chore(patch): update @anthropic-ai/claude-code to 2.1.233 #patch

[public-glueops-renovatebot]

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-code	2.1.220 → 2.1.233

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.233

Compare Source

• Added GitLab merge request URL support to the --worktree flag and the claude agents view (where MRs display as !N)
• Added an opt-in forward_user_identity apps gateway setting on Anthropic upstreams that sends the signed-in user's identity as headers, so a proxy behind the gateway can attribute spend per user
• Added opt-in memory cgroup support for Bash tool commands on Linux (CLAUDE_CODE_TOOL_MEMORY_LIMIT) so a runaway build can't stall the session
• Added CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS environment variable to configure the WebFetch session URL cache TTL (default unchanged: 15 minutes)
• Fixed cloud sessions occasionally being marked as lost when the environment shut down while Claude was waiting on a permission prompt
• Fixed MCP v2 connections endlessly reopening the subscriptions/listen stream against servers that terminate long-held streams on a fixed timeout (e.g. serverless hosts)
• Fixed Notification hooks not firing for permission prompts when running under Claude Desktop or VS Code
• Fixed idle sessions on Linux sometimes keeping one CPU core at 100% when sandboxing is enabled
• Fixed bundled skill aliases like /checkup and /review reporting "Unknown command" in -p mode or with plugins/MCP loaded when a user or project skill shadows the bundled skill
• Fixed skill/command argument substitution to prevent argument values from being re-expanded as template markers
• Fixed Windows paths spelled with the NT \??\ device prefix bypassing UNC path validation, closing an NTLM credential-leak vector
• Improved claude self-hosted-runner session start time: the session branch is now created without rewriting the working tree, and two server round trips no longer block the agent's launch
• Improved apps gateway error forwarding: 400/413 errors from Vertex, Foundry, and Claude Platform on AWS upstreams now carry the upstream's own message; fixes a bug with auto-compact on apps gateway
• Improved claude plugin validate to check a bare .claude/skills directory, reporting SKILL.md files whose frontmatter fails to parse
• Improved screen reader mode: the /effort selector renders as a numbered list with a typed-number prompt, and hint and dialog text is no longer clipped
• Improved print mode diagnostics: a [claude-code:unrecognized_model] line is written to stderr when a request goes out for a model ID Claude Code doesn't recognize; map it with modelOverrides to silence
• Changed the GitHub app setup tip to no longer appear in repositories whose origin remote is on gitlab.com or bitbucket.org; the enterprise marketplace tip now covers non-GitHub internal git hosts
• Todo/task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to bring them back
• Windows: fixed auto mode repeatedly stopping for manual approval on ordinary cd <dir> && <command> > file Bash commands (a 2.1.232 regression)
• Reverted the 2.1.232 Bash permission changes for Cygwin-style symlinks on Windows and for input redirections (< file); a narrower version will return in a later release

