Updates: #Claude Code.

[PATCH] Claude Code 2.1.223 · A Bash permission bypass where a crafted command could hide parts of itself from permission checks is fixed, along with permission prompts where tabs or invisible Unicode could hide part of the command from the approval dialog. Workflow scripts can no longer use dynamic import() to run code outside the workflow sandbox, and an agent definition's bypassPermissions mode no longer ignores the org bypass-permissions disable policy. The strictKnownMarketplaces and blockedMarketplaces managed settings now accept owner wildcard entries ("owner/*"), and cloud sessions show a /teleport hint for continuing locally with claude --teleport <session id>. CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K, and /review is an alias of /code-review.

[PATCH] Claude Code 2.1.222 · Worktree-isolated sessions and their subagents could run destructive git commands against the main checkout — isolation now applies to file edits and Bash in every session type, and PreToolUse auto-allow hooks no longer bypass tool restrictions in background agent tasks. In auto mode, messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch. Remote Control auto-start can no longer be turned on by repo-local settings (they can still turn it off) — enable it at user scope via /config — and the ultraplan feature is removed. Also fixed: the startup connectivity check hanging behind an HTTPS proxy, and /usage overattributing usage to MCP servers.

[PATCH] Claude Code 2.1.221 · The VS Code extension gains Focus view, a chat-menu toggle that hides tool activity behind an expandable per-turn summary. Sandbox credential files on Linux and WSL support `mode: "mask"`, where sandboxed commands read a sentinel copy while the sandbox proxy substitutes the real value on egress. Two permission-check bypasses are fixed: zsh executing hidden commands in `[[ ]]` regex conditionals, and PowerShell checks mishandling paths with quote characters on Windows. Background sessions now commit and push to preserve work and open a draft PR only when the task calls for one, and plugins installed from `/plugin` activate immediately when safe instead of always requiring `/reload-plugins`.

[PATCH] Claude Code 2.1.219 · Claude Opus 5 (`claude-opus-5`) is now the default Opus model, with 1M context and fast mode at $10/$50 per Mtok. `/fast` now applies to Opus 5 and Opus 4.8, and Opus 4.7 is out of fast mode. Subagents can spawn nested subagents up to depth 3 by default, and dynamic workflows default to a medium size guideline that aims for fewer than 15 agents. The release also adds `sandbox.network.strictAllowlist` to deny non-allowlisted hosts for sandboxed commands without prompting, a `DirectoryAdded` hook that fires when a working directory is registered mid-session, and fixes `claude -p` dropping the answer it had already produced when a turn dies on a mid-stream API error.

[NEW] Claude Opus 5 · Anthropic introduced Claude Opus 5 on July 24, 2026, for complex agentic coding and enterprise work. It is priced at $5 per million input tokens and $25 per million output tokens, the same as Opus 4.8, with the model ID claude-opus-5, a 1M token context window, and 128k max output tokens. Adaptive thinking is now on by default, effort runs up to max, and two betas ship alongside it: mid-conversation tool changes and automatic fallbacks. It is the new default model on Claude Max and the strongest model on Claude Pro.

[PATCH] Claude Code 2.1.218 · `/code-review` now runs as a background subagent, so review work no longer fills your conversation and stacked slash commands stay as its review target. `/ultrareview` no longer fails on descriptive arguments like "review my auth changes", and `/code-review ultra` no longer silently runs a local review in non-interactive sessions — it launches the cloud review. Auto mode now lets the classifier adjudicate the dangerous-rm, background-`&`, and suspicious-Windows-path checks instead of opening permission dialogs, and skills with `context: fork` run in the background by default. The release also fixes Windows `\u`-prefixed paths corrupting into CJK characters, the left arrow key discarding the conversation with no undo, and a retry loop that re-sent identical doomed requests after a context-overflow error, alongside a large batch of session, input, and accessibility fixes.

