Organizations can roll out managed MCP servers, and startup halts if managed config is corrupt
Administrators can now distribute HTTP or SSE MCP servers (Model Context Protocol, which connects AI to external tools) to every user via the managedMcpServers setting, using the same format as .mcp.json while skipping local commands:
allowedMcpServers now governs only user-added servers; to block managed-mcp.json servers after upgrading, use deniedMcpServers instead. If the managed settings file, a drop-in file, the MDM plist, or the HKLM value fails to parse, Claude Code now refuses to start and names the source. Additionally, forceRemoteSettingsRefresh now properly triggers at startup even after a policy helper configured by MDM or managed settings has already run.
FEATURE
Unattended hosts get a prompt-suppression flag to auto-deny blocking prompts
For unattended headless servers — environments running without a visible terminal window — you can run the full command:
claude --permission-prompts none
This flag is built for automated pipelines on unattended machines. Whenever an action would pop up a prompt asking for confirmation, it is automatically denied on the spot, while the active permission mode (including auto mode) continues making decisions in the background. Running scheduled jobs or CI pipelines in a session no longer risks a single unprompted action freezing the entire workflow indefinitely.
FEATURE
GitLab merge requests are recognized natively with footer badge refreshes
When you manage merge requests in GitLab repositories via the command line, the terminal now natively recognizes commands like glab mr create, merge, close, reopen, note, and update. Running these commands formats the merge request number as MR !N inside the collapsed tool summary and immediately refreshes the footer MR badge. This allows you to track code review and merge progress from the command line without switching back and forth to your browser.
FEATURE
Running the GitHub App installer inside GitLab repos now points to GitLab CI docs
Running /install-github-app inside a GitLab repository no longer fails silently with invalid requests or vague errors. The output now clearly explains that the command is GitHub-only and directly links to the official GitLab CI/CD documentation for setting up your automation pipeline. This provides cross-platform engineering teams with the right alternative steps and configuration guidance right away.
BUGFIX
Bash Read deny rules tighten around option values, git operands, and chained commands
Bash Read() deny rules previously had loopholes when handling hidden file paths. Passing denied files as option values (such as --ignore-revs-file=.env, -f.env, or @file), as file operands in git diff and git grep, or chained in compound commands like cd DIR && cat FILE previously slipped past security checks; all of these paths are now strictly intercepted. Furthermore, running grep -r or cp -r over a directory containing a denied file now explicitly prompts for permission.
BUGFIX
Worktree isolation accommodates non-standard git probe messages from hook-created trees
When running with worktree isolation — the Git feature that lets you maintain multiple parallel checkouts of the same project — parallel working copies created by automation pipelines now enjoy broader compatibility. If your project provisions worktrees automatically via hooks (scripts triggered when specific lifecycle events occur), certain environments where underlying git rev-parse probe calls failed with messages other than "not a git repository" previously caused Claude Code to misjudge and reject the directory. This probe handling has been fixed so hook-created isolated workspaces load smoothly.
BUGFIX
Worktree isolation relaxes checks on pipelines and launcher scripts outside the main repo
Command execution constraints under worktree isolation — which creates isolated duplicate copies of a repository — have been reasonably relaxed. Previously, running common Bash loops, xargs pipelines, or wrapper commands from launcher scripts inside isolated sessions was overly restricted and rejected. As long as these commands cannot reach the main checkout directory, they are now permitted to run freely, streamlining routine automated batch workflows.
BUGFIX
Concurrent sessions no longer overwrite settings, improving resumes and repo detection
Running multiple sessions at once no longer causes background processes to silently revert each other's updates to ~/.claude.json, protecting workspace trust, MCP servers, and project state from getting lost during concurrency. Furthermore, --resume no longer crashes and --continue no longer opens a blank chat when a saved session contains an attachment missing its payload; repository detection will not drop a known repo identity after a transient git probe failure; and background GitHub connection checks for claude.ai users are now remembered across app restarts.
FEATURE
Remote control stops background agents reliably, and workflow outputs gain syntax coloring
Hitting Stop in remote-control sessions now reliably terminates background agents and workflows, keeping killed tasks visible and stoppable until their underlying processes completely exit. Resuming a workflow while a previously stopped run is still exiting no longer spawns duplicate agent instances. When a paused remote or scheduled session approves a connector tool permission prompt, execution resumes smoothly. Under /workflows, agent detail views now pretty-print JSON results with syntax highlighting and line breaks, tucking lengthy outputs behind an expand toggle, while nested background subagent results are retained inside parent transcripts.
