發布日期：2026-09-02
企業管理者能透過 managedMcpServers 設定，統一派發 HTTP 或 SSE 的 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器，格式同 .mcp.json 並略過本機指令：
{
"managedMcpServers": {
"company-docs": {"url": "https://mcp.internal.example.com/sse", "type": "sse"}
}
}allowedMcpServers 改為僅管制使用者新增的伺服器；升級後若要封鎖 managed-mcp.json 伺服器，需改用 deniedMcpServers。若管理設定檔、drop-in 檔案、MDM plist 或 HKLM 值解析失敗，Claude Code 會拒絕啟動並指名來源。由 MDM 或管理設定檔設定的 policy helper 執行後，forceRemoteSettingsRefresh 強制重整也修復生效。
針對無人看管的無頭模式（headless，沒有終端機視窗的執行模式）伺服器，你可以透過完整指令執行：
claude --permission-prompts none這項新旗標專門處理無人主機的自動化流程。只要遇到任何需要跳出對話框請求確認的操作，系統都會自動予以拒絕，而當前生效的權限模式（包含自動模式）則會持續在背後自主決策。當你在伺服器排程或 CI 流程中跑工作階段時，再也不用擔心某個未授權的操作讓整個流程無限期停擺。
當你在 GitLab 專案中透過命令列工具管理合併請求時，終端機現在能原生識別 glab mr create、merge、close、reopen、note 與 update 等操作。只要執行這些指令，摺疊的工具摘要就會以 MR !N 的格式清楚標記合併請求編號，並同步重新整理顯示在終端機最底下的狀態列徽章。這讓你在命令列追蹤程式碼審查與合併進度時，不必反覆切換瀏覽器頁面確認。
在 GitLab 儲存庫內執行 /install-github-app 指令時，終端機不會再默默發送無效請求或顯示不明錯誤。系統現在會主動向你說明該指令僅限 GitHub 專案使用，並直接附上 GitLab CI/CD 官方文件連結指引你如何設定自動化流程。這讓跨平台開發的團隊在摸索指令時，能第一時間獲得正確的替代方案與設定說明。
過去 Bash 的 Read() 檔案讀取拒絕規則存在安全漏洞。如果把敏感檔案放在參數值（例如 --ignore-revs-file=.env、-f.env 或 @file）、作為 git diff 與 git grep 的檔案操作對象，或是組裝成 cd DIR && cat FILE 複合指令，系統曾會漏抓；現在這些途徑全數納入攔截範圍。此外，當你對含有被拒檔案的資料夾執行 grep -r 或 cp -r 時，系統現在也會主動跳出授權詢問。
在啟用工作樹（worktree，Git 讓同一專案平行開多份副本的功能）隔離環境時，由自動化流程建立的平行工作區現在相容性更佳。若你的專案透過掛鉤（hook，特定事件發生時被觸發的小程式）自動新增工作樹，過去在部分作業環境中，當底層 git rev-parse 探測指令回傳了「not a git repository」以外的自訂錯誤訊息時，系統會誤判而拒絕載入；現在這項異常判斷已修正，確保平行工作區能順暢運作。
在工作樹（worktree，Git 讓同一專案平行開多份副本的功能）隔離環境下執行命令時，檢查限制獲得了合理放寬。以往在隔離工作階段中執行常見的 Bash 迴圈、xargs 管線指令，或是透過啟動器包裝的命令時，系統容易過度防衛而直接拒絕執行；現在只要確認這些指令無法碰觸到主儲存庫目錄，系統便會允許正常執行，不再阻礙日常的批次自動化處理。
同時開啟多個工作階段（session，對話工作階段）時，各視窗不再於背景悄悄還原彼此對全域設定檔 ~/.claude.json 的修改，工作區信任、MCP 與專案狀態再也不會因為並行運作而遺失。此外，若已儲存的紀錄中含有缺少酬載的附件資料，以前執行 --resume 會失敗且執行 --continue 會開啟空白對話，現在皆能順利接續；儲存庫辨識機制不再因短暫的 Git 探測失敗而丟失身分；claude.ai 使用者的背景 GitHub 連線檢查結果也會跨次啟動妥善記住。
在遠端遙控的工作階段中按下停止時，背景代理與工作流程現在會確實終止，已被中斷的任務在行程完全結束前會維持可見且允許再次停止；在前次中斷尚未結束前恢復工作流程，也不會再意外跑出重複的代理。當暫停中的遠端或排程工作階段核准了連接器工具的授權請求後，系統會正確接續運作。檢視 /workflows 的代理詳細資訊時，JSON 結果會以語法上色與換行整齊美化，過長內容亦會收合在展開按鈕後；巢狀背景子代理的成果也會保存於母代理紀錄中。
你在自訂指令與技能檔頭指定的 model: 設定，在互動式工作階段中現在會如實生效。在自動模式下若遇到不支援的模型，系統則會穩定保留當前工作階段的模型繼續執行，避免任務意外中斷。此外，針對帶有 @YYYYMMDD 日期後綴的 Vertex 格式模型代碼，即便屬於系統尚未內建識別的模型版本，環境變數 CLAUDE_CODE_MAX_CONTEXT_TOKENS 所設定的 token（AI 處理與計費的文字單位）上限如今也能正確生效。
在對話過程中若模型的思考歷程曾遭拒絕一次，後續輪次不會再陷入重複被拒的窘境。在關閉遙測的工作階段中，更新 OAuth 授權令牌時，也不會意外清除提示詞快取（cache，把算過的結果暫存起來直接用）。此外，觸發阻擋型 Stop 掛鉤（hook，特定事件發生時被觸發的小程式）後，下一輪對話依然能完整保留上一輪的思考推導脈絡，避免在特定模型上發生快取未命中而重複計算的情況。
