Claude Code

Auto mode ships without opt-in on Bedrock, Vertex AI, and Foundry, and Claude Opus 4.8 is now the default on those platforms. Fixed a terminal freeze during long streaming responses, remote managed settings being permanently recorded without consent, and a plugin shell-injection vector where user config in commands is now rejected.

Fixed MCP servers configured via --mcp-config or .mcp.json ignoring per-server request_timeout_ms, which caused long-running tool calls to time out at the 60s default in fresh sessions. Also fixed OAuth MCP servers requiring manual re-authentication after a single failed token refresh, and improved the agents view to use full terminal width for the status column instead of truncating at 64 characters.

Added an auto mode rule that blocks tampering with session transcript files. Fixed --json-schema silently producing unstructured output when the schema was invalid, and schemas using the format keyword being rejected. Fixed a critical Windows bug where worktree removal deleted files outside the worktree when an NTFS junction or directory symlink existed inside it, and a Windows crash when the directory Claude was launched from is deleted, locked, or unmounted.

Fixed hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook.

Fixed background sessions becoming permanently unresponsive when the daemon's session token went stale — they now recover automatically. Also fixed worktree-isolated subagents sometimes running shell commands in the parent checkout, and worktree creation rejecting nested repositories that left background sessions unable to isolate and edit. Plus dozens of additional fixes across session recovery, agent delegation, environment inheritance, and terminal rendering.

Fixed commands sent from Remote Control (mobile/web) into interactive sessions failing with "Unknown command", and /rename on background sessions being reverted when the job restarts. Also fixed images and files from Remote Control being silently dropped without captions, voice dictation retrying unboundedly on microphone failure, and session resumption by name taking minutes in repositories with many git worktrees.

Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders.

The default permission mode is now "Manual" across CLI, VS Code, and JetBrains (opt-in idle timeout for AskUserQuestion dialogs via /config). Fixed background sessions silently stopping mid-turn after sleep/wake or session reopening, re-running cancelled turns after stalls, and daemon crashes leaving stale locks that prevented restarts. Also fixed subagents cut off by rate limits returning empty results, plugin loading from git worktrees, and terminal control bytes leaking into agent view.

Fixed a background-agent daemon bug on Linux that killed every running agent every ~50 seconds after an unclean shutdown. Stacked slash-skill invocations now load up to 5 leading skills, SSL certificate errors fail immediately with actionable guidance, and mid-stream API errors keep partial output. Plus dozens of smaller fixes across subagents, hooks, and session management.

Claude in Chrome is now generally available. Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing. Also added background agent notifications, a /dataviz skill, and dozens of additional fixes across agents, worktrees, and fullscreen mode.

Claude Sonnet 5 replaces the previous default model, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31.

Fixed a critical bug where waking a background job deleted the conversation and reran the original prompt. Security: claude mcp list/get no longer spawns repo-approved .mcp.json servers in untrusted workspaces. Also fixes OAuth scope rejection on enterprise IdPs, rate-limit flickering, and PowerShell exit-code false positives.

Hook matchers with hyphenated identifiers now perform exact-matching instead of substring-matching, use mcp__brave-search__.* to match tools from hyphenated MCP servers. Fixed voice dictation capturing silence after input device changes and auto-submit not firing for languages written without spaces, plus fixes for background task data loss and crashed-task blank screen.

OpenTelemetry logging for assistant responses is enabled by default for deployments already logging user prompts — set OTEL_LOG_ASSISTANT_RESPONSES=0 to keep prompts-only. Added autoMode.classifyAllShell setting to route all Bash/PowerShell commands through the classifier, plus live bash path autocomplete and MCP auth startup notices.

Stopping a background agent from the tasks panel is now permanent — agents no longer resurrect after being stopped. The scroll position no longer jumps to the bottom while reading earlier output during streaming, and CPU usage during streaming is reduced by ~37%. Also fixed hooks with comma-separated matchers, Cmd+click in Ghostty over ssh/tmux, and managed settings propagation.

What's changed

• Bug fixes and reliability improvements

Sandboxed commands can now be blocked from reading credentials and secrets via sandbox.credentials, and org-configured model restrictions are enforced across the model picker, --model, and /model. Fixes include remote MCP tool call timeout, CJK text mojibake, agent proxy startup latency, and dozens more.

Added claude mcp login and logout for authenticating MCP servers from the CLI without the interactive menu, with --no-browser for SSH. Bash ! commands now trigger Claude to respond automatically; set "respondToBashCommands": false to restore the previous context-only behavior. Over 20 fixes including streaming requests failing after wake-from-sleep, subagent transcript scroll bleeding, and agent team effort-level inheritance.

The stream-stall hint now reads "Waiting for API response · will retry in …" instead of "No response from API · Retrying in …", and triggers after 20 seconds of silence instead of 10.

Destructive git commands (git reset --hard, git checkout --., git clean -fd, git stash drop) are now blocked when you didn't ask to discard local work. Fixed fullscreen TUI corruption in Windows Terminal under heavy nested-subagent load, blank turns from thinking-only model responses, and MCP servers exposing auth-stub tools in headless mode.