發布日期：2026-10-14
當你跟 Claude 進行長對話並暫離時，終端機現在會在背景幫你顧好快取（cache，把查過的結果暫存起來直接用）。若對話超過 20 萬個 token（AI 處理與計費的文字單位）且閒置約 54 分鐘，它會在滿一小時的提示快取過期前自動壓縮對話歷史，避免下一則訊息重新耗費完整處理成本。這項功能需要 v2.1.290 或更新版本。你可以設定環境變數 CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS 調整觸發門檻，若想停用，可在 ~/.claude/settings.json 加入 {"idleCompaction": false}。
你在對話裡用 @ 標註檔案時，現在能讓 Claude 只接收檔案路徑而非把整份文件內容直接塞進提示詞。只要設定環境變數 CLAUDE_CODE_DISABLE_FILE_MENTIONS，Claude 就會改用自身的檔案工具讀取目標路徑。當你在訊息裡提及 PDF 檔案時，系統不再把整份文件的原始位元組留在工作階段紀錄中，減少記憶體與磁碟空間消耗。另外，在 Linux 遠端工作階段中以非最高權限執行時，Read 工具讀取 PDF 指定頁面範圍失敗的問題也已修好。
管理背景執行的代理工作階段時，現在能在代理檢視裡直接用 /effort 與 /fast 決定新工作階段預設使用的思考深度與速度。直接單獨輸入 /model、/effort 或 /fast 也會跳出選單供你直接挑選。針對帶有 --safe-mode 啟動的背景工作階段，代理檢視的預覽面板現在會多出一行提示清楚顯示處於安全模式，且在工作階段被喚醒或重啟時，也不會再發生無預警脫離安全模式的情況。此外，極簡模式（bare mode）的背景提示不再誤導你重開時省略 --bare，而是改為指引你使用 /stop 與 claude --resume 來退出模式。以前背景工具重開可能遺失防護設定，現在狀態始終維持原貌。
查詢用量時，現在 /usage 能提前在幾種特別吃額度的情況下發出提醒。當你開啟最高思考深度、執行自動化工作流程、啟用常駐上下文，或是工具回傳大量資料時，畫面都會亮出提醒避免額度驟減。同時，先前在終端機與 VS Code 裡的 /usage、額度即將用盡警示，以及顯示在終端機最底下的狀態列（status line）中，偶爾會出現已用額度超過百分之一百的荒謬數字，這個計算異常已經修正。
維運自架執行器（self-hosted runner）時，調度程式現在能透過 --shutdown-drain-sec 參數設定收到 SIGTERM 結束訊號後的緩衝秒數。執行器會立刻停止輪詢新任務，並保留這段秒數讓進行中的輪詢與掛鉤（hook，特定事件發生時被觸發的小程式）順利跑完。同時，在執行期間如果連線器設定異動，透過外部包裝檔帶入的 MCP（讓 AI 連接外部工具的協定）伺服器不再被意外關閉。在主機缺少 Git 登入資訊時，setup 與 doctor 會給出更清楚的指引。工作階段若在首輪前就輸出內容，先前會漏設釋放計時器而忽略 --retire-at 導致延遲關機，現在計時器能正常運作。此外，雲端與自架環境中的 MCP 請求不再跟隨代理伺服器的 HTTP 轉址。
透過企業應用閘道串接 Claude Desktop 或終端機工作階段時，現在能更自由地管控簽章標註。如果不想在 Claude Desktop 的 Code 分頁或閘道工作階段中看見歸屬區塊，只要在閘道策略的環境變數設定 CLAUDE_CODE_ATTRIBUTION_HEADER=0 即可完全關閉。歸屬區塊本身也新增了自訂欄位。在安全管理方面，閘道先前在套用精確比對或是黑名單策略時，可能誤將被封鎖的模型對外開放。現在閘道會確實把這些違規模型從清單中排除，若收到請求則直接回傳 400 錯誤拒絕連線。以前權限控管容易出現漏網之魚，現在名單檢驗滴水不漏。
串接自訂 API 閘道伺服器時，系統現在能更穩固地處理長連線與金鑰隔離。透過環境變數 ANTHROPIC_BASE_URL 轉發串流回覆時，等待資料抵達的逾時限制從 180 秒放寬至 300 秒，減少長思考過程被中途掐斷的機率。過去當自訂閘道的工作階段對話逼近 20 萬個 token（AI 處理與計費的文字單位）時，容易誤判為長度過長而直接中斷，現在會正常送出請求。在安全性部分，先前向官方伺服器請求受控設定、功能旗標、個人資料或意見回饋時，曾發生誤將第三方閘道的金鑰一起送往官方伺服器的漏洞；現在這些請求已確實將第三方金鑰隔離，僅在必要時發送正確的官方金鑰。
開發與執行擴充模組的介面時，排版彈性現在提高許多。模組的 Text 元件新增了 size、weight、mono 與 tabular 屬性，Box 元件也支援從 xs 到 xl 的具名間距級距，舊有的 bold 則改由 weight 取代。在終端機顯示上，dimColor 淡色文字在暗色 ANSI 主題與 16 色終端機下不再與一般文字混淆。在 VS Code 或文字模式 claude -p 等無法繪製面板的環境中，$.ui.open 不會再虛報面板已放置成功。模組透過 $.ui.invalidate 觸發重繪後，更新後的內容現在會在下一輪確實送交 Claude。此外，在外掛測試框架中比對介面樹狀結構時，根節點現已強制標記所屬外掛名稱。
受企業管控的擴充模組現在能從掛鉤（hook，特定事件發生時被觸發的小程式）中獲得更多上下文細節。在 prompt.submit 掛鉤中，你可以透過 $.prompt.media 直接讀取提示詞夾帶的圖片或文件原始資料。呼叫 $.session.identity() 則能獲取工作階段的登入方式、組織與電子郵件。針對技能呼叫，skill.prompt 掛鉤現在會收到該技能的前置設定資料、來源、外掛名稱與檔案路徑。此外，session.append 掛鉤新增了佇列入口，讓記錄在對話歷程中的佇列項目能與實際發送的內容做出區隔。而 turn.start 掛鉤不再只監聽主迴圈，也能藉由是否存在 e.agentId 來識別並監聽子代理或隊友的執行回合。
在無頭模式（headless，沒有視覺介面的執行模式）下執行自動化腳本時，模組的生命週期現在受到更嚴密的防護。以往若有模組在每回合結束時自動提交提示詞，曾發生無視 --max-turns 上限、預算限制或中斷訊號而持續運行的問題，現在這些限制會被強制遵守。當管理者從遠端停用模組時，進行中的工作階段會在回合交替時立刻卸載該模組。模組熱重載在重載失敗後若立刻存入修正，現在能正確觸發更新，且重複儲存未更動的檔案不再引發無謂重載。此外，跨檔案匯入函式傳遞物件被拒絕、模組掛鉤非同步等待外部作業引發無限重複執行，以及在特定路徑未經確認建立模組等異常，均已徹底修復。
擴充外掛傳遞複雜資料結構時，系統建立了全新的深度防禦機制。外掛掛鉤與工作流程腳本現在統一將傳回物件的巢狀層級上限收緊至 28,000 層，避免惡意或異常結構拖垮系統。當外掛掛鉤因異常無法接收或回傳結果時，原本具有攔截權限的動作將直接被拒絕執行而非放行；若工具已先行運作，其輸出結果也會被強制扣留。針對個別屬性取值引發錯誤時，系統不再整份拒絕物件，僅剔除出錯的鍵值。此外，內部資料傳遞不再偷偷抹除原型鍵值，確保工具安全檢查不被繞過；模組發起網路請求收到無內容的回應碼時，也不再因標頭長度誤判超標。
在為外掛撰寫自動化測試與評估時，測試工具的精準度獲得了顯著改善。執行 claude plugin eval 時，現在能透過 --disallow-tools 參數或測試案例裡的 disallowed_tools 欄位，將特定的內建工具排除在評估流程之外。當評估過程遭遇 API 拒絕存取等錯誤時，該測試會直接判定為 0 分並以狀態碼 1 結束，不再僥倖判定為通過。在測試執行期間，若模組呼叫的服務方法在 10 秒內未給予回應，測試會比照工作階段直接判定失敗。同時，掛鉤的執行時間預算不再被背景持續呼叫所凍結。型別宣告檔位於特定路徑時驗證報錯，以及遙測事件誤報沒有掛鉤的問題也已一併修復。
在受企業統一管轄的開發環境中，受控策略與外部模組的隔離更加嚴格。當組織集中管理 Claude Code 時，/plugin 指令與外掛驗證工具現在會主動列出哪些模組掛鉤會被略過。系統修補了沙盒環境中的指令得以寫入 --plugin-dir 資料夾的安全漏洞，防止外部未經驗證的程式碼藉由沙盒外重新載入而取得高權限執行。此外，使用者自行安裝的模組不再能透過設定環境變數影響企業受控命令的執行前綴，組織定義的權限規則與 MCP（讓 AI 連接外部工具的協定）工具名稱也不再被本機模組覆蓋。透過本機裝置管理設定的強制登入組織與驗證方式，現在始終享有最高優先權。
開發與分享擴充外掛時，跨視窗同步與發布流程現在更加直覺。當你使用技能製作模組並準備發布時，Claude 現在會在建立 GitHub 儲存庫之前，先向你確認要設為公開還是私人專案，並且會主動檢查即將推送的檔案內容是否妥當。在多個終端機視窗並行作業的情境下，先前在另一個終端機剛剛安裝的新外掛，在當前視窗執行 /reload-plugins 時可能會抓不到，現在這項同步問題已經修復。
使用沙盒機制隔離執行指令時，系統修補了多項利用捷徑繞過管制的漏洞。在 macOS 上，沙盒指令過去曾藉由符號連結（symlink，指向另一個位置的捷徑檔）找到目標真實路徑，進而讀寫被明確禁用的目錄，現在這類捷徑穿透已被阻斷。當沙盒允許讀寫的起始目錄在執行中被替換成符號連結時，權限規則會立即重新檢查。針對包含大括號、括號或反斜線等特殊字元的資料夾路徑，設定檔檢查與底層沙盒對萬用字元的解讀現在已完全一致。在 Linux 環境下，若指令在展開萬用字元讀取規則時耗時較長，使用者也能正常按下 Esc 或 Ctrl-C 隨時中斷操作。
