chore(deps): update dependency npm:@anthropic-ai/claude-code to v2.1.163 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
npm:@anthropic-ai/claude-code	2.1.128 → 2.1.163

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

CVE-2026-55607 / GHSA-7835-87q9-rgvv

More information

Details

Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it.

Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/metnew for reporting this issue.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv
• https://nvd.nist.gov/vuln/detail/CVE-2026-55607
• https://github.com/anthropics/claude-code
• https://github.com/anthropics/claude-code/releases/tag/v2.1.163

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

CVE-2026-54316 / GHSA-fg94-h982-f3mm

More information

Details

Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/novee for reporting this issue.

Severity

• CVSS Score: 6.0 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-54316
• https://github.com/anthropics/claude-code

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

anthropics/claude-code (npm:@​anthropic-ai/claude-code)

v2.1.163

Compare Source

• Added requiredMinimumVersion and requiredMaximumVersion managed settings — Claude Code refuses to start if its version is outside the allowed range and directs the user to an approved version
• Added /plugin list command to list installed plugins, with --enabled/--disabled filters
• Added a "c to copy" shortcut to /btw that copies the raw markdown answer to the clipboard, preserving formatting when pasted elsewhere
• Hooks: Stop and SubagentStop hooks can now return hookSpecificOutput.additionalContext to give Claude feedback and keep the turn going without being labeled a hook error
• Skills: added \$ escape syntax to include a literal $ before a digit in command bodies
• stdio MCP servers now receive the same CLAUDE_CODE_SESSION_ID as hooks/Bash on --resume
• Fixed claude -p hanging forever after its final result when a backgrounded command never exits — background shells are now stopped ~5s after the result once stdin closes
• Fixed claude -p failing with "ANTHROPIC_API_KEY required" on Bedrock/Vertex/Foundry when CI=true and no Anthropic API key is set
• Fixed bash commands failing under bazel and EDR-protected Go workflows: $TMPDIR was overridden to /tmp/claude-{uid} for all commands instead of only sandboxed ones (regression in 2.1.154)
• Fixed Bash commands failing on Windows with "EEXIST: file already exists" on the session-env directory when it has the read-only attribute or is inside OneDrive
• Fixed org-managed permission rules not applying for the entire session when the managed settings fetch completed during startup on a fresh config directory
• Fixed background sessions in claude agents losing their running background tasks when reattached after a Claude Code update
• Fixed terminal misalignment and a multi-second hang when exiting the agent view by pressing Esc
• Fixed clicking Stop on a background-task chip in the desktop app not clearing the chip when the underlying process was already gone
• Fixed keyboard input becoming permanently unresponsive after a paste operation whose end marker is dropped by the terminal
• Fixed hook if: "Bash(...)" conditions firing on every Bash command containing $() or $VAR; the pattern now matches against commands inside subshells and backticks too
• Fixed deny rules on home-directory paths (e.g. Read(~/Desktop/**)) not blocking Bash commands that reference the path via $HOME
• Fixed a stray "(no content)" line left in the transcript after closing panel dialogs like /mcp and /plugins
• Background agent sessions now update to a new Claude Code version in the background, so opening a session after an update no longer waits on a cold restart
• Clearer descriptions for built-in commands and skills in the / menu
• The subscription-switch suggestion now shows in the startup announcement slot instead of a toast
• claude agents dispatching from the state-grouped view now starts the session in the directory the agent view was opened from

v2.1.162

Compare Source

• claude agents --json now includes waitingFor showing what a waiting session is blocked on (e.g. permission prompt)
• --tools: explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search (previously these names were silently ignored)
• /effort now confirms when your chosen level will persist as the default for new sessions
• Clicking a slash command in the autocomplete menu now fills it into your prompt instead of running it immediately; press Enter to run
• Remote Control now shows as a persistent footer pill (with a link to the session) instead of a startup message
• Renamed Windsurf to Devin Desktop in the /ide menu, /terminal-setup, and /scroll-speed, following the editor's rebrand
• Fixed a silent startup hang when the config directory is read-only or unwritable — Claude Code now starts with in-memory config and surfaces startup errors instead of showing a blank screen
• Fixed WebFetch permission rules not being applied to built-in preapproved domains; explicit WebFetch(domain:...) deny/ask/allow rules now take precedence over the preapproved-host auto-allow
• Fixed Windows permission rules never matching when spelled with backslashes (~\, \\server\share) or case-variant paths, and Read deny rules not hiding files from Glob/Grep results
• Fixed an interrupt (Esc) sent at the very start of a turn being silently dropped in stream-json/SDK sessions, leaving the turn running with no "Interrupted" feedback
• Fixed API 400 no low surrogate in string errors for classifier side-queries and MCP server descriptions containing emoji near a truncation boundary
• Fixed MCP per-server timeout config values below 1000 ms being floored to a 1-second watchdog that aborted every tool call; sub-1000 ms values are now ignored (falling back to MCP_TOOL_TIMEOUT or default), and claude mcp get annotates them accordingly
• Fixed the LSP tool's workspaceSymbol operation returning no results; it now accepts a query parameter and passes it to the language server
• Fixed claude agents cutting live status text (tool args, replies, prompts, exec output) at 60–120 columns on wide terminals; the status detail now uses the full terminal width
• Fixed claude agents truncating long session names at 40 columns; the name column now grows with terminal width
• Fixed claude agents attach occasionally bouncing straight back to the session list on the first try after a background-service restart
• Fixed claude agents Ctrl+V image paste doing nothing in the dispatch input and the session reply box; pasting with no image now shows a hint
• Fixed backgrounding a session with ← silently losing the conversation when the background service cannot start; the session stays in the list as a failed row you can wake with Enter
• Fixed replies from the agents view that fail to send being lost; they are now queued for delivery on the next session start
• Fixed cross-session messaging (SendMessage) silently breaking when CLAUDE_CODE_TMPDIR or $TMPDIR points at a deep directory
• Fixed opening a running background session from claude agents stalling for 5 seconds before attaching
• Quieter startup: notices group by severity, and session info and announcements share a single line per launch
• Startup warnings rewritten to be shorter and clearer, each with a concrete fix
• Launch-prompt warnings (deep link/pre-filled prompt) now stay pinned below the input until you act instead of scrolling away
• Failed turns now show a compact warning line instead of a multi-line red error block
• Improved background service startup and claude update verification to wait out endpoint-security scanning of new binaries instead of failing after 5 seconds
• Background dispatch spawn failures now report the error class name when no errno is available
• Removed the "Claude in Chrome enabled" and "marketplace installed" startup messages; model auto-updates and the team-onboarding tip now show as quiet notices under the logo

