Claude Code

Fixed a permission-check bypass in Windows PowerShell 5.1 sessions and made Bash permission checks fail closed on file-descriptor redirect forms that Bash parses differently than the permission analyzer. Also added the EndConversation tool for abusive users, permission prompts for docker daemon-redirect flags, and fixed unbounded memory growth with oversized settings files.

Redesigned /fork: it now copies your conversation into a new background session, while the old in-session subagent is now /subtask. Added claude auto-mode reset to restore default auto-mode configuration. Fixed plan mode auto-running file-modifying Bash commands without a permission prompt or SDK callback. Plus dozens of additional fixes across worktree creation, ultrareview, Windows, OpenTelemetry, and web reliability.

Fixed permission previews not neutralizing bidirectional-override and look-alike quote characters that could visually alter approval messages. Fixed parallel sessions all logging out after wake-from-sleep, plugin MCP servers not reconnecting after idle, and auto mode overriding a PreToolUse hook's ask decision. Also fixed /clear not resetting the session cost counter, subagent model overrides reverting, and a prompt-caching regression on Bedrock and Vertex. Includes dozens of additional fixes across file uploads, Vim mode, background agents, and Windows stability.

Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree. Also fixed the ultracode keyword firing on non-human input, plugin server teardown during re-sync, and dozens of other fixes across session management, MCP, and crash handling.

Fixed /model and other dialogs that were being blocked in background sessions started with claude agents, reverting an overly broad guard.

Added an opt-in screen reader mode for plain-text rendering, and fixed multiple memory leaks in long sessions including MCP stdio server stderr accumulating up to 64 MB per server and LSP documents staying open indefinitely. Also includes a new corporate launcher wrapper, vim insert-mode remaps, and dozens of bug fixes spanning session attach, context window resets, and tool failures.

Auto mode ships without opt-in on Bedrock, Vertex AI, and Foundry, and Claude Opus 4.8 is now the default on those platforms. Fixed a terminal freeze during long streaming responses, remote managed settings being permanently recorded without consent, and a plugin shell-injection vector where user config in commands is now rejected.

Fixed MCP servers configured via --mcp-config or .mcp.json ignoring per-server request_timeout_ms, which caused long-running tool calls to time out at the 60s default in fresh sessions. Also fixed OAuth MCP servers requiring manual re-authentication after a single failed token refresh, and improved the agents view to use full terminal width for the status column instead of truncating at 64 characters.

Added an auto mode rule that blocks tampering with session transcript files. Fixed --json-schema silently producing unstructured output when the schema was invalid, and schemas using the format keyword being rejected. Fixed a critical Windows bug where worktree removal deleted files outside the worktree when an NTFS junction or directory symlink existed inside it, and a Windows crash when the directory Claude was launched from is deleted, locked, or unmounted.

Fixed hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook.

Fixed background sessions becoming permanently unresponsive when the daemon's session token went stale — they now recover automatically. Also fixed worktree-isolated subagents sometimes running shell commands in the parent checkout, and worktree creation rejecting nested repositories that left background sessions unable to isolate and edit. Plus dozens of additional fixes across session recovery, agent delegation, environment inheritance, and terminal rendering.

Fixed commands sent from Remote Control (mobile/web) into interactive sessions failing with "Unknown command", and /rename on background sessions being reverted when the job restarts. Also fixed images and files from Remote Control being silently dropped without captions, voice dictation retrying unboundedly on microphone failure, and session resumption by name taking minutes in repositories with many git worktrees.

Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders.

The default permission mode is now "Manual" across CLI, VS Code, and JetBrains (opt-in idle timeout for AskUserQuestion dialogs via /config). Fixed background sessions silently stopping mid-turn after sleep/wake or session reopening, re-running cancelled turns after stalls, and daemon crashes leaving stale locks that prevented restarts. Also fixed subagents cut off by rate limits returning empty results, plugin loading from git worktrees, and terminal control bytes leaking into agent view.

Fixed a background-agent daemon bug on Linux that killed every running agent every ~50 seconds after an unclean shutdown. Stacked slash-skill invocations now load up to 5 leading skills, SSL certificate errors fail immediately with actionable guidance, and mid-stream API errors keep partial output. Plus dozens of smaller fixes across subagents, hooks, and session management.

Claude in Chrome is now generally available. Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing. Also added background agent notifications, a /dataviz skill, and dozens of additional fixes across agents, worktrees, and fullscreen mode.

Claude Sonnet 5 replaces the previous default model, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31.

Fixed a critical bug where waking a background job deleted the conversation and reran the original prompt. Security: claude mcp list/get no longer spawns repo-approved .mcp.json servers in untrusted workspaces. Also fixes OAuth scope rejection on enterprise IdPs, rate-limit flickering, and PowerShell exit-code false positives.

Hook matchers with hyphenated identifiers now perform exact-matching instead of substring-matching, use mcp__brave-search__.* to match tools from hyphenated MCP servers. Fixed voice dictation capturing silence after input device changes and auto-submit not firing for languages written without spaces, plus fixes for background task data loss and crashed-task blank screen.

OpenTelemetry logging for assistant responses is enabled by default for deployments already logging user prompts — set OTEL_LOG_ASSISTANT_RESPONSES=0 to keep prompts-only. Added autoMode.classifyAllShell setting to route all Bash/PowerShell commands through the classifier, plus live bash path autocomplete and MCP auth startup notices.