v2.1.232

Compare Source

• Subagent forking is now on by default: a subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by default
• Type @ in the prompt to mention another Claude session by name; Claude then uses SendMessage to reach that session directly
• SendMessage now delivers to a bare name that exactly matches one live session, instead of asking to confirm with a ref first
• Interactive sessions on one machine now keep unique names: starting or renaming a session to a name another live session already uses gives it a name-word-word variant and tells you
• Added /config rows for "Dialog expiry" and "Messages from your other sessions" (cross-session inbound accept/hold/refuse)
• Added secret redaction for GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-) and full redaction of routable glpat-/gldt- tokens; the glab CLI config store gets the same sandbox and credential-path protection as gh
• Added GitLab support to plugin marketplaces: bare gitlab.com repo URLs (including nested subgroups) now clone like github.com URLs, and clone auth-failure hints name your actual git host
• Settings: additionalMarketplaces and allowedMarketplaces are now accepted as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces
• Enterprise policy: a url-typed blockedMarketplaces entry for a bare repo URL keeps blocking that URL when the CLI classifies it as a git clone
• Gateway: the desktop: overlay now accepts every released Desktop setting (was 11 hand-listed keys), validated at boot against Desktop's own schema; unknown or invalid keys fail boot
• Gateway: empty managed.policies[].match.groups/admin.admin_groups entries and malformed email_domain values (empty, or containing @, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin access
• Fable 5 is offered as an advisor in /advisor again for organizations with Fable access, with usage-credits consent set up through /model fable
• Fixed a PowerShell permission bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands' file access
• Fixed a Windows permission bypass where Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approval
• Fixed nested git repositories inheriting trust from a parent directory; each repository now requires its own trust confirmation
• Fixed MCP connections hanging for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probe
• Fixed Remote Control sessions hosted by a bridge inside a cloud session inheriting that session's transcript or credentials
• Fixed Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed; they now reattach to the existing one
• Fixed Remote Control sessions appearing unreachable to newly attached clients while idle
• Fixed Remote Control bridge sessions not restoring conversation history when the session worker restarts
• Remote Control: resuming a conversation whose session was deleted from claude.ai or the app now starts a replacement instead of failing with a message about your login (regressed in v2.1.227)
• Fixed Cloud gateway /login exiting silently or leaving an unresponsive terminal after "Press Enter to continue" when managed settings failed to load; the reason is now shown
• Fixed voice mode on native builds getting stuck on "listening…" when the voice service rejected the connection; the rejection is now shown immediately
• Fixed mTLS client certificate rotation requiring a restart; Claude Code now reloads the rotated cert and key automatically on connection errors
• Fixed malformed AWS or Vertex region values being used to build request URLs; they now fall back to the default region
• Fixed stream idle timeout errors failing the request instead of recovering on Bedrock, Vertex, and gateway deployments
• Fixed content-sized overlays containing truncated text rendering one column too wide, and start-truncated text collapsing to an ellipsis
• Fixed a stray garbled character where a long shell-command or agent-description preview was cut off mid-emoji
• Fixed a startup race that could silently unregister a plugin marketplace due to concurrent writes to known_marketplaces.json
• Fixed /update and /tui refusing to restart while work that survives the relaunch was running
• Fixed usage-limit guidance suggesting unavailable slash commands in SDK and remote sessions
• Fixed the consent message for interactive --advisor fable launches, which told you to run /model fable in an interactive session that had just exited
• Improved fullscreen streaming: long sessions stay responsive because the whole conversation is no longer re-normalized on every update
• Improved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep)
• /feedback and /bug now open immediately when invoked while Claude is responding, instead of waiting for the turn to finish
• /plugin install plugin@marketplace now refreshes the marketplace first, so newly published plugins install without a manual marketplace update
• /code-review at high, xhigh, and max effort now runs in a background agent like the other levels
• Pasted and clipboard images are read without blocking the event loop
• Remote Control now keeps reconnecting for about 30 minutes after a network blip and no longer drops after a few blips spread across an hour
• Remote Control: resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that still has it; run /remote-control there to move it
• Updated agent panel: completed subagents hide immediately with a /tasks footer hint, and the "↓ N more" overflow indicator moved left for visibility
• Remote Control: the terminal now says whether a session was taken over by another device, ended from another app, or deleted, and stops suggesting a reconnect that would undo it
• Bash input redirections (< file) are now permission-checked like their argument spellings on all platforms
• Shortened the message shown when resuming a completed background agent
• Cowork sessions no longer inline external @​-imports from user-scope memory files
• Hardened the auto-generated cross-session messaging socket directory on shared /tmp: a pre-planted symlink or another user's directory is now refused instead of used
• Hardened the Linux filesystem sandbox against a protected-path bypass
• Changed sandbox.ripgrep to be honored only from user, managed, and --settings settings; project settings can no longer override the sandbox's ripgrep binary
• Removed the startup tip suggesting you create custom subagents, and the matching nudge in the /powerup tour

v2.1.231

Compare Source

• Fixed MCP OAuth sign-in failing with a redirect URI mismatch for servers that use a pre-registered OAuth client, such as Slack