[PATCH] Claude Code 2.1.217 · Emoji shortcode autocomplete lands in the prompt input (`:heart:` → ❤️), and warnings now surface when transcript writes fail silently or session saving is off. To rein in runaway subagents, concurrent runs are capped by default (20), nested spawning is off by default, and `--max-budget-usd` now halts background subagents at the cap. Fixes cover corporate mTLS, proxy, and OAuth settings being ignored in Claude Desktop, auto-compact on Opus 4.8 over Bedrock, a memory leak that kept truncated MCP outputs in memory, and Windows auto-updates that could leave `claude.exe` missing.

[NEW] The iOS Simulator pane comes to Claude Code Desktop (public beta) · Claude Code Desktop opens your app in an iOS Simulator pane when Claude builds, runs, or checks it, streaming the device screen live next to your conversation. Watch Claude install and tap through the app to verify its own changes, or tap through it yourself. It's in public beta on macOS, available on Pro, Max, and Team plans.

[PATCH] Claude Code 2.1.216 · A new sandbox.filesystem.disabled setting skips filesystem isolation while keeping network egress control. A slowdown in long sessions — where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes — is fixed, along with worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE, and workflow saves and scheduled-task writes following a symlink at .claude that could redirect writes outside the project. A large batch of session, permission, and worktree regressions also lands, including auto mode denying commands with HTTP 401 classifier errors after the OAuth token rotated mid-session and AskUserQuestion acting against your answer's intent.

[PATCH] Claude Code 2.1.214 · A release centered on permission-check hardening. Single-segment rules like `Edit(src/**)` that auto-approved writes to nested `dir/` directories anywhere in the tree, a permission-check bypass in Windows PowerShell 5.1 sessions, and Bash permission checks misjudging file-descriptor redirects and very long commands (over 10,000 characters) all now fail closed. A new EndConversation tool lets Claude end sessions with highly abusive users or jailbreak attempts, and long-running tool calls get a periodic progress heartbeat. Background daemon and session lifecycle, Windows PowerShell tool reliability, and streaming/proxy fixes round out the release.

[PATCH] Claude Code 2.1.212 · To stop runaway loops, this release adds per-session caps on web searches (default 200) and subagent spawns (default 200). `/fork` now copies your conversation into a new background session while the old in-session subagent moves to `/subtask`, and MCP tool calls running longer than 2 minutes move to the background automatically. Fixes land for plan mode auto-running file-modifying Bash commands without a permission prompt, a `continue:false` hook's halt being dropped, and several session-resume regressions.

[PATCH] Claude Code 2.1.211 · A new --forward-subagent-text flag (and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT env var) includes subagent text and thinking in stream-json output. This is a stabilization-focused release: it fixes a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request, stops auto mode from overriding a PreToolUse hook's ask decision for unsandboxed Bash, and neutralizes look-alike characters in permission previews relayed to chat channels. always allow rules now save at the repository root so approvals persist across worktrees, and a batch of background-agent reliability issues around respawning, deletion, and result reporting are cleaned up.

[PATCH] Claude Code 2.1.208 · A screen reader mode (`--ax-screen-reader`) adds opt-in plain-text rendering, a `vimInsertModeRemaps` setting maps two-key insert-mode sequences like `jj` to Escape, and `CLAUDE_CODE_PROCESS_WRAPPER` routes every self-spawn through a required corporate launcher. Several long-session memory leaks (MCP stderr, LSP documents, tool-result payloads) and transcript size (up to 79x in edit-heavy sessions) are cut down, and fixes land for the context window resetting to 200k after an auto-update (false "100% context used"), truncated stream-json output when piping large responses from `claude -p`, and a 2.1.207 regression where Bedrock auth failed for AWS SSO profiles.

[PATCH] Claude Code 2.1.207 · Auto mode is now available without the `CLAUDE_CODE_ENABLE_AUTO_MODE` opt-in on Bedrock, Vertex AI, and Foundry (disable via `disableAutoMode`), and Bedrock, Vertex, and Claude Platform on AWS now default to Claude Opus 4.8. Fixes land across streaming, permissions, Remote Control, and Bedrock — including terminal freezes while streaming very long lists, tables, or code blocks, remote managed settings from a non-interactive run being recorded as consented without ever showing the consent dialog, and `/usage-credits` amount inputs silently stripping malformed values to digits.

