Plugin Directory Supports Batch Loading with Dynamic Hot-Reloading for Subfolders
If you regularly develop multiple extensions, you previously had to specify each plugin path individually whenever starting the command line.
Now, the --plugin-dir flag directly supports pointing to a parent folder containing multiple plugins. As long as each child folder inside has a manifest file (a specification document recording plugin metadata), the system automatically discovers and loads all extensions on startup. Even better, adding or removing child folders under that directory while running is dynamically detected and applied immediately, saving you from repeatedly restarting sessions.
BUGFIX
Plugin Path Containment Checks Hardened with More Complete Marketplace Details and Lists
Security validation and marketplace listing displays when managing plugins have received comprehensive fixes in this release. On macOS and Linux, plugins with paths containing backslashes no longer bypass symlink containment checks. Folders whose names start with two dots are no longer mistakenly refused as outside the plugin root. If the OS cannot check a component folder (such as a symlink loop), it is now explicitly reported with an error code in /plugin instead of being silently skipped. Regarding information display, marketplace discovery listings and claude plugin list --json --available now fully display descriptions and names for plugins whose metadata lives only in plugin.json. Meanwhile, the Installed tab and claude plugin details prioritize marketplace registry entries, filling any missing fields from plugin.json.
BUGFIX
Subagent Prompt Prefixes Locked for Higher Cache Reuse and Interrupted Tool Calls Preserved
Prompt caching mechanisms are now far more reliable during multi-agent collaboration and resumed workflows.
Previously, resuming a foreground-spawned subagent would alter its tool list and system prompt prefix, breaking prompt-cache reuse. Agent teammates and resumed subagents also moved SubagentStart hook context and preloaded skills out of the prompt prefix on later turns, similarly destroying cache benefits. Now, all these prefix structures remain locked in place. In addition, if a previous process died unexpectedly while a tool was running, resuming no longer rewrites the final prompt, but instead fully retains the tool call and marks it as interrupted.
FEATURE
Workflows Panel Unfolds Tool Calls with Clearer Forked Skill Streaming and Container Recovery
Progress tracking and diagnostics have become much clearer when running multi-step workflows and forked skills. In the /workflows agent detail panel, individual tool calls are now clearly marked as running, failed, or done, displaying any subagent task lists and letting you press Enter to unfold calls with their inputs and results. When using forked skills (running in an isolated background branch with context: fork), kickoff prompts and text turns generated with --forward-subagent-text now stream properly as progress events to stream-json output. If a workflow container restarts and its run journal is missing, the system now fails with a clear error instead of blindly rerunning every agent.
FEATURE
Enterprise Gateway Telemetry Exports Directly to Collectors with Identity Fields and Unpaused Relays
Transmission stability and identity metadata have been significantly enhanced when administrators collect audit data via gateways. Telemetry sent by Claude Desktop and Cowork through an apps gateway now includes user.email and user.groups fields, matching the recording specs of terminal sessions. When gateway managed settings specify a collector endpoint via OTEL_EXPORTER_OTLP_ENDPOINT, gateway sessions export OpenTelemetry data directly to that collector instead of routing through the gateway relay, while sessions without a named collector continue using the relay. Furthermore, an issue where the relay paused all forwarding for 30 seconds after rejecting a few malformed or oversized payloads has now been resolved.
BUGFIX
Managed Settings Enforce Gateway Login on Startup with Accurate Subdirectory Agent Scoping
Login flows and permission boundaries are now strictly aligned in environments governed by enterprise managed settings.
Machines with forceLoginGatewayUrl configured in managed settings now start directly as apps gateway sessions, behaving just like forceLoginMethod: "gateway", while leftover claude.ai logins or API keys are discarded. Re-running /login in these gateway sessions no longer falsely reports that no gateway URL is configured. Additionally, when loading subdirectories via /add-dir <subdirectory>, the system no longer refuses to load subdirectory agents when managed settings lock only skills to plugins, nor does it mistakenly promise agents when only agents are locked.
