Claude Code

Claude -p and Agent SDK sessions with no permission mode now start in default mode on third-party providers with telemetry off or on a fresh install, and fork subagents are on by default across the CLI, Agent SDK, desktop app, and VS Code. The Read tool no longer loads image files of any size into memory and refuses image sources over 128 MB, and idle compaction can be toggled off from a new row in /config.

Vim mode gains the % motion to jump to the matching bracket, mods get a multi-line rows input field, and CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS now bounds unattended retry at far-off usage limits. Fixed quitting removing a WorktreeCreate hook's worktree without asking, and sign-in refresh timeouts that caused unexpected sign-outs after short commands like claude auth status exited mid-refresh.

Adds mod authoring capabilities including virtualText prompt decorations, agentId transcript views, the prompt.change hook, and prompt/model rewriting in the agent.spawn hook, plus OpenTelemetry GenAI semantic-convention attributes on trace spans. The release also fixes more than 35 issues across subagent tracking, worktree handling in reftable repositories, resume/compaction message loss, and cloud session policy handling.

What's changed

Managed-settings PreToolUse and prompt hooks that block a tool call now refuse it and end the turn, and Edit and NotebookEdit no longer replace every non-ASCII character in files that are not valid UTF-8 — such edits are refused instead. Adds a code key to the Claude apps gateway's managed.policies[], autoCompactWindow for subagents, CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL, an allow_large option for the Read tool, plus a long list of fixes across MCP servers, plugins, self-hosted runners, cloud sessions, and Windows.

Command and HTTP hooks support onFailure: "block" so a hook that fails to start, times out, or exits unexpectedly blocks the action instead of allowing it, and Claude apps gateway upstreams now accept an optional models list that limits which models are sent there, including on failover. Also fixed context-1m beta rejection breaking all requests on [1m] models, remote MCP reconnects looping against servers that drop connections, and claude -p text output dropping earlier responses when background work started another turn.

Fixed an issue where prompt and agent hooks written as instructions, such as "Block commands that...", allowed what they should block. Improved how prompt hooks on Stop and SubagentStop written as instructions are judged, so Claude is less likely to stop early.

Claude Haiku 5.5 (claude-haiku-5-5) is now the default Haiku model on the Anthropic API with 1M context and $0.10/$0.50 per Mtok. Fixed a memory leak where an HTTP MCP connection retained every request until it closed, along with fixes for work retraction after context compaction and lost messages when backgrounding sessions.

Claude Code v2.1.292 adds a --marketplace <source> option to claude plugin install and an effort parameter for the Agent tool, plus an overloaded-request retry delay env var. It also closes several sandbox and permission bypasses, including sandboxed commands reading staged /ultrareview upload file copies, managed read-deny paths not dropping project grants, network-path reads skipping the permission prompt, and a tampered settings cache disabling the policy plugin.

Fixed a 2.1.290 regression where cloud sessions could drop answers to permission prompts, and a 2.1.288 regression where a session's final messages could be lost when quitting.

Mod and plugin hooks gain richer context: serverToolUses in turn.step results, agentId on tool.check events, a ceiling on required approvals, and theme typing for drawing. The release also fixes requests failing behind proxies that reject beta headers, sessions with hundreds of images getting stuck on unprocessable-request errors, WebFetch silently dropping text past 100,000 characters, and compaction failures plus scheduled tasks vanishing on resume. Added claude attach and claude logs accepting partial session names, and a Deny button on the Claude apps gateway sign-in approval page.

Several fixes harden sandbox rule enforcement: deny or ask rules on nested parts of compound shell commands no longer get overridden by a user-installed mod's approval, and Bash deny/ask rules are no longer skipped under sandbox auto-allow when an environment variable prefix or bare variable assignment precedes the command. Also fixed terminal freezes on short code blocks with many unclosed script tags or nested substitutions, and reverted the 2.1.288 claude auth status change that may have made sign-outs more frequent.

Fixed a dangerous rm (such as one on / or the home directory) inside a bash -c or sh -c script running without a prompt in bypassPermissions mode or under a shell allow rule, and added a re-authenticate prompt when an MCP server asks for more OAuth scope during a tool call. Also added draft recovery after Ctrl+C via Up on the empty prompt, and fixed resume dropping context restored by compaction or cutting transcripts short.

Claude Mods let plugins modify deeper behavior, with a built-in mod "You should know" where a side agent flags things you or Claude might miss. Added URL prompts from MCP servers on the 2025-11-25 protocol, plus fixes for Remote Control reconnects, repeated model fallback in claude -p sessions, and MCP connectors double-running calls.

Fixed claude --resume and --continue sometimes losing every turn after a batch of parallel tool calls when the earlier session crashed or was killed, and closed several secret-redaction gaps where MCP error messages, percent-encoded Bearer tokens, redacted logs, and URL passwords could expose credential values. Also fixed repeated login browser windows when gcpAuthRefresh or awsAuthRefresh credentials expire, API 400 errors after a tool returned a non-text value, and stale Remote Control sessions, plus permission-prompt counter and fullscreen list improvements.

Added claude --desktop to open the Claude desktop app on the current directory or a resumed session, plus a CLAUDE_CODE_DISABLE_WEB_FETCH variable and an allowedProviders managed setting that limits which API providers a machine may use. Fixed a regression causing cloud-session first replies to arrive late, an Artifact allow rule permitting publishes outside working directories, and a rare auth failure when two sessions recover a login refresh lock left by a crashed process.

Claude Sonnet 5.5 (claude-sonnet-5-5) is now the default Sonnet model on the Anthropic API, with 1M context and $2/$10 per Mtok pricing. Damaged response streams are now retried or reported as interrupted instead of surfacing raw JSON parse errors or writing "undefined" into an answer, and MCP tool calls in resumed sessions wait up to 10 seconds for a still-connecting server instead of failing with "No such tool available".

New managed settings availableModelsMatch ("exact" blocks any model version not explicitly listed) and deniedModels let admins block specific models even when availableModels allows them, plus a /doctor prompt-audit command that flags CLAUDE.md, skills, agents and commands written for older models. Dozens of fixes follow, including SDK sessions losing deferred tool calls or held approvals, stateless MCP servers left unusable for a session after a brief 404, installed_plugins.json being rewritten with lost records, and a Windows PowerShell tool that let cmd /c rd delete drive roots and the home folder.

Added a maxProseWidth setting that caps Claude's prose width in wide terminals while tables and code keep full width. Fixed every request failing with a 400 error in conversations whose history holds undecryptable web search results, plus resumed sessions re-sending earlier messages in changed form and dropped extended thinking after slash commands.

Fixed recursive rm commands whose target is only command-substitution output (e.g. rm -rf "$(pwd)") running unprompted in auto mode, and fixed resumed sessions re-sending earlier turns in a changed form that could make the API drop the conversation's prior reasoning. Also fixed proxy/gateway stream handling that showed truncated responses as complete. Adds Claude apps gateway Bedrock assume_role and guardrails, plus "attribution": false in settings.json.