Claude Code 2.1.316 继续收紧托管策略边界

2026-08-17 · 2.1.234 (2026-08-17, in-window): rejects Windows NT-namespace (\??\) paths across remote file reads, session restore, CLAUDE.md includes, workflow scripts and uploads — hardens pre-approval file accesses against the NTLM credential-leak vector; GitLab MR footer badge (draft/pending/green states, glab repos); auto-continue sessions when usage limit resets (toggle in /config); claude-api skill context cost cut from ~200k+ to ~25k tokens; selection:clear keybinding; CLAUDE_CODE_PROJECT_DIR_NAME env var; many Remote Control / permission-preview / TUI fixes.

2026-08-18 · 2.1.235 (2026-08-18, in-window): security-relevant fix — Shift+Tab in the permission prompt's comment field no longer wrongly grants session-wide edit permission; new optional `spellcheck` setting (aspell/hunspell/ispell); fix for whole-prompt-cache invalidation when a language server disconnects mid-session; nested markdown list misalignment fix (depth 3+); lower memory/CPU usage for background cloud sessions (/ultrareview); permission dialogs now display exactly what a grant covers; VS Code focus fix after window restore. Recommendation stays ADOPT; upgrading also picks up the 2.1.234 NTLM hardening.

2026-08-19 · 2.1.236 (2026-08-19, in-window): `notify_when_idle` option added to cross-session SendMessage — one session can request a single notice when another goes idle (macOS/Linux), extending the inter-agent messaging primitive with idle-awareness; new ANTHROPIC_DEFAULT_MODEL env var sets the starting model for new sessions (/model pick still overrides and persists); macOS sandbox hardening — wildcard read-deny rules like **/.env now take precedence inside allowed regions and resist rename-based bypass; /goal idle sessions auto-check-in after 30 minutes behind long background work; /usage gains a usage-credits row (Team/Enterprise); fixes: clipboard/background tasks breaking after session-directory removal, fullscreen renderer permanently failing after one bad start, /model picker overflow on tall terminals, various fullscreen/tmux rendering issues. Recommendation stays ADOPT.

2026-08-20 · 2.1.237 + 2.1.238 (both 2026-08-20, in-window). 2.1.237: fixed prompt caching for sessions using an LLM gateway or custom base URL (directly relevant to gateway deployments); added a built-in 'Concise' output style ('Claude leads with results and skips preamble and narration') selectable via /config. 2.1.238: fixed unbounded memory growth in long interactive sessions — subagent tool results are now freed after leaving the recent display window, directly relevant to long-running multi-agent sessions; plugin marketplaces gained `headersHelper` for URL marketplaces/catalog entries (mints short-lived HTTP headers such as tokens for catalog and same-origin archive fetches, shown to the user first with [y/N] confirmation, no inherited credential env vars) — private/enterprise plugin distribution; self-hosted runner `--defer-shutdown-max-min` (keep serving attached sessions on SIGTERM, then park and exit) and `--proxy-authorization-command`/`--proxy-authorization-file` for proxies needing a fresh Proxy-Authorization header per connection; numerous Remote Control fixes (mid-turn messages vanishing from transcripts, model picks on phone/web not updating the terminal, 'login expired' on brief network hiccups now retries, crashed-session reuse, env-var leaks, per-task Stop, ListAgents/SendMessage wrongly reporting 'not connected' in server mode); cross-session messaging hardening (refused inboxes now report 'refused'; rate-limited/dropped messages notify the sender instead of vanishing); MCP fixes (stdio servers no longer receive server/discover before initialize — lazy servers no longer start on every open; elicitation dialogs fixed for URLs over 4,096 chars; disabled servers listed without health-checking). Recommendation stays ADOPT.

