發布日期：2026-09-01
你在 Claude Code 裡選 Fable 這一檔模型時，現在拿到的是新版 Fable 5.1（模型代號 claude-fable-5-1），已接手成 Fable 系列的預設，不必自己指定。它能一次讀進一百萬個 token（AI 一次能納入考量的文字量單位），大專案的程式碼一次丟給它都吞得下。計費每百萬輸入 token 十美元、輸出五十美元；暫存過的內容再讀一次只要每百萬 0.25 美元，反覆追問同一批檔案便宜很多。但有個過渡限制：透過官方閘道（gateway，把請求轉給模型的中間層）跑的工作階段，打 fable 或 best 目前仍落到 Fable 5——閘道還沒設定好會拒收 5.1，要用就在 /model 手動挑。
Claude Code 每輪回答結束會標一個時間，逐字稿（transcript，把整段對話存成純文字的紀錄）裡每則訊息也有時間戳記。以前這個格式固定，現在多了兩個設定：timeFormat 決定顯示樣式，可填 12 小時制、24 小時制、24 小時制 UTC，或一段 strftime 格式字串（用 %H:%M 這類代號自己拼時間長相）；timeZone 決定用哪個時區換算。在 settings.json 裡加，例如：
{
"timeFormat": "24-hour",
"timeZone": "Asia/Taipei"
}自動模式（auto mode，Claude 不逐項問你、直接執行的檔次）下跑一長串工作時，現在多攔三種動作。第一是「Containment Escape」規則：抓雲端主機的中繼資料憑證（metadata-credential，換取存取權的一段資訊）、繞過對外流量限制、或跨租戶讀別人的資源，不再自動放行，除非環境標示為預期行為。第二是第一次讀工作目錄外的檔案時跳一次性提醒，可當場擋掉；要永遠擋就在 settings.json 放 {"permissions": {"blockReadsOutsideWorkingDirectories": true}}。第三是 Cowork／claude.ai 雲端階段裡，讀不屬於你的產物（artifact，對話生成的檔案）一律先問你，自動模式也不例外。
你請 Claude 分頭跑好幾個子代理（subagent，主對話派出去、各自幹一小塊活的分身）時，每個子代理可能有自己被指定的模型：有的在派出當下指定，有的寫死在代理定義檔裡。想讓它們全部改用某一個模型，以前得一個個翻出來改。現在多了 CLAUDE_CODE_SUBAGENT_MODEL_FORCE 這個環境變數（environment variable，在系統層設定、程式啟動時讀取的參數）。把它打開，CLAUDE_CODE_SUBAGENT_MODEL 指定的模型（沒指定就是主對話用的模型）會套到每一個子代理身上，那些個別指定一律被忽略。適合你想壓成本、或想確保整批任務一致時一次生效。
/effort 是調 Claude 想多久再回答的指令——力度高，思考更透徹但慢、也更貴；力度低則相反。以前用它會把設定改成長期的，之後每個工作階段（session，一次從開啟到結束的對話）都跟著變。現在 /effort 選單裡多了一個 s：挑它就只改當前這個工作階段，關掉視窗就回到你原本的預設，跟 /model 早就有的作法一致。另外，換到一個新模型時，它自帶的「預設力度鎖定」現在也只鎖這個工作階段，不再是永久；如果你是透過遠端遙控（Remote Control）從 claude.ai 那邊挑好力度再連進來，那個選擇在鎖定期間會直接生效。
有些公司會讓 Claude Code 透過自家閘道（gateway，把請求轉給模型的中間層）連到一批內部模型，開關是環境變數 CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY。以前這些模型在 /model 選單裡只有名字，看不出差別。現在閘道可以隨每個模型附一段 description，選單就照著顯示；沒附說明的仍寫「From gateway」。搭配的一項調整：這個發現動作即使你設了 CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC（關掉非必要對外連線）也照跑，因為它只問你自己的閘道、不對外。
/btw（by the way 的縮寫）讓你在不打斷主線任務的情況下，臨時問 Claude 一個小問題，問完再回到原本的答案。以前在這些側邊問答之間翻頁用 ←／→，跟其他地方的方向鍵功能容易撞。現在改成 Shift+←／Shift+→，也可以用 [／]，一路翻過你最近幾個插話問題、再翻回正在進行的答案。另外修好一個卡點：在 claude agents（管理子代理的畫面）裡開著 /btw 面板時按 ← 原本沒反應，現在它會帶你回子代理清單，就算問答還沒結束也行；重新打開那個工作階段時，面板會再出現。
/add-dir（以及啟動時的 --add-dir、設定裡的 additionalDirectories）用來把額外的資料夾納入 Claude 的工作範圍，連同那個資料夾的 skills、指令、代理一起載入。這版收拾了兩個相反方向的毛病。一是網路路徑：Windows 的 UNC 網路共享、/net/<主機> 這類自動掛載，現在會在真的去碰之前就擋下並說明，Windows 使用者請改用對應到磁碟機代號的路徑。二是就在你目前工作目錄底下的子資料夾，以前 /add-dir 會無理由拒絕，現在會接受，並像啟動時的 --add-dir 一樣載入該資料夾的 skills、指令、代理。
bypassPermissions 是最寬鬆的權限檔次，Claude 幾乎什麼都不問就做。過去只要在專案的 .claude/settings.json 或 .claude/settings.local.json 裡把 defaultMode 設成 "bypassPermissions"，一打開這個專案就進入這個模式。問題是這種檔案常跟著程式碼一起流通，等於任何人送你一份專案就能決定你的機器不設防。現在專案層級的這個值會被忽略，行為跟設 "auto" 一樣。要真的用這個模式，改在使用者層級或受管理設定裡設，或每次啟動時自己加 --permission-mode。
公司用受管理設定統一配置 Claude Code 時，這批修那條路上的毛病。policyHelper（核對公司政策的小程式）被開機快取蓋掉，以前要等下次開機才更新，現在伺服器一回報設定移除就立刻改跑或退出。managedSourcesBehavior: "merge" 下，sandbox.credentials.awsPairs、sandbox.ripgrep 現在採最高階來源整份沿用；timeoutMs、refreshIntervalMs 填超過計時器上限（2147483647）也會被夾回合法範圍，不再整個失敗。診斷更清楚：更新失敗顯示在 /status，婉拒對話框印出退出原因，逾時明講成逾時；核准對話框在設定同時動追蹤或匯出時也顯示對應措辭。