v2.1.161

Compare Source

• OTEL_RESOURCE_ATTRIBUTES values are now included as labels on metric datapoints, so you can slice usage metrics by custom dimensions like team or repo
• claude agents rows now show done/total before the detail when work is fanned out; peek shows the longest-running item
• /mcp now collapses claude.ai connectors you've never signed in to behind a "Show unused connectors" row
• Parallel tool calls: a failed Bash command no longer cancels other calls in the same batch — each tool returns its own result independently
• Fullscreen mode: clipboard now uses wl-copy/xclip/xsel on Linux when available, copies to both the clipboard and PRIMARY selection for middle-click paste, and the "hold {key} for native selection" hint now shows the correct key per terminal
• Fixed the /effort dialog, workflow animations, and prompt keyword shimmer not honoring the "Reduce motion" setting
• Fixed forceLoginOrgUUID/forceLoginMethod managed-settings policies blocking third-party provider sessions (Bedrock, Vertex, Foundry, Mantle) alongside the org pin (regression in 2.1.146)
• Fixed background subagent output corrupting claude -p stdout when using --output-format text or json
• Fixed /usage-credits starting a re-login for Team and Enterprise admins instead of pointing to the organization's usage settings page
• Fixed /autofix-pr reporting "cannot run on the default branch" when the session is inside a git worktree or another repository
• Fixed --resume picker not showing sessions from the current directory when it isn't a git worktree (e.g., jj workspaces)
• Fixed Windows hooks that invoke bash explicitly (e.g., /usr/bin/bash script.sh) failing with "command not found" or "cannot execute binary file"
• Fixed OpenTelemetry log events (user_prompt, api_request, tool_result, tool_decision) being silently dropped when emitted before telemetry initialization completed
• Fixed claude mcp list/get/add printing secrets to the terminal: ${VAR} references are no longer expanded, and credential headers and URL secrets are redacted
• Fixed Workflow agents spawned with isolation: "worktree" in background sessions being blocked from editing files inside their own worktree
• Fixed background sessions dispatched from claude agents booting on a stale model from the daemon's environment instead of the model in settings.json
• Fixed a potential crash when rendering Write tool results after resuming a session
• Fixed completed subagents getting stuck showing as running when an error occurs while finalizing their result
• Fixed EADDRINUSE errors from tools that bind Unix sockets under $TMPDIR when CLAUDE_CODE_TMPDIR is set to a deep path
• Improved terminal rendering performance by stabilizing the layout engine's JIT compilation profile
• Improved rendering performance for large file writes
• [VSCode] Added a tip suggesting disabling terminal GPU acceleration (or running /terminal-setup) to fix garbled glyphs

