Claude Code v2.1.248 发布：新增受限模式与跨会话消息功能

更新内容

• 新增 --restricted（或 CLAUDE_CODE_RESTRICTED=1）：移除可运行命令或代码的内置工具以及 WebFetch（除非在 --tools 中明确指定），将文件工具限制在工作目录内，拒绝 bypassPermissions，并忽略用户、项目和本地设置文件。
• 在 Agent frontmatter 中新增 experimental.cacheTtl（"5m" 或 "1h"）：当未配置子 Agent TTL 设置时，用于每个 Agent 的提示词缓存 TTL。
• 新增 claude self-hosted-runner --client-label <label>（或 SELF_HOSTED_RUNNER_CLIENT_LABEL），用于覆盖 Runner 注册时使用的标签（默认值：主机名）。
• 新增服务端托管设置诊断：设置加载失败时会在启动阶段显示警告；/doctor 和 /status 会说明加载失败的原因，或解释为何未获取设置（Bedrock/Vertex/第三方提供商、自定义 ANTHROPIC_BASE_URL）。
• 当 GitHub CLI Token 缺少 workflow scope 时，/web-setup 会新增警告；因为缺少该权限时，推送到超大型仓库可能被拒绝。
• 为通过 AWS Marketplace 计费的 Enterprise 组织、自助式 Enterprise 以及 Enterprise 试用版新增 /usage-credits，成员可通过该命令向管理员申请提高用量限制。
• 在 Bedrock、Vertex 和 Foundry 上，以及禁用遥测时，新增同一台机器上不同会话之间的跨会话消息传递（SendMessage / ListAgents）。
• 修复了长会话中大约每小时发生一次的提示词缓存未命中问题，以及由此导致的扩展思考上下文丢失问题；根因是 OAuth Token 刷新后工具定义被重新渲染。
• 修复了当账户进入超额用量状态时，ScheduleWakeup 工具定义会在会话与其 --resume 之间发生变化的问题；此前这会导致恢复会话后的首轮请求发生完整提示词缓存未命中。
• 修复 Claude Desktop 和 Cowork 会话在 30 天后消失的问题：现在，只要会话仍在应用中，转录清理机制就会保留由桌面端写入的会话（除非组织策略管理保留期限）；新增 desktopSessionCleanupPeriodDays 设置可限制该豁免期。
• 修复了当另一个 Claude Code 进程持有 Token 刷新锁、同时会话 Token 已过期时被送往登录页面的问题；现在请求将以可重试错误失败。
• Windows：修复从会话脱离后，或在处于 win32-input-mode 的终端标签页中启动时，claude agents 列表无法响应键盘操作的问题。
• 修复 /login 中推荐的 Console 登录方式：在无法使用该方式的机器上（例如设置了 ANTHROPIC_API_KEY 或 API Key Helper）会在显示登录 URL 前因 OAuth 错误而失败；现在会回退至 API Key 登录。
• 修复 /model 和快速模式切换通知中的模型名称渲染问题：模型名称现以代码格式显示，因此 [1m] 等后缀会按字面文本显示，而不会被渲染为链接。
• 修复当设置 CI 环境变量时，claude agents 跳过工作区信任提示的问题。
• 修复当 PR 状态缓存包含格式错误条目时，claude agents 启动崩溃的问题。
• 修复机器关机后 Agent 视图重新唤起数周前后台会话的问题：此类会话现在将在其实际结束位置显示为已停止，打开时会先询问是否恢复其保存的对话。
• 修复启动新会话时 Agent 视图有时会打开较旧对话并丢弃已输入提示词的问题。
• 修复 claude agents：如果已在另一个终端恢复某个停止会话，打开该会话不再为同一对话启动第二个进程；对应行现在会提示该会话已在终端中打开。
• 修复 claude agents 和 claude rm 在会话工作树分支已合并到当前检出的默认分支（例如本地 main）但尚未推送时，拒绝删除会话并显示“has commits that are not pushed anywhere”的问题。
• 修复当 PermissionRequest 或 PreToolUse Hook 输出无效回答时，后台会话会静默等待的问题：claude agents 对应行现在会显示 Hook 名称及 Schema 错误。
• 修复 Hook 会将不是有效 JSON 的 stdout {…} 对象静默当作纯文本处理的问题；现在会将其报告为 Hook 错误，并附带解析错误信息。