透過 Bedrock、Vertex、Foundry 跑 Claude Code，這批修的是請求裡夾帶不該夾的登入資訊。重複列了兩次的自訂 Authorization 標頭曾蓋掉你的憑證（Bedrock、Mantle、Vertex、WIF 都中招）、Vertex 精靈撿到殘留舊設定檔、官方閘道把多餘標頭送給 Foundry／Vertex／Bedrock 且 Foundry Entra ID 上游啟動失敗、API 金鑰模式下殘留 Anthropic 金鑰跟著多送——都不再發生，閘道登入與 token 更新也開始驗證固定 TLS 憑證。另外，工作階段過期後重開會說「已結束」並給 /login；免金鑰的 Console 登入也會套用組織設定、/status 顯示所屬組織。
這組都跟「Claude 要不要停下來問你」有關。介面上，權限確認框底下的 Ctrl+E 指令說明拿掉了；Edit（改檔）確認框的差異檢視，以前把 emoji 等多碼字元寬度算錯、排版會歪，現在對齊了。真正重要的是三個漏洞收口：permissions.ask（要求先問過的規則）若指令包在複合指令或子殼層裡跑，以前會被自動模式跳過不問，現在照攔；某些 [[ ]] 條件 zsh 跟 bash 解讀不同，以前自動放行，現在跳確認；Bash 的 Read／Edit 拒絕規則，以前對 < 檔案 重新導向、tac、egrep 這類讀檔指令不生效，現在命中任一參數或導向目標就整條拒絕。
背景工作階段（background session，丟給 Claude 在後台跑的任務）這批修「根本啟動不了」的幾種情形。macOS 上用 npm 安裝、碰上 Claude Code 自我更新時，背景工作階段會開不起來；Windows 上過期的 daemon（常駐服務程式）鎖檔指向被重用行程編號，也一樣。另一種是另一個行程正在下載更新，開背景工作階段會直接報「Couldn't start the background service」，現在會等下載完再啟動。還有兩個收拾殘局的：更新後仍跑舊版執行檔的背景工作階段以前會堆著不退場，現在會被汰換；cc-daemon-* 這種啟動中斷留下的暫存資料夾，現在會被 cleanupPeriodDays 保留期一併掃掉。
這批修 claude agents（管理背景工作階段的畫面）跟指令列「記錯狀態」的幾個地方。state.json 的 detail 欄位被排程喚醒後會重複原本派工指令，不更新。重新對已完成的背景工作階段追問後，理應回清單前面，卻卡在「Completed」舊位置，現在照最新完成時間排序。從已刪掉的目錄打 claude --bg，以前謊報成功、留下壞紀錄，現在印出失敗原因並以結束碼 1 收場。--resume 把背景對話列兩次，--continue 打開的是背景化前卡住的舊副本；現在 --continue 也能打開跑完的背景工作階段，claude --resume <session-id> --bg 在沒人跑那個工作階段時會接續原編號，真要另起副本才明講。
背景工作階段被中斷時，這批讓狀態如實反映。Ctrl+S 在開啟的背景工作階段暫存提示，閒置或停止後重開以前會不見，現在保得住。用 ← 或 Ctrl+B 把任務丟到背景時，子代理或工具正跑，曾誤判工具被拒絕；現在會正確重跑。從任務面板或用戶端停止背景指令時，以前 Claude 不會被告知，現在會。停止背景子代理時，它的監控（monitor，代替你盯著某件事、完成或逾時就通知）以前會繼續跑，現在會停掉。用 timeout 或 setsid 把背景指令和 shell 脫鉤時，停止任務或結束 Claude Code 後它以前仍會跑，現在也會結束。另外，claude agents 以前不會說「有背景工作階段在等你核准另一階段傳來的訊息」也不說是誰傳的，現在會清楚顯示。
這批修 claude agents（管理子代理畫面）跟逐字稿的可用性。用 ← 開子代理工作階段，以前沿用原權限模式、蓋掉目標 defaultMode 與 permissionMode，現在照目標走；Ctrl+G 重新綁定以前不生效，Ctrl+S、Ctrl+T 現在可透過新 Agents 情境重綁。切到另一子代理逐字稿，用量計數器常凍住，現在即時更新；claude agents --json 以前會短暫切終端機成 raw 模式、退出蓋掉別程式設定，現在不會。子代理被睡眠、斷線或伺服器錯誤打斷，以前停在半截，現在自動接完；重新接續已停掉的子代理，主對話以前不被告知，現在會；逐字稿超 5MB 的子代理恢復或傳訊，以前報「No transcript found」，現在正常。
提示快取（prompt cache，記住送過的內容、下次不重算不重收費）本是省錢機制，這批修幾個讓它悄悄失效的漏洞。遠端遙控在工作階段進行到一半才連上時，會重送一次 Bash 工具定義，光這樣就讓快取失效，現在不會。設了顧問模型（advisor model，輔助主模型判斷的模型）的工作階段，背景請求以前吃不到快取、每次重送整段對話，現在能命中；背景請求指壓縮對話、/recap 這類動作。對話倒帶回空白後，/model 跟 /effort 以前會多顯示一則快取警告，現在不會。長時間夾大量截圖的工作階段，圖片超單次請求上限後每輪快取失誤，這問題已修。/fork（把對話另開一份背景工作階段）現在會把原本快取保留到新階段，做法是把工作樹簡報改成訊息帶過去，不動系統提示本身。
遠端遙控（Remote Control，讓你從手機或另一台裝置連進正在跑的 Claude Code）這批修的是「同意」跟「聽誰的」出錯的地方。以前不管是按 Esc、還是在 claude remote-control 選單裡按 n，用意都是拒絕連線，卻被系統當成「已經同意」記下來，導致下一次請求直接連上、不再問你。這次修好，真的按了拒絕才算數。另一個是從 Claude app 發起的遠端遙控工作階段，以前會忽略你在 app 裡選好的模型，逕自用這台機器的預設模型跑，現在會照你選的模型執行。
MCP（Model Context Protocol，讓 Claude 連外部工具的協定）這批修連線與紀錄。/mcp 重新連線或啟用時，現在會擋住啟動後才被允許／拒絕清單或 strictPluginOnlyCustomization 禁用的設定檔伺服器。受此設定限制時，claude mcp remove 會連同遠端伺服器的 OAuth 憑證清掉。claude mcp add/remove 遇到 .mcp.json 是 FIFO 或裝置檔符號連結，現在會快速失敗並說明原因，不再卡住或吃光記憶體。WebSocket 失敗會顯示真正錯誤，不再只印「[object ErrorEvent]」；連線與 OAuth 紀錄也會遮蔽網址或標頭的憑證。