BUGFIX
Custom commands support frontmatter models, and Vertex IDs respect token context caps
Frontmatter model: declarations inside custom commands and skills now apply properly in interactive sessions. When running in auto mode, requesting a model that is not supported will retain the current session's model instead of breaking the turn. Furthermore, CLAUDE_CODE_MAX_CONTEXT_TOKENS now respects Vertex-style model IDs carrying @YYYYMMDD date suffixes, even for version tags that Claude Code does not natively recognize out of the box.
BUGFIX
Thinking processes are not rejected repeatedly, and prompt caches persist across token refreshes
If a model's thinking reasoning is rejected during a conversation, subsequent turns will no longer be repeatedly rejected in a loop. In sessions with telemetry disabled, refreshing an OAuth token no longer unexpectedly invalidates the prompt cache. In addition, triggering a blocking Stop hook preserves the previous turn's reasoning and prevents prompt cache misses on supported models.
FEATURE
MCP server disconnects report errors immediately, and session starts speed up by 50 ms
When an MCP server (Model Context Protocol, which connects AI to external tools) disconnects while enumerating available tools at startup, Claude Code now reports the error clearly instead of showing as connected with zero tools. In remote claude.ai sessions, closing a browser-hosted MCP server tab will no longer leave you waiting 60 seconds at the start of each turn. Furthermore, headless and SDK sessions now begin their first turn up to 50 ms sooner once MCP servers finish connecting.
FEATURE
Fullscreen mode avoids blank renders, and text measurement reuse accelerates terminals
Engaging in lengthy conversations with hundreds of tool calls in fullscreen mode no longer causes the display to go blank. Resizing the terminal or rendering lengthy responses for the first time now reuses text measurement data to improve rendering performance. Shell command live output previews no longer hide the newest lines when earlier text wraps. Additionally, a bug where the file edit permission dialog occasionally truncated modified lines without warning has been fixed.
FEATURE
Plugin validation supports structured JSON, and cloud metrics restore missing user attributes
In plugin tooling and observability integrations, running claude plugin validate --json now outputs a machine-readable JSON validation report. When installing plugins, GitHub marketplace URLs containing trailing slashes or dangling ? and # fragments now correctly resolve to usable .git clone URLs. Publishing Artifacts in sessions continued from older versions no longer fails on an "unexpected parameter note" error. In addition, OpenTelemetry metrics and events emitted from cloud sessions now restore the previously missing user.email, organization.id, and user.account_uuid attributes.
FEATURE
[VSCode] Active quick filter and status menu added to session sidebar
The VS Code extension's session list sidebar now features upgraded filtering controls. A new Active quick filter button lets you instantly view ongoing sessions, alongside a dedicated status filter menu offering categories like Needs input (waiting for user response), Working (in progress), and Completed. This helps you quickly zero in on conversations requiring immediate attention when juggling multiple tasks.
Original changelog
Original changelogOrganizations can roll out managed MCP servers, and startup halts if managed config is corrupt
Added `managedMcpServers` managed setting: organizations can provide HTTP/SSE MCP servers to every user (same entry shape as `.mcp.json`); entries that name a command to run are skipped
Fixed managed `forceRemoteSettingsRefresh` being ignored at startup when a policy helper configured by MDM or the managed settings file had already run
Fixed managed settings silently going unenforced when the managed-settings file, a drop-in, the MDM plist, or the HKLM value cannot be parsed: Claude Code now refuses to start and names the source
Changed `allowedMcpServers` to govern only servers users add: a literal `managed-mcp.json` server your allowlist used to filter out now loads on upgrade; use `deniedMcpServers` to keep it off
Original changelogUnattended hosts get a prompt-suppression flag to auto-deny blocking prompts
Added `--permission-prompts none` for unattended headless hosts: anything that would prompt is denied automatically while the active permission mode (including auto mode) keeps deciding
Original changelogGitLab merge requests are recognized natively with footer badge refreshes
Added recognition of `glab mr create/merge/close/reopen/note/update` so GitLab merge requests show as `MR !N` in the collapsed tool summary and refresh the footer MR badge
Original changelogRunning the GitHub App installer inside GitLab repos now points to GitLab CI docs
Improved `/install-github-app` to explain it is GitHub-only and point to the GitLab CI/CD docs when run inside a GitLab repository
Original changelogBash Read deny rules tighten around option values, git operands, and chained commands