BUGFIX
Remote Control and Background Session Stability Upgraded with Persistent Working Directories Across Turns
Operational continuity for Remote Control and background sessions has improved significantly in this release. Non-interactive sessions (such as -p with stream-json, Agent SDK, and cloud sessions) no longer reset their working directory on every message, allowing cd commands to persist across turns. Remote Control sessions no longer send an early end-of-turn signal before the final message arrives, preventing the app from prematurely showing the reply as finished. Running /clear via Remote Control no longer waits on SessionStart hooks or open terminal dialogs before completing. Background sessions (--bg) are no longer retired mid-turn when a message arrives just before the idle timeout. Remote sandboxes no longer stay alive while waiting for connector approvals or sign-in links. Furthermore, closing VS Code or SDK sessions while refreshing authentication tokens no longer forces a re-login.
BUGFIX
MCP Supports Legacy Transport Fallback with Deferred Client Registration and Fixed Connection States
Connection handshakes and authentication mechanisms for external tools have become much more flexible. For MCP servers configured as http that only speak the legacy HTTP+SSE transport architecture, which previously failed to connect entirely, the system now automatically falls back to SSE as described in the specification. For secure registration, connecting to remote servers that require sign-in no longer registers OAuth clients in advance, but instead waits until you actually authenticate. In addition, cloud sessions previously showed some external connector servers as requiring login if they responded to unsupported requests with HTTP 401, even if you were already connected on the web; this misleading status has now been fixed.
FEATURE
Tool Output Disk Writes Capped at 1 GB with Stricter Artifact Publishing and Malicious Prompt Defense
Tool output persistence safeguards and artifact security have been significantly reinforced in this release. When external tool outputs are exceedingly large, saved disk files now have a 1 GB cap; if contents are truncated, in-conversation previews explicitly display truncation notices to prevent disk space exhaustion. For artifact management, publishing now strictly validates declared tools against connectors: publication is refused if none of the declared tools exist, and warned if only some are missing. Furthermore, when reading artifacts written by others, the summarization process now treats page content as untrusted data, actively flagging embedded instructions rather than relaying them to guard against prompt injection attacks.
FEATURE
Image Processing Moves to Built-in Engine with Specific Causes and Fixes for Size Limit Errors
Underlying architecture for handling images in the terminal is now much lighter and cleaner.
The CLI now fully utilizes the runtime's built-in image features, no longer extracting native binary modules to temporary directories on startup, which reduces disk write overhead and leftover files. Meanwhile, when an image exceeding size limits cannot be decoded, error messages now state the underlying cause and provide troubleshooting suggestions instead of merely citing the limits, letting you quickly adjust image dimensions and continue your session.
BUGFIX
Git Worktrees Support Parallel Checkout with Fixes for Sandbox File Access and Permission Wording
This release brings multiple low-level improvements to file access, version control, and permission settings. When creating worktrees via --worktree in large repositories, Git 2.32+ now checks them out in parallel, drastically reducing startup time. Resuming long sessions that previously read numerous files is also noticeably faster. On Windows, an issue where Read, Write, and Edit operations were completely rejected inside AppContainer or restricted-token sandboxes has been resolved. In addition, internal Git status and diff checks are no longer disrupted by clean filters configured in nested repositories within the working tree. Permission wording for the .claude folder has also been revised, clearly explaining that it allows editing files in the project's .claude directory or ~/.claude for that session.
FEATURE
Slash Commands Expand to Full Search Lists with Extended Two-Key Shortcut Windows and Layout Polish
Everyday terminal interactions and command menu handling have received thorough layout and responsiveness refinements in this release. Typing slash commands mid-prompt now displays matching results in a full list (which can be opened with Tab outside fullscreen), and plugin skills can be found directly by their bare names. In multitasking environments like tmux, two-key shortcuts whose second key arrives more than 1 second later now wait 3 seconds and display a timeout notice instead of cancelling silently. Fullscreen transcripts no longer jump by a row when menus open or close. Dialog heights remain stable when switching tabs in /config. Permission prompts no longer drop characters following specific syntax sigils. Resumed sessions now display unfinished background tasks as concise status lines rather than cluttering the screen with lengthy internal instructions.
BUGFIX
Model Switching Supports Specific Target Names with Stable Advisor Decisions and Accurate Error Reporting
Decision logic when switching models and configuring advisor behaviors is now significantly more stable and transparent.
Previously, the advisor tool and its instructions were re-decided per request based on that request's model; decisions are now made once and announced directly in conversation whenever they change. In terms of commands, typing /model opusplan[1m] is no longer rejected with "Model not found". If saving a default model fails due to unwritable configuration files, /model no longer falsely claims success, but instead reports the failure and its underlying cause. In addition, the built-in claude-api skill reference documentation has been corrected: model access failures return 404 and unavailable beta headers return 400, rather than the previously documented 403.