沙盒（sandbox，把 Claude 動作限制在安全範圍內的隔離環境）與工作樹這批，修的是邊界沒守住、或殘留沒被發現的地方。網路主機名結尾多打一個點時，deniedDomains 以前擋不住這個 host，「不要再問」也一直重複跳出，現在能正確擋下。外掛宣告的元件路徑如果是指向外部的符號連結，以前能藉此讀到外面的檔案，現在會被拒絕並報錯。工作樹隔離的工作階段，以前把不碰 git 的 Bash 迴圈、$VAR 讀取、heredoc 都當成太複雜而拒絕，現在能正確放行；cd 進連結工作樹的子目錄後，對共用 .git 目錄的寫入權限以前會不見，現在不會。另外，/doctor 現在會提醒你，被強制結束的工作階段留下的沙盒遮罩檔還在。
這批修的是 Claude Code 「重新讀設定」這件事沒做徹底的幾個地方。專案裡如果是啟動之後才建立的 .claude/ 資料夾，裡面的設定以前要等重開才會被讀到，現在啟動後建立也能生效。allowManagedPermissionRulesOnly（只允許受管理規則生效）開啟時，第一次設定重新載入後，--disallowedTools 跟工作階段層級的拒絕規則以前會被連帶清掉，現在會保留。另外，遙測（telemetry，回報使用狀況的機制，這裡指 OTEL）透過受管理設定推送下來的值，暖啟動時以前會被忽略，桌面版 App 開的 Code 工作階段也中招，現在都會生效。暖啟動指沿用既有行程、不是整個重開機的啟動方式。
這批讓終端機畫面在長對話裡跑得更順，也修掉幾個卡住的小地方。渲染效能改善：每輪要重繪的東西變少，串流不會因回答變長跟著變慢，背景代理更新不再整個畫面重繪；輸入框打字要重繪的量也減少，延遲跟著降。修好的：工作指示燈以前會在回應串流到一半、被 slash 指令面板擋住時停止轉動，看起來像卡住，現在不會；自動接續的 slash 指令回應串流時，畫面下方以前會多冒一行幽靈重複指令列，現在不會；全螢幕模式下以前點不了 ! 的 shell 輸出去展開，現在點得到；貼帶 ANSI 顏色碼的文字進 /feedback 這類對話框以前會當掉，現在不會。另外，emoji 自動完成現在認得剩下的 GitHub／Slack 簡碼別名。
這批修無頭模式（headless，沒有終端機視窗，常見於腳本、CI）跟長時間串流該等或該停的情形。claude -p 印完結果後，模型啟動 Monitor（背景監看任務）若還在跑，以前約 5 秒就退出，現在等它觸發或逾時。管線輸入不是合法 JSONL 時，以前記憶體會無止盡成長，現在會快速失敗並說明錯誤。Proactive 輸出風格的工作階段，背景指令或 Monitor 還在跑時以前會用填充訊息與重讀日誌瞎忙，現在會閒置。Bedrock 與 Bedrock Mantle 長時間隱藏思考時，以前會被閒置逾時切斷；現在串流帶進度事件。SDK 主機端也改善存活回報，調高 CLAUDE_STREAM_IDLE_TIMEOUT_MS 後的長等待不再被誤判卡死。
這版收攏幾個零散修復。/schedule 存的提示少了訊息角色時，以前會空跑，現在正常執行；隊友權限請求碰上隊長信箱暫鎖時，不再回覆兩次；agent-team 隊友確認關閉後，tmux 或 iTerm2 分頁會關掉。雲端工作階段啟動時網路代理失敗，不再整段遺失 git／GitHub 憑證，會背景重試恢復。/code-review --comment 可用 glab mr note 貼 GitLab 合併請求；排隊的 MCP elicitation 或權限詢問，會同時送出閒置通知；claude self-hosted-runner --configure-git 會開 git push 協商，舊複製版首推新分支只傳新提交；同時完成的非同步 hook 通知會合成一行。
這版 VSCode（微軟程式編輯器）擴充套件整理側欄與操作。工作階段清單新增可收合的 ACCOUNT & USAGE、SESSION MANAGER、Ungrouped 區；前兩區有帳號、用量與詳情連結。輸入列模型膠囊可選模型，含 Effort 與 More models；命令選單可選含自訂的輸出風格。第三方供應商不再顯示 claude.ai 專用功能或殘留登入，用量也會先顯示上次記錄；Enable Remote Control for all sessions 對已開啟工作階段生效，螢幕報讀也修正。Delete session 改 Archive session，項目移入可收合的 Archived sessions，能 Unarchive；slash 指令與 MCP 伺服器改在可篩選視窗操作。
When you pick the Fable model in Claude Code, you now get the new Fable 5.1 (model id claude-fable-5-1), which has taken over as the default for the Fable line. It takes in a million tokens at once — the unit of text an AI weighs in a single pass — enough for the code of a whole large project in one go. Pricing is $10 per million input tokens and $50 per million output; cached content costs $0.25 per million to read again, so repeated questions about the same files are far cheaper. One transitional catch: sessions run through the official gateway (the middle layer that forwards requests to a model) still resolve fable and best to Fable 5, since gateways not yet configured for 5.1 reject it — pick Fable 5.1 in /model yourself.