在不同作業系統上啟動沙盒時，邊界環境的設定儲存與目錄權限修復完畢。在 WSL2（Windows 上的 Linux 子系統）環境下，當沙盒具備 Windows 磁碟的寫入權限時，過去曾因目錄建立失敗報錯而卡住，現在已能正常執行。在 Linux 系統上，沙盒指令結束後若在設定目錄留下空白檔案，先前會導致登入狀態、伺服器清單與專案信任紀錄看起來全部丟失，這項顯示異常已修復。另外，若專案資料夾本身為唯讀而無法寫入設定，輸入 /sandbox 過去會虛報成功，現在會誠實告知設定未變更以及具體原因。以前遇到權限受阻時容易讓人摸不著頭緒，現在所有狀態都如實呈現。
當你替專案配置多個擴充服務並設定存取規則時，不再會因為特殊字元或縮寫而套用到錯誤目標。在設定檔中若 MCP（讓 AI 連接外部工具的協定）伺服器恰好命名為 constructor、prototype 或 toString 等 JavaScript 保留關鍵字，過去會無法連線或在自動授權模式下反覆跳出確認視窗，現在已恢復正常。同時，權限規則對名稱的匹配不再寬鬆放行：例如規則 mcp__a 過去會誤讓名稱為 a__b 或 a_ 的伺服器一同通過，現在僅嚴格允許名稱完全吻合的目標，若要涵蓋全部工具必須寫成完整名稱 mcp__<server>__*。若伺服器名稱本身包含雙底線，詢問與阻擋規則現在也能正確生效，不再因為底線切割而失效。
透過網路連接外部工具時，通訊連線與資料傳遞的完整性獲得顯著提升。在雲端工作階段與遠端連線中，連線器預設將自動協商最新的 2026-07-28 協定版本。官方第一方伺服器的工具說明與指示文字，原本在超過 4,096 個字元時會被無情切斷，現在會完整傳遞給 Claude。進行身分驗證或更新 token（授權令牌）時，系統現在會如實送出自訂的標頭資訊，避免企業反向代理伺服器阻擋。針對 HTTP 連線收到通知時伺服器未結尾導致連線卡死 30 秒、背景重新連線導致工具呼叫重複執行或失敗，以及未經驗證的 HTTP 轉址問題，均已在此次更新中一併排除。
管理外部工具的設定清單時，格式驗證與啟動防護更加安全。現在當專案中的 .mcp.json 內容為空時，claude mcp list、claude doctor 與 /status 不再把它誤報為無效設定。如果設定檔裡的啟用清單只填寫單一伺服器名稱字串，整份檔案也不會再被忽略。在安全防護方面，當被安全性策略阻擋的伺服器遭到查詢或動態載入時，系統現在會在連線前就直接標記為受阻，絕不再暗中將其啟動或建立連線。此外，執行 claude mcp add 加入指令時，若指令結尾包含 --background，系統不會再誤把新增指令本身當成背景工作階段執行。以前設定檔格式稍微精簡就容易失效，現在容錯率高且安全把關嚴密。
從網頁端使用遠端遙控（Remote Control）操控本機終端機時，連線佇列的傳輸韌性更加穩固。在網路連線不穩或頻寬較慢的環境下，大量事件資料無法及時上傳時曾導致網頁畫面完全凍結，現在這類卡死狀況已經修復。當整批排隊等待的提示詞中有一則發送失敗時，同批次的其他提示詞不再會無故被整批丟棄。若使用者手動按下停止（Stop）中斷了下一則提示詞的檢查，前一則已經順利通過檢查的提示詞也能如實保留在歷史紀錄中。另外，使用方向鍵停留在佇列訊息上方時，介面現在會明確解釋停留原因。執行清除重置後再恢復舊工作階段，也不會再發生錯連到清除後新工作階段的靈異現象。
透過遠端遙控發送多媒體檔案時，傳輸遺失的漏洞已全部補齊。當你從手機或遠端網頁介面上傳照片時，即便電腦端本機暫存複本因磁碟或權限問題無法儲存，Claude 現在依然能正常接收並看見該張照片。在長時間持續運行的遠端工作階段中，先前偶爾會發生傳送的檔案憑空消失、Claude 完全沒收到的狀況，現在檔案送達的可靠性已獲得修正。此外，大小落在 30 到 35 MiB 之間的大型檔案，過去在傳送至遠端遙控或雲端工作階段時會卡住無法送達，現在這類體積的大檔案也能順暢上傳。以前跨裝置傳大檔或照片容易漏接，現在每次發送都能確實抵達。
連線至雲端工作階段遇到存取受阻時，系統現在能給出更正確的錯誤指引。如果因為網頁端登入憑證失效或被拒絕而無法連線，畫面現在會清楚提示具體原因，並指引你使用 claude auth login 重新登入。當你透過金鑰輔助工具（apiKeyHelper）帶入金鑰且連線遭拒時，錯誤訊息不再張冠李戴指向錯誤的企業組織名稱。在介面顯示方面，先前在工具組單行標籤展開後，偶爾會在標籤後方多餘露出模型接續產生的內部文字，現在這些排版干擾已經清理乾淨。以前登入遇到狀況往往只能看著模糊的報錯乾著急，現在每一條阻擋訊息都清楚告訴你下一步該如何處理。
在雲端執行長對話時，背景工作單元（worker）更換時的回覆更為穩定。雲端工作階段的背景工作單元被換掉的那一刻，以前如果恰好碰上使用者回覆授權詢問、對話剛完成壓縮，或是輸出剛好碰觸到 token（AI 處理與計費的文字單位）上限，系統容易遺失當前狀態，導致訊息被已讀不回或輸出停滯在半空中。現在這些中斷的回答都能順利接續。同時，若在工具執行完畢且同時載入技能的關鍵步驟重啟工作階段，也不會再發生把早已完成的回合又重新重複回答一次的狀況。以前替換時容易卡死，現在交接過程順暢無痕。
在團隊協作（Cowork）雲端工作階段中，外掛跨裝置同步與授權防護機制全面優化。你在另一台裝置上對外掛進行的更新、停用或刪除，進行中的協作工作階段現在能及時生效，不再執著於舊版本直到重開。啟動時多個處理程序同步外掛所產生的路徑未找到假警報也已排除。在權限控管上，自動模式下的權限掛鉤（PermissionRequest）不再被允許自動核准終端機指令或衍生子代理，這類高風險操作必須等待人工授權或直接被拒絕。而在非自動模式下使用瀏覽器擴充功能時，若安全分類器標記了已核准網站的動作，系統會改為主動向你確認而非直接拒絕。此外，前版中中途停止導致編輯重試失敗的問題也已修好。
在終端機中閱讀中日韓文字（CJK）與表情符號交雜的內容時，畫面排版現在更加平整。過去在特定視窗寬度下，中英夾雜或帶有表情圖示的段落換行時，最後一行文字偶爾會無端消失，或者在下方留下突兀的空白行；在極度狹窄的視窗或單格寬度欄位中，這類雙倍寬度字元也容易引發多餘空行。此外，當文字在寬字元旁邊截斷時，容易出現留下空白格子或被錯誤截斷兩次的問題，表情符號內部遇到顏色屬性切換時圖案憑空消失的臭蟲也已解決。
在終端機全螢幕模式下檢視對話紀錄時，選取文字與格式呈現更加穩定。現在雙擊展開行中的單字會精準選取該單字，不再誤將整行折疊收起。當系統在閒置時提示輸入指令以節省 token（AI 處理與計費的文字單位）時，新版本安裝完成的通知會並排顯示於提示旁，不再被擋住。在排版樣式上，表格內部粗體、斜體等巢狀文字樣式先前在遇到自動換行時，常會破壞表格邊框或丟失樣式，現在已能維持邊框完整。此外，在不支援括號貼上模式的終端機裡貼入大段文字時，遇到全形引號等不可見控制字元時文字被整批截斷的重大問題，也已徹底修復。以前看長紀錄容易誤觸折疊或排版跑版，現在互動體驗順暢自然。
長時間開啟除錯模式或呼叫多個代理人時，記憶體佔用過高的狀況獲得了徹底根治。在開啟 --debug 或 --debug-file 記錄大量日誌時，過去記憶體會隨著輸出持續膨脹；若儲存日誌的磁碟或網路掛載點突然停止寫入，程式在結束退出時還會陷入死當，現在這兩項問題都已修復。當除錯輸出導向標準錯誤輸出，而外部父行程停止讀取串流時，記憶體也不會再毫無上限地暴增。此外，在遠端遙控或雲端環境中，如果一個工作階段先前曾派生執行過大量子代理（subagent），以往重新連線恢復該工作階段時會瞬間吃掉巨量記憶體。這個問題已經修好，恢復後記憶體不再飆高。
你在終端機裡打字與系統互動時，多項輸入誤觸與格式拼接的問題均已修復。過去當你在輸入框打字尚未送出時，背後若剛好彈出授權確認或提問，按下的 Enter 鍵容易不小心把該詢問直接確認掉，現在系統會保護輸入狀態不被誤觸。透過串流 JSON 格式發送多個排隊內容區塊時，合併為同一回合的訊息不再黏在一起，會保留清楚的換行符號。如果對背景工作階段輸入 --bg 或 --background 等文字內容，系統不再誤把文字當成指令參數而重複開啟新工作階段。此外，包含特殊鍵盤符號表情圖示的授權說明文字不再提前換行截斷，自訂指令內嵌的指令碼在被新訊息中斷時也不會再重複跑兩次。
使用 /btw 向 Claude 提出額外的旁支問題時，畫面捲動與超時防護更加完善。在終端機全螢幕模式下向上捲動查看歷史紀錄時，如果中途輸入 /btw 提問，畫面過去會冷不防被強制拉回最底端，現在捲動位置會固定在原地不受干擾。在自動化執行的非互動式工作階段中，先前發起的 /btw 提問若在工作階段結束前未被處理，常會遺留在背景甚至在收到相同請求時重複執行第二次；現在工作階段結束時會立刻取消未完提問。同時，非互動模式下的 /btw 提問如果超過 11 分鐘仍未獲得回應，系統會主動回傳逾時錯誤不再無限等待。以前提問容易打斷看紀錄的節奏，現在安靜又守時。
自訂技能（Skill）與斜線指令的載入機制進行了多項安全防護。檔案或資料夾名稱若夾帶隱藏字元、轉向控制字元、空白字元或角括號等危險符號，系統會直接拒絕載入該技能直至更名。在掛鉤執行順序上，UserPromptSubmit 掛鉤現在會搶在技能或指令展開前優先執行，如果掛鉤阻擋了提示詞，其內部嵌入的終端機命令也會一併被安全攔截。此外，使用 /reload-skills 時會清楚提示它會將完整技能清單重新發送，是長對話壓縮後召回遺失技能的最佳方式。呼叫未知技能時若誤加前綴，系統會主動建議正確名稱。以 / 開頭、用 Agent SDK 的 verbatimPrompts 選項送出的提示詞，在重啟後不會再被誤當成斜線指令執行。
利用 Git 工作樹（worktree，讓專案平行開多份副本的功能）進行隔離作業時，系統的容錯與清理機制更加可靠。在具備隔離保護的工作階段中，安全防護層先前會意外放行某些特定 awk 腳本，現在這些可能突破邊界的程式碼已確實被攔截拒絕。在採用新版 reftable 格式儲存參照的 Git 儲存庫中，結束工作階段後留置在內部的殘留資料夾現在能正常清理乾淨。如果因為儲存庫尚未有任何提交紀錄而導致基底無法解析，或是嘗試在裸儲存庫（bare repository）的根目錄建立工作樹，錯誤訊息不再丟出艱澀的底層代碼，而是明確說明檔案結構與具體原因。以前遇到失敗難以除錯，現在提示清楚又好懂。