BUGFIX
[VSCode] Auto-Archiving for Inactive Sessions with Fixes for Blank Restarts and Layout Glitches
Sidebar session management and visual details have received thoughtful fixes in the VS Code extension. To keep conversation lists uncluttered over time, a new "Archive inactive sessions" setting automatically moves sessions to an archive after 14 days of inactivity by default. Previously, if a chat had been open for more than 10 minutes, reloading the window or restarting the editor often left the sidebar blank; this rendering bug has now been resolved. Additionally, a layout misalignment where the timeline dot sat beneath text in "Remote Control is active" notices has been corrected.
Original changelog
Original changelogPlugin Directory Supports Batch Loading with Dynamic Hot-Reloading for Subfolders
Added support for pointing `--plugin-dir` at a folder of plugins: each child folder with a manifest loads, and children added or removed while running are picked up
Original changelogPlugin Path Containment Checks Hardened with More Complete Marketplace Details and Lists
Fixed a plugin path containing a backslash bypassing the symlink containment check on macOS and Linux
Fixed plugin directories whose names begin with two dots being wrongly refused as outside the plugin root
Fixed a plugin's default component folder that the OS cannot check, such as a symlink loop, being silently skipped; it is now reported in `/plugin` with the error code
Fixed `/plugin` Discover/Browse and `claude plugin list --json --available` showing no description or display name for marketplace plugins whose metadata lives only in their `plugin.json`
Changed plugin display metadata to prefer the marketplace entry over `plugin.json` on the Installed tab and `claude plugin details`, filling gaps from `plugin.json`
Original changelogSubagent Prompt Prefixes Locked for Higher Cache Reuse and Interrupted Tool Calls Preserved
Fixed resuming a foreground-spawned subagent changing its tool list and system prompt prefix, which broke prompt-cache reuse for that agent
Fixed agent teammates and resumed subagents moving SubagentStart hook context and preloaded skills out of the prompt prefix on later turns, which broke prompt-cache reuse
Fixed resume after the previous process died while a tool was running: the last prompt is no longer rewritten, and the interrupted tool call is kept and marked interrupted
Original changelogWorkflows Panel Unfolds Tool Calls with Clearer Forked Skill Streaming and Container Recovery
Fixed forked skills (`context: fork`) not streaming their kickoff prompt and, with `--forward-subagent-text`, their text turns as progress events in stream-json
Fixed resuming a workflow run after its container restarted; a resume whose run journal is missing now fails with a clear error instead of rerunning every agent
Improved `/workflows` agent detail: tool calls are marked running, failed or done, the subagent's task list is shown when it has one, and Enter unfolds the listed calls with their inputs and results
Original changelogEnterprise Gateway Telemetry Exports Directly to Collectors with Identity Fields and Unpaused Relays
Added `user.email` and `user.groups` to the telemetry Claude Desktop and Cowork send through a Claude apps gateway, matching terminal sessions
Fixed the Claude apps gateway's OTLP telemetry relay pausing all forwarding to a collector for 30 seconds after it rejected a few payloads as malformed or too large
Changed Claude apps gateway sessions to export OpenTelemetry directly to a collector the gateway's managed settings name in `OTEL_EXPORTER_OTLP_ENDPOINT`, instead of through the gateway's relay; sessions without a named collector still use the relay
Original changelogManaged Settings Enforce Gateway Login on Startup with Accurate Subdirectory Agent Scoping
Fixed `/add-dir <subdirectory>` refusing to load a subdirectory's agents when managed settings lock only skills to plugins, and promising agents when only agents are locked
Fixed `/login` showing "no gateway URL is configured" when re-run in a session that signed in to a Claude apps gateway set by managed settings
Changed machines with `forceLoginGatewayUrl` in managed settings to be Claude apps gateway sessions from startup, like `forceLoginMethod: "gateway"`; a leftover claude.ai login or API key is not used
Original changelogRemote Control and Background Session Stability Upgraded with Persistent Working Directories Across Turns
Fixed VS Code and SDK sessions occasionally requiring re-login when a session was closed while refreshing its token
Fixed Remote Control sessions sending the end-of-turn signal before the reply's last message, which could show a reply as finished in the Claude app before its last part arrived
Fixed background (`--bg`) sessions occasionally being retired mid-turn when a message arrived just before the idle timeout