v2.1.229

Compare Source

• Documented claude remote-control --continue for resuming the most recent Remote Control session
• Added server-supplied Claude Code hook support for self-hosted runner sessions, matching managed-environment behavior
• Added SSE keepalive pings to gateway streaming responses during long thinking pauses, preventing idle-timeout disconnects on Vertex and Bedrock upstreams
• Added plugin marketplace command sources: a local command (e.g. an IDE) prints the plugin directory, which is re-resolved each session and applied without a restart; mode: "link" uses it in place
• ListAgents now marks disconnected Remote Control sessions as offline and labels your cloud sessions as cloud
• Fixed long responses partly disappearing while streaming and being printed twice in the terminal
• Fixed a crash to the error screen (including on --resume of the affected session) when a tool call had a non-string glob, file_path, or command value
• Fixed a RangeError crash when a progress bar or markdown table rendered in a very narrow terminal window (could also crash claude --continue/--resume at startup)
• Fixed a crash on Windows when a tool call or message referenced a file by an extended-length (\\?\) or UNC path
• Fixed auto mode failing on every tool call for users who disable the attribution header via CLAUDE_CODE_ATTRIBUTION_HEADER (direct Anthropic API connections)
• Fixed /model rejecting Sonnet/Opus 1M for claude.ai subscribers using a custom ANTHROPIC_BASE_URL gateway
• Fixed MCP OAuth with strict authorization servers by using 127.0.0.1 instead of localhost in the redirect URI
• Fixed Remote Control clients showing a stuck working spinner after a slash command typed in the laptop terminal
• Fixed the Claude Code Review workflow generated by /install-github-app completing without posting its review on the pull request
• Fixed multi-second UI stalls after editing a file with thousands of IDE diagnostics while the IDE extension is connected
• Fixed one-shot claude plugin commands leaving a stray liveness file that could prevent cleanup of outdated plugin versions
• Fixed dynamic workflows inside CPU-limited containers using the host machine's core count instead of the container's CPU limit
• Fixed a file-watcher handle leak after atomic file replacements, and an uncaught error on Windows when the scheduled-tasks watcher failed on a network or virtual filesystem
• Fixed SDK and --input-format stream-json sessions getting a 400 API error when a whitespace-only message was submitted
• Fixed conversations whose messages alone exceed the API's 32 MB request limit retrying compaction when no images or documents can be stripped; they now fail once with a clear message
• Fixed OpenTelemetry export from Claude Desktop sessions being rejected by the Desktop-managed gateway when that gateway is also the telemetry endpoint
• Fixed self-hosted runner and other remote sessions exiting at startup when managed-mcp.json is deployed and the server delivers MCP servers; those servers are now skipped with a warning
• Fixed self-hosted runner repository preparation hanging on a Git Credential Manager prompt; git now fails fast when credentials are missing
• Improved workflow fan-outs to stagger same-prefix sibling agents so subsequent agents read the cached prompt prefix instead of re-paying it (CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS=0 disables)
• Improved "prompt is too long" errors to explain why automatic compaction could not recover instead of only suggesting /compact
• Improved sandbox: IPv6 literals in network domain lists are now bracketed ([::1]:443), and ambiguous spellings are enforced fail-closed and flagged by /doctor
• Updated /login to repeat the CLAUDE_CODE_OAUTH_TOKEN override warning after a successful login
• Changed /commit-push-pr so git/gh commands with dangerous flags (--force, --amend, --no-verify, etc.) are no longer auto-approved
• Changed self-hosted runner Windows startup to require an explicit --base-dir; there is no default checkout directory on Windows
• [VSCode] "Report a problem" and /bug now open the built-in feedback dialog instead of a retired survey link
• [VSCode] Made the /btw side-question panel resizable by dragging its boundary, in both side-docked and stacked layouts
• [VSCode] Added session groups in the sidebar — right-click to create, rename, or delete; Cmd/Ctrl- or Shift-click to move several sessions at once

v2.1.228

Compare Source

• Fixed interactive sessions that could stop redrawing entirely, while the process kept running, after a rare internal layout error
• Fixed git / Git Bash not being found on Windows when Claude Code is launched from a parent folder of the git installation
• Fixed /tui reverting the session to an earlier model when /model had been changed since the last response
• Fixed cross-session messaging sometimes starting without an inbox in the first session after install or upgrade
• Fixed Remote Control /resume while connected leaking the resumed conversation's title or history into the connected session
• Fixed claude self-hosted-runner sessions failing on every fresh runner when the checkout hook fails for a repository the session doesn't push to; that repository is now skipped with a warning
• Fixed self-hosted runners ending sessions in the gap between a background task finishing and the follow-up turn starting
• Fixed session cleanup deleting contents inside a project's memory folder
• Fixed background plugin-cache cleanup deleting a plugin's cache when its only version is a symlinked development checkout
• Fixed a settings-merge issue where a marketplace entry redefined in a higher-precedence settings tier could inherit another tier's custom headers; marketplace entries now merge as whole entries
• Fixed the deferred-tools reminder occasionally being sent to the model twice after a skill invocation
• Hardened skills synced from claude.ai: they no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and on your machine their bodies don't run ! commands or expand @ files
• Improved cross-session messages: the sender and body now display inline instead of a collapsed line, and messages to Remote Control sessions on other machines show your Remote Control session name as the sender
• Improved Vertex AI credential handling: expired or missing Google Cloud credentials now fail within seconds instead of retrying for minutes
• Improved compaction progress: the retry countdown and stall hint now appear during compaction instead of only a progress bar
• Updated terminal title busy-spinner glyphs to reduce tab-bar jitter on some terminals
• Changed the Write tool so newer models can overwrite an existing file they haven't read this session, matching the Edit tool's rules; older models still require the read first
• Removed the outdated note about auto mode sessions costing slightly more from the first-use notice for Pro, Max, and Team plans