Claude Code stamps a time at the end of every turn, and each message in the transcript — the plain-text record of the whole conversation — carries a timestamp too. That format used to be fixed. Now there are two settings: timeFormat sets the style and accepts 12-hour, 24-hour, 24-hour UTC, or an strftime pattern (codes like %H:%M that let you spell out the shape of the time yourself); timeZone sets which zone the clock is converted to. Add them in settings.json, for example:
{
"timeFormat": "24-hour",
"timeZone": "America/New_York"
}When you let Claude run a long stretch of work in auto mode — where it acts without checking each step with you — it now holds back three more kinds of action. First, a Containment Escape rule: fetching a cloud host's metadata credentials (a piece of information a cloud platform hands out in exchange for access), slipping past outbound-traffic limits, or reaching across tenants to read someone else's resources are no longer auto-approved unless your environment marks them as expected. Second, a one-time prompt the first time it wants to read a file outside your working directories; block it on the spot, or for good with {"permissions": {"blockReadsOutsideWorkingDirectories": true}} in settings.json. Third, in Cowork and claude.ai cloud sessions, reading an artifact (a file produced by a conversation) that is not yours now always asks you first, even in auto mode.
When you have Claude fan out across several subagents — the helpers the main conversation dispatches to each do a slice of the work — each one may carry its own assigned model: some set at dispatch time, some hard-coded in an agent definition file. Switching them all to one model used to mean hunting each down. Now there is an environment variable, CLAUDE_CODE_SUBAGENT_MODEL_FORCE — a setting made at the system level and read when the program starts. Turn it on and the model named by CLAUDE_CODE_SUBAGENT_MODEL (or the main conversation's model if none is named) applies to every subagent, and those per-subagent choices are all ignored. Handy when you want to hold costs down, or keep a whole batch of work consistent, in one move.
/effort tunes how long Claude thinks before answering — higher effort means deeper reasoning but slower and pricier; lower is the reverse. Using it used to change the setting for the long term, so every later session (one conversation from open to close) inherited it. Now the /effort menu has an s option: pick it and only the current session changes, and closing the window returns you to your own default — matching what /model has done for a while. Separately, when you move to a new model, the default-effort hold it ships with now locks only this session rather than permanently; and if you connected via Remote Control after picking an effort on claude.ai, that choice now applies during the hold.
Some companies let Claude Code reach a set of internal models through their own gateway — the middle layer that forwards requests to a model — switched on by the environment variable CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY. Those models used to appear in the /model picker as bare names with nothing to tell them apart. Now the gateway can attach a description to each one and the picker shows it; entries without one still read "From gateway". A paired change: this discovery step now runs even when you have set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC (which turns off non-essential outbound calls), because it only queries your own gateway and reaches nothing outside.
/btw (short for by the way) lets you slip Claude a quick question without derailing the main task, then return to the original answer. Paging between these side exchanges used to be ←/→, which clashed with what the arrow keys do elsewhere. It is now Shift+←/Shift+→, or [/], stepping through your recent side questions and back to the live answer. A separate snag is fixed: with the /btw panel open inside a claude agents session (the screen for managing subagents), pressing ← did nothing; it now takes you back to the agents list even mid-answer, and the panel returns when you reopen that session.
/add-dir — along with --add-dir at startup and additionalDirectories in settings — brings an extra folder into Claude's working scope, loading that folder's skills, commands and agents with it. This release cleans up two faults pointing opposite ways. One is network paths: Windows UNC shares and /net/<host> automounts are now refused with a message before anything touches them, and Windows users should use a mapped drive letter instead. The other is a subfolder right under your current working directory, which /add-dir used to reject for no reason; it is now accepted, and its skills, commands and agents load just as --add-dir does at startup.
bypassPermissions is the most permissive mode, where Claude acts on almost anything without asking. It used to be enough to set defaultMode to "bypassPermissions" in a project's .claude/settings.json or .claude/settings.local.json, and opening that project dropped you into the mode. The trouble is that such files travel with the code, so anyone who hands you a project could decide your machine runs unguarded. Now that value is ignored at the project level and behaves like "auto". To really use the mode, set it in user or managed settings, or pass --permission-mode at each startup.
If your Claude Code is centrally configured by your company through managed settings, this batch fixes faults along that path. A policyHelper (the small program that checks company policy) shadowed at launch by cached settings used to wait until next launch to update; now it runs or exits as soon as the server reports that setting removed. Under managedSourcesBehavior: "merge", sandbox.credentials.awsPairs and sandbox.ripgrep are now taken whole from the highest source that sets them, not blended; timeoutMs and refreshIntervalMs above the timer maximum (2147483647) no longer fail outright, and are clamped instead. Diagnostics are clearer: refresh failures show in /status, declining prints why it exited, timeouts are reported as timeouts; the approval dialog also shows matching telemetry wording when the settings also touch tracing, raw API logging, or trace export.
For anyone running Claude Code through Bedrock, Vertex or Foundry, this batch fixes login details getting into outgoing requests. A doubly-listed custom Authorization header used to override your configured credential (Bedrock, Mantle, Vertex, WIF all affected); the Vertex setup wizard picked up a leftover profile from ~/.config/anthropic; the official gateway sent stray headers to Foundry, Vertex and Bedrock, and Foundry's Entra ID upstream failed to start when ANTHROPIC_FOUNDRY_API_KEY was set; API-key mode against a Foundry key sent a leftover Anthropic key alongside it. None of that happens now, and gateway sign-in and token refresh now verify the pinned TLS certificate too. Also, launching after a session expired now says "ended" and offers /login; the keyless Console sign-in now applies your organization's settings and /status shows the Organization.
This group is all about whether Claude stops to ask you. On the surface, the Ctrl+E command-explanation line under Bash and PowerShell permission prompts is gone, and the Edit prompt's diff view — which had been miscounting the width of emoji and characters built from several code points, skewing the layout — now lines up. The substantive part is three holes closed: a permissions.ask rule (one that requires asking first) was skipped in auto mode when the matching command ran inside a long compound command or a subshell, running without a prompt; it is caught now. Certain [[ ]] conditionals that zsh parses differently from bash were auto-approved and now prompt. And Bash Read()/Edit() deny rules did not apply to a < file redirect or to reader commands like tac and egrep; now a deny rule matching any argument or redirect target refuses the whole command.