2026-08-21 · 2.1.239 (2026-08-21T17:18Z, in-window). Cost/estimation: /cost, the status line and --max-budget-usd now include the 1.1x US-only-inference premium for data-residency workspaces; the usage-limit message now states when the session or weekly limit resets. Bedrock: fixed streaming behind proxies that strip the response Content-Type header (which silently doubled billed API calls by re-running every turn non-streaming) and fixed startup hangs behind an HTTPS proxy with SSO profiles + awsAuthRefresh. Cloud sessions: plugins synced from claude.ai now show as name@synced and work with `claude plugin enable/disable <name>@synced` (never overriding a same-named locally installed plugin); fixed remote MCP servers staying failed after a transient 5xx on mid-session reconnect; fixed resuming out of plan mode after an idle worker restart. Multi-agent/messaging refinements (same primitive family, not new primitives): ListAgents now lists live teammates and tells a session its own peer name; SendMessage to your own name now says so; fixed sessions titled with a leading / being unaddressable; fixed runaway Remote Control session-title syncing (2.1.232 regression). /goal: repeat check-ins on long-running background work now back off (30 min -> 1 h -> 2 h); `claude --resume` restores the active goal. Also: Alpine/musl native add-ons (paste/clipboard/audio), `/claude-api upgrade` for anthropic 0.x -> 1.x Python migration, MCP elicitation form scroll fix in fullscreen, OpenTelemetry trace-fragmentation fix for hook-deferred tool calls, vim-mode agent-view Escape fix. Recommendation stays ADOPT.

2026-08-22 · 2.1.240 (2026-08-22T13:03Z) + 2.1.241 (2026-08-22T23:58Z), both in-window. Both entries in the official changelog read only 'Bug fixes and reliability improvements' - no new primitives or documented behavior changes; npm publish timestamps (@anthropic-ai/claude-code) serve as release evidence. Two same-day patch releases after 2.1.239's Bedrock double-billing fix; recommendation stays ADOPT.

2026-08-24 · Recovered from index (previous run wrote the update note to index/events.json only): 2.1.242 (19:16Z, no changelog entry) + 2.1.243 (23:10Z): /usage Loops breakdown, modelPicker setting, promptCacheTtl + subagentPromptCacheTtl settings (1h main / 5m subagent), modelPricing managed setting (contracted rates into /cost), keyless Console sign-in

2026-08-25 · Recovered from index (previous run wrote the update note to index/events.json only): 2.1.245 (04:45Z): glibc 2.44 startup-crash fix; 2.1.246 (19:17Z): Auto-mode rules tab in /permissions, startup warning for wildcard-before-subcommand Bash allow rules, MCP tool-arg typing fix (empty-schema {}), transcript rendering perf fixes

2026-08-26 · Recovered from index (previous run wrote the update note to index/events.json only): 2.1.247 (18:02Z): SendFeedback tool, /claude-api cost-optimize (profile API spend across caching/token hygiene/batch/effort/model choice), sub-agent fallback model chain on 404, Sonnet 5 default auto-compact window to full 1M, cross-session peer messages collapse to one-line preview

2026-08-27 · Recovered from index (previous run wrote the update note to index/events.json only): 2.1.248 (20:35Z): --restricted confinement mode (strips exec/WebFetch tools, working-directory confinement, refuses bypassPermissions), per-agent experimental.cacheTtl, cross-session messaging (SendMessage/ListAgents) extended to Bedrock/Vertex/Foundry + telemetry-off, hourly OAuth-refresh prompt-cache-miss fix, Workflow tool prompt 5.7k->1k tokens, /usage-credits for Enterprise; 2.1.250 (22:27Z): bug fixes only

2026-08-28 · 2.1.251 (2026-08-28T15:34:26Z npm, in-window; sole release of the day). New: PreModelSwitch / PostModelSwitch hook events (block, confirm or annotate a model switch); SessionStart resume hooks now receive session staleness and estimated re-cache cost; live streaming of a foreground subagent's tool calls and results to Remote Control clients (background subagents still show status only); spend-limit bar in /usage plus rate_limits.spend_limit status-line field; per-session prompt-cache line in /cost (hit ratio, misses, tokens re-cached, warm/cold) with a prompt_cache object for status line scripts; claude attach/logs/stop/respawn/rm surfaced in --help. Security fixes: file tools following a symlink swapped inside the working directory after the permission check (read/write outside approved location); plugin marketplace commands pointing outside the plugin directory rejected as path traversal; Grep/Glob not applying Read(...) deny rules through symlinked search paths; Workflow tool reading scriptPath outside readable scope before the permission check; project settings can no longer enable detailed beta tracing or raw API body logging or bypass a managed OTLP collector. Multi-agent fixes: teammate final answers now reach the team lead in the idle notification; background subagents can reply to unnamed sibling/parent agents; framing tells Claude that own-subagent senders are workers inside this session. Recommendation stays ADOPT.