退出 Claude Code 時，終端機印出的重新連線指令現在更安全且更簡潔。程式退出時提供的恢復指令改為固定採用工作階段 ID 識別，不再使用可能包含特殊字元的自訂名稱，杜絕直接貼上指令時發生非預期程式碼執行的風險。在工作樹工作階段結束時，若螢幕寬度不足以容納完整參數，指令會自動縮短使用 -w 與 -r 縮寫；若仍放不下則會在上方提示適合執行的目錄位置。此外，執行程式碼審查指令 /ultrareview 遭遇上傳阻礙時，錯誤訊息不再草率建議讀者執行 git add .，避免不小心把敏感的環境設定檔誤加入暫存區。以前複製指令心驚膽跳，現在處處設有防護線。
在對話中上傳圖片與文件附件時，檔案傳輸與處理邏輯迎來全方位修復。在長對話中，若先前曾有一張超大尺寸圖片被 API 拒絕，過去會導致後續每一輪對話新附帶的圖片全部跟著丟失，現在這項連鎖錯誤已經排除。當 Claude 正在運算產出時若你在輸入框追加發送訊息，內含的文件區塊不再被漏掉。在 VS Code 或桌面版中背景附加的圖片，系統不再強制以原始超大尺寸硬塞給伺服器，降低長對話反覆報錯的機會。針對接近正方形的大型圖片，新模型上的座標提示偏移問題已重新校準。遠端工作階段中途下載卡住的附件，現在也會自動重新嘗試下載。此外，貼上圖片時模組改寫提示詞被吞掉的毛病也已修復。
管理即時產出物（Artifact）與讀寫檔案時，容量與編碼轉換的安全規範更為健全。本機工作階段現在能同時監視多達 25 個已發布的產出物，高於舊版的 10 個上限。當發布請求遭到伺服器或代理端以 HTTP 403 拒絕時，系統不再盲目建議重試，而是具體回報權限受限並指導使用者。在檔案讀寫方面，Read 工具先前讀取帶有位元組順序記號的 UTF-16LE 檔案會產生亂碼，Write 工具也曾發生丟失記號或擅自將其他編碼轉為 UTF-8 的危險行為，現在遇到這類特殊編碼會明確拒絕防止資料損壞。此外，差異比對介面處理頭尾帶有空格的檔名時不再搞錯名稱，大頁面因單一換行引發的發布衝突也已解決。
讓背景代理人（Agent）與隊友協同作業時，通知反饋與資訊安全更加可靠。背景代理的通知訊息現在會精準說明細部狀態，包括它只是在等待自身的背景工作、收到的訊息晚於產出結果，或是因為額度上限而被強制停止。如果啟動隊友時未指定描述，系統不再把提示詞中的機密登入資訊誤當成任務描述顯示在面板上，杜絕憑證外洩風險。在自動模式下，背景子代理不再把最終報告重複發送兩次。重新啟動終端機並恢復工作階段後，SendMessage 也能依照名稱找到子代理（最近一次壓縮之前取的名稱仍需改用 agent ID）。此外，當已結束的子代理或被終止的隊友重新喚醒時，模組掛鉤現在會如實收到恢復通知並具備否決權限。
為 Claude 設定定時排程與自動喚醒時，時間計算的準確度獲得全盤校準。排程工具過去在播報任務預計執行時間時常會偏差一分鐘，現在已修正為如實回報下一次運行的真實時刻。在日光節約時間（夏令時間）結束並重複同一小時的時區交替期間，排程任務與迴圈先前會在每一回合反覆被觸發甚至提前偷跑，這個時間計算漏洞已經徹底修復。在 Agent SDK、IDE 與遠端遙控環境下，當背景有其他任務正在執行時，定時喚醒機制先前會遭到壓制而無法發動，現在皆能準時觸發。此外，當設定檔啟用進階功能時，無頭模式的排程回合也能正確收到環境通報。以前排程容易搶跑或延遲，現在分毫不差。
在 Windows 平台上運行 Claude Code 時，底層命令執行與資源回收修復多項盲點。在忙碌的主機上檢查處理程序是否存活時，過去容易在系統中殘留無人認領的孤兒 PowerShell 行程，累積到最後甚至耗盡記憶體，現在程序生命週期已經能正常結束。如果電腦尚未安裝 Git for Windows，未特別指定命令解譯器的工具使用前檢查與權限授權掛鉤，過去會因找不到執行環境而門戶大開直接放行，現在遇到防護檢查失敗時會直接阻擋工具呼叫以策安全。此外，修復了 Git Bash 在啟動時若未正確回報環境路徑（PATH），導致整場工作階段中所有 Bash 指令全部回報找不到指令而癱瘓的嚴重問題。
使用計畫模式（plan mode）規劃複雜任務時，系統安全防護更加嚴密。當環境中開啟了跳過授權功能時，進入計畫模式現在會顯示一次性提示，告知你大部分的檔案修改與指令執行將不會逐一向你詢問確認。計畫模式現在會嚴格禁止任何寫入操作，即便該操作被前置檢查掛鉤所放行也一律強制擋下。在終端機執行腳本時，過濾刪除指令的機制不再神經質，針對未真正執行 rm 的腳本不再彈出不必要的刪除警告。當切換至不支援自動模式的模型時，無頭模式工作階段不會再硬留在自動模式中。雲端工作階段重啟時重複執行核准工具的瑕疵，以及瀏覽器擴充功能未連線時的提示也已一併修正。
在文字輸出模式下運行時，系統的錯誤反饋與爬取機制迎來貼心調整。執行 claude -p 時若設定檔驗證失敗，終端機不再毫無反應地默默退出，而是會在標準錯誤輸出中列出出錯的檔案路徑與無效設定項目。當你在 /config 切換推播通知開關時，伺服器不再把上一動的舊設定誤存進帳號中。若啟動時帶入了無法辨識的模型識別碼，歡迎橫幅下方現在會收攏成簡潔的一行警示並附上說明文件連結。針對 WebFetch 讀取網頁的行為，系統現在會比照網路搜尋的邏輯，智慧配合呼叫者當前模型的思考深度。另外，安全防護通知中已移除申請驗證計畫的舊指示。以前排查設定錯誤宛如瞎子摸象，現在問題根源一目了然。
在 VS Code 裡使用 Claude Code 擴充套件時，工作階段切換與啟動速度獲得了明顯優化。你在對話框輸入到一半尚未送出的提示詞與檔案附件，在切換到其他對話視窗再切回來時會完整保留，不再憑空消失。在尚未配置 Python 環境的工作區中，Claude 會在 Python 套件載入的同時同步啟動，有效縮短等待時間；針對曾開啟過的專案資料夾，新視窗中的模型選擇器與斜線指令選單現在一開就能立刻就緒。在資源管理上，開啟新對話後未使用的空白聊天視窗不再霸佔背景處理程序。此外，當你在未登入狀態點擊語音麥克風按鈕時，介面不再跳出冷冰冰的內部錯誤代碼，而是貼心引導你完成登入。
管理雲端自架環境與例行常規任務（routine）時，操作反饋與防護流程顯著升級。在建立自架環境或金鑰時，畫面上顯示的部署指令現在會完整展開、在參數間適當換行，並附上顯眼的複製按鈕。當管理者刪除某個自架環境時，綁定該環境的常規任務會立刻被自動停用並標註原因，不再放任排程在背景無端報錯。在編輯常規任務時，即便所屬環境已被刪除，也不會再偷偷被移轉到其他無關的環境中。在管理介面中貼上工作階段 ID 搜尋時，先前查無結果的問題已修復；當搜尋沒有相符項目時，介面會清楚提示無符合項目而非誤報清單為空。此外，大量既有產出檔案同時回傳導致工作階段記憶體瞬間暴增崩潰的漏洞也已排除。
當你的遠端電腦暫時斷線或無法連線時，遠端遙控視窗不再假裝訊息已經順利送出。以前在連線中斷時按下送出，文字會直接從輸入框消失，讓人誤以為指令已經送達遠端主機執行，直到苦等許久才發現電腦根本沒收到。現在只要偵測到連線中斷，你輸入的內容會安穩留在輸入框裡，送出按鈕也會維持反灰鎖定狀態，直到重新連上電腦為止。
在 Slack 頻道中使用 Claude 機器人時，互動禮節與編輯習慣變得更加優雅。當 Claude 需要更正先前回答錯誤的訊息時，現在會直接在原地編輯該則留言並附上簡短的「已編輯」標註，不再把整段舊文字劃上刪除線弄亂版面。當它被邀請加入超過 100 名成員的大型群組時，現在會保持安靜默默加入，不再大肆張貼自我介紹洗版。如果頻道成員要求刪除它先前建立的畫布（canvas），Claude 現在也能順從指令直接刪除。在有訪客的頻道中，若頻道指示要求它回答未標註自己的貼文，Claude 不再沉默神隱。此外，回覆未加入的私密討論串會明確回報無法送達，自架執行器缺少 Python 環境導致發不出訊息的狀況也已修正。
你在專案的合併請求中收到審查留言，或是發現檢查清單提示本月費用已經達到上限時，能更快找到調整額度的地方。通知卡片與留言先前會誤把管理員帶到一般的 Claude Code 設定選單，讓人到處翻找卻找不到修改位置。現在點擊通知裡的連結，會直接導向用量（Usage）專屬頁面，也就是設定該上限的正確位置。
When you have a long conversation with Claude and step away, the terminal now manages your cache in the background. If a conversation exceeds 200,000 tokens and remains idle for around 54 minutes, it automatically compacts the conversation history before the one-hour prompt cache expires, preventing the next message from incurring the full processing cost again. This feature requires v2.1.290 or later. You can set the environment variable CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to adjust the trigger threshold, or disable it by adding {"idleCompaction": false} to ~/.claude/settings.json.