Background sessions — work you hand Claude to run behind the scenes without taking over your current screen — get a batch of "would not start at all" fixes. On macOS npm installs that coincided with Claude Code self-updating, a background session would fail to open; so would one on Windows when a stale daemon lock file (a daemon is a service program that stays resident in the background) pointed at a reused process id. Another case: with a different Claude Code process downloading an npm update, opening a background session reported "Couldn't start the background service"; it now waits for that download to finish. Two cleanup fixes go with it: after a self-update, background sessions still running an older Claude Code binary used to pile up instead of retiring, and are now replaced; and cc-daemon-* folders left in the system temp directory after an interrupted daemon start are now swept by the cleanupPeriodDays retention pass.
This batch fixes claude agents (the screen for managing background sessions) and the CLI misremembering which session is in what state. A session's state.json detail field kept repeating its own original dispatch prompt after a scheduled wake-up instead of updating to the new state. Re-prompting a finished background session should bring it back to the front, but it stayed stuck at its old spot under Completed; Completed now orders by the latest finish. Running claude --bg from a directory that was just deleted used to falsely report "backgrounded" and leave a crashed session row; it now prints the reason and exits with code 1. --resume listed a backgrounded conversation twice, and --continue reopened its stalled pre-background copy; --continue now also opens finished background sessions. And claude --resume <session-id> --bg now continues that session under its own ID when nothing is running it, instead of quietly starting a copy — and announces it when a copy really is started.
This batch fixes background sessions not honestly reflecting their state when interrupted or watched. Stashing a prompt with Ctrl+S inside an opened background session used to lose it if that session went idle or was stopped and reopened; it now survives. Backgrounding a turn with ← or Ctrl+B while a subagent or other tool happened to be running would occasionally make the background session wrongly treat that tool as rejected when it should have re-run; it now re-runs correctly. Stopping a background command from the tasks panel or a connected client used to leave Claude uninformed; now it is told. Stopping a background subagent used to leave the monitors it had started (a monitor is a background watcher that notifies you when something finishes or times out) still running; now they stop with it. A background command detached from its shell with timeout or setsid used to survive stopping a task or exiting Claude Code; it now ends too. And claude agents used to say nothing about a background session waiting for you to approve a message from another session, or who sent it — it now shows this clearly.
This batch is about visibility and continuity in claude agents (the screen for managing subagents) and subagent transcripts. Opening a subagent's session with ← from this view used to always inherit the original session's permission mode, overriding the target directory's own defaultMode and that agent's permissionMode; it now follows the target's settings. keybindings.json rebinds of Ctrl+G were ignored inside claude agents; its Ctrl+S / Ctrl+T are now rebindable through a new Agents context. Switching to another subagent's transcript often froze or crawled the usage counter in the corner; it now updates live, for background subagents and teammates too. claude agents --json used to briefly switch the terminal to raw mode and undo another program's terminal settings on exit; it no longer does. A subagent cut off mid-stream by a computer sleep, dropped connection, or server error used to stop at that incomplete response; it now automatically continues. Resuming a subagent you had stopped from its transcript view used to leave the main agent uninformed that you did so; now it is told. A subagent whose transcript grew past 5 MB (common after reading many images) used to fail to resume or message with "No transcript found"; that now works.
The prompt cache — remembering conversation content already sent once so the same content is not recomputed or rebilled next time — is a time- and money-saver by design, and this batch fixes several ways it was quietly going stale. Remote Control connecting mid-session used to re-send the Bash tool definition, and that alone missed the cache; it no longer does. Sessions with an advisor model set (an extra model consulted to help the main model decide) used to miss the cache on background requests — compaction, /recap, prompt suggestions — resending the full conversation uncached each time; they now hit the cache. Rewinding a conversation back to empty made /model and /effort show an extra cache warning; it no longer does. Long screenshot-heavy sessions missed the cache on every turn once images exceeded the per-request size cap; that cap issue is fixed. /fork (spinning the current conversation off into a new background session) now keeps the original conversation's cache in that new session, by sending its worktree briefing — the message about the parallel copy of the project Git sets up — as a regular message instead of changing the system prompt.
Remote Control — connecting into a running Claude Code from your phone or another device — gets two fixes about consent and whose choice wins. Dismissing the consent prompt, whether by Esc or by pressing n at claude remote-control, was meant as a refusal, but the system recorded it as consent, so the next request connected straight in without asking again. That is fixed: a real refusal now counts as one. The other: a Remote Control session started from the Claude app used to ignore the model you had selected there and run on the machine's default instead; it now runs on the model you selected.
MCP (Model Context Protocol, the standard that lets Claude connect to external tools) gets a batch of connection-management and error-logging fixes. /mcp's reconnect and enable used to still connect a settings-file MCP server that a managed MCP allow/deny list or strictPluginOnlyCustomization (restricting MCP to plugin-supplied servers only) loaded after startup should have blocked; now it is blocked as it should be. With strictPluginOnlyCustomization locking MCP to plugin-only servers, claude mcp remove used to leave a removed remote server's stored OAuth credentials behind; they are now cleaned up too. claude mcp add/remove used to hang or exhaust memory when a project's .mcp.json turned out to be a FIFO (a named pipe file) or a device-file symlink; it now fails fast with an actionable message. WebSocket MCP server connection failures used to log only the unreadable "[object ErrorEvent]"; the underlying error is logged now. And MCP connection and OAuth debug/error logs used to print credentials carried in a server's URL or request headers as-is; they are now redacted.
Sandbox (the isolated environment keeping Claude's actions inside a safe boundary) and worktree get fixes for boundaries that were not holding, or leftovers nobody flagged. A trailing dot on a network host used to slip past a deniedDomains entry, and "don't ask again" kept re-prompting; both are now handled correctly. A plugin's declared component path, if it was a symlink reaching outside the plugin, could be used to read files outside it; such paths are now refused with an error. Worktree-isolated sessions used to reject Bash loops, $VAR reads, and heredocs that never touch git as too complex; they are now correctly allowed. Sandboxed git in a linked worktree used to lose write access to the shared .git directory after cd into a subdirectory; it no longer does. And /doctor now warns about a stale sandbox mask file left by a killed session.