Fixed Bash `Read()` deny rules not covering files given as option values (`--ignore-revs-file=.env`, `-f.env`, `@file`), `git diff`/`git grep` file operands, or `cd DIR && cat FILE` compounds; `grep -r`/`cp -r` over a directory holding a denied file now asks
Original changelogWorktree isolation accommodates non-standard git probe messages from hook-created trees
Fixed worktree isolation refusing hook-created worktrees on machines where `git rev-parse` fails with a message other than "not a git repository"
Original changelogWorktree isolation relaxes checks on pipelines and launcher scripts outside the main repo
Fixed worktree-isolated sessions refusing common Bash loops, xargs pipelines and launcher-wrapped commands that cannot reach the main checkout
Original changelogConcurrent sessions no longer overwrite settings, improving resumes and repo detection
Fixed concurrent sessions silently reverting each other's `~/.claude.json` changes — workspace trust no longer resets and MCP/project state is no longer lost when running many sessions at once
Fixed `--resume` failing (and `--continue` opening an empty conversation) when a saved session contains an attachment entry with no payload
Fixed repository detection dropping a known repo identity after a transient git probe failure
Fixed a background GitHub connection check that ran on every launch for claude.ai users; the result is now remembered across launches
Original changelogRemote control stops background agents reliably, and workflow outputs gain syntax coloring
Fixed Stop not actually stopping background agents and workflows in remote-control sessions: killed tasks now stay visible and re-stoppable until their processes exit
Fixed resuming a workflow run while its previous stopped run was still exiting, which could run duplicate copies of its agents
Improved `/workflows` agent detail: JSON outcomes are pretty-printed with syntax colors and real line breaks, and long outcomes fold behind an expand toggle
Improved nested background subagent results to be saved in the parent subagent's transcript, so resumed subagents keep them and shared transcripts show the delivery
Fixed remote and scheduled sessions doing nothing after a connector-tool permission prompt was approved while the session was paused
Original changelogCustom commands support frontmatter models, and Vertex IDs respect token context caps
Fixed auto mode running a turn on a model it doesn't support when a command or skill's frontmatter `model:` named one; the turn now keeps the session model
Fixed `CLAUDE_CODE_MAX_CONTEXT_TOKENS` being ignored for Vertex-style model IDs (`@YYYYMMDD` suffix) of model versions Claude Code doesn't recognize
Fixed frontmatter `model:` on custom commands and skills being ignored in interactive sessions
Original changelogThinking processes are not rejected repeatedly, and prompt caches persist across token refreshes
Fixed a conversation whose thinking was rejected once being rejected again on every later turn
Fixed the prompt cache being invalidated when the OAuth token refreshed in sessions with telemetry disabled
Fixed blocking Stop hooks causing the turn after a block to lose the model's reasoning from that turn and, on some models, miss the prompt cache
Original changelogMCP server disconnects report errors immediately, and session starts speed up by 50 ms
Fixed MCP servers that disconnect while their tools are being listed at startup showing as connected with no tools instead of reporting the error
Fixed remote (claude.ai) sessions taking 60 seconds to start a turn after a browser-hosted MCP server's page had gone away
Improved headless/SDK session start: the first turn begins up to 50 ms sooner when MCP servers finish connecting
Original changelogFullscreen mode avoids blank renders, and text measurement reuse accelerates terminals
Fixed fullscreen mode showing a blank conversation after a long turn with hundreds of tool calls
Fixed the live output preview of a running shell command hiding its newest lines when an earlier line wrapped
Fixed the file edit permission dialog sometimes showing a changed line cut short with no indication
Improved terminal resize and first-render performance for long responses by reusing text measurements
Original changelogPlugin validation supports structured JSON, and cloud metrics restore missing user attributes
Added `--json` to `claude plugin validate` for a machine-readable validation report
Fixed Artifact publishing failing once with an "unexpected parameter `note`" error in conversations continued from an older version
Fixed OpenTelemetry metrics and events from cloud sessions missing the `user.email`, `organization.id`, and `user.account_uuid` attributes
Fixed marketplace repo URLs on github.com with a trailing slash or dangling `?`/`#` producing an unusable `.git` clone URL
Original changelog[VSCode] Active quick filter and status menu added to session sidebar
[VSCode] Added an Active quick filter and a status filter menu (Needs input, Working, Completed) to the session list sidebar