[PATCH] Claude Code 2.1.206 · `/doctor` gained a check that proposes trimming checked-in CLAUDE.md files by cutting content Claude could derive from the codebase, and `/cd` now suggests directory paths like `/add-dir`. Fixes include an expired login failing every model with a misleading error, MCP servers configured via `--mcp-config` or `.mcp.json` ignoring a per-server `request_timeout_ms` and timing out at 60s, and `claude --resume` / `--continue` not responding to keyboard input on startup, alongside several login, MCP, session-resume, and `/model` picker fixes.

[PATCH] Claude Code 2.1.205 · Auto mode gains a rule that blocks tampering with session transcript files and now asks before running `rm -rf` on a variable it can't resolve from context. Background agents and the agent view report session state more accurately, and `/doctor` becomes a full setup checkup that can diagnose and fix issues (`/checkup` alias). Auto-update binary downloads stream to disk instead of buffering in memory, cutting peak memory by roughly 400 MB, alongside fixes for Windows worktree removal deleting files outside the worktree, a message lost at the `--max-turns` limit, and `--json-schema` silently producing unstructured output on an invalid schema.

[PATCH] Claude Code 2.1.203 · This release focuses on background agent and session reliability. Background sessions that became permanently unresponsive when the daemon's session token went stale now recover automatically, returning to claude agents no longer silently stops running subagents or re-runs the prompt from scratch, and background agents no longer inherit a stale PATH or drop a shell-exported ANTHROPIC_BASE_URL, which had caused missing tools and 401 errors. Git worktree isolation also improves — Bash no longer fails in repos with many worktrees and worktree-isolated subagents run in their own checkout — alongside a new login-expiry warning and a grey ⏸ badge for manual permission mode.

[PATCH] Claude Code 2.1.202 · Adds a "Dynamic workflow size" setting in `/config` to control how large Claude makes dynamic workflows, plus `workflow.run_id` and `workflow.name` OpenTelemetry attributes so a workflow run can be reconstructed from OTel data. Fixes a batch of Remote Control issues (commands failing with "Unknown command", uncaptioned images and files silently dropped, wrong permission mode), slow session resume in repositories with many git worktrees, and re-invoking an already-loaded skill duplicating its instructions in context. `/review <pr>` is back to a fast single-pass review.

[PATCH] Claude Code 2.1.200 · AskUserQuestion dialogs no longer auto-continue by default; opt into an idle timeout via `/config`. The "default" permission mode is now called "Manual" across the CLI, `--help`, VS Code, and JetBrains, with `--permission-mode manual` and `"defaultMode": "manual"` accepted alongside `default`. Many background bugs were fixed, including sessions silently stopping after sleep/wake and background agents never starting again after a crash left a stale `daemon.lock` whose PID the OS reused, plus improved screen-reader output.

[PATCH] Claude Code 2.1.199 · Stacked slash-skill invocations now load all leading skills (up to 5), and transient server rate-limit errors unrelated to your usage limit are retried automatically with backoff for subscribers. SSL certificate errors from TLS-inspecting proxies or expired certs now fail immediately with actionable guidance instead of burning retries, and streaming responses cut off mid-stream keep their partial output. Many background task and subagent bugs were fixed, including the Linux background-agent daemon killing itself every ~50 seconds and subagents reporting API errors as successful results.

[PATCH] Claude Code 2.1.198 · Claude in Chrome is now generally available, background agents that need input or finish now fire the Notification hook, and a new `/dataviz` skill provides chart and dashboard design guidance. Background agents launched from `claude agents` now commit, push, and open a draft PR when they finish worktree code work, and the built-in Explore agent inherits the main session's model (capped at opus) instead of running on haiku. Many bugs were fixed, including brief network drops aborting a turn and background tasks getting stuck on 'Running' after they finish.

[PATCH] Claude Code 2.1.197 · Claude Sonnet 5 is now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31, 2026. Update to version 2.1.197 for access.