This batch fixes a few places where Claude Code did not "reload settings" thoroughly enough. Settings in a .claude/ folder created after startup used to be picked up only after a restart; now they take effect once created. With allowManagedPermissionRulesOnly (only managed rules take effect) turned on, --disallowedTools and session-level deny rules used to be dropped after the first settings reload; they are now kept. And telemetry (OTEL, the standard for reporting usage) values pushed through server-managed settings used to be ignored on a warm start (one that reuses an existing process rather than a full restart), desktop-app Code sessions included; they now apply.
This batch makes the terminal UI run smoother in long conversations and clears a few stuck spots. Rendering is improved: less work to redraw each turn in long conversations, streaming no longer slows down as a reply grows, and background-agent updates no longer redraw the whole screen. The input box also redraws less per keystroke, cutting typing lag. Fixes: the working spinner used to stop turning — looking stuck — while a response streamed behind a slash-command panel, and no longer does; a phantom duplicate slash-command row used to appear below the in-flight turn while an auto-continued response streamed, and no longer does; fullscreen mode used to block clicking ! shell-command output to expand it, and now allows it; pasting ANSI-colored text (like a CI log) into a dialog such as /feedback used to crash, and no longer does. Also, emoji autocomplete now accepts the remaining GitHub/Slack shortcode aliases (:satisfied:, :telephone:, :collision:, and others).
This batch fixes headless mode (no terminal window, common in scripts or CI) and long-lived streams either not waiting when they should, or not stopping when they should. claude -p used to exit about 5 seconds after printing its final result even if a Monitor (a background watch task) the model had armed was still running; it now waits for that watch to actually fire or time out. Reading piped input with claude -p --input-format stream-json, if what came in was not valid JSONL (one JSON object per line), used to grow memory without bound; it now fails fast with a clear error. Sessions using the Proactive output style used to busy-loop with filler messages and repeated log reads instead of idling quietly while a background command or Monitor they had started was still running; they now idle honestly. On Bedrock and Bedrock Mantle with Opus 4.7 and later, long hidden-thinking phases (the model reasoning behind the scenes, invisible on screen) used to go silent and get cut by an idle timeout; the stream now carries progress events so it is not mistaken for unresponsive. And on the SDK-host side, liveness reporting is improved while a response is held open by gateway keep-alives, so long waits under a raised CLAUDE_STREAM_IDLE_TIMEOUT_MS are no longer mistaken for a hung session.
This card gathers the rest of this version's unrelated small fixes and touches. /schedule (the scheduling feature): a routine whose saved prompt was missing a message role used to fire at its scheduled time and run with nothing to do; it now runs properly. A teammate's (the peer role in multi-agent collaboration) permission request, if it landed just as the leader's mailbox write was briefly locked, used to get answered twice; now only once. Agent-team teammates in tmux or iTerm2 panes sometimes stayed open after acknowledging a shutdown request; they now actually close. Cloud sessions whose network proxy failed to start at launch used to lose git/GitHub credentials for the rest of the session; it now retries in the background and recovers. Three small CLI improvements: /code-review --comment can now post findings on GitLab merge requests via glab mr note instead of reporting the target as unsupported; an MCP elicitation (a request for more information from you) or permission ask queued behind another dialog now sends its idle desktop notification at the same delay as a visible one; claude self-hosted-runner --configure-git now also enables git push negotiation, so the first push of a new branch from a clone that has sat around for a while uploads only the new commits instead of the whole tree; and in verbose/transcript output, several async hook completion notices arriving together now appear on one line instead of flooding the screen one line per hook.
This release's updates to the VSCode extension — Microsoft's code editor — center on tidying the side panel and clearing a few stuck spots. The session list gains collapsible ACCOUNT & USAGE and SESSION MANAGER headers holding the account email, the usage meter, and a link that opens the usage dialog; the input footer gains a model pill showing the current model and opening the picker, with an Effort row and a More models page; the Ungrouped section can now be collapsed; and the command menu can select an output style, custom ones included. Fixes: third-party provider deployments such as Bedrock and Vertex were still showing claude.ai-only features and a leftover login, now hidden; the usage meter that stayed blank after the panel loaded now shows the last known usage first; the Enable Remote Control for all sessions toggle now applies to already-open sessions; two screen-reader announcement bugs are corrected. Delete session is renamed Archive session, with archived items moving to a collapsible Archived sessions group at the bottom and an Unarchive action; the action menu now lists slash commands in a filterable dialog instead of inline, and the MCP servers dialog gained the same filter box.