• 修复 /mcp 将声明 claude.ai 连接器类型的项目 .mcp.json 条目列在受信任“claude.ai”标题下的问题；现在该条目会显示在其实际作用域下。
• 修复 MCP 服务器中 headersHelper 提供 Authorization Header 时，遇到 401 会进入 OAuth 发现流程，而非按文档重新运行 Helper 并重试调用的问题。
• 修复在需要托管设置安全审批对话框时，登录 Claude apps Gateway 的 /login 卡住的问题。
• 修复当 apiKeyHelper 是唯一凭据时，Gateway 模型发现功能（CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY）从不运行的问题。
• 修复 claude logs 在其运行所在终端中遗留鼠标跟踪、Bracketed Paste 和备用屏幕开启状态的问题。
• 修复信任对话框的仓库权限规则列表中，较长规则在 Emoji 中间被截断时显示乱码的问题。
• 修复在按下 ctrl+c 后立即按 shift+tab 时，权限模式指示器仍被“Press Ctrl-C again to exit”提示遮挡的问题。
• 修复 /ultrareview 和本地预置的云会话上传对 prod.env 风格文件、*.tfvars 文件、编辑器交换文件、临时文件及凭据文件备份副本（例如 key.pem.tmp、id_rsa.swo）的未提交修改问题；这些文件现在会保留在本机。
• 修复远程控制会话在 CLI 静默重连后，偶尔永远不显示权限提示或连接设备上的最新消息的问题。
• 修复云会话在容器的会话凭据尚不可读取时偶尔启动失败的问题。
• 修复当全局 Flag 或包装器注入的选项位于子命令之前时，claude remote-control 拒绝自身 Flag（例如 --spawn、--name）的问题。
• 修复启动警告（例如“N MCP servers need authentication”）在转录内容其余部分右侧一列渲染的问题。
• 修复后台工作树会话丢失检出内容的问题：后台会话现在运行期间会持有工作树锁，因此清理操作和 git worktree remove 不会影响它。
• 修复使用非拉丁字符输入的其他会话 @ 提及无法按名称匹配的问题，例如通过 IME 输入的韩文。
• 修复无效的 crossSessionInbound 值被静默忽略的问题：现在会发出警告；在修复前，用户设置会保留跨会话消息，托管设置则会拒绝这些消息。
• 修复速率限制、用量和快速模式消息在组织无法使用该命令时仍提示运行 /usage-credits 的问题，例如通过 DISABLE_EXTRA_USAGE_COMMAND 隐藏该命令时。
• [VSCode] 修复聊天标签页在其会话从未保存时卡在“No conversation found”的问题；现在会改为启动新对话。
• 优化 Workflow 工具的提示词占用：其描述现在约为 1k Token，而非 5.7k Token；脚本编写参考内容已移至内置的 workflow-authoring Skill。
• 优化提示词页脚中的 PR 徽章：当 Pull Request 未变化时，降低检查 GitHub 的频率；执行推送或 gh pr 命令仍会立即刷新。
• 优化托管设置：客户端超时、MCP 启动模式和流监控器相关环境变量不再触发设置审批提示。
• 优化 /ultrareview <PR#>：现在会在启动前检查与 Claude 账户关联的 GitHub 账户是否有权访问该仓库，并说明修复方法，而不是在云会话启动后才失败。
• 优化跨会话消息：当默认目录不可用时，会回退到私有的按用户划分的 /tmp 目录；通知和 /status 会显示需要修复的目录名称。
• 更改 Agent 视图调度输入框中的 shift+enter 行为：现在插入换行（与提示词输入一致）；ctrl+enter 现在执行调度并附加内容。
• 更改 /loop：自定节奏动态模式及无需提示词的自主默认模式现在始终可用，包括在 Bedrock/Vertex/Foundry 上。
• 更改 Anthropic 遥测导出失败的日志级别：现在以 debug 级别记录为 [Anthropic telemetry]，而非 [3P telemetry] OTEL diag error，避免被误认为是用户的 OTel 收集器故障。
• 更改 Linux 用户命名空间中的跨会话消息机制：对于未映射所有者，具备 root 等效信任的范围现仅限于规范系统目录。
• 更改从子 Agent 向另一会话发送 SendMessage 的行为：结果现在会说明，任何回复将被投递到父会话的对话中，而非该子 Agent。