v2.1.227

Compare Source

• Fixed feature flags being evaluated without the user's subscription tier when a session started with an expired login token, which could wrongly prompt Max plan users to enable usage credits for Fable
• Fixed every Bash command failing under claude-code-action with allowed_non_write_users on GitHub-hosted runners
• Fixed /tui bringing back a conversation that had been rewound to before its first message
• Improved slash-command menu: blue now marks only the selected row, matched characters are bolded instead of recolored, and emoji or accented names keep their glyphs
• Improved performance: fewer event-loop stalls on file-not-found suggestions and at-mention size checks

v2.1.226

Compare Source

• Bug fixes and reliability improvements

v2.1.225

Compare Source

• Added gateway spend-limit support to Claude Code's usage warning; the limit-reached message now names the cap, its reset time, and the operator's message (requires the gateway on 2.1.225)
• Added a workspace trust prompt to claude agents for untrusted directories, matching the behavior of claude
• Fixed a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking headless sessions until restart
• Fixed MCP OAuth servers on macOS intermittently failing with a burst of 401 errors, as if never authenticated, after a keychain read timed out
• Fixed auto mode counting a safety-filter refusal of its own permission check toward the consecutive-block limit; the action is still denied, but the model is now told to move on rather than retry
• Fixed cross-session messages staying parked without a notice or expiry in headless sessions and during startup
• Fixed conversation history breaking on Remote Control session resume after very large conversations were compacted
• Fixed hovering over a session in another project in the agents list changing the directory the next agent starts in
• Fixed claude self-hosted-runner registering and then failing every session when --base-dir cannot be created or written; it now exits at startup with a clear error
• Fixed Claude Code on the web sessions being misreported as stuck, re-sending a growing event backlog on every reconnect
• Improved Remote Control: photos attached from the Claude app are now shown to Claude directly instead of being read from disk with a separate tool call
• [VSCode] Fixed Focus view folding away the latest to-do list, a pending question's context, and settled answers; thinking-only folds show "Thought for Ns" and re-collapse when their turn completes
• SendMessage can now start a conversation with your Remote Control sessions on other machines by name (ListAgents shows them as name [ref]), instead of only replying after they message you first
• SendMessage: a Remote Control recipient you already confirmed is never swapped for a same-named session on this machine when its own list couldn't be checked

v2.1.224

Compare Source

• Added self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise plans
• Added archive plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning
• Added a cancel-and-confirm step when removing an unavailable paste changes a command's text
• Added ANTHROPIC_BEDROCK_REGION_PREFIX env var for Bedrock to prefer a specific cross-region inference profile over the AWS_REGION-derived one
• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
• Added sandbox credential-masking options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing; these need network.tlsTerminate and are honored only from user, managed, or --settings settings
• Added cross-session SendMessage: Claude Code sessions can now message each other, on any of your machines, with ListAgents to discover them (macOS and Linux)
• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list, rename, fork, delete and /resume no longer cross projects
• Fixed SendMessage reporting "Message sent" when the write to a teammate's inbox had actually failed; failed deliveries are now reported as errors
• Fixed sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS
• Fixed sandbox violation details never appearing in Bash tool results; Claude now sees which file or network access was denied and why
• Fixed MCP tools that connect mid-turn being deferred for tool search without their names announced to the model
• Fixed plugin install records being silently corrupted when the same plugin is installed in multiple projects
• Fixed recalled or restored paste content occasionally attaching wrong data or silently losing text when the paste had aged out or placeholder numbers collided
• Fixed copy-on-select on Wayland sometimes not reaching the clipboard; the two selection writes no longer race
• Fixed the feedback survey's transcript share silently failing on long sessions; a failed share now shows an error instead of a success message
• Fixed Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on a cold start with a stale login token
• Fixed Remote Control and SDK clients showing a blank "(no content)" message after /clear and other output-less commands
• Fixed a Remote Control session recreated after its server session expired uploading prior local conversation history into the new session
• Improved fullscreen mode to keep the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval
• Improved Remote Control: attached web and mobile clients now see compaction progress and the post-compaction boundary instead of a silent pause; /clear resets now propagate to attached clients
• Improved Remote Control: connection failures now show a persistent failure indicator with details and a reconnect shortcut, instead of only an 8-second toast
• Removed the 200-subagent-per-session spawn cap; long-running sessions no longer refuse new agents (concurrency and depth limits still apply)
• Changed managed settings: the approval prompt no longer re-appears after re-login or org switching when the organization's settings are unchanged
• Changed the feedback-survey transcript share: with your consent it now also uploads the last request's model settings — the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large
• Changed the Bash tool description to always note that command output is displayed to the model, not reliably to the user
• Changed recalled paste placeholder numbers to renumber when accepted into the input
• Changed Remote Control to archive the stale server session instead of leaving a dead one listed when a fresh session is minted after compaction or /resume
• [VSCode] Fixed the extension showing Remote Control as connected after the connection failed
• Fixed a session resume silently reconnecting Remote Control after the user turned it off (--resume, SDK hosts, and the VS Code extension)
• [VSCode] Fixed sessions not honoring remoteControlAtStartup when explicitly enabled