Added Claude Fable 5.1 (`claude-fable-5-1`), now the default Fable model — 1M context, $10/$50 per Mtok with $0.25/Mtok cache reads
Changed `fable` and `best` in Claude apps gateway sessions to keep resolving to Fable 5 for now, since gateways not yet configured for Fable 5.1 reject it; pick Fable 5.1 in `/model` to use itAdded "Time format" (`timeFormat`) and `timeZone` settings: 12-hour, 24-hour, 24-hour UTC, or a strftime pattern for the turn-end clock and transcript-view timestampsAdded a Containment Escape rule to auto mode so cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless your environment marks them expected
Added a one-time prompt in auto mode before the first file read outside the working directories, with the option to block such reads (`permissions.blockReadsOutsideWorkingDirectories`)
Changed Cowork and claude.ai cloud sessions: reading an artifact that isn't yours now always asks you first, even in auto modeAdded `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` to apply `CLAUDE_CODE_SUBAGENT_MODEL` (or the main model) to every subagent, ignoring per-spawn and agent-definition model overridesAdded `s` in `/effort` to change effort for the current session only, matching `/model`
Changed `--effort` to lift a new model's default-effort hold for that session only rather than permanently; an effort picked on claude.ai for a Remote Control session now applies during the holdAdded support for a gateway-supplied `description` on discovered `/model` picker entries (`CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY`); entries without one still read "From gateway"
Changed gateway model discovery (`CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1`) to run even when `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` is set, since it only queries your gatewayFixed `←` doing nothing in the `/btw` panel inside a `claude agents` session: it now returns to the agents list (even mid-answer), and the panel comes back when you reopen the session
Changed `/btw` history browsing from `←`/`→` to `Shift+←`/`Shift+→` (or `[`/`]`), stepping through your recent side questions and back to the live answerFixed `/add-dir` rejecting a directory inside the current working directory; it now loads that directory's skills, commands, and agents like `--add-dir` does at startup
Changed `--add-dir`, `/add-dir`, and `additionalDirectories` to refuse network paths (UNC shares, `/net/<host>` automounts) with a message before touching them; on Windows use a mapped drive letterChanged `defaultMode: "bypassPermissions"` in `.claude/settings.json` or `.claude/settings.local.json` to be ignored, like `"auto"`; set it in user or managed settings, or pass `--permission-mode`Fixed `policyHelper` `timeoutMs` and `refreshIntervalMs` values above the timer maximum (2147483647) causing failures or re-runs every millisecond; they are now clamped
Fixed the managed-settings approval prompt showing the generic warning instead of its telemetry wording when the settings also turn detailed tracing or raw API body logging off, or trace export on
Improved policy helper diagnostics — refresh failures now show in `/status`, declining the managed-settings dialog prints why Claude Code exited, and helper timeouts are reported as timeouts
Changed a `policyHelper` in MDM or `managed-settings.json` shadowed at launch by cached server-managed settings to run (or exit) as soon as the fetch reports them removed, not at the next launch
Changed `managedSourcesBehavior: "merge"` to take `sandbox.credentials.awsPairs` and `sandbox.ripgrep` whole from the highest managed source that sets them instead of combining the sources' valuesFixed a doubly-listed custom `Authorization` header overriding the configured credential on Bedrock, Mantle, Vertex, and WIF, and the Vertex setup wizard picking up a leftover Anthropic profile from `~/.config/anthropic`
Fixed Claude apps gateway sending stray host `Authorization` or profile headers to Foundry, Vertex, and Bedrock, and Foundry Entra ID upstreams not starting when `ANTHROPIC_FOUNDRY_API_KEY` is set
Fixed a leftover Anthropic API key or auth token being sent alongside your Foundry subscription key in API-key mode
Fixed launching Claude Code after a Claude apps gateway expired or revoked your session: it now says the session ended and offers `/login` instead of reporting a network error
Fixed the keyless Console sign-in ("Sign in with your Console account") not applying your organization's server-managed settings, and `/status` not showing the Organization for that sign-in
Changed Claude apps gateway sign-in and token refresh requests to verify the gateway's pinned TLS certificate, as the managed settings fetch already doesFixed a `permissions.ask` rule being skipped in auto mode when the matching command ran inside a compound command or subshell, letting it run without the confirmation prompt
Fixed Bash `Read()`/`Edit()` deny rules not applying to `< file` redirects and reader commands like `tac` and `egrep`; a deny rule on any argument or redirect target now refuses the command
Fixed Bash permission checks auto-approving certain `[[ ]]` conditionals that zsh parses differently from bash; these commands now prompt for approval
Fixed the Edit permission prompt's diff view rendering emoji and multi-code-point characters with incorrect widths
Removed the Ctrl+E command explanation on Bash and PowerShell permission promptsFixed background sessions failing to start on macOS npm installs during a self-update, and on Windows when a stale daemon lock file pointed at a reused process id
Fixed background sessions failing to open with "Couldn't start the background service" while another Claude Code process was downloading an npm update; the start now waits for it
Fixed background sessions left running an older Claude Code binary piling up across auto-updates instead of being retired
Fixed leftover `cc-daemon-*` folders in the system temp directory after an interrupted background daemon start; the `cleanupPeriodDays` retention sweep now removes themFixed a background session's `state.json` `detail` repeating its own dispatch prompt after a scheduled wake-up
Fixed `claude agents` keeping a background session you re-prompted buried in Completed after it finished again; Completed now orders by the latest finish
Fixed `claude --bg` from a directory that was just deleted reporting "backgrounded" and leaving a crashed session row; it now prints the reason and exits 1
Fixed `--resume` listing a backgrounded conversation twice and `--continue` reopening its stalled pre-background copy; `--continue` now also opens finished background sessions
Changed `claude --resume <session-id> --bg` to continue that session under its own ID when nothing is running it, instead of silently starting a copy; a copy is now announcedFixed a prompt stashed with Ctrl+S inside an opened background session being lost when the session went idle or was stopped and then reopened
Fixed backgrounding a turn (`←` or Ctrl+B) while a subagent or other tool was running occasionally making the background session treat that tool as rejected instead of re-running it
Fixed Claude not being told when you stop a background command from the tasks panel or a connected client
Fixed stopping a background subagent leaving its monitors running
Fixed `claude agents` not saying that a background session is waiting for you to approve a message from another session, or who sent it
Fixed background commands that detach from their shell (for example under `timeout` or `setsid`) surviving a task stop or Claude Code exitFixed sessions dispatched from an agent view opened with `←` always starting in the original session's permission mode, overriding the target directory's `defaultMode` and the agent's `permissionMode`
Fixed `keybindings.json` rebinds of Ctrl+G being ignored in `claude agents`; its Ctrl+S / Ctrl+T are now rebindable via the new `Agents` context