1. Releases
2. v2.1.248

Compare

Sorry, something went wrong.

No results found

What's changed

• Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files
• Added experimental.cacheTtl ("5m" or "1h") to agent frontmatter: a per-agent prompt cache TTL used when no subagent TTL setting is configured
• Added claude self-hosted-runner --client-label <label> (or SELF_HOSTED_RUNNER_CLIENT_LABEL) to override the label the runner registers with (default: hostname)
• Added server-managed settings diagnostics: a startup warning when the settings fail to load, and a /doctor and /status line explaining a load failure or why they weren't fetched (Bedrock/Vertex/third-party provider, custom ANTHROPIC_BASE_URL)
• Added a warning in /web-setup when the GitHub CLI token lacks the workflow scope, since pushes to very large repositories can be rejected without it
• Added /usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials, so members can request a higher usage limit from their admin
• Added cross-session messaging (SendMessage / ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabled
• Fixed a prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh
• Fixed the ScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, causing a full prompt-cache miss on the resumed session's first turn
• Fixed Claude Desktop and Cowork sessions disappearing after 30 days: the transcript cleanup now keeps desktop-written sessions while they are in the app (unless org policy manages retention); the new desktopSessionCleanupPeriodDays setting caps the exemption
• Fixed being sent to the login screen when another Claude Code process held the token refresh lock while the session token had expired; the request now fails with a retryable error instead
• Windows: Fixed the claude agents list not responding to the keyboard after detaching from a session, or when launched in a terminal tab left in win32-input-mode
• Fixed the recommended Console sign-in in /login failing with an OAuth error before showing a sign-in URL on machines where it can't be used (for example when ANTHROPIC_API_KEY or an API key helper is set); it now falls back to the API-key sign-in
• Fixed model names in /model and fast-mode switch notices to render as code, so suffixes like [1m] display literally instead of as a link
• Fixed claude agents skipping the workspace trust prompt when the CI environment variable is set
• Fixed claude agents crashing on launch when the PR-status cache held a malformed entry
• Fixed agent view resurrecting a weeks-old background session after the machine was off: such a session now shows as stopped at its real end, and opening it asks before resuming its saved conversation
• Fixed agent view sometimes opening an older conversation, and dropping the typed prompt, when starting a new session
• Fixed claude agents: opening a stopped session that you already resumed in another terminal no longer starts a second process on that conversation; the row now says it is open in a terminal
• Fixed claude agents and claude rm refusing to delete a session ("has commits that are not pushed anywhere") when its worktree branch was already merged into your checked-out default branch (e.g. local main) but not yet pushed
• Fixed background sessions waiting silently when a PermissionRequest or PreToolUse hook prints an invalid answer: the claude agents row now names the hook and the schema error
• Fixed hooks silently treating a stdout {…} object that isn't valid JSON as plain text; it's now reported as a hook error with the parse message
• Fixed /mcp listing a project .mcp.json entry that declares the claude.ai connector type under the trusted "claude.ai" heading; it now appears under its real scope
• Fixed MCP servers whose headersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the helper and retrying the call as documented
• Fixed /login to a Claude apps gateway hanging when the managed-settings security approval dialog was required
• Fixed gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY) never running when apiKeyHelper is the only credential
• Fixed claude logs leaving mouse tracking, bracketed paste and the alternate screen switched on in the terminal it was run from
• Fixed the trust dialog's list of repo permission rules showing a garbled character when a long rule was cut off in the middle of an emoji
• Fixed the permission mode indicator staying hidden behind the "Press Ctrl-C again to exit" hint when you press shift+tab right after ctrl+c
• Fixed /ultrareview and locally seeded cloud sessions uploading uncommitted edits to prod.env-style and *.tfvars files, or to editor swap, temp, and backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machine
• Fixed Remote Control sessions occasionally never showing a permission prompt or the latest messages on the connected device after the CLI silently reconnected
• Fixed cloud sessions occasionally failing at startup when the container's session credentials were not yet readable
• Fixed claude remote-control rejecting its own flags (e.g. --spawn, --name) when a global flag or a wrapper-injected option precedes the subcommand
• Fixed startup warnings (e.g. "N MCP servers need authentication") rendering one column right of the rest of the transcript
• Fixed a backgrounded worktree session losing its checkout: the background session now holds the worktree's lock while it runs, so cleanup and git worktree remove leave it alone
• Fixed @-mentions of other sessions not matching names typed with non-Latin characters (for example Korean entered through an IME)
• Fixed an invalid crossSessionInbound value being silently ignored: it now warns and holds cross-session messages (user settings) or refuses them (managed settings) until fixed
• Fixed rate-limit, usage, and fast-mode messages telling you to run /usage-credits when that command isn't available for your organization (e.g. hidden with DISABLE_EXTRA_USAGE_COMMAND)
• [VSCode] Fixed a chat tab getting stuck on "No conversation found" when its session was never saved; it now starts a new conversation instead
• Improved the Workflow tool's prompt footprint: its description is now about 1k tokens instead of 5.7k, with the script-writing reference moved into a bundled workflow-authoring skill
• Improved the prompt-footer PR badge to check GitHub less often while the pull request is unchanged; a push or a gh pr command still refreshes it right away
• Improved managed settings: client-side timeout, MCP startup-mode, and stream-watchdog env vars no longer trigger the settings-approval prompt
• Improved /ultrareview <PR#> to check before launch that the GitHub account connected to your Claude account can access the repository, and to explain how to fix it, instead of failing after the cloud session starts
• Improved cross-session messaging: falls back to a private per-user /tmp directory when the default one can't be used, and the notice and /status name the directory to fix
• Changed shift+enter in the agent view dispatch input to insert a newline (matching the prompt); ctrl+enter now dispatches and attaches
• Changed /loop: self-paced dynamic mode and the no-prompt autonomous default are now always available, including on Bedrock/Vertex/Foundry
• Changed Anthropic telemetry export failures to log at debug level as [Anthropic telemetry] instead of [3P telemetry] OTEL diag error, so they are not mistaken for your OTel collector failing
• Changed cross-session messaging in Linux user namespaces: root-equivalent trust for unmapped owners is limited to canonical system directories
• Changed SendMessage from a subagent to another session: the result now notes that any reply is delivered to the parent session's conversation, not to the subagent

You can’t perform that action at this time.