Fixed `/clear` from Remote Control waiting on SessionStart hooks and on open terminal dialogs before completing
Fixed non-interactive sessions (`-p` with stream-json input, Agent SDK, cloud sessions) resetting the shell working directory at each new user message; a `cd` now persists across turns
Fixed remote sessions keeping their sandbox container alive while a connector approval or sign-in link waits for you
Original changelogMCP Supports Legacy Transport Fallback with Deferred Client Registration and Fixed Connection States
Fixed MCP servers configured as `http` that only speak the legacy HTTP+SSE transport never connecting; Claude Code now falls back to SSE as the MCP spec describes
Fixed some claude.ai connectors in cloud sessions showing as needing authentication even though they are connected in claude.ai (servers that answer an unsupported request with HTTP 401)
Improved remote MCP servers that need sign-in: Claude Code no longer registers an OAuth client with them until you actually authenticate
Original changelogTool Output Disk Writes Capped at 1 GB with Stricter Artifact Publishing and Malicious Prompt Defense
Added a 1 GB cap on tool results saved to disk; the in-conversation preview says when a saved file was truncated
Fixed artifact publish accepting connector tool names the connector doesn't expose; the publish is now refused when none of the declared tools exist, and warned when only some don't
Improved the Artifact tool's read of an artifact someone else wrote: the summary now treats the page as untrusted content and flags embedded instructions rather than relaying them
Original changelogImage Processing Moves to Built-in Engine with Specific Causes and Fixes for Size Limit Errors
Improved the error shown when an image over the size limits cannot be decoded: it now names the cause and how to fix it instead of only citing the limit
Changed image processing to use the runtime's built-in image support; the CLI no longer extracts a native image module to the temp directory
Original changelogGit Worktrees Support Parallel Checkout with Fixes for Sandbox File Access and Permission Wording
Fixed Claude Code's own git status and diff probes running clean filters configured by a nested repository inside the working tree
Windows: Fixed Read, Write and Edit refusing every file ("symlink resolution changed after permission was checked") when running inside an AppContainer or restricted-token sandbox
Improved `--worktree` startup on large repositories: the new worktree is now checked out in parallel (git 2.32+)
Improved the time to resume long sessions that read many files
Updated the `.claude` folder permission option to say what it actually allows: editing files in the project's `.claude` folder (or `~/.claude`) for the session
Original changelogSlash Commands Expand to Full Search Lists with Extended Two-Key Shortcut Windows and Layout Polish
Fixed syntax-highlighted code in permission prompts and messages sometimes omitting a character after a Ruby `?`, Erlang `$`, or Perl `$` sigil
Fixed the fullscreen transcript jumping by one row whenever the slash-command or @-file suggestion list opened or closed
Fixed two-key keyboard shortcuts cancelling silently when the second key arrived more than a second later, as happens inside tmux; they now wait 3 seconds and show a notice when they time out
Fixed the `/config` dialog changing height when switching between its tabs
Fixed resumed sessions showing long model-facing recovery instructions in "background task didn't finish" notices instead of a short status line
Improved slash commands typed mid-prompt: matches now show in a list (Tab opens it outside fullscreen) instead of a single suggestion, and a plugin skill is now found by its bare name
Original changelogModel Switching Supports Specific Target Names with Stable Advisor Decisions and Accurate Error Reporting
Fixed `/model opusplan[1m]` being rejected with "Model not found"
Fixed the advisor tool and its instructions being re-decided per request from the request's model; the decision is now made once and announced in the conversation when it changes
Fixed `/model` claiming a model was "saved as your default" when the settings file couldn't be written; it now says the save failed and why
Fixed the `claude-api` skill's error-code reference: model access failures return 404 and unavailable beta headers return 400, not 403
Original changelog[VSCode] Auto-Archiving for Inactive Sessions with Fixes for Blank Restarts and Layout Glitches
[VSCode] Added automatic archiving of sessions inactive for a set period (new "Archive inactive sessions" setting, default 14 days)
[VSCode] Fixed the sidebar chat coming back blank after Reload Window or a restart when the conversation had been open for more than 10 minutes
[VSCode] Fixed the timeline dot sitting below the text on the "Remote Control is active" message