[NEW] Introducing Claude Sonnet 5 · Anthropic released Claude Sonnet 5 on June 30, 2026, an agentic model that approaches Opus 4.8 performance at lower prices. It can make plans, use tools like browsers and terminals, and run autonomously, with benchmark gains over Sonnet 4.6 across coding, reasoning, tool use, and knowledge work. The model ID is claude-sonnet-5; it is the default model for Free and Pro plans and is available in Claude Code, the Claude Platform, and the Claude API.

[PATCH] Claude Code 2.1.196 · Organization admins can now set a default model that shows as 'Org default' in `/model`, sessions get readable default names at start, and chat file attachments are Cmd/Ctrl-clickable to reveal them in Finder/Explorer. Background sessions and agents are far more reliable — long-running commands and workflows now survive the process being stopped, restarted, or updated, and workers killed by a daemon restart auto-resume. Fixes include waking a background job no longer deleting its conversation, several `claude agents` side panel issues, and `/context` showing 0 tokens for all tool groups on Bedrock.

[NEW] Introducing the Claude apps gateway — centrally manage Claude Code on Amazon Bedrock and Google Cloud · The Claude apps gateway is a self-hosted control plane for managing Claude Code deployments on Amazon Bedrock and Google Cloud. It provides corporate SSO sign-in, centrally managed settings enforced on every request, and per-user cost attribution, and ships as a stateless container within the existing claude binary. It supports OIDC-based authentication, control over allowed models, and spend caps per organization, group, or user.

[PATCH] Claude Code 2.1.195 · A new CLAUDE_CODE_DISABLE_MOUSE_CLICKS environment variable disables mouse click, drag, and hover in fullscreen mode while keeping wheel scroll. Hook matchers with hyphenated identifiers (code-reviewer, mcp__brave-search) that accidentally substring-matched now exact-match, and voice dictation fixes cover macOS capturing silence after the default input device changes plus auto-submit never firing for languages written without spaces (Japanese, Chinese, Thai). Background agent fixes address jobs disappearing from claude agents when written by a newer version, blank screens when reopening crashed tasks, and daemons running unreachable when the control socket fails to start.

[PATCH] Claude Code 2.1.193 · A new autoMode.classifyAllShell setting routes all Bash/PowerShell commands through the auto-mode classifier, and a claude_code.assistant_response OpenTelemetry log event now carries the model's response text. Bash mode (!) gains live file path autocomplete, and a startup notice points at /mcp when MCP servers need authentication. A cluster of backgrounding and agent-panel regressions gets cleaned up — backgrounding (←←) no longer spuriously cancels when all tasks carry over, and a phantom subagent that re-ran the main conversation is gone. Note that the assistant_response log starts capturing response content on upgrade for deployments that already log prompts.

[PATCH] Claude Code 2.1.191 · `/rewind` now supports resuming a conversation from before `/clear` was run. CPU usage during streaming responses drops by ~37% by coalescing text updates to 100ms, and sandbox network hosts you allow with "Yes" are remembered for the rest of the session instead of re-prompting on every connection. MCP capability discovery and OAuth now retry transient network errors, and a batch of bug fixes lands: stopped background agents no longer resurrect, and hooks with comma-separated matchers (e.g. "Bash,PowerShell") no longer silently fail to fire.

[PATCH] Claude Code 2.1.187 · A security- and stability-focused release. A new sandbox.credentials setting blocks sandboxed commands from reading credential files and secret environment variables, org-configured model restrictions now apply to the model picker, --model, /model, and ANTHROPIC_MODEL, and select menus gain mouse click support in fullscreen mode. Remote MCP tool calls that hung with no response for 5 minutes now abort with an error instead of blocking indefinitely, alongside fixes for mojibake on pasted Korean/CJK text, --resume failing on empty -p runs, and a batch of resume, remote, and terminal stability issues.