When mentioning files with @ in a conversation, you can now have Claude receive only the file path instead of stuffing the full document content into the prompt. Simply set the environment variable CLAUDE_CODE_DISABLE_FILE_MENTIONS, and Claude will instead use its own file tools to read the target path. When you mention a PDF file in a message, the system no longer retains the raw bytes of the entire document in the session history, cutting down on memory and disk consumption. In addition, an issue where the Read tool failed to read specific page ranges of PDFs when running without root privileges in Linux remote sessions has been fixed.
When managing background agent sessions, you can now use /effort and /fast directly in the agent view to set the default thinking depth and speed for new sessions. Entering /model, /effort, or /fast on its own also opens a menu for direct selection. For background sessions launched with --safe-mode, the preview panel in the agent view now displays an extra line clearly indicating that safe mode is active, and sessions will no longer silently drop out of safe mode when resumed or restarted. In addition, background prompts in bare mode no longer mislead you into omitting --bare when reopening, guiding you instead to use /stop and claude --resume to exit the mode. Previously, reopening background tools risked losing protection settings, but now state remains intact throughout.
When checking resource usage, /usage now warns you in advance during several scenarios that consume significant quota. Alerts appear on screen when you configure maximum thinking depth, run automated workflows, enable persistent context, or receive heavy tool output, helping prevent rapid quota exhaustion. At the same time, a calculation bug that occasionally produced absurd figures exceeding 100 percent in /usage, quota exhaustion warnings, and the status line at the bottom of the terminal across both the terminal and VS Code has now been corrected.
When operating self-hosted runners, the scheduler can now use the --shutdown-drain-sec flag to specify a grace period in seconds after receiving a SIGTERM signal. The runner immediately halts polling for new tasks and preserves this duration to allow active polls and hooks to complete cleanly. Meanwhile, MCP servers loaded via external wrapper files are no longer unexpectedly terminated if connector configurations change during execution. When a host lacks Git credentials, setup and doctor now provide clearer instructions. Sessions that emit output before their first turn previously missed setting a retirement timer and ignored --retire-at, causing delayed shutdowns; this timer now operates properly. Additionally, MCP requests in both cloud and self-hosted environments no longer follow proxy HTTP redirects.
When routing Claude Desktop or terminal sessions through enterprise application gateways, you can now manage attribution signatures with greater flexibility. If you prefer not to display the attribution block in gateway sessions or the Code tab of Claude Desktop, setting the environment variable CLAUDE_CODE_ATTRIBUTION_HEADER=0 in your gateway policy disables it entirely. The attribution block itself also gains custom fields. For security management, gateways previously could inadvertently expose blocked models when applying exact-match or blacklist policies. The gateway now strictly excludes these prohibited models from its catalog and rejects matching requests by returning a 400 error. Permission enforcement previously risked leaking blocked entries, but list verification is now airtight.
When connecting custom API gateway servers, the system now provides more resilient handling for long-lived connections and API key isolation. Streaming responses routed through the ANTHROPIC_BASE_URL environment variable now have their data timeout extended from 180 seconds to 300 seconds, reducing the likelihood of long thinking processes getting cut off midstream. In the past, custom gateway sessions nearing 200,000 tokens were often mistakenly flagged as exceeding length limits and aborted; requests are now dispatched normally. On the security front, requests to official servers for managed settings, feature flags, profile data, or feedback previously suffered from a vulnerability that forwarded third-party gateway keys to official endpoints; those requests now strictly isolate third-party keys and transmit only the valid official keys when required.
When developing and rendering module interfaces, layout flexibility is now substantially improved. The module Text component introduces size, weight, mono, and tabular properties, while the Box component supports named spacing scales ranging from xs to xl, with the legacy bold property replaced by weight. On terminal displays, dimColor muted text is no longer conflated with standard text under dark ANSI themes and 16-color terminals. In environments incapable of rendering overlays, such as VS Code or text-mode claude -p, $.ui.open no longer falsely reports successful placement. When a module triggers a re-render via $.ui.invalidate, updated contents are now reliably delivered to Claude on the subsequent turn. Furthermore, when asserting UI trees in the plugin test framework, root nodes are now strictly labeled with their owning plugin name.
Enterprise-managed extension modules now receive richer contextual details from hooks. Inside the prompt.submit hook, you can access raw image and document attachments from prompts directly through $.prompt.media. Calling $.session.identity() retrieves the session login method, organization, and email address. For skill invocations, the skill.prompt hook now receives the skill frontmatter configuration data, source, plugin name, and file path. In addition, the session.append hook introduces a queue entry point, separating queued transcript items from dispatched content. The turn.start hook no longer listens exclusively to the main loop, allowing it to recognize and monitor subagent or teammate turns via the presence of e.agentId.
When running automation scripts in headless mode, module lifecycles are now shielded by stricter safeguards. Previously, if a module automatically submitted prompts at the end of each turn, it could bypass --max-turns limits, budget constraints, or abort signals and keep running; these constraints are now enforced. When administrators remotely disable a module, active sessions unload it immediately at turn boundaries. If fixes are saved immediately after a hot-reload failure, hot reloading now triggers updates properly, and re-saving untouched files no longer sparks redundant reloads. Furthermore, issues where cross-file function imports rejected object passing, module hooks asynchronously awaiting external operations entered endless loops, and modules were created at specific paths without confirmation have all been thoroughly resolved.
A new defense-in-depth mechanism is now in place when plugins pass complex data structures. Plugin hooks and workflow scripts now uniformly cap the nesting depth of returned objects at 28,000 levels, preventing malicious or abnormal structures from degrading the system. When a plugin hook fails to receive or return results due to an exception, actions with intercept permissions are directly blocked from running rather than allowed through. If a tool has already run, its output is also forcibly withheld. When retrieving an individual property triggers an error, the system no longer rejects the entire object and instead only removes the offending key. Additionally, internal data passing no longer silently strips prototype keys, ensuring tool security checks cannot be bypassed. When a module makes a network request and receives a no-content status code, it also no longer misreports header length limits as exceeded.
Testing accuracy has improved significantly when writing automated tests and evaluations for plugins. When running claude plugin eval, you can now exclude specific built-in tools from the evaluation flow using the --disallow-tools flag or the disallowed_tools field in test cases. When an evaluation encounters errors such as API access denials, the test is immediately scored 0 and exits with status code 1, rather than passing by chance. During test runs, if a service method called by a module does not respond within 10 seconds, the test directly fails just like a regular session. Meanwhile, hook execution time budgets are no longer frozen by continuous background calls. Validation errors when type declaration files are located at specific paths, along with telemetry events falsely reporting no hooks, have also been fixed.
Managed policies and external modules are now more strictly isolated in centrally governed enterprise development environments. When an organization manages Claude Code centrally, the /plugin command and plugin verification tools now proactively list which module hooks will be skipped. A vulnerability where commands inside the sandbox could write to the --plugin-dir folder has been patched, preventing unverified external code from gaining elevated execution privileges through reloads outside the sandbox. Furthermore, user-installed modules can no longer influence execution prefixes for enterprise-managed commands by setting environment variables. Organization-defined permission rules and MCP tool names can also no longer be overridden by local modules. Enforced login organizations and authentication methods configured through local device management now consistently receive top priority.