v2.1.160

Compare Source

• Added a prompt before writing to shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/, which could otherwise lead to unintended command execution
• acceptEdits mode now prompts before writing build-tool config files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/, etc.)
• Edit no longer requires a separate Read after viewing a file with grep: single-file grep/egrep/fgrep commands now satisfy the read-before-edit check
• Fixed copy-on-select not writing to the Windows clipboard on WSL — now uses PowerShell interop instead of OSC 52, which terminals like MobaXterm don't support
• Fixed restoring a completed session from claude agents dropping chat history and re-running the original prompt
• Fixed background sessions re-attached after overnight retire losing their conversation and re-running the original prompt
• Fixed claude --bg occasionally failing with "socket missing" when the background daemon was cold-starting on a loaded machine
• Fixed an issue on Windows where the directory a background session was started in could not be deleted after claude rm until the background daemon exited
• Fixed background agents that resumed work being shown under Completed in the agents list
• Fixed claude agents freezing for several seconds when returning to the session list due to the auto-updater re-checking on every exit
• Fixed Esc, arrow keys, and typing becoming unresponsive on Windows when attached to a background session or in the agent view while the host is under heavy CPU load
• Fixed background agents emitting terminal sync-output markers to terminals that don't support them (Apple Terminal, tmux), causing render artifacts when entering a running agent
• Fixed mouse wheel scrolling prompt history instead of the transcript right after opening a session from the agents list
• Fixed CJK IME composition appearing at the bottom-left of the screen instead of at the input caret in the claude agents view
• Fixed valid file:///C:/... links being rewritten to a broken path on Windows terminals with hyperlink support
• Fixed voice mode failing to connect when the project directory or branch name contains non-ASCII or special characters
• Fixed the auto mode unavailability message on third-party providers (Bedrock/Vertex/Foundry) to point to the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in instead of incorrectly blaming the model
• Fixed /effort ultracode incorrectly blaming the dynamic workflows setting when the model cannot run xhigh; ultracode is no longer offered on models that do not support it
• Fixed model-not-found errors suggesting --model when running via the SDK or other hosts where the CLI flag doesn't apply
• Fixed Claude's past replies disappearing from scrollback when resuming a brief mode session with brief mode turned off
• Fixed vim mode p pasting on the line below instead of at the cursor when the register was yanked with v$
• Improved performance of opening recently-inactive background agent sessions in claude agents
• Improved auto mode classifier latency by reducing reasoning on routine actions, lowering the chance of "could not evaluate this action" blocks
• Improved background-session teardown (claude rm/stop, idle reap) to send SIGTERM to running shell subprocesses before SIGKILL, so cleanup handlers run
• Removed CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE; the environment variable is now a no-op
• Removed the JetBrains plugin install suggestion from startup
• Renamed the dynamic-workflow trigger keyword from workflow to ultracode. The word "workflow" no longer triggers a run; asking for one in your own words still works. The trigger keyword is highlighted in violet in the prompt input

v2.1.159

Compare Source

• Internal infrastructure improvements (no user-facing changes)

v2.1.158

Compare Source

• Auto mode is now available on Bedrock, Vertex, and Foundry for Opus 4.7 and Opus 4.8. Opt in by setting CLAUDE_CODE_ENABLE_AUTO_MODE=1

v2.1.157

Compare Source

• Plugins in .claude/skills directories are now automatically loaded, no marketplace required
• Added claude plugin init <name> to scaffold a new plugin in .claude/skills
• Added autocomplete for /plugin arguments: subcommands, installed plugin names, and plugins from known marketplaces
• claude agents: the agent field in settings.json is now honored for dispatched sessions, with --agent <name> to override it
• EnterWorktree can now switch between Claude-managed worktrees mid-session
• tool_decision telemetry events now include tool_parameters (bash commands, MCP/skill names) when OTEL_LOG_TOOL_DETAILS=1
• Worktrees managed by Claude are now left unlocked when the agent finishes, so git worktree remove/prune can clean them up
• Fixed unprocessable images (zero-byte, corrupt) attached via paste, MCP, or dialog crashing the request instead of becoming a text placeholder
• Fixed sandbox network permission prompts appearing in auto and bypass-permissions mode when using the desktop app, IDE extensions, or SDK
• Fixed claude agents completed sessions not retiring when an idle subagent was still parked or had leaked a backgrounded shell
• Fixed claude agents pressing Esc not cancelling a slow "opening…", leaving the list unresponsive
• Fixed background agent worktrees under .claude/worktrees/ being orphaned after the 30-day job retention sweep
• Fixed background sessions re-attached after a sleep/wake not telling the model the correct date
• Fixed copy-on-select in claude agents not reaching the system clipboard inside tmux with set-clipboard on (regression in 2.1.153)
• Fixed --resume not reporting background subagents that were running when the previous Claude Code process exited
• Fixed the --resume session picker leaving its contents on the terminal after exiting in fullscreen mode
• Fixed --worktree and --worktree --tmux returning to the canonical repo root instead of the current linked worktree
• Fixed the /model picker showing an incorrect "Newer version available" hint when the selected model is already the newest in its family; the pinned-model row now shows the model's description instead of its raw ID
• Fixed literal markdown markers (backticks, asterisks) appearing in the in-progress message text in fullscreen mode
• Fixed the terminal freezing after approving the managed-settings security dialog at startup
• Fixed a rare duplicate line appearing in scrollback after the terminal UI redraws
• Fixed right-click paste duplicating the clipboard in the VS Code, Cursor, and Windsurf integrated terminals
• WSL: fixed image paste (alt+v keybinding), screenshot paste on Windows 11, and added support for dragging images from Windows Explorer
• Improved performance of long and resumed conversations by eliminating redundant message-rendering recomputations
• /terminal-setup now disables GPU acceleration in VS Code/Cursor/Windsurf integrated terminals to prevent garbled-text rendering
• The Feature of the Week credit-claim status now appears as a notification in the status area instead of a line above the prompt
• claude agents: slash-command autocomplete in the dispatch input now matches substrings
• Removed the "bash commands will be sandboxed" startup banner — sandbox status still shows in /status and when a command is blocked
• Removed the "/ide for …" startup hint toast
• [IDE] Fixed clicking Stop while a background subagent is running not actually stopping it
• [VSCode] Fixed the fast mode indicator not appearing on Opus 4.8
• Pressing backspace right after a workflow trigger keyword now dismisses the workflow request (same as alt+w) instead of deleting a character
• Added a "Workflow keyword trigger" setting in /config to stop the word "workflow" in a prompt from triggering a dynamic workflow

v2.1.156

Compare Source

• Fixed an issue when using Opus 4.8 where thinking blocks were modified, leading to API errors.

