party provider setup section
[VSCode] Changed the Remote Control banner to a footer pill (shown while Remote Control is on or has failed) that opens the session on claude.ai/code; turn it on or off with `/remote-control`