Cross-window synchronization and publishing flows are now more intuitive when developing and sharing plugins. When creating a module using skills and preparing to publish, Claude now checks whether you want the project to be public or private before creating a GitHub repository, and proactively verifies whether the files about to be pushed are appropriate. When working across multiple terminal windows in parallel, newly installed plugins from another terminal could previously be missed when running /reload-plugins in your current window, but this sync issue is now resolved.
Several vulnerabilities that exploited shortcuts to bypass controls while running commands in an isolated sandbox have been patched. On macOS, sandboxed commands could previously follow symbolic links to resolve real target paths and read or write explicitly forbidden directories, but such traversal is now blocked. If a root directory permitted for sandbox read and write access is replaced with a symbolic link during execution, permission rules are immediately re-evaluated. For directory paths containing special characters such as braces, brackets, or backslashes, configuration checks and the underlying sandbox now interpret wildcards in complete alignment. Under Linux, if a command takes a long time to expand wildcard read rules, users can press Esc or Ctrl-C normally to cancel the operation at any time.
Configuration saving and directory permissions in boundary environments are now fixed when launching the sandbox across different operating systems. In WSL2 environments where the sandbox has write permissions to Windows drives, directory creation failures previously halted execution, but it now runs properly. On Linux, if a sandboxed command left empty files in the configuration directory upon exiting, login states, server lists, and project trust records previously appeared entirely lost, a display issue that is now resolved. In addition, if a project folder is read-only and prevents writing settings, running /sandbox previously reported a false success, but it now accurately reports that settings were unchanged along with the specific reason. While blocked permissions previously caused confusion, all statuses are now reported faithfully.
When configuring multiple extension services and setting access rules for a project, rules will no longer apply to the wrong target due to special characters or abbreviations. In configuration files, if an MCP server happens to be named after a JavaScript reserved keyword like constructor, prototype, or toString, connections previously failed or repeatedly prompted confirmation dialogs in auto-approve mode, but this now works normally. At the same time, permission rules no longer match names loosely. For example, rule mcp__a previously allowed servers named a__b or a_ to pass by mistake, but it now strictly permits only exact name matches. Covering all tools now requires the full pattern mcp__<server>__*. If a server name itself contains __, prompt and block rules now also take effect correctly without breaking when the name is split at that point.
Communication connections and data integrity have improved markedly when connecting to external tools over the network. In cloud sessions and remote connections, connectors now automatically negotiate the latest 2026-07-28 protocol version by default. Tool descriptions and instructions from official first-party servers, which were previously cut off past 4,096 characters, are now delivered in full to Claude. When authenticating or refreshing tokens, the system now faithfully sends custom headers to prevent enterprise reverse proxies from blocking requests. Issues where HTTP connections hung for 30 seconds due to unclosed server notifications, background reconnections caused duplicate or failing tool calls, and unverified HTTP redirects occurred have all been resolved in this update.
Format validation and launch guards are now safer when managing configuration lists for external tools. When .mcp.json in a project is empty, claude mcp list, claude doctor, and /status no longer misreport it as an invalid configuration. If the enabled list in a configuration file contains only a single server name string, the entire file is no longer ignored. On the security side, when a server blocked by a security policy is queried or dynamically loaded, the system now marks it as blocked prior to connecting and never launches it or establishes a connection covertly. Furthermore, when adding a command with claude mcp add, if the command ends with --background, the system no longer mistakes the add command itself for a background session. Where slightly condensed configuration formats once failed easily, fault tolerance is now high alongside strict security checks.
Transmission resilience in the connection queue is sturdier when using Remote Control from the web to operate a local terminal. Under unstable network connections or slower bandwidth, heavy event uploads previously caused the web UI to freeze completely, but these lockups are now resolved. When one prompt in a queued batch fails to send, other prompts in the same batch are no longer discarded for no reason. If a user manually presses Stop to interrupt checks on the next prompt, the prior prompt that already passed checks is properly preserved in history. In addition, when hovering over queued messages with arrow keys, the interface now clearly explains why the pause occurred. Restoring an old session after a clear reset also no longer glitches into the newly cleared session.
Transfer loss bugs when sending multimedia files via remote control have now been resolved. When you upload photos from a phone or the remote web interface, Claude can now properly receive and view the image even if local caching on your computer fails due to disk space or permission issues. In long-running remote sessions, delivered files that previously vanished into thin air without reaching Claude are now reliably delivered. Furthermore, large files between 30 and 35 MiB that previously stalled when sent to remote control or cloud sessions now upload smoothly. Cross-device transfers for large files and photos previously dropped packets easily, but every transmission now arrives as expected.
When access to a cloud session is blocked, the system now provides more accurate error guidance. If a connection fails because web login credentials have expired or been rejected, the screen now clearly explains the specific reason and directs you to run claude auth login to authenticate again. When you supply a key through apiKeyHelper and the connection is denied, error messages no longer point to the wrong organization name. On the interface side, internal model text that previously leaked behind expanded single-line toolset labels has been cleaned up. Login issues that previously left you stranded with vague errors now provide clear next steps for every blocked request.
Responses during long conversations in the cloud are now more stable when background workers are replaced. Previously, if a cloud session worker was swapped right as a user answered an authorization prompt, context was compacted, or output reached the token limit, the system could lose its state and drop the message or stall the response. These interrupted turns now resume smoothly. Additionally, restarting a session during the critical step where a tool finishes running while skills are being loaded no longer causes previously completed turns to be repeated. Transitions that once froze operations now proceed seamlessly.
Plugin synchronization and authorization safeguards across devices have been comprehensively improved in Cowork cloud sessions. Updates, disabling, or deletions made to plugins on another device now take effect immediately in active collaborative sessions instead of clinging to old versions until a restart. False path-not-found warnings triggered by multiple processes syncing plugins during startup have also been eliminated. For permission control, PermissionRequest hooks in auto mode are no longer allowed to automatically approve terminal commands or spawned subagents, requiring manual approval or outright rejection for such high-risk operations. When using browser extensions in non-auto mode, actions flagged by security classifiers on approved websites now prompt you for confirmation rather than being rejected immediately. In addition, an issue from the previous version where stopping mid-stream caused edit retries to fail has been resolved.
Terminal layouts are now much cleaner when viewing content that mixes Chinese, Japanese, and Korean (CJK) characters with emojis. Previously, at specific window widths, paragraphs with mixed scripts or emojis would occasionally drop their final line during wrapping or leave an unexpected blank line below. In extremely narrow windows or single-column fields, these double-width characters could also trigger superfluous line breaks. Additionally, truncating text adjacent to wide characters previously left empty cells or caused text to be truncated twice, and an issue where emojis vanished when switching color attributes has also been fixed.
Text selection and formatting are now far more stable when reviewing conversation logs in fullscreen terminal mode. Double-clicking a word in an expanded line now precisely highlights that word instead of accidentally collapsing the entire line. When the system prompts for commands while idle to save tokens, notifications for newly installed versions now appear side by side next to the prompt without being obscured. In formatting layouts, nested text styles like bold and italics inside tables previously broke borders or lost formatting during text wrapping, but borders are now preserved intact. Furthermore, pasting large blocks of text into terminals without bracketed paste mode support previously truncated text upon encountering invisible control characters such as full-width quotes, which has now been resolved. Reviewing long histories no longer risks accidental folding or layout glitches.
Excessive memory consumption during extended debug sessions or when spawning multiple agents has been resolved. When logging heavily with --debug or --debug-file, memory previously expanded continuously with output volume, and the application could freeze upon exit if the disk or network mount storing logs stopped accepting writes; both issues are now fixed. When debug output is redirected to standard error and an external parent process stops reading the stream, memory no longer balloons indefinitely. Additionally, in remote control or cloud environments, reconnecting to resume a session that previously spawned numerous subagents no longer triggers a sudden memory spike. Reconnecting now keeps memory usage steady.
Multiple input handling and formatting concatenation issues when typing in the terminal have been fixed. Previously, if an authorization confirmation or prompt appeared while you were typing in the input box, pressing Enter could accidentally confirm the prompt; the system now protects your active input state against accidental submission. When sending queued content blocks via streaming JSON, messages merged into the same turn no longer run together and now preserve distinct line breaks. Typing literal text like --bg or --background into a background session is no longer misinterpreted as command flags that spawn duplicate sessions. In addition, authorization descriptions containing special keyboard symbol emojis no longer break lines prematurely, and scripts embedded in custom commands no longer run twice if interrupted by incoming messages.
Screen scrolling and timeout protections when asking side questions with /btw have been significantly refined. When scrolling up through history in fullscreen terminal mode, asking a question with /btw previously forced the view back to the bottom, but the scroll position now stays firmly in place. In automated non-interactive sessions, pending /btw queries that were left unprocessed when a session ended previously lingered in the background or ran a second time upon receiving an identical request; unfinished questions are now promptly canceled upon session exit. Furthermore, /btw queries in non-interactive mode that receive no response after 11 minutes now return an explicit timeout error rather than waiting indefinitely. Asking questions no longer interrupts your scrolling rhythm.
Loading mechanisms for custom skills and slash commands now feature several security protections. If a file or folder name contains hidden characters, bidirectional control characters, whitespace, or angle brackets, the system rejects loading the skill until it is renamed. In terms of hook order, the UserPromptSubmit hook now executes before skills or commands expand, ensuring that terminal commands embedded inside a prompt are safely intercepted if the hook blocks it. In addition, running /reload-skills now clearly explains that it resends the full skill list, making it the recommended way to restore missing skills after context compaction. Calling an unknown skill with an accidental prefix now prompts the system to suggest the correct name. Finally, prompts beginning with / sent using the Agent SDK verbatimPrompts option are no longer mistakenly executed as slash commands after a restart.