Fixed the token counter freezing or crawling after switching to another subagent's transcript, and made background subagents' and teammates' counters update live while a response streams
Fixed `claude agents --json` briefly switching the terminal to raw mode and undoing another program's terminal settings on exit
Fixed subagents stopping when a response was cut off mid-stream by a computer sleep, dropped connection, or server error; they now automatically continue instead of ending with an incomplete response
Fixed the main agent not being told when you resume a subagent you had stopped from its transcript view
Fixed resuming or messaging a subagent whose transcript had grown past 5 MB (for example after reading many images) failing with "No transcript found"Fixed Remote Control connecting mid-session re-sending the Bash tool definition, causing a prompt-cache miss
Fixed sessions with an advisor model set missing the prompt cache on background requests (compaction, `/recap`, prompt suggestions) and re-sending the full conversation uncached each time
Fixed `/model` and `/effort` showing a prompt-cache warning after rewinding a conversation back to empty
Fixed prompt-cache misses on every turn in long screenshot-heavy sessions once images exceeded the per-request size cap
Improved `/fork` to keep the original conversation's prompt cache in the new background session: its worktree briefing now arrives as a message instead of a system-prompt changeFixed dismissing the Remote Control consent prompt (Esc, or `n` at `claude remote-control`) counting as consent, so the next request connected without asking
Fixed Remote Control (`claude remote-control`) sessions started from the Claude app ignoring the selected model and running on the machine's default insteadFixed `/mcp` reconnect and enable still connecting a settings-file MCP server that a managed MCP allow/deny list or `strictPluginOnlyCustomization` loaded after startup should block
Fixed `claude mcp remove` leaving a remote server's stored OAuth credentials behind when `strictPluginOnlyCustomization` locks MCP to plugin-only servers
Fixed `claude mcp add/remove` hanging or exhausting memory when the project's `.mcp.json` is a FIFO or a device-file symlink; it now fails fast with an actionable message
Fixed WebSocket MCP server connection failures being logged as "[object ErrorEvent]" instead of the underlying error
Improved MCP connection and OAuth debug/error logs so credentials carried in a server's URL or request headers are redactedAdded a `/doctor` warning for stale sandbox mask files left by a killed session
Fixed sandbox network hosts written with a trailing dot (`example.com.`): a `deniedDomains` entry didn't block the host inside the sandbox, and "don't ask again" for such a host kept prompting
Fixed plugins being able to read files outside their own directory through a declared command, agent, skill, hooks or other component path that is a symlink; such paths are now refused with an error
Fixed worktree-isolated sessions refusing Bash loops, `$VAR` reads, `"$(…)"` and heredocs that never touch git as "too complex to verify that it stays inside the worktree"
Fixed sandboxed git commands in a linked worktree losing write access to the repository's common `.git` directory after `cd` into a subdirectoryFixed settings in a `.claude/` folder created after startup not being picked up until restart
Fixed `--disallowedTools` and session deny rules being dropped after the first settings reload when `allowManagedPermissionRulesOnly` is enabled
Fixed telemetry (OTEL) settings pushed through server-managed settings being ignored on warm starts, including desktop-app Code sessionsImproved rendering performance: less re-render work per turn in long conversations, streaming no longer slows down as the reply grows, and background-agent updates no longer re-render the whole screen
Improved prompt input responsiveness by reducing per-keystroke rendering work
Fixed the working spinner stopping while a response streams behind a slash-command panel
Fixed a phantom duplicate slash-command row rendering below the in-flight turn while a command's auto-continued response streamed
Fixed fullscreen mode not letting you click `!` shell command output to expand it
Fixed a crash when pasting ANSI-colored text (e.g. a CI log) into dialogs like `/feedback`
Improved emoji autocomplete to accept the remaining GitHub/Slack shortcode aliases (`:satisfied:`, `:telephone:`, `:collision:`, …)Fixed `claude -p` exiting about 5 seconds after its final result while a Monitor the model armed was still running; it now waits for the watch to fire or time out
Fixed unbounded memory growth when non-JSONL data is piped into `claude -p --input-format stream-json`; it now fails fast with a clear error
Fixed Proactive output style sessions busy-looping with filler messages and repeated log reads instead of idling while a background command or Monitor they started is still running
Fixed Bedrock and Bedrock Mantle requests going silent during long hidden-thinking phases on Opus 4.7 and later, which let idle timeouts cut the connection; the stream now carries progress events
Improved liveness reporting to SDK hosts while a response is held open by gateway keep-alives, so long waits under a raised `CLAUDE_STREAM_IDLE_TIMEOUT_MS` are not mistaken for a hung sessionFixed `/schedule` routines whose prompt was saved without a message role and then ran with nothing to do
Fixed a teammate permission request being answered twice when the leader's mailbox write was briefly locked
Fixed agent-team teammates in tmux/iTerm2 panes sometimes staying open after acknowledging a shutdown request
Fixed cloud sessions losing git/GitHub credentials for the rest of the session when the session's network proxy failed to start at launch; it now retries in the background and recovers
Improved `/code-review --comment` to post findings on GitLab merge requests via `glab mr note` instead of reporting the target as unsupported
Improved notifications: an MCP elicitation or permission ask queued under another dialog now sends its idle desktop notification at the same delay as a visible ask
Improved `claude self-hosted-runner --configure-git` to also enable git push negotiation, so the first push of a new branch from a stale clone uploads only the new commits instead of the whole tree
Improved verbose/transcript output: async hook completion notices that arrive together now appear on one line instead of one line per hook[VSCode] Added collapsible ACCOUNT & USAGE and SESSION MANAGER section headers to the session list panel, with the account email, the usage meter, and a View details link opening the usage dialog
[VSCode] Added a model pill to the input footer that shows the current model and opens the model picker, with an Effort row and a "More models" page
[VSCode] Added a collapse toggle to the Ungrouped section of the session list
[VSCode] Added output style selection to the command menu, including custom styles
[VSCode] Fixed third-party provider deployments (Bedrock, Vertex, and others) still showing claude.ai-only features (remote sessions, dictation, usage) and calling claude.ai with a leftover login
[VSCode] Fixed the session list panel's usage meter staying blank after the panel loads; it now shows the last known usage immediately
[VSCode] Fixed the "Enable Remote Control for all sessions" toggle so turning it on or off applies to sessions that are already open, not only to new ones
[VSCode] Fixed screen reader announcements: a control character before a fence or heading no longer drops visible lines from speech, and bold markers spanning a heading are no longer mis-paired
[VSCode] Changed the action menu to list slash commands in a filterable "Slash commands" dialog instead of inline; picking one runs it; the MCP servers dialog gained the same filter box
[VSCode] Changed "Delete session" to "Archive session": archived sessions move to a collapsible "Archived sessions" group at the bottom of the list with an Unarchive action