Claude Code

Fixed an issue where prompt and agent hooks written as instructions, such as "Block commands that...", allowed what they should block. Improved how prompt hooks on Stop and SubagentStop written as instructions are judged, so Claude is less likely to stop early.

Claude Haiku 5.5 (claude-haiku-5-5) is now the default Haiku model on the Anthropic API with 1M context and $0.10/$0.50 per Mtok. Fixed a memory leak where an HTTP MCP connection retained every request until it closed, along with fixes for work retraction after context compaction and lost messages when backgrounding sessions.

Claude Code v2.1.292 adds a --marketplace <source> option to claude plugin install and an effort parameter for the Agent tool, plus an overloaded-request retry delay env var. It also closes several sandbox and permission bypasses, including sandboxed commands reading staged /ultrareview upload file copies, managed read-deny paths not dropping project grants, network-path reads skipping the permission prompt, and a tampered settings cache disabling the policy plugin.

Fixed a 2.1.290 regression where cloud sessions could drop answers to permission prompts, and a 2.1.288 regression where a session's final messages could be lost when quitting.

Mod and plugin hooks gain richer context: serverToolUses in turn.step results, agentId on tool.check events, a ceiling on required approvals, and theme typing for drawing. The release also fixes requests failing behind proxies that reject beta headers, sessions with hundreds of images getting stuck on unprocessable-request errors, WebFetch silently dropping text past 100,000 characters, and compaction failures plus scheduled tasks vanishing on resume. Added claude attach and claude logs accepting partial session names, and a Deny button on the Claude apps gateway sign-in approval page.

Several fixes harden sandbox rule enforcement: deny or ask rules on nested parts of compound shell commands no longer get overridden by a user-installed mod's approval, and Bash deny/ask rules are no longer skipped under sandbox auto-allow when an environment variable prefix or bare variable assignment precedes the command. Also fixed terminal freezes on short code blocks with many unclosed script tags or nested substitutions, and reverted the 2.1.288 claude auth status change that may have made sign-outs more frequent.

Fixed a dangerous rm (such as one on / or the home directory) inside a bash -c or sh -c script running without a prompt in bypassPermissions mode or under a shell allow rule, and added a re-authenticate prompt when an MCP server asks for more OAuth scope during a tool call. Also added draft recovery after Ctrl+C via Up on the empty prompt, and fixed resume dropping context restored by compaction or cutting transcripts short.

Claude Mods let plugins modify deeper behavior, with a built-in mod "You should know" where a side agent flags things you or Claude might miss. Added URL prompts from MCP servers on the 2025-11-25 protocol, plus fixes for Remote Control reconnects, repeated model fallback in claude -p sessions, and MCP connectors double-running calls.

Fixed claude --resume and --continue sometimes losing every turn after a batch of parallel tool calls when the earlier session crashed or was killed, and closed several secret-redaction gaps where MCP error messages, percent-encoded Bearer tokens, redacted logs, and URL passwords could expose credential values. Also fixed repeated login browser windows when gcpAuthRefresh or awsAuthRefresh credentials expire, API 400 errors after a tool returned a non-text value, and stale Remote Control sessions, plus permission-prompt counter and fullscreen list improvements.

Added claude --desktop to open the Claude desktop app on the current directory or a resumed session, plus a CLAUDE_CODE_DISABLE_WEB_FETCH variable and an allowedProviders managed setting that limits which API providers a machine may use. Fixed a regression causing cloud-session first replies to arrive late, an Artifact allow rule permitting publishes outside working directories, and a rare auth failure when two sessions recover a login refresh lock left by a crashed process.

Claude Sonnet 5.5 (claude-sonnet-5-5) is now the default Sonnet model on the Anthropic API, with 1M context and $2/$10 per Mtok pricing. Damaged response streams are now retried or reported as interrupted instead of surfacing raw JSON parse errors or writing "undefined" into an answer, and MCP tool calls in resumed sessions wait up to 10 seconds for a still-connecting server instead of failing with "No such tool available".

New managed settings availableModelsMatch ("exact" blocks any model version not explicitly listed) and deniedModels let admins block specific models even when availableModels allows them, plus a /doctor prompt-audit command that flags CLAUDE.md, skills, agents and commands written for older models. Dozens of fixes follow, including SDK sessions losing deferred tool calls or held approvals, stateless MCP servers left unusable for a session after a brief 404, installed_plugins.json being rewritten with lost records, and a Windows PowerShell tool that let cmd /c rd delete drive roots and the home folder.

Added a maxProseWidth setting that caps Claude's prose width in wide terminals while tables and code keep full width. Fixed every request failing with a 400 error in conversations whose history holds undecryptable web search results, plus resumed sessions re-sending earlier messages in changed form and dropped extended thinking after slash commands.

Fixed recursive rm commands whose target is only command-substitution output (e.g. rm -rf "$(pwd)") running unprompted in auto mode, and fixed resumed sessions re-sending earlier turns in a changed form that could make the API drop the conversation's prior reasoning. Also fixed proxy/gateway stream handling that showed truncated responses as complete. Adds Claude apps gateway Bedrock assume_role and guardrails, plus "attribution": false in settings.json.

Claude Opus 5.5 (claude-opus-5-5) is now the default Opus model with 1M context and $4/$20 per Mtok pricing. Writes through a symlinked path are now judged by where they land, so acceptEdits, allow rules and auto mode no longer approve a write landing outside the tree, plus a long tail of fixes across dialogs, auto mode retries, and background subagents.

Auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, now defaults to the server-side classifier, which does not charge for classifier overhead; CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out on Bedrock, Vertex, Foundry and gateways, and billed fallback now warns. A new Auto mode server row in /status shows whether the session's auto mode classifier runs on the server.

Projects without a CLAUDE.md now fall back to AGENTS.md, configurable under Project instructions in /config (not yet on Bedrock, Vertex or Foundry). Fixed claude -p and Agent SDK sessions hanging with no result after an internal error, which now report the error and exit with code 1, plus a fix for conversations failing with "text content blocks must be non-empty" after --resume.

Fixed a 2.1.275 regression where every request failed with "400 ... Input tag 'advisor_20260301'" when ANTHROPIC_BASE_URL points at a proxy or gateway.

Fixed a restored memory file's age note changing between requests after compaction or resume, which caused prompt cache misses, and stopped plugin and marketplace messages, logs, and listings from showing passwords or tokens stored in git, ssh, or marketplace URLs. Also added a send-now key (ctrl+enter) that interrupts the current turn and sends all queued messages, and syncing of claude.ai skills and plugins to terminal sessions.

Sessions stuck endlessly retrying "unexpected tool_use_id" 400 errors now self-heal corrupted transcripts where possible, and otherwise end the loop with a clear error and a /rewind hint. Also adds CLAUDE_CODE_MCP_STARTUP_WAIT_MS to bound how long the first non-interactive turn waits for connecting MCP servers, a critical memory-usage warning, and dozens of fixes across MCP, the Claude apps gateway, plugins, and permissions.