v2.1.154

Compare Source

• Opus 4.8 is here! Now defaults to high effort · /effort xhigh for your hardest tasks
• Introducing dynamic workflows: ask Claude to create a workflow and it orchestrates work across tens to hundreds of agents in the background, so you can take on larger, more complex tasks. Run /workflows to view your runs
• Fast mode on Opus 4.8 is now available at a fraction of its previous cost: 2x the standard rate for 2.5x the speed
• The lean system prompt is now the default for all models except Haiku, Sonnet, and Opus 4.7 and earlier
• Claude now reserves the multiple-choice question prompt for decisions it genuinely cannot make itself, instead of asking when it already has enough context to proceed
• /simplify now runs a cleanup-only review (reuse, simplification, efficiency, altitude) and applies the fixes, instead of running the full /code-review --fix bug-hunting review
• Renamed the /effort slider labels from "Speed"/"Intelligence" to "Faster"/"Smarter" for clarity
• claude agents: type ! <command> to run a shell command as a background session you can attach to and detach from. Also available as claude --bg --exec '<command>'
• claude agents: /logout now signs you out instead of being sent to a background session
• ←← to open the agents view now works on Bedrock, Vertex, Foundry, and with telemetry disabled
• Claude in Chrome: pick which connected browser to use via /chrome → "Select browser…", or in-chat when a browser action runs with multiple connected
• Plugins can now declare defaultEnabled: false in plugin.json or a marketplace entry; enable them with /plugin or claude plugin enable. Dependencies of enabled plugins are still enabled automatically
• The /plugin Discover tab now pins plugins whose relevance signals match the current directory with a "suggested for this directory" annotation
• Streaming tool execution is now always enabled, including when telemetry is disabled or on Bedrock/Vertex/Foundry (previously behind a feature flag)
• Stdio MCP server subprocesses now receive CLAUDE_CODE_SESSION_ID and CLAUDECODE=1 in their environment
• claude mcp list/get now show unapproved .mcp.json servers as ⏸ Pending approval instead of auto-approving and connecting when output is piped
• /remote-control autocomplete now shows "Disconnect Remote Control" when Remote Control is already active
• Added Claude Opus 4.8 support and 4.7 → 4.8 migration guidance to the /claude-api skill
• Deprecated CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE (will be removed on 06/01). To use fast mode on Opus 4.6, switch with /model claude-opus-4-6[1m] and then /fast on
• Improved the auto-mode classifier's detection of data exfiltration, particularly bulk transfers of repository contents
• Fixed rm -rf $HOME not being blocked as a dangerous path when HOME has a trailing slash
• Fixed $TMPDIR resolving to different directories in sandboxed vs unsandboxed Bash commands within the same session
• Fixed unreadable highlighted-row text in claude agents when the Claude Code theme doesn't match the terminal background
• Fixed background-agent completion notifications triggering premature "out of context" behavior on some 1M-context models
• Fixed background-session classifier losing the user's goal when a scheduled /command fires
• Fixed pinned background sessions respawning every minute after a Claude Code update, causing repeated agent-start notifications and process churn at idle
• Fixed background sessions stuck at "blocked", "running", or "working" not retiring after the idle grace period
• Fixed subagents in background sessions bypassing the worktree-isolation guard and writing to the shared checkout
• Fixed orphaned claude --bg-pty-host processes spinning at 100% CPU after the daemon exits on macOS
• Fixed number key shortcuts not working for options shown below the divider in option dialogs
• Fixed worktree.baseRef: "head" resolving to the main checkout's HEAD instead of the current worktree's HEAD when spawning subagents or calling EnterWorktree from inside a linked worktree
• Fixed a stray leading space on wrapped lines when the previous line ended exactly at the terminal width
• Fixed intermittent terminal rendering corruption in VS Code by capping the number of distinct colors the thinking spinner produces
• Fixed plan file names including [Image #N] / [Pasted text #N] placeholders when a plan-mode prompt starts with pasted images or text
• Fixed a phantom expand/click affordance on colored tool output: short ANSI-colored lines that fit on screen no longer show a "ctrl+o to expand" hint
• Fixed a single invalid allowedMcpServers/deniedMcpServers entry in managed settings discarding all managed-settings policy; the bad entry is now dropped with a claude doctor warning
• Fixed API 400 errors on models that don't support the effort parameter when CLAUDE_CODE_ALWAYS_ENABLE_EFFORT is set
• Windows: Fixed update failures caused by claude.exe being in use showing a generic error instead of telling you to close other sessions and retry
• Removed the stale "& for background" hint from the shortcuts help panel
• [VSCode] Auto mode no longer requires the bypass-permissions setting to appear in the mode picker, and a dismissable notice on the new-session screen explains auto mode the first time it's active
• Fixed the task panel below the prompt showing a stray unselectable "main" row when only a workflow is running
• Fixed /mcp tools list and tool detail rendering when MCP servers have long or multi-line tool names or long descriptions
• Fixed the /model picker not showing fast mode pricing on the Default option for API (pay-as-you-go) users when fast mode is on
• Fixed auto mode incorrectly blocking actions with "could not evaluate this action" when the safety classifier ran out of output tokens while reasoning