When running isolated tasks with Git worktree (the ability to check out multiple branches of the same project simultaneously), fault tolerance and cleanup mechanics are now far more dependable. In sessions protected by isolation barriers, security filters previously let certain specific awk scripts slip past; these boundary-crossing operations are now reliably intercepted and blocked. In Git repositories storing references with the new reftable format, leftover directories abandoned inside upon exiting a session are now purged cleanly. If a base revision cannot resolve because the repository has no commits yet, or if you attempt to create a worktree at the root of a bare repository, the error message replaces cryptic low-level codes with a clear explanation of the directory layout and root cause. Troubleshooting setup failures used to be baffling, but now the diagnostics are transparent and simple.
When exiting Claude Code, the reconnect instructions printed to your terminal are now safer and more concise. Resume commands given on exit now consistently stick to session IDs instead of custom names that might contain special characters, eliminating the risk of accidental code execution when pasting them directly into your shell. At the end of a worktree session, if terminal width cannot fit full parameters, commands automatically abbreviate using -w and -r flags; if space remains too tight, a tip above points out the best directory to run them from. Furthermore, when the code review command /ultrareview encounters upload hurdles, error output stops carelessly recommending git add ., preventing sensitive environment configuration files from being accidentally staged into your commit index. Copying exit commands used to feel risky, but safeguards are now embedded at every step.
When attaching pictures and document payloads across conversations, file transmission and pipeline processing have received comprehensive fixes. In extended threads, if an oversized image was previously rejected by the API, that single rejection used to drop newly attached images in every subsequent turn; this cascading error has now been eliminated. If you queue an additional message while Claude is actively generating responses, attached document blocks are no longer silently omitted. For images attached in the background within VS Code or desktop environments, the client stops forcing massive raw dimensions onto the server, curbing recurring failures in long sessions. Large, near-square images now benefit from recalibrated coordinate hints on new models. Stalled attachment downloads in remote sessions now retry automatically. Additionally, an issue where pasted images swallowed rewritten prompt text has been resolved.
When managing live Artifacts and reading or writing workspace files, capacity limits and encoding protections are much sturdier. Local sessions can now watch up to 25 published artifacts simultaneously, up from the previous ceiling of 10. When publishing requests receive an HTTP 403 refusal from servers or proxy endpoints, the system stops blindly recommending a retry, returning specific permission diagnostics alongside actionable guidance instead. On the file I/O front, the Read tool previously produced mojibake when opening UTF-16LE files containing byte-order marks, while the Write tool occasionally stripped marks or converted alien encodings to UTF-8 without consent; the Read tool now reads such files correctly, and the Write tool now explicitly refuses to save in these special encodings to prevent data corruption. Furthermore, diff viewers no longer mangle filenames with leading or trailing whitespace, and publishing conflicts caused by solitary newlines on large pages are resolved.
When collaborating with background agents and teammates, notification clarity and credential safeguards are significantly tighter. Status updates from background agents now articulate precise operational states, specifying whether an agent is simply waiting on internal subtasks, whether incoming messages trailed behind generated outputs, or whether it halted due to quota ceilings. If a teammate launches without an explicit description, the runtime no longer mistakes sensitive credentials in the prompt for task summaries on your dashboard, eliminating inadvertent credential leaks. In auto mode, background subagents stop delivering final summaries twice. After relaunching the terminal and resuming sessions, SendMessage locates subagents by their assigned names (though names established prior to the most recent context compaction still require an agent ID). Additionally, when dormant subagents or killed teammates get revived, system hooks now receive resumption events alongside full veto power.
When configuring timers and automated wake-up triggers for Claude, scheduling calculations are fully realigned. The scheduling tool previously displayed expected execution times off by an entire minute, but it now faithfully reports the precise minute of the next run. When daylight saving time ends and the same hour repeats, recurring jobs and loops previously triggered repeatedly or jumped ahead early; this temporal calculation flaw has been completely patched. In the Agent SDK, IDE extensions, and remote control sessions where active background tasks used to suppress scheduled timers, prompt wake-ups now fire punctually regardless of background load. Furthermore, headless scheduled turns now correctly receive the environment notice whenever advanced features are enabled in settings. Automations used to fire prematurely or fall behind, but intervals now hit their mark reliably.
Running Claude Code on Windows brings major fixes to low-level process dispatching and system cleanup routines. When polling whether background tasks remain alive on busy hosts, orphaned PowerShell runners previously piled up unnoticed in memory tables, occasionally exhausting available RAM; process lifecycles now terminate cleanly. On machines lacking Git for Windows, pre-tool evaluation checks and authorization hooks that lacked an explicit shell runner previously opened system gates by letting commands execute unchecked whenever environments were missing; failed guard validations now outright block execution for security. Furthermore, an issue where Git Bash failed to report system PATH variables on startup—leaving every subsequent Bash command broken with command-not-found errors throughout the entire session—has been eliminated.
Planning complex tasks with plan mode now features reinforced environmental controls. When bypass-authorization flags are active in your settings, entering plan mode presents a one-time reminder explaining that file edits and terminal executions will not prompt for routine confirmation. Plan mode strictly prohibits all write operations across the workspace, rejecting write requests immediately even when approved by preceding hook interceptors. During terminal command execution, deletion filters no longer trigger false alarms on harmless scripts that do not actually invoke rm. When switching to models that do not support auto mode, headless sessions no longer get locked into that mode against their capabilities. Duplicate tool execution hiccups occurring during cloud session reboots and missing warnings for disconnected browser companions have also been corrected.
Operating in plain print mode now provides cleaner feedback and smarter scraping mechanisms. When running claude -p encounters configuration validation failures, the terminal stops silently exiting without a trace, writing the problematic configuration paths and invalid keys straight to standard error instead. Toggling the push notification switches inside /config no longer causes the server to persist outdated settings from prior states. Supplying an unrecognized model identifier at startup cleanly condenses welcome banners into a single diagnostic warning paired with documentation links. WebFetch operations retrieving page content now mirror live web search behavior, intelligently adapting scrapers to match the thinking budget of the calling model. In addition, deprecated application instructions for verification programs have been removed from security banners. Resolving setup errors once felt like guesswork, but root causes are now immediately apparent.
Using the Claude Code extension within VS Code brings noticeable speedups to launch sequences and session transitions. Prompts and file attachments typed halfway into the composer without being sent are preserved intact when hopping across conversation splits, no longer vanishing into thin air. In project folders lacking a prepared Python runtime, Claude starts up in parallel while Python libraries load behind the scenes, substantially cutting down launch delays; for previously indexed workspace folders, the model selector and slash command menus appear instantly in new panels. Regarding resource management, blank chat windows abandoned after starting fresh tasks release background runners rather than consuming memory. Furthermore, clicking the audio microphone icon while signed out guides you directly through login instead of flashing internal error codes.
When managing cloud self-hosted environments and routines, operational feedback and safeguards receive a major upgrade. When creating a self-hosted environment or key, deployment commands shown on screen now expand fully, break appropriately across parameters, and include a prominent copy button. When an administrator deletes a self-hosted environment, routines bound to that environment are immediately disabled automatically with the reason noted, preventing schedules from throwing errors aimlessly in the background. When editing a routine, it will no longer be silently transferred to another unrelated environment even if its associated environment has been deleted. In the management console, searching by pasting a session ID previously returned no results, which has now been fixed. When a search yields no matches, the interface clearly indicates that no matching items were found instead of erroneously reporting an empty list. Additionally, a vulnerability where returning large volumes of existing generated files simultaneously caused session memory to surge and crash has also been resolved.
When your remote computer is temporarily disconnected or unreachable, the remote control window no longer pretends that messages were successfully sent. Previously, pressing send during a connection drop made the text vanish directly from the input box, giving the false impression that commands had reached the remote host for execution, only for you to wait endlessly before discovering the computer never received them. Now, as long as a connection drop is detected, your entered content remains safely in the input box, and the send button stays grayed out and locked until you reconnect to the computer.
When using the Claude bot in Slack channels, interaction etiquette and editing behavior become much more refined. When Claude needs to correct a previously inaccurate answer, it now edits the message directly in place with a concise "edited" label, rather than cluttering the channel by striking through entire blocks of old text. When invited to large groups with more than 100 members, it now joins quietly in silence instead of spamming the channel with a broad self-introduction announcement. If channel members ask to delete a canvas it previously created, Claude now follows the instruction and deletes it directly. In channels with guest users, Claude no longer stays silent when channel instructions require it to reply to posts that do not tag it. Additionally, replying to unjoined private threads now explicitly reports that the message could not be delivered, and an issue where self-hosted runners failed to send messages due to a missing Python environment has also been resolved.
When you receive review comments in a project's pull request or notice a checklist warning that this month's spending has hit the limit, you can find the place to adjust quotas much faster. Notification cards and comments previously led administrators to the general Claude Code settings menu by mistake, leaving them searching everywhere without finding where to make changes. Now, clicking the link in the notification directs you straight to the dedicated Usage page, which is the exact place to configure that limit.
Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all
Added `CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS` to change idle compaction's 200K-token minimum; `"idleCompaction": false` in settings.json turns it off. Both need v2.1.290 or laterAdded `CLAUDE_CODE_DISABLE_FILE_MENTIONS` environment variable: Claude gets the paths of `@` file mentions to read with its file tools, not the files' contents
Fixed Read failing on PDF page ranges in remote sessions on Linux that run without elevated privileges
Improved memory and disk use when PDFs are @-mentioned: their bytes are no longer kept in the session transcriptAdded `/effort` and `/fast` in agent view to set what new sessions start with; a bare `/model`, `/effort` or `/fast` there now opens a picker
Added a "safe mode" line to the agents view peek panel for background sessions started with `--safe-mode`
Fixed bare mode notices in background sessions telling you to restart without `--bare`, which keeps the mode; they now name `/stop` and `claude --resume`, as safe mode ones do
Fixed background sessions started with `--safe-mode` silently leaving safe mode when the session was woken or restartedAdded `/usage` warnings for max effort, workflows, always-on context and large tool results
Fixed `/usage`, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (anthropics/claude-code#92238)Added `--shutdown-drain-sec` to `claude self-hosted-runner orchestrator`: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
Fixed self-hosted runner sessions shutting down MCP servers added through an `--exec-path` wrapper's own `--mcp-config` when connectors change mid-session
Fixed `claude self-hosted-runner` sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
Self-hosted runner: Improved what `setup` and `doctor` say when the runner's machine has no git credentials
Self-hosted runner: Fixed sessions that wrote output before their first turn being left with no release timer, ignoring `--retire-at` and delaying shutdown
Changed MCP requests in cloud and self-hosted runner sessions to no longer follow HTTP redirects from the session's MCP proxyAdded support for turning off the attribution block in Claude Desktop's Code tab: set `CLAUDE_CODE_ATTRIBUTION_HEADER=0` in the `env` of a Claude apps gateway's `code` policy
Added a field to the attribution block in Claude Code sessions behind a Claude apps gateway; remove the block with `CLAUDE_CODE_ATTRIBUTION_HEADER=0`
Fixed the Claude apps gateway serving models that a policy's `availableModelsMatch: exact` or `deniedModels` blocks; it now answers 400 and leaves them out of its model listsFixed sessions on a gateway-specific model name behind a custom `ANTHROPIC_BASE_URL` ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets `ANTHROPIC_BASE_URL`
Fixed streams through a custom `ANTHROPIC_BASE_URL` being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
Fixed feature flag, startup, fast mode, profile and feedback requests to Anthropic carrying the API key configured for a third-party gateway (`ANTHROPIC_BASE_URL`); Anthropic API keys are still sentAdded `size`, `weight`, `mono` and `tabular` to a mod's `Text` and named spacing steps (`xs` to `xl`) to its `Box`; `bold` is deprecated in favor of `weight`
Fixed a mod's `tool.describe` or `prompt.section` answer that changed after `$.ui.invalidate` never reaching Claude; the new answer is now sent on the next turn
Fixed `$.ui.open` reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and `claude -p`
Fixed a mod's `dimColor` text looking the same as plain text under the dark ANSI theme and on 16-color terminals
Changed `ui.render` trees in `claude plugin test`: each mod's Box or Text root now carries `part: { plugin }` naming the mod, so exact-tree assertions must include itAdded `$.prompt.media` so a `prompt.submit` hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
Added `$.session.identity()` for mods installed by managed settings: how the session is signed in, and its organization and email when managed `forceLoginOrgUUID` lists that organization
Added the skill's frontmatter, source, plugin name and file path to what a mod's `skill.prompt` hook receives
Added a `queue` door to the `session.append` mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
Changed the `turn.start` mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by `e.agentId` (absent on the main loop)Fixed a mod that submits a prompt at the end of every turn keeping a headless run going past `--max-turns`, `--max-budget-usd`, an interrupt, or the end of the host's conversation
Fixed the Write and Edit tools creating a mod in a session's mods folder without asking in accept-edits mode when the config directory's path has no `.claude` in it
Fixed installed mods that kept running in an open session after being turned off remotely; they now unload between turns
Fixed a mod hook, with or without a `.catch`, being run again without end when it waits on another mod's noun that does its work outside the call
Fixed a mod's hot reload ignoring a fix saved right after a failed reload; saving a mod file without changing it no longer reloads the mod
Fixed mods loaded from source files being refused when a hook hands `$` to a function declaration imported from another file of the modFixed plugin hooks being skipped when they pass a very deeply nested tool input or message on with next()
Fixed a value a mod's hook passes to `next()`, returns, or sends to a `$` method being refused whole when one of its getters throws a `RangeError`; now only that key is refused
Fixed mods' hooks being handed values with `__proto__` keys silently removed, which could skip a `tool.check` guard on a tool call another mod made
Fixed `$.http.fetch` in mods refusing a `304`, `204` or `205` response that declares a `Content-Length` over the 4 MiB body limit
Changed plugin hooks and workflow scripts to refuse values they hand back that nest deeper than 28,000 levels, with an error naming the limit (workflow scripts allowed 100,000)
Changed actions a plugin hook can block to be refused, not let through, when the hook cannot be handed them or cannot hand back its answer; a tool that already ran has its result withheldAdded `--disallow-tools` and a `disallowed_tools` case field to `claude plugin eval` to keep specific built-in tools, such as Agent, out of eval runs
Fixed `claude plugin test` pausing a hook's time budget while a served `$` method it had called kept making `$` calls after answering
Fixed the `plugin_loaded` telemetry event reporting `has_hooks` as false for plugins whose hooks are a hooks module, built-in plugins included
Fixed `claude plugin eval` passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
Fixed `claude plugin validate` rejecting a mod's `$.state` references when `plugin.json` has no `types` key and the contract is at `./types/index.d.ts`
Changed `claude plugin test` to fail a call to a mod's served `$` method that has not answered within ten seconds, as a session doesAdded a note in `/plugin` and `claude plugin validate` naming a mod's hooks that are skipped where an organization manages Claude Code
Fixed a sandboxed shell command being able to write into a `--plugin-dir` folder, whose code Claude Code reloads and runs outside the sandbox
Fixed managed settings and organization policy not being fetched when the stored login's plan was changed locally on machines whose MDM or managed-settings file sets `forceLoginOrgUUID`
Fixed `forceLoginOrgUUID` and `forceLoginMethod` from MDM or the managed-settings file being hidden or replaced by server-managed settings
Fixed a user-installed mod's `$.env.set` changing the environment or shell prefix that command hooks from managed settings start with
Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed modsFixed `/reload-plugins` not loading a plugin installed from another terminal a moment earlier
Improved the plugin-authoring skill's steps for sharing a mod: Claude asks public or private and checks the files before creating a GitHub repositoryFixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink
Fixed sandbox `denyRead` and `allowRead` globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
Fixed sandbox glob `allowRead` and `allowWrite` entries not being re-checked when the directory they start from is replaced by a symlink
Improved sandboxed Bash on Linux: Esc and Ctrl-C now work while wildcard read rules are being expanded for a commandFixed sandboxed commands failing on WSL2 with `bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode` when the sandbox can write to the Windows drive
Fixed sign-in, MCP servers and project trust appearing lost on Linux after a sandboxed command left an empty `.config.json` in the config directory
Fixed `/sandbox` reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and whyFixed MCP servers named `constructor` or `prototype` in an MCP config never being connected
Fixed tools of an MCP server named `constructor` or `toString` asking for permission in auto mode and bypass permissions mode
Fixed deny and ask rules for an MCP server (`mcp__<server>`) not applying when the server's normalized name contains a double underscore
Fixed `--bare` sessions leaving out an MCP server named `constructor` or `prototype` that `--channels` asked for
Changed MCP allow rules to reach only the server they name: `mcp__a` no longer allows a server named `a__b` or `a_`; write `mcp__<server>__*` with the server's whole normalized name
Changed agent `tools:` lists to take only the named MCP server's tools; list a server whose name contains `__` as `mcp__<whole name>__*`Fixed MCP connections over HTTP hanging for 30 seconds and failing when a server never ends the body of its reply to a notification (anthropics/claude-code#99014)
Fixed MCP tool calls in headless and SDK sessions sometimes failing or running twice when a background reconnect closed the connection they were running on
Fixed MCP OAuth sign-in, token refresh and sign-out not sending configured `headers`/`headersHelper` values, which broke servers behind an authenticating proxy
Changed requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers to no longer follow HTTP redirects; redirects by a connector's own server are unaffected
Changed cloud session and Remote Control MCP connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; `MCP_PROTOCOL_NEGOTIATION=legacy` opts out
Changed MCP tool descriptions and server instructions from Anthropic's first-party MCP servers at `api.anthropic.com` to reach Claude in full instead of being cut at 4,096 charactersFixed `claude mcp list`, `claude doctor` and `/status` reporting an empty `.mcp.json` as invalid
Fixed a settings file being ignored when `enabledMcpjsonServers` or `disabledMcpjsonServers` held a single server name (letters, digits, - or _) as a plain string
Fixed MCP servers added to a running headless or SDK session being connected before some policy checks ran; a blocked server is now reported as failed without being contacted
Fixed `claude mcp list`, `claude mcp get` and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
Fixed `claude mcp add <name> -- <command> --background` being started as a background sessionFixed the claude.ai view of a Remote Control or cloud session freezing when a large batch of events could not finish uploading over a slow connection
Fixed a Remote Control prompt being lost when another queued prompt in the same batch failed to deliver
Fixed a Remote Control prompt that had passed its hooks being dropped from prompt history when Stop interrupted the next queued prompt's hook
Fixed `←` not saying why it stayed put over a queued message while Remote Control is on
Fixed resuming a conversation from before `/clear` reattaching to the Remote Control session of the conversation after itFixed photos sent over Remote Control being dropped when their copy could not be saved on your computer; Claude now still sees the photo
Fixed files sent over Remote Control sometimes not arriving in long-running sessions
Fixed files of 30 to 35 MiB sent over Remote Control or to a cloud session not arrivingFixed the error for a denied cloud session, which could point to the wrong organization when a key from `apiKeyHelper` was in use
Fixed cloud sessions sometimes showing the model's follow-up text after a tool group's one-line label
Improved the error shown when a cloud session is refused because your claude.ai login was rejected or has expired: it now tells you to sign in again with `claude auth login`Fixed a cloud session sometimes ignoring the answer to a permission prompt or a question when the answer was given while the session's worker was being replaced