啟動時若有 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器在列出工具清單的過程中斷線，系統現在會明確回報錯誤訊息，不再顯示為已連線卻有零個工具。在 claude.ai 遠端工作階段中，若瀏覽器端託管的伺服器分頁已關閉，系統也不會再讓你在每輪對話開頭枯等 60 秒。同時，在無頭模式（headless，沒有終端機視窗的執行模式）與 SDK 工作階段啟動時，只要工具伺服器連線完畢，第一輪對話最多能提早 50 毫秒開始執行。
當你在全螢幕模式下進行呼叫數百次工具的長篇對話時，畫面不會再發生顯示空白對話的異常；終端機在調整視窗大小或初次渲染長回覆時，也會重複利用文字量測數據以提升流暢度。執行 Shell 指令時的即時預覽，不再因為前段文字自動換行而遮蔽最新輸出的幾行。此外，檔案編輯授權對話框過去偶爾會在無任何提示下截斷變更內容的問題，現在也已修復並完整顯示變更行。
在擴充套件與監控整合方面，執行 claude plugin validate --json 現在可產出供程式解析的結構化檢驗報告。在安裝擴充套件時，帶有結尾斜線或尾隨 ? 與 # 的 GitHub 市集網址，現在也能正確解析出可用的 .git 複製位址。從舊版本接續下來的工作階段發布 Artifact 產物時，不會再因「unexpected parameter note」錯誤而失敗一次。此外，雲端工作階段發出的 OpenTelemetry 指標與事件，也已補回過去遺漏的 user.email、organization.id 與 user.account_uuid 三項識別屬性。
VS Code 擴充套件的側邊欄工作階段（session，對話工作階段）清單迎來了篩選功能升級。側邊欄新增了 Active 快捷過濾按鈕，能快速篩出進行中的項目；同時加入了狀態篩選選單，提供等待使用者輸入的 Needs input、執行中的 Working 以及已完成的 Completed 等分類選項。這讓你在同時管理多個任務時，能迅速定位需要立即處理的對話。
Administrators can now distribute HTTP or SSE MCP servers (Model Context Protocol, which connects AI to external tools) to every user via the managedMcpServers setting, using the same format as .mcp.json while skipping local commands:
{
"managedMcpServers": {
"company-docs": {"url": "https://mcp.internal.example.com/sse", "type": "sse"}
}
}allowedMcpServers now governs only user-added servers; to block managed-mcp.json servers after upgrading, use deniedMcpServers instead. If the managed settings file, a drop-in file, the MDM plist, or the HKLM value fails to parse, Claude Code now refuses to start and names the source. Additionally, forceRemoteSettingsRefresh now properly triggers at startup even after a policy helper configured by MDM or managed settings has already run.
For unattended headless servers — environments running without a visible terminal window — you can run the full command:
claude --permission-prompts noneThis flag is built for automated pipelines on unattended machines. Whenever an action would pop up a prompt asking for confirmation, it is automatically denied on the spot, while the active permission mode (including auto mode) continues making decisions in the background. Running scheduled jobs or CI pipelines in a session no longer risks a single unprompted action freezing the entire workflow indefinitely.
When you manage merge requests in GitLab repositories via the command line, the terminal now natively recognizes commands like glab mr create, merge, close, reopen, note, and update. Running these commands formats the merge request number as MR !N inside the collapsed tool summary and immediately refreshes the footer MR badge. This allows you to track code review and merge progress from the command line without switching back and forth to your browser.