v2.1.153

Compare Source

• Added skipLfs option to github/git plugin marketplace sources to skip Git LFS downloads during clone and update
• Claude Code now shows a one-time notice when your npm global install can't auto-update; /doctor lists the fixes
• Status line commands now receive COLUMNS and LINES environment variables so scripts can size output to the terminal width
• claude agents: autocomplete in the dispatch input now suggests native slash commands and bundled skills, not just project skills
• claude agents: PR column now shows PR #N for a single PR or N PRs for multiple
• claude doctor now shows the result of your last update attempt
• Combined the separate "needs authentication" startup notifications for MCP servers and connectors into a single message
• macOS: background agents now appear as "Claude Code" in Privacy & Security and keep their permission grants across upgrades
• Fixed stateful MCP servers without the optional GET SSE stream reconnect-looping on tools/list (regression in v2.1.147)
• Fixed a regression where a custom API gateway could receive the user's Anthropic OAuth credential instead of the gateway's own token
• Fixed subagent (Agent tool) frontmatter MCP servers ignoring --strict-mcp-config, --bare, remote mode, enterprise managed MCP config, and managed-settings MCP server allow/deny policies
• --strict-mcp-config no longer strips inline mcpServers from explicitly-passed agent definitions (--agents / SDK agents), and blocked subagent MCP servers now surface a visible warning
• Fixed the Windows PowerShell installer reporting "Installation complete!" when installation actually failed
• Fixed claude update installing the latest version instead of the configured release channel's version for npm installations
• Fixed excessive memory usage (multiple GB) when resuming a session by transcript file path on machines with many stored sessions
• Fixed claude agents and claude --bg running on a stale daemon started before binary-takeover support, even after upgrading
• Fixed a hang where the CLI could fail to exit when stdin was closed without EOF in stream-json mode, leaving a stale session marker behind
• Fixed malformed file:// links in Claude's responses not being clickable in the terminal
• Fixed claude --help rendering unwrapped output on terminals narrower than 92 columns
• Fixed MCP tool progress notifications not rendering in the collapsed tool view
• Fixed Agent tool with subagent_type: 'claude' running in an undocumented temporary worktree, which could silently discard outputs written to gitignored paths
• /bg while Claude is responding now continues the response in the background session instead of dropping it
• Fixed /btw keyboard shortcuts becoming unresponsive in background sessions while a task is running
• Fixed background sessions writing temp files to $CLAUDE_JOB_DIR triggering a "sensitive file" permission prompt
• Fixed recovering a background agent whose working directory was deleted showing a truncated stack trace instead of a clear error message
• Fixed EnterWorktree not being available immediately in background sessions (previously required ToolSearch first)
• Fixed cmd+k in iTerm2/Terminal.app not repainting attached background sessions
• Fixed the IME candidate window appearing at the bottom of the screen instead of next to the input caret in attached background sessions on Windows
• Fixed background-color bleed when attaching to a background agent from 256-color-only terminals after the agent had rendered file diffs
• Fixed /copy and copy-on-select silently failing to update the system clipboard when attached to a background session inside tmux
• Fixed opening claude agents with Remote Control enabled leaving zombie session entries on the Code tab after exiting
• Fixed /rename in background sessions not updating the session banner immediately
• Fixed Windows update rollback: if a Windows update fails, Claude Code now restores the original executable by copy and tells you how to recover
• [VSCode] Fixed Claude Code processes not shutting down cleanly when VS Code closed on Windows, causing false "unclean exit" reports and orphaned MCP servers
• /model now saves your selection as the default for new sessions (matching the IDE). Press s in the picker to switch models for the current session only.
• If you customized the modelPicker:setAsDefault keybinding, rename it to modelPicker:thisSessionOnly in keybindings.json (the d action was replaced by s)