v2.1.223

Compare Source

• Added owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings for allowing or blocking all marketplace repos under a GitHub org
• Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead
• Added a /teleport hint in cloud sessions showing how to continue locally with claude --teleport <session id>
• Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks
• Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
• Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox
• Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy
• Fixed resuming a session after a mid-session /cd coming back empty
• Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*
• Fixed modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented
• Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key
• Fixed sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory
• Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
• Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment
• Fixed a rare hang when parsing unusual git push output
• Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K
• Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior
• Changed /review to be an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use /code-review ultra for a deep cloud review
• Changed /code-review with no effort level to reuse the level you typed last; type a level like /code-review high to change it

v2.1.222

Compare Source

• Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type
• Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
• Fixed /usage-credits on Team and Enterprise showing "you've already sent a usage credit request" for members whose earlier request was dismissed, blocking them from sending a new one
• Fixed the startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message
• Fixed "Connection closed mid-response" errors being reported on responses that had actually completed
• Fixed /usage overattributing usage to MCP servers: a server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it
• Fixed sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API
• Fixed org-restricted model: opus-style subagent and teammate family aliases dropping to the parent model instead of stepping down to the newest org-allowed model in the family
• Fixed stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire
• Fixed claude.ai connectors being falsely marked as needing authorization when the session token is invalid — they now show a /login hint instead
• Fixed tool errors not being displayed for tools no longer available locally, for example after an MCP server is removed
• Fixed SendMessage rejecting a long summary — it now truncates instead, so sends no longer fail on a character limit
• Fixed the spinner's effort label in a subagent's transcript view showing the session's effort level instead of the subagent's own effort: setting
• Fixed rare crashes when a file watcher hit a filesystem error or during file-watcher teardown
• Fixed screen readers re-reading the whole input line on every backspace in --ax-screen-reader mode — end-of-line deletions now echo just the deleted characters
• Fixed host model-selection keys not taking precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set
• Improved auto mode safety: messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch
• Improved the refusal when Claude tries to invoke a skill with disable-model-invocation: Claude is now told to ask you to run the skill instead of replicating its workflow
• Improved the /diff view, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web sessions to use raw git blob content, ignoring workspace-configured diff drivers and textconv
• Changed Remote Control auto-start so repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on (they can still turn it off); enable it at user scope via /config
• Removed ultraplan feature

v2.1.221

Compare Source

• [VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
• Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
• Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
• Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
• Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
• Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
• Fixed MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text
• Fixed @​-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
• Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
• Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled
• Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
• Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
• Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume; falsy values are now honored
• Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
• Fixed renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
• Fixed plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions
• Fixed the "Plugins changed" notification lingering after plugins were reloaded instead of clearing
• Fixed Vim mode: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied
• Fixed Vim mode: undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
• Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
• Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
• Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
• Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
• Improved /ultrareview error messages when a repo shares no history with its base: a checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest git fetch --unshallow on clones that are already complete
• Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
• Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
• Changed /plugin install to refresh a stale marketplace catalog and retry before reporting a plugin not found
• Changed plugins installed from /plugin to activate immediately when safe, instead of always requiring /reload-plugins
• Changed plugins to accept "." as a skills path, and the root-level SKILL.md validation error now suggests using the plugin root
• Changed /status to show the session kind: interactive, or a background job that is attached or unattended
• Changed emoji autocomplete to accept common alternate shortcodes like :thumbsup:, :thumbsdown:, and :love:
• Changed sessions forked with /fork to create a new worktree of their own instead of working in the original session's checkout
• Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
• Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
• Changed Monitor: a watch that exits without producing any output now says so instead of reporting "stream ended"
• Changed the Gateway model field validation: non-string values are rejected with a 400 instead of being forwarded
• Removed the repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.