[PATCH] Claude Code 2.1.186 · New claude mcp login and claude mcp logout commands authenticate MCP servers from the CLI without opening the interactive /mcp menu, with --no-browser stdin redirect for completing over SSH. ! bash commands now trigger Claude to respond to the output automatically (set respondToBashCommands: false to keep the previous context-only behavior), and /workflows gains status filtering (f) plus a Skills section in the /plugin Installed tab. Background subagents now surface permission prompts in the main session instead of auto-denying, Agent(type) deny rules are now enforced for named subagent spawns, streaming requests no longer fail with "Content block not found" after the machine wakes from sleep, and several claude agents display issues are fixed.

[PATCH] Claude Code 2.1.183 · Auto mode safety is tightened: destructive git commands (`git reset --hard`, `git clean -fd`, and more) and `terraform destroy`/`pulumi destroy`/`cdk destroy` are now blocked unless you asked to discard work or named the specific stack. A warning now flags deprecated or auto-updated models, an `attribution.sessionUrl` setting omits the claude.ai session link from commits and PRs, and `/config --help` lists the shorthand keys. Fixes land for `thinking.disabled.display` 400 errors on subagent spawns, WebSearch returning empty results in subagents, fullscreen TUI corruption in Windows Terminal, and background tasks being killed when a teammate finishes a turn.

[NEW] Claude Code now supports artifacts — turn session work into live web pages · Claude Code can now turn session work into artifacts — live, shareable web pages built from full session context. Ask for a PR walkthrough, dashboard, or incident timeline, and the open page refreshes in place when Claude Code updates it. Artifacts are private by default and viewable only by authenticated members of your org, available in beta for Claude Team and Enterprise orgs.

[PATCH] Claude Code 2.1.181 · A new `/config key=value` syntax sets any setting straight from the prompt (e.g. `/config thinking=false`), working in interactive, `-p`, and Remote Control. A `CLAUDE_CLIENT_PRESENCE_FILE` environment variable suppresses mobile push notifications while you're at the machine, the bundled Bun runtime moves to 1.4, and long paragraphs now stream line-by-line instead of waiting for the first line break. A large batch of fixes lands across startup (a ~120ms regression, a 15-second blank-terminal hang), Write/Edit producing 0-byte files on network drives, prompt caching not reading on custom `ANTHROPIC_BASE_URL` and Foundry, macOS error -600 auth failures, and terminal rendering.

[NEW] Claude Design now stays on brand for daily work · Claude Design now imports your design system — from GitHub repos, design files, or raw uploads — so Claude builds with your components and validates against your system. New /design-sync and /design commands connect it to Claude Code, the editor gains rich layout controls and hundreds of stability fixes, usage limits are now shared with chat, Claude Cowork, and Claude Code, and connectors expand to Adobe, Base44, Canva, Gamma, Lovable, Miro, Replit, Vercel, and Wix.

[PATCH] Claude Code 2.1.179 · Mid-stream connection drops now preserve partial responses instead of showing a raw error, and the spinner no longer gets stuck at "running tool". This release also fixes a WSL2 mouse-wheel scrolling regression from 2.1.172, a sandbox denyRead/allowRead glob over a large directory tree that made the Bash tool description enormous and froze Linux sessions, and the welcome screen stacking multiple promotional banners, alongside improved plugin loading performance in remote sessions.

[PATCH] Claude Code 2.1.178 · Permission rules gain `Tool(param:value)` syntax (with `*` wildcard) to match a tool's input parameters — e.g. `Agent(model:opus)` to block Opus subagents. Skills in nested `.claude/skills` directories now load automatically when working on files there, and on a name clash the nested one is exposed as `<dir>:<name>` so both stay available. Plus a wide round of fixes — a CLI OOM crash when a parent process leaks a stale websocket/OAuth file-descriptor env var, `claude agents` workers failing with `401 Invalid bearer token` under custom API gateways, compaction not honoring `--fallback-model`, and MCP server-level specs in subagent `disallowedTools` being silently ignored.