v2.1.152

Compare Source

• /code-review --fix now applies review findings to your working tree after the review, surfacing reuse, simplification, and efficiency suggestions; /simplify now invokes /code-review --fix
• Skills and slash commands can now set disallowed-tools in frontmatter to remove tools from the model while the skill is active
• Added /reload-skills command to re-scan skill directories without restarting the session
• SessionStart hooks can now return reloadSkills: true to re-scan skill directories, making skills installed by the hook available in the same session
• SessionStart hooks can now set the session title via hookSpecificOutput.sessionTitle on startup and resume
• Added a MessageDisplay hook event that lets hooks transform or hide assistant message text as it is displayed
• Added pluginSuggestionMarketplaces managed setting: admins can allowlist org marketplaces whose plugins may be suggested via context-aware tips
• claude plugin marketplace remove now accepts --scope user|project|local for symmetry with marketplace add, install, and uninstall
• Claude Code now switches to your configured --fallback-model for the rest of the session when the primary model is not found, instead of failing every request
• Auto mode no longer requires opt-in consent
• Vim mode: / in NORMAL mode now opens reverse history search (like Ctrl+R), matching bash/zsh vi-mode
• The /usage breakdown now includes large session files; files are scanned with a streaming read so memory usage stays flat
• Thinking summaries in the collapsed group now stay readable for at least 3 seconds, render as markdown, and cap at 10 lines (Ctrl+O shows the full thinking)
• In fullscreen mode, the "Thinking for Ns" indicator now counts up live while the model is thinking, and keeps its value if you interrupt mid-thought
• Simplified the Workflow tool's inline progress display — live agent counts now show only in the persistent workflow status row below the prompt
• The post-response timer now shows "Waiting for N background agents/workflows to finish" when backgrounded agents or workflows are still running, and reports the cumulative time once their results are processed
• Added the session entrypoint as an OpenTelemetry metric attribute (app.entrypoint, opt-in via OTEL_METRICS_INCLUDE_ENTRYPOINT=true)
• Fixed terminal styling degrading in very long sessions by recycling the renderer's style pool
• Fixed the sandbox-enabled warning not appearing in condensed startup mode — it now shows in every layout
• Fixed the loading spinner showing "still thinking"/"almost done thinking" while a tool is running, and reset the thinking status to "thinking" after each tool
• Fixed focus mode showing a spurious "N messages hidden" count on turns with no hidden activity
• Fixed clicking a link inside an expanded tool result collapsing the section instead of opening the link
• Fixed markdown table cell borders inheriting the color of inline code, wrapped continuation lines losing their style, and empty header cells showing a label in the narrow-terminal stacked layout
• Fixed plugin MCP servers with the same command but different environment variables being incorrectly deduplicated
• Fixed /doctor reporting "marketplace not found" or "plugin not found" for stale enabledPlugins entries referencing removed marketplaces or dropped plugins
• Fixed plugins that track a git branch silently no longer receiving updates after the plugin registry was rebuilt
• Fixed remote MCP servers failing to connect in Claude Code Remote sessions when the egress proxy is enabled
• Fixed the effort-change confirmation dialog appearing when the conversation has no messages or when switching between effort levels that resolve to the same underlying value
• Fixed the Agent tool description referencing an agent list that is never delivered when running with --bare or with attachments disabled
• Fixed a background worker crash in claude agents when accepting a stale permission prompt after a subagent was cancelled
• Fixed cache_creation_input_tokens reporting as 0 in transcript and result usage when the API reports cache writes only via the nested cache_creation breakdown
• Fixed the PushNotification tool incorrectly reporting "Mobile push not sent (Remote Control inactive)" in SDK-hosted sessions when Remote Control is enabled
• Fixed sessions getting stuck after a model or login switch left stale thinking-block signatures in history; now stripped proactively with a retry safety-net

v2.1.150

Compare Source

• Internal infrastructure improvements (no user-facing changes)

v2.1.149

Compare Source

• /usage now shows a per-category breakdown of what's driving your limits usage — skills, subagents, plugins, and per-MCP-server cost
• /diff detail view can now be scrolled with the keyboard (arrows, j/k, PgUp/PgDn, Space, Home/End)
• Markdown output now renders GFM task list checkboxes (- [ ] todo / - [x] done) instead of plain bullets
• Enterprise: added the allowAllClaudeAiMcps managed setting to load claude.ai cloud MCP connectors alongside managed-mcp.json
• Fixed a PowerShell permission bypass: built-in cd functions (cd.., cd\, cd~, X:) changed the working directory undetected, letting a later command read outside the workspace
• Fixed the sandbox write allowlist in git worktrees covering the entire main repository root instead of only the shared .git directory (with hooks/ and config denied)
• Fixed PowerShell prefix/wildcard allow rules (e.g. PowerShell(dotnet.exe build *)) not pre-approving native executables and scripts
• Fixed a permission-analysis gap where the parser trusted stale variable-tracking values for PWD/OLDPWD/DIRSTACK across cd/pushd/popd
• Fixed find in the Bash tool exhausting the macOS system file/vnode table and crashing the host on large directory trees
• Fixed the managed-settings approval dialog leaving the terminal frozen after accepting at startup
• Fixed /ultraplan and remote session creation failing with "Could not capture uncommitted changes" when the working tree has no real changes
• Fixed otelHeadersHelper failing silently when the script path contains spaces; helper failures are now reported in /doctor and the debug log
• Fixed the thinking spinner staying amber across tool calls and onto fresh thinking bursts
• Fixed collapsed Bash output reporting the wrong hidden-line count for outputs with many short lines
• Fixed slash-command argument-hint clipping trailing typed characters when the hint overflows the input box
• Fixed argument-hint and progressive arg suggestions not appearing after Tab-completing a skill whose frontmatter name: differs from its directory basename
• Fixed the status bar showing the user's baseline /effort setting instead of the effort level applied by skill/agent effort: frontmatter
• Fixed Ctrl+O transcript view freezing at the moment it was opened instead of tailing new messages
• Fixed editing a recalled prompt-history entry losing the edit when navigating further up/down with arrow keys
• Fixed /config exit summary reporting phantom changes to auto-compact and theme when toggling unrelated settings
• Fixed /insights crashing when cached session-meta files are missing optional fields
• Fixed malformed PowerShell and History tool calls with missing input being misclassified as reads in transcript collapsing
• Fixed renaming a Remote Control session from claude.ai or the Claude mobile app not updating the local session name for claude --resume
• Fixed a race where a just-submitted prompt could appear twice in the up-arrow history
• Fixed tapping the "Jump to bottom" pill in fullscreen mode not dismissing it immediately
• Improved /feedback reports to include the conversation that happened before context compaction, making issues from earlier in long sessions easier to triage

v2.1.148

Compare Source

• Fixed the Bash tool returning exit code 127 on every command for some users (a regression introduced in 2.1.147)