Running /install-github-app inside a GitLab repository no longer fails silently with invalid requests or vague errors. The output now clearly explains that the command is GitHub-only and directly links to the official GitLab CI/CD documentation for setting up your automation pipeline. This provides cross-platform engineering teams with the right alternative steps and configuration guidance right away.
Bash Read() deny rules previously had loopholes when handling hidden file paths. Passing denied files as option values (such as --ignore-revs-file=.env, -f.env, or @file), as file operands in git diff and git grep, or chained in compound commands like cd DIR && cat FILE previously slipped past security checks; all of these paths are now strictly intercepted. Furthermore, running grep -r or cp -r over a directory containing a denied file now explicitly prompts for permission.
When running with worktree isolation — the Git feature that lets you maintain multiple parallel checkouts of the same project — parallel working copies created by automation pipelines now enjoy broader compatibility. If your project provisions worktrees automatically via hooks (scripts triggered when specific lifecycle events occur), certain environments where underlying git rev-parse probe calls failed with messages other than "not a git repository" previously caused Claude Code to misjudge and reject the directory. This probe handling has been fixed so hook-created isolated workspaces load smoothly.
Command execution constraints under worktree isolation — which creates isolated duplicate copies of a repository — have been reasonably relaxed. Previously, running common Bash loops, xargs pipelines, or wrapper commands from launcher scripts inside isolated sessions was overly restricted and rejected. As long as these commands cannot reach the main checkout directory, they are now permitted to run freely, streamlining routine automated batch workflows.
Running multiple sessions at once no longer causes background processes to silently revert each other's updates to ~/.claude.json, protecting workspace trust, MCP servers, and project state from getting lost during concurrency. Furthermore, --resume no longer crashes and --continue no longer opens a blank chat when a saved session contains an attachment missing its payload; repository detection will not drop a known repo identity after a transient git probe failure; and background GitHub connection checks for claude.ai users are now remembered across app restarts.
Hitting Stop in remote-control sessions now reliably terminates background agents and workflows, keeping killed tasks visible and stoppable until their underlying processes completely exit. Resuming a workflow while a previously stopped run is still exiting no longer spawns duplicate agent instances. When a paused remote or scheduled session approves a connector tool permission prompt, execution resumes smoothly. Under /workflows, agent detail views now pretty-print JSON results with syntax highlighting and line breaks, tucking lengthy outputs behind an expand toggle, while nested background subagent results are retained inside parent transcripts.
Frontmatter model: declarations inside custom commands and skills now apply properly in interactive sessions. When running in auto mode, requesting a model that is not supported will retain the current session's model instead of breaking the turn. Furthermore, CLAUDE_CODE_MAX_CONTEXT_TOKENS now respects Vertex-style model IDs carrying @YYYYMMDD date suffixes, even for version tags that Claude Code does not natively recognize out of the box.
If a model's thinking reasoning is rejected during a conversation, subsequent turns will no longer be repeatedly rejected in a loop. In sessions with telemetry disabled, refreshing an OAuth token no longer unexpectedly invalidates the prompt cache. In addition, triggering a blocking Stop hook preserves the previous turn's reasoning and prevents prompt cache misses on supported models.
When an MCP server (Model Context Protocol, which connects AI to external tools) disconnects while enumerating available tools at startup, Claude Code now reports the error clearly instead of showing as connected with zero tools. In remote claude.ai sessions, closing a browser-hosted MCP server tab will no longer leave you waiting 60 seconds at the start of each turn. Furthermore, headless and SDK sessions now begin their first turn up to 50 ms sooner once MCP servers finish connecting.
Engaging in lengthy conversations with hundreds of tool calls in fullscreen mode no longer causes the display to go blank. Resizing the terminal or rendering lengthy responses for the first time now reuses text measurement data to improve rendering performance. Shell command live output previews no longer hide the newest lines when earlier text wraps. Additionally, a bug where the file edit permission dialog occasionally truncated modified lines without warning has been fixed.
In plugin tooling and observability integrations, running claude plugin validate --json now outputs a machine-readable JSON validation report. When installing plugins, GitHub marketplace URLs containing trailing slashes or dangling ? and # fragments now correctly resolve to usable .git clone URLs. Publishing Artifacts in sessions continued from older versions no longer fails on an "unexpected parameter note" error. In addition, OpenTelemetry metrics and events emitted from cloud sessions now restore the previously missing user.email, organization.id, and user.account_uuid attributes.
The VS Code extension's session list sidebar now features upgraded filtering controls. A new Active quick filter button lets you instantly view ongoing sessions, alongside a dedicated status filter menu offering categories like Needs input (waiting for user response), Working (in progress), and Completed. This helps you quickly zero in on conversations requiring immediate attention when juggling multiple tasks.