Fixed a cloud session leaving a reply unfinished when its worker was replaced just after the reply hit the output token limit
Fixed cloud sessions sometimes leaving a message unanswered when the worker was replaced right after a compaction
Fixed cloud sessions and `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same stepFixed Edit and Retry in Cowork and claude.ai cloud sessions failing on a message stopped while its `UserPromptSubmit` or mod `prompt.submit` hooks were still running (regression in 2.1.296)
Fixed a spurious "synced[0] commands path not found" plugin error at startup when another Claude Code process had just updated a claude.ai-synced plugin
Fixed Cowork cloud sessions staying on an old account plugin after a plugin reload that timed out or a restart that reused a recent sync
Fixed Cowork cloud sessions running the old version of an account plugin changed, removed or disabled from another device until the session restarted
Changed Claude in Chrome in Cowork cloud sessions outside auto mode: an approved-site action the safety classifier flags now asks you instead of being refused, unless managed settings apply
Changed auto mode in Cowork cloud sessions: a `PermissionRequest` hook can no longer approve shell commands or subagents; those prompts wait or are deniedFixed wrapped text mixing CJK or emoji with Latin words losing its last line or leaving a blank row at some terminal widths
Fixed blank rows appearing under CJK and emoji text squeezed into a one-cell column, as in a very narrow terminal
Fixed text cut in the middle beside wide characters leaving a cell unused or being cut twice, and an emoji vanishing where a color changed inside itFixed double-clicking a word in an expanded transcript row in fullscreen mode collapsing the row instead of selecting the word
Fixed the fullscreen "Update installed" notice being hidden behind the idle "/clear to save tokens" hint; it now shows beside the hint
Fixed bold, italic and other nested text styles running over table borders or being lost on wrapped rows
Fixed long pastes in terminals without bracketed paste losing all text after an invisible control character, such as a mis-decoded curly quoteFixed memory growth under heavy debug logging (`--debug`, `--debug-file`), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
Fixed memory growing without bound when debug output goes to stderr and the parent process stops reading it
Fixed high memory use after resuming a cloud or Remote Control session that had run many subagentsFixed Enter answering a question or permission prompt that had been held back while you typed an unsent message
Fixed queued prompts sent as content blocks over `--input-format stream-json` running together without a line break when merged into one turn
Fixed permission prompts cutting off or wrapping too early when the reason text contains keycap or joined emoji
Fixed a prompt or reply of `--bg` or `--background` to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
Fixed a custom slash command's embedded shell line running twice when a newer message interrupted the command while its prompt was being checkedFixed `/btw` jumping the transcript to the bottom when asked while scrolled up in fullscreen
Fixed `/btw` side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
Changed `/btw` side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutesFixed a prompt starting with `/`, sent with the Agent SDK's `verbatimPrompts` option, running as a slash command when `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` re-ran it after a restart
Improved the Skill tool's "Unknown skill" error to suggest a skill's listed name when Claude wrongly adds the `anthropic-skills:` prefix to it
Improved `/reload-skills` to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
Changed skill and command loading: one whose file or folder name has hidden, direction-changing or blank-like characters, `<` or `>` is no longer offered until renamed; such a `name:` is ignored
Changed `UserPromptSubmit` hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
Changed a skill's own front-matter `UserPromptSubmit` hook to first run on the prompt after the one that invokes the skillFixed worktree-isolated sessions accepting some awk programs the isolation guard should refuse
Fixed `--worktree` sessions leaving a folder behind in `.git/worktrees` in repositories using git's reftable ref storage
Improved the error shown when a worktree cannot be created because its base commit does not resolve: it now says how the lookup ended and the likely reasons, such as a repository without a commit
Improved the error for creating a worktree at a bare-repository layout's root: it now explains the layout instead of an unrelated git errorChanged the resume command printed at exit: it names the session by its ID and no longer by its name, so that nothing in a session name can run when the line is pasted
Changed the resume command printed at exit of a worktree session: it uses `-w` and `-r` if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
Changed the errors shown when `/ultrareview` can't upload a repository to stop suggesting `git add .`, which could stage or commit untracked files such as `.env`Fixed a mod's `prompt.submit` rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
Fixed document blocks being dropped from your own message sent while Claude is working
Fixed long conversations losing newly attached images on every turn after one oversized image was refused by the API
Fixed images attached while Claude is working (VS Code, desktop app, SDK) being sent at full size, which led to repeated image errors in long conversations
Fixed the image coordinate hint being missing or slightly off for large near-square images on newer models
Fixed a file attached to a message in a remote session being left out when its download stalled part way; the download is now tried againFixed the Artifact tool advising a retry when a publish that requests connectors or other access was refused by the server or a proxy (HTTP 403); it now says so and what to tell the user
Fixed the diff view listing a new file whose name begins or ends with a space under the wrong name
Fixed the Artifact tool reporting a spurious one-line difference against the live page, and refusing the publish, when a large page with a line break after `<head>` is published again unchanged
Fixed replies cut off at the output token limit ending the turn silently, with no retry or error, after a request fell back to non-streaming mode
Fixed Read garbling UTF-16LE files with a byte-order mark, and Write dropping byte-order marks or silently converting Windows-1252, Shift-JIS, GBK or UTF-16BE files to UTF-8 (now refused)
Improved artifact watching: a local session can now watch up to 25 published artifacts at once, up from 10Fixed an agent teammate started without a description keeping part of a credential from its prompt in the task description shown for it
Fixed the `agent.spawn` mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries `resume`, and a mod can refuse it
Fixed background subagents in auto mode sometimes sending their final report twice, once as the result and once as a message
Fixed `SendMessage` not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
Improved background agent notifications: they now say when an agent is only waiting on its own background work, got a message too late for its result, or was stopped by a usage limitFixed scheduled wakeups (ScheduleWakeup) not firing while a background task was running in Agent SDK, IDE and `claude remote-control` sessions
Fixed scheduled tasks being announced for the wrong minute: the scheduling tools now report each job's actual next run time
Fixed scheduled tasks and loops firing again after every turn, or firing early, during the repeated hour when daylight saving time ends
Fixed Ultracode not being announced to scheduled tasks and other delivered headless turns when `ultracode` is on in settingsWindows: Fixed the process-liveness check leaving orphaned PowerShell processes behind on busy machines until memory ran out
Windows: Fixed PreToolUse and PermissionRequest hooks that set no shell failing open when Git for Windows isn't installed; a guard that fails now blocks the call
Windows: Fixed Bash commands failing with "command not found" for a whole session when Git Bash did not report its PATH at startupAdded a one-time note when plan mode won't ask before most edits or commands because bypass permissions is available
Fixed rm prompts on shell `-c` scripts that don't run `rm`. An rm built at run time in a script Claude Code can't read no longer prompts unless `CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1`
Fixed SDK and headless sessions staying in auto mode after the host switched to a model that doesn't support auto mode
Fixed Claude in Chrome asking for permission while no browser is connected; it now says the extension is not connected
Fixed a regression in 2.1.296 where cloud and headless sessions could run an approved tool call twice if a new message arrived as the session resumed after a restart
Fixed plan mode running a write (an MCP tool's, a file's, a shell command's) that a `PreToolUse` hook or a mod's `tool.check` hook allowedFixed `claude -p` saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
Fixed `/config` push notification toggles sending your account the previous setting instead of the one you just chose
Improved the startup warning for an unrecognized model ID: it is now one short line under the welcome banner with a docs link, instead of a long raw message
Changed WebFetch page reads to pick their effort as web searches do: the caller's level on the caller's own model, otherwise the level settings give the small model
Changed the cyber safeguard notice to no longer ask people to apply to the Cyber Verification Program[VSCode] Fixed an unsent prompt and its attachments being lost when switching to another session and back
[VSCode] Fixed unused blank chats keeping a background Claude process running after starting a new conversation
[VSCode] Fixed the mic button showing an internal error message when you are signed out of claude.ai; it now offers to sign you in
[VSCode] Improved startup time in workspaces without a Python environment by starting Claude while the Python extension loads
[VSCode] Improved startup: the model picker and slash command menu now fill in right away in a new window on a folder you've opened before[Cloud sessions] Fixed a memory spike that could crash a session when many of its existing output files were re-sent to it at once
[Cloud sessions] Fixed saving an edited routine silently moving it to a different environment when its own had been deleted or wasn't in the list; the routine now keeps its environment
[Cloud sessions] Fixed Sessions search in a self-hosted environment's admin details finding nothing when you paste the session ID from a session's link
[Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches
[Cloud sessions] Improved the deploy command shown when you create a self-hosted environment or environment key: it shows in full, wraps between arguments, and has a visible copy button
[Cloud sessions] Changed deleting a self-hosted environment to turn off its routines right away, with the reason shown on each routine, instead of leaving their runs to fail[Remote Control] Fixed Remote Control sessions whose computer can't be reached still appearing to send your messages; your text now stays in the box and Send is off until it reconnects[Claude Tag] Added the ability for Claude in Slack to delete a canvas it created in a channel when someone asks it to
[Claude Tag] Fixed Claude in Slack staying silent on untagged posts that a channel's own instructions tell it to answer, such as posts that tag someone else, in channels with guests
[Claude Tag] Fixed Claude in Slack reporting a reply to another channel's thread as posted when it isn't a member there; it now says the reply wasn't delivered and how to fix that
[Claude Tag] Fixed Claude in Slack sometimes ending a turn without posting its answer when a self-hosted runner's image has no python3
[Claude Tag] Changed how Claude in Slack corrects a message it got wrong: it edits the message in place and adds a short "Edited" note instead of striking through the old text
[Claude Tag] Changed Claude in Slack to join channels with more than 100 members quietly, with no intro message[Code Review] Fixed Code Review's monthly spend-limit comment and check-run card sending admins to Claude Code settings; they now link the Usage page, where that limit is set