v2.1.147

Compare Source

• Pinned background sessions (Ctrl+T in claude agents) now stay alive when idle, are restarted in place to apply Claude Code updates, and are shed under memory pressure only after non-pinned sessions
• Renamed /simplify to /code-review. It now reports correctness bugs at a chosen effort level (e.g., /code-review high); pass --comment to post findings as inline GitHub PR comments. The old cleanup-and-fix behavior has been removed
• Improved auto-updater: retries transient network failures, reports specific error categories and OS error codes on failure, and shows the current version when an update fails
• Improved diff rendering performance for large file edits
• Prompt history no longer records consecutive duplicate entries — recalling a prompt with arrow-up and submitting it again won't add another copy
• Fixed enterprise login restrictions (forceLoginOrgUUID and forceLoginMethod managed-settings) not being enforced against third-party-provider and API-key sessions
• Fixed & in ! command output displaying as &, which broke copy-pasting URLs from commands like gcloud auth login on headless machines
• Fixed unknown slash commands silently doing nothing in headless/SDK mode — they now show an error message
• Fixed /help rendering a broken tab header and showing only one command per page on small terminals when not in fullscreen mode
• Fixed shell snapshot dropping user functions whose names start with a single underscore, which broke aliases referencing them
• Fixed plugin agents that declare multiple Agent(...) types in tools: frontmatter dropping all but the last entry
• Fixed hook if conditions like PowerShell(git push*) never matching — only PowerShell(*) worked
• Fixed PowerShell tool dropping output for commands that rely on the default formatter
• Fixed: on Windows, "Yes, and don't ask again" for a PowerShell script invocation now writes a rule that actually matches on subsequent runs
• Fixed PowerShell tool failing on Windows with exit code 1 when pwsh is installed via winget or the Microsoft Store
• Fixed /effort opening with the slider on the wrong level — it now starts at your current effort
• Fixed paginating MCP servers dropping resources, templates, and prompts past page 1
• Fixed full-screen strobing in attached background sessions on Windows Terminal while Claude is streaming
• Fixed: on Windows, removing a background-job worktree no longer follows NTFS junctions into the main repo
• Fixed /background refusing sessions whose only typed input was a skill or custom slash command
• Fixed auto mode suppressing AskUserQuestion when the user or a skill explicitly relies on it; the auto-mode classifier now sees the user's answers as intent signal
• Fixed /theme "New custom theme" and color editor dialogs not responding to Esc
• Fixed an uncaught exception at the end of streaming sessions when running via the Agent SDK
• Fixed a rare hang when waiting for scroll to settle on Windows
• Fixed stale and doubled rows in the agent view list on Windows when background session results contain wide (CJK) characters
• Fixed pasted text being delivered to agents as an unreadable [Pasted text #N] placeholder instead of the actual content
• Fixed plugin component counts in claude plugin details and /plugin being doubled when a plugin's manifest listed paths overlapping its default directories
• Fixed backgrounded sessions re-prompting for tool permissions you already granted with "don't ask again"
• Fixed GNOME Terminal right-click and middle-click paste not inserting text
• Fixed CLAUDE_CODE_SUBAGENT_MODEL not applying to teammate processes spawned by agent teams
• Fixed slash commands followed by a tab or newline being treated as an unknown command
• Fixed several spacing and layout glitches in the /plugin, /status, /mobile, /sandbox, and /permissions menus
• Fixed stripped images prompting the model to repeatedly re-read media that was no longer present

v2.1.146

Compare Source

What's changed

• Renamed /simplify to /code-review with an optional effort level (e.g. /code-review high)
• Auto mode no longer suppresses AskUserQuestion when the user or a skill explicitly relies on it
• Fixed Windows PowerShell tool failing with "command line is invalid" when pwsh is installed via winget or the Microsoft Store (regression in v2.1.124)
• Fixed MCP resources/list, resources/templates/list, and prompts/list dropping items past page 1 on paginating servers
• Fixed full-screen strobing in attached background sessions on Windows Terminal while Claude is streaming
• Fixed the auto-updater status line not showing your current version when an update fails
• Fixed on Windows, removing a background-job worktree no longer follows NTFS junctions into the main repo
• Fixed /background refusing sessions whose only typed input was a skill or custom slash command
• Fixed backgrounded sessions re-prompting for tool permissions you already granted with "don't ask again"
• Fixed /theme color editor and "New custom theme" dialogs not responding to Esc
• Fixed an uncaught exception at the end of streaming sessions when running via the Agent SDK
• Fixed forceLoginOrgUUID and forceLoginMethod managed-settings policies not being enforced against third-party-provider and API-key sessions
• Fixed GNOME Terminal right-click and middle-click paste not inserting text
• Fixed CLAUDE_CODE_SUBAGENT_MODEL not being forwarded to child processes in multi-agent sessions
• Improved auto-updater reliability: native version checks and downloads now retry transient network failures instead of failing immediately
• Improved diff rendering performance for large file edits