Added `managedMcpServers` managed setting: organizations can provide HTTP/SSE MCP servers to every user (same entry shape as `.mcp.json`); entries that name a command to run are skipped
Fixed managed `forceRemoteSettingsRefresh` being ignored at startup when a policy helper configured by MDM or the managed settings file had already run
Fixed managed settings silently going unenforced when the managed-settings file, a drop-in, the MDM plist, or the HKLM value cannot be parsed: Claude Code now refuses to start and names the source
Changed `allowedMcpServers` to govern only servers users add: a literal `managed-mcp.json` server your allowlist used to filter out now loads on upgrade; use `deniedMcpServers` to keep it offAdded `--permission-prompts none` for unattended headless hosts: anything that would prompt is denied automatically while the active permission mode (including auto mode) keeps decidingAdded recognition of `glab mr create/merge/close/reopen/note/update` so GitLab merge requests show as `MR !N` in the collapsed tool summary and refresh the footer MR badgeImproved `/install-github-app` to explain it is GitHub-only and point to the GitLab CI/CD docs when run inside a GitLab repositoryFixed Bash `Read()` deny rules not covering files given as option values (`--ignore-revs-file=.env`, `-f.env`, `@file`), `git diff`/`git grep` file operands, or `cd DIR && cat FILE` compounds; `grep -r`/`cp -r` over a directory holding a denied file now asksFixed worktree isolation refusing hook-created worktrees on machines where `git rev-parse` fails with a message other than "not a git repository"Fixed worktree-isolated sessions refusing common Bash loops, xargs pipelines and launcher-wrapped commands that cannot reach the main checkoutFixed concurrent sessions silently reverting each other's `~/.claude.json` changes — workspace trust no longer resets and MCP/project state is no longer lost when running many sessions at once
Fixed `--resume` failing (and `--continue` opening an empty conversation) when a saved session contains an attachment entry with no payload
Fixed repository detection dropping a known repo identity after a transient git probe failure
Fixed a background GitHub connection check that ran on every launch for claude.ai users; the result is now remembered across launchesFixed Stop not actually stopping background agents and workflows in remote-control sessions: killed tasks now stay visible and re-stoppable until their processes exit
Fixed resuming a workflow run while its previous stopped run was still exiting, which could run duplicate copies of its agents
Improved `/workflows` agent detail: JSON outcomes are pretty-printed with syntax colors and real line breaks, and long outcomes fold behind an expand toggle
Improved nested background subagent results to be saved in the parent subagent's transcript, so resumed subagents keep them and shared transcripts show the delivery
Fixed remote and scheduled sessions doing nothing after a connector-tool permission prompt was approved while the session was pausedFixed auto mode running a turn on a model it doesn't support when a command or skill's frontmatter `model:` named one; the turn now keeps the session model
Fixed `CLAUDE_CODE_MAX_CONTEXT_TOKENS` being ignored for Vertex-style model IDs (`@YYYYMMDD` suffix) of model versions Claude Code doesn't recognize
Fixed frontmatter `model:` on custom commands and skills being ignored in interactive sessionsFixed a conversation whose thinking was rejected once being rejected again on every later turn
Fixed the prompt cache being invalidated when the OAuth token refreshed in sessions with telemetry disabled
Fixed blocking Stop hooks causing the turn after a block to lose the model's reasoning from that turn and, on some models, miss the prompt cacheFixed MCP servers that disconnect while their tools are being listed at startup showing as connected with no tools instead of reporting the error
Fixed remote (claude.ai) sessions taking 60 seconds to start a turn after a browser-hosted MCP server's page had gone away
Improved headless/SDK session start: the first turn begins up to 50 ms sooner when MCP servers finish connectingFixed fullscreen mode showing a blank conversation after a long turn with hundreds of tool calls
Fixed the live output preview of a running shell command hiding its newest lines when an earlier line wrapped
Fixed the file edit permission dialog sometimes showing a changed line cut short with no indication
Improved terminal resize and first-render performance for long responses by reusing text measurementsAdded `--json` to `claude plugin validate` for a machine-readable validation report
Fixed Artifact publishing failing once with an "unexpected parameter `note`" error in conversations continued from an older version
Fixed OpenTelemetry metrics and events from cloud sessions missing the `user.email`, `organization.id`, and `user.account_uuid` attributes
Fixed marketplace repo URLs on github.com with a trailing slash or dangling `?`/`#` producing an unusable `.git` clone URL[VSCode] Added an Active quick filter and a status filter menu (Needs input, Working, Completed) to the session list sidebar