Claude Code

What's changed

• Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type
• Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
• Fixed /usage-credits on Team and Enterprise showing "you've already sent a usage credit request" for members whose earlier request was dismissed, blocking them from sending a new one
• Fixed the startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message
• Fixed "Connection closed mid-response" errors being reported on responses that had actually completed
• Fixed /usage overattributing usage to MCP servers: a server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it
• Fixed sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API

What's changed

• [VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
• Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
• Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
• Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
• Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval

What's changed

• Added Claude Opus 5 (claude-opus-5), now the default Opus model — 1M context, fast mode at $10/$50 per Mtok
• Added sandbox.network.strictAllowlist setting to deny non-allowlisted hosts for sandboxed commands without prompting
• Added DirectoryAdded hook that fires after /add-dir or the SDK register_repo_root control request registers a new working directory mid-session
• Added mcp_server_errors to the headless stream-json init event, listing --mcp-config entries skipped by config validation; terminal runs print a startup warning
• Added the workflowSizeGuideline settings key so the advisory Dynamic workflow size guideline can be set from any settings file; the /config row is hidden while one does
• Added nested subagent forwarding in stream-json: subagents spawned at depth-2+ now appear when --forward-subagent-text is set, keyed by their spawning Agent tool_use id
• Fixed claude -p text output dropping the answer already produced when a turn dies on a mid-stream API error

What's changed

• Changed /code-review to run as a background subagent, so review work no longer fills your conversation and keeps stacked slash commands as its review target
• Added screen-reader announcements of deleted text for word and line deletions (Option+Delete, Ctrl+W, Cmd+Backspace, Ctrl+U, Ctrl+K) in --ax-screen-reader mode
• Fixed Windows paths with \u-prefixed segments (like C:\Users\unicorn) being corrupted into CJK characters in tool inputs, which made those files inaccessible
• Fixed the left arrow key discarding the conversation with no undo: presses right after editing now ask to confirm, and Esc in the agent view returns to the conversation it backgrounded
• Added HTTP status and error text to claude mcp list and /mcp when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace
• Fixed multi-line paste collapsing into one line with j in place of newlines in terminals that encode pasted newlines as Ctrl+J
• Fixed /context reporting stale pre-compact token usage after compacting from the message picker

What's changed

• Added emoji shortcode autocomplete in the prompt input: type :heart: to insert ❤️, or :hea for suggestions — disable with the emojiCompletionEnabled setting
• Added warnings when transcript writes are failing (e.g. disk full) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently
• Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
• Fixed Windows auto-update failures that could leave claude.exe missing; failed updates now restore the preserved executable automatically
• Fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
• Fixed auto-compact never triggering for Claude Opus 4.8 on Bedrock and /compact failing once over the limit
• Fixed corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions
• Fixed screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds to update elapsed time and token counts

What's changed

• Added sandbox.filesystem.disabled setting to skip filesystem isolation while keeping network egress control
• Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
• Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
• Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording
• Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes
• Fixed @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of c-operators and paste, statusline running twice on resume, and resume-picker hangs on failure
• Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored
• Fixed worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE

What's changed

• Fixed single-segment dir/** allow rules like Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree instead of only <cwd>/dir
• Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
• Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
• Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically
• Fixed Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval
• Fixed Bash permission checks to no longer auto-approve certain help and man commands that could run unsafe options, command substitutions, or backslash paths
• Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
• Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations

What's changed

• /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
• Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)
• Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops
• Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget
• MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS
• Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
• Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback

What's changed

• Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output
• Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
• Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt
• Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
• Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings

What's changed

• Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck
• Added a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead
• Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree
• Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
• Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element
• Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text
• Fixed claude attach sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes

What's changed

• Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.
• Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode
• Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
• Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
• Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings
• Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts
• Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from

What's changed

• Auto mode is now available without CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry; disable via disableAutoMode in settings
• Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks
• Fixed remote managed settings from a non-interactive run (claude -p, the SDK) being permanently recorded as consented without ever showing the security consent dialog
• Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates
• Fixed the auto-updater overwriting a custom launcher script or symlink at ~/.local/bin/claude on every release; /doctor now reports an externally managed launcher
• Fixed compound commands with cd prompting for permission when the only output redirect was to /dev/null
• Fixed the transcript jumping above the start of the answer when a response finishes streaming
• Fixed extensions.worktreeConfig being left in the repo's .git/config (breaking go-git tools like tea) after the last worktree.sparsePaths worktree was removed