v2.1.145

Compare Source

• Added claude agents --json to list live Claude sessions as JSON for scripting (tmux-resurrect, status bars, session pickers)
• Added agent_id and parent_agent_id attributes to claude_code.tool OTEL spans, and fixed trace parenting so background subagent spans nest under the dispatching Agent tool span
• Status line JSON input now includes GitHub repo and PR information when detected
• /plugin Discover and Browse screens now show a plugin's commands, agents, skills, hooks, and MCP/LSP servers before installation
• claude agents terminal tab title now shows the awaiting-input count so an alt-tabbed window tells you when an agent needs attention
• Slash command and @​-mention suggestion list now supports mouse hover and click in fullscreen mode
• Stop and SubagentStop hook input now includes background_tasks and session_crons fields
• Fixed a permission-prompt bypass where bare variable assignments to non-allowlisted environment variables in Bash commands were auto-approved
• Fixed MCP prompt slash commands showing raw server validation errors when a required argument is omitted — the error now names the missing argument and shows expected usage
• Fixed the spinner and elapsed-time display freezing until a keypress after the terminal was resized or refocused
• Fixed the cross-project resume hint failing in default Windows PowerShell 5.1 — Windows now uses ; as the command separator
• Fixed voice push-to-talk not working in the agent view's reply pane
• Fixed task lists rendering in random order when several tasks are created at once
• Fixed stale "Failed to install Anthropic marketplace" banner showing when the marketplace is already installed
• Fixed the PR badge in the footer not updating immediately after gh pr create and other PR-state-changing commands run in-session
• Fixed Agent Teams teammates with non-ASCII names failing every API call due to invalid header encoding
• Fixed /review using a deprecated projectCards GraphQL query that errored on repos with Classic Projects
• Fixed claude plugin validate not flagging skills: entries that point at a file instead of a directory — the error now suggests the parent directory
• Fixed an infinite loop where a skill using context: fork could repeatedly re-invoke itself instead of running
• Improved the Read tool to return a truncated first page with a "PARTIAL view" notice instead of a hard error when a whole-file read exceeds the token limit

v2.1.144

Compare Source

• Added /resume support for background sessions — sessions started via claude --bg or agent view now appear alongside interactive ones, marked with bg
• Added elapsed duration to background subagent completion notifications (e.g. "Agent completed · 3h 2m 5s")
• The /plugin browse and discover panes now show when a plugin was last updated
• /model now changes the model for the current session only; press d in the model picker to set a default for new sessions
• Renamed "extra usage" to "usage credits" across CLI copy; /extra-usage is now /usage-credits (old name still works)
• Fixed startup hanging up to 75s when api.anthropic.com is unreachable (captive portal, firewall, VPN issues) — side-channel API calls now time out after 15s
• Fixed garbled terminal output after a missed window-resize event (e.g. dragging a VS Code split-pane divider) — now self-heals on the next frame instead of requiring Ctrl+L
• Fixed progressive terminal display corruption (stale/garbled glyphs) that could appear in very long sessions and only cleared on terminal resize or restart
• Reduced terminal rendering glitches in VS Code by reducing spinner animation color count
• Fixed macOS background sessions crashing with "exit 1 before init" when the project lives under a Full Disk Access-protected folder (regression in 2.1.143)
• Fixed an unrecoverable conversation when reading a file whose image extension doesn't match its contents (e.g. HTML saved as .png) — now falls back to text
• Fewer spurious tool errors during search: head/tail file views now satisfy the read-before-edit check, and a "no matches" result (exit code 1) from egrep, fgrep, git grep, or git diff is no longer reported as a command failure
• Fixed /branch failing with "No conversation to branch" after entering a worktree or in some background sessions
• Fixed pressing Escape in the AskUserQuestion notes field aborting the turn instead of returning to answer selection
• Fixed model selection not applying when changed via the IDE model picker or applyFlagSettings after startup
• Resumed sessions now keep the model they were using instead of picking up another session's /model choice
• Fixed Bedrock and Vertex users unable to select "Opus (1M context)" from the /model picker (regression in v2.1.129)
• Fixed remote-session login failing with "Can't access this organization" for users with forceLoginMethod and forceLoginOrgUUID set
• Fixed MCP servers with paginated tools/list responses only returning the first page, silently dropping tools
• Fixed MCP images with unsupported MIME types (e.g. SVG) breaking the conversation — now saved to disk and referenced in the tool result
• Fixed file descriptor exhaustion when a build runs inside a skill directory — non-.md files no longer trigger skill reloads
• Fixed session title being generated from plugin monitor output instead of the user's first prompt
• Fixed Skill tool failing with permission error in headless mode (regression in v2.1.141)
• Fixed plugins enabled in your own settings showing "not cached" errors after first load on a fresh machine; plugins enabled only by a project's .claude/settings.json now show an actionable claude plugin install hint
• Fixed claude mcp list silently reporting no servers when .mcp.json can't be parsed (e.g. using VS Code's "servers" key instead of "mcpServers") — now shows configuration errors
• Fixed background side-queries on custom ANTHROPIC_BASE_URL setups and Bedrock Mantle not using Haiku — now falls back correctly when a first-party API key is configured or no Haiku model is set
• Fixed scrolling in attached background sessions on Windows — PgUp/PgDn, mouse wheel, and Ctrl+O transcript navigation now work
• Fixed a crash when closing the terminal while attached to a background session
• Fixed on Windows, pressing ← in claude agents leaving the list unresponsive to keyboard input
• Fixed ghost characters at the left edge when switching panes in Agent View on Windows Terminal with CJK content
• /bg and ←-detach now preserve directories added via `/add-d

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.