[PATCH] Claude Code 2.1.176 · Session titles are now generated in the language of your conversation, and a new `footerLinksRegexes` setting adds regex-matched link badges to the footer. Bedrock credentials from `awsCredentialExport` are cached until their `Expiration` instead of a fixed hour. Plus a wide round of fixes — `ANTHROPIC_DEFAULT_*_MODEL` redirecting alias picks to blocked models, auto mode failing on Fable 5 for orgs without Opus 4.8, hook `if` conditions like `Edit(src/**)` not matching, and regressions across Remote Control, background sessions, and agents.

[PATCH] Claude Code 2.1.174 · The VS Code `/usage` dialog now breaks down usage by cache misses, long context, subagents, and per-skill/agent/plugin/MCP attribution. The `/model` picker no longer hides the model family that Default resolves to — Opus, Sonnet, and pay-as-you-go API rows now appear correctly. Regressions across models, auth, and background sessions are fixed, including Bedrock GovCloud regions deriving the wrong inference profile prefix and background sessions inheriting another session's `ANTHROPIC_*` provider env.

[PATCH] Claude Code 2.1.172 · Sub-agents can now spawn their own sub-agents up to 5 levels deep. Amazon Bedrock reads the AWS region from ~/.aws config files when AWS_REGION isn't set, matching AWS SDK precedence, and a search bar lands when browsing a marketplace's plugins in /plugin. Sessions using 1M context without usage credits no longer get permanently stuck — they automatically compact back under the standard context limit. A batch of model-selection fixes also lands: availableModels restrictions now apply to subagent model overrides and the dispatch model picker, and WebFetch(domain:*.example.com) wildcard domain rules now actually match subdomains.

[PATCH] Claude Code 2.1.169 · The new `--safe-mode` flag (and `CLAUDE_CODE_SAFE_MODE` env) starts Claude Code with all customizations (CLAUDE.md, plugins, skills, hooks, MCP servers) disabled for troubleshooting, and `/cd` moves a session to a new working directory without breaking the prompt cache. `disableBundledSkills` (and `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS`) hides bundled skills, workflows, and built-in slash commands from the model. Fixes for enterprise managed MCP policies (`allowedMcpServers`/`deniedMcpServers`) not being enforced on reconnect or IDE-typed configs, Up/Down arrows jumping past wrapped rows of a long input, a 30-50ms per-turn UI stall on macOS with claude.ai credentials, and `claude -p` being slow on Windows (regression in 2.1.161) also land.

[NEW] Claude Opus 4.8 · Claude Opus 4.8 builds on Claude Opus 4.7 with improvements across benchmarks and is a more effective collaborator, available today for the same price. It targets long-horizon agentic coding with better long-context handling and compaction recovery, more reliable effort calibration, and better tool triggering. The model ID is claude-opus-4-8; it supports the 1M token context window by default on the Claude API, Amazon Bedrock, and Vertex AI, with 128k max output tokens.

[NEW] Dynamic workflows in Claude Code · Claude breaks a problem into subtasks and fans them out across tens to hundreds of subagents running in parallel, dynamically writing orchestration scripts that run in a single session and checking its work before anything reaches you. It targets broad work like codebase-wide bug hunts and security audits and large migrations spanning thousands of files, verifying each result before folding it into the final answer. Available as a research preview on Max, Team, and Enterprise plans.

[NEW] Agent view in Claude Code · Agent view is a centralized interface inside the Claude Code CLI for managing multiple concurrent agent sessions. Now in Research Preview, it lets developers see which agents need input, are actively working, or have completed tasks — and scale up background work via peek, `/bg`, and `claude --bg`.

[NEW] Claude Opus 4.7 · A new Opus model with significant gains in coding, high-resolution vision, and instruction following. Claude Code adds /ultrareview and the xhigh effort level.

[NEW] Routines — automated Claude Code workflows · Autonomous routines in Claude Code triggered by schedules, API calls, and GitHub events. Run code review, bug fixes, and deploy verification from the cloud — laptop closed.

[NEW] Claude Code Remote Control · Keep a local Claude Code session running and control it from claude.ai/code or the mobile apps — with your local files, MCP servers, and tools intact.