2026-09-02 · 2.1.252 (8/31T17:07Z): bug fixes (Bash task-output-swap failure on some Macs, always-allow saving without settings.local.json, Remote Control stalls on degraded connections, oversized failure-output notifications). 2.1.257 (9/1T17:15Z): Claude Fable 5.1 (claude-fable-5-1) added and made the default Fable model (1M context, $10/$50 per Mtok, $0.25/Mtok cache reads); Containment Escape rule in auto mode — cloud metadata-credential fetches, egress evasion and cross-tenant reach no longer auto-approved; one-time prompt before first file read outside working directories with optional permissions.blockReadsOutsideWorkingDirectories; CLAUDE_CODE_SUBAGENT_MODEL_FORCE; plugins can no longer read outside their directory via symlinked component paths; Remote Control consent fix (dismissal no longer counts as consent); subagents auto-continue after mid-stream cutoffs; Proactive-style sessions stop busy-looping. 2.1.258 (9/1T22:25Z): fixed launch failure on macOS 12 (regression from 2.1.255) and remote/scheduled sessions failing with empty user messages after a re-sent permission approval

2026-09-04 · 2.1.259 (9/2T21:21Z): managedMcpServers managed setting (org pushes HTTP/SSE MCP servers to every user), --permission-prompts none for unattended headless hosts (auto-deny anything that would prompt), glab MR recognition, plugin validate --json; fixes incl. concurrent sessions silently reverting each other's ~/.claude.json, Bash Read() deny-rule gaps (option values, git diff/grep operands, cd DIR && cat compounds), OAuth-refresh prompt-cache invalidation with telemetry off, managed-settings parse failure now refuses startup. 2.1.260 (9/3T22:32Z): /diff side panel; prompt-cache miss diagnostics in /cost + status bar; security fixes (Edit/Write/Read rules with brackets in paths were dropped — 'read-only' folders writable; uncompilable pattern failing every edit; zsh REPORTTIME/REPORTMEMORY assignments hiding command substitution from auto-approve); Fable 5.1 model-picker + [1m]-tag agents silently running 200K windows fixed; tool-result prompt-cache fix on Fable 5.1; subagent 1h background-command limit removed; 1M-context auto-compact improvements. 2.1.261 (9/4T17:49Z): /status org-policy row; bashOutputMaxChars/taskOutputMaxChars (inline up to 128K chars); --append-subagent-system-prompt-file; /skill-doctor (unused skills + context cost); Bedrock wizard hang fix; Remote Control fixes; rm -rf prompt now catches positional args and quoted sh -c; agent-team second-round announcement re-send (cache miss) fix. Captured 2026-09-05 run

2026-09-13 · 2.1.270 released 2026-09-12T18:52:44Z (npm): single hotfix - read-only git commands in Bash no longer unexpectedly request permission after the session has been running for a while (regression introduced in 2.1.269). No other documented changes.

2026-09-24 · Claude Code 2.1.280/281: Opus 5.5 default, symlink-write hardening, OTel detail, Bedrock role/guardrail gateway controls and stricter auto-mode review; stays ADOPT

2026-09-26 · Claude Code 2.1.282: managed-policy fail-safe fixes, approval replay hardening, session recovery and gateway failover resilience; stays ADOPT

2026-09-27 · Claude Code 2.1.283: exact model allow/deny controls, prompt-level gateway correlation, fail-closed sandbox parsing, Windows destructive-command protection and restart-safe cloud sessions; stays ADOPT