Claude Code v2.1.251 发布：新增模型切换钩子、子代理实时流与大量安全修复

更新内容

• 新增 PreModelSwitch 和 PostModelSwitch 钩子事件，可阻止、确认或注释模型切换；SessionStart 恢复钩子现在可接收会话陈旧度和预估的缓存重建成本。
• 新增将前台子代理的工具调用及其结果实时流式传输到 Remote Control 客户端的能力（默认的后台子代理仍只显示状态）。
• 为通过设有消费限额的 Claude apps 网关接入的开发者，在 /usage 中新增消费限额条，并新增 rate_limits.spend_limit 状态行字段。
• 在 /cost 中新增按会话统计的提示缓存信息行，包括命中率、未命中次数、重新缓存的 token 数量以及热/冷状态；同时为状态行脚本新增对应的 prompt_cache 对象。
• 在 claude --help 中新增 attach、logs、stop、respawn 和 rm；正在运行的后台会话的 --resume 提示现在会显示准确的 claude attach <id> 命令。
• 修复了权限检查后，工作目录内的符号链接被替换时，文件工具（Read、Write、Edit）可能跟随该链接并在已批准位置外读取或写入的问题。
• 修复了 marketplace 条目中声明的插件命令可指向插件目录外的问题；此类路径现在会因路径遍历错误而被拒绝。
• 修复了项目设置可启用详细 Beta 追踪或原始 API 请求体日志的问题；同时修复了较低作用域的 Beta 追踪端点可绕过由托管设置或宿主应用固定的 OTLP 收集器的问题。
• 修复了 Workflow 工具在权限检查运行前读取会话无权读取的 scriptPath（并在错误信息中引用其内容）的问题。
• 修复了 Grep 和 Glob 未将 Read(...) 拒绝规则应用于通过符号链接搜索路径访问文件的问题。
• 修复了模型在某一轮仅产生 thinking 后，对话可能卡在“text content blocks must be non-empty”错误上的问题。
• 修复了全新安装首次启动时，对于启动默认设置为自动模式的账户，仍会以默认模式而非自动模式启动的问题。
• 修复了在 effort 为 xhigh/max 且关闭 thinking 时，Opus 5 请求因“effort … is not supported when thinking is disabled”而失败的问题；此情况下现会发送 high effort。
• 修复了回复 Claude Desktop 从其他会话传递的消息时的问题：向该会话 ID 发送的 SendMessage 现在会通过 Claude Desktop 投递，而不会因“not reachable”失败。
• 修复了存在大量并行子代理时的 TUI 卡顿问题：每秒进度更新现在会替换前一条，而非在记录中持续堆积。
• 修复了 Agent 团队中队友的最终回答无法送达团队负责人的问题：现在会在空闲通知中送达，而不再显示没有内容的“available”通知。
• 修复了后台子代理无法回复未命名同级代理或父代理消息的问题（from 为代理类型而非可寻址的地址）。
• 修复了托管设置 disableAutoMode 在会话中途生效时，无法将已运行的自动模式会话切回默认模式的问题。
• 修复了即使当前 Opus 模型已拥有 100 万上下文窗口，仍会显示“切换至 Opus 1M 以获得 5 倍更多上下文”提示的问题。
• 修复了 Claude apps 网关会话将已保存的 Anthropic 配置文件（例如 Console 登录）视为活动状态的问题：此前会在 /status 中列出该配置文件，并使用它重试网关 401 错误，尽管请求实际上从不使用它。
• 修复了云端会话在宿主仅设置会话初始模型时，却告知 Claude 模型已发生更改的问题。
• 修复了组织策略禁用 Remote Control 时仍报告失败的问题；现在仅显示一条低干扰通知。
• 修复了在 Remote Control 中执行 /mcp reconnect 时，如果服务器在另一会话中被禁用，会显示通用的详情隐藏错误而非实际解决办法的问题。
• 修复了 --input-format stream-json：客户端注入、且未附带消息 ID 的 assistant 工具调用会被合并到第一条调用并丢失结果的问题，包括恢复旧会话时的情形。
• 修复了切换目录将会话迁移至已有相同 ID 的记录时，会话记录会被静默覆盖的问题。
• 修复了后台会话及其子代理无法编辑它们通过 git worktree add 创建的 git worktree 内文件的问题。
• 修复了另一 Claude Code 进程恰好同时刷新插件 marketplace 时，后台会话偶尔会在没有任何插件技能的情况下启动并保持该状态的问题。
• 修复了通过 SSH 在 tmux 中选中已打开后台会话文本的问题：现在会像前台会话一样复制到 tmux 缓冲区，而不再退回使用 OSC 52。
• 修复了 SDK 和云端会话在 SDK MCP 服务器的握手确认丢失时可能无限期挂起的问题；现在等待会在 70 秒后超时，并仅将该服务器标记为失败。
• 修复了自托管 runner 在强制停止卡住的会话后，仍保留该会话 Bash 工具进程运行的问题。
• 修复了 Team 和 Enterprise 成员在管理员将组织用量积分限额设为 $0 时，/usage-credits 会提示已达到上限的问题；现在会建议用户向管理员提出请求。
• 修复了在 gitlab.com 源仓库上使用带合并请求编号的 --worktree --tmux 时，会先尝试注定失败的 GitHub 风格 fetch，而非直接获取 GitLab ref 的问题。
• 修复了在后台会话中，对会打开 /dev/tty 的编辑器（如 emacs -nw 和 micro）使用 Ctrl+G 时出现“Emacs quit unexpectedly”的问题。
• 修复了来自 SDK 宿主、IDE 或钩子的 additionalDirectories 条目包含空字节时会导致启动崩溃，或破坏 /add-dir 与后续设置更新的问题；现在会跳过该条目。
• 修复了 MCP 服务器菜单的复制快捷键：现在会说明登录 URL 的复制方式，而不再总是宣称复制成功。
• 修复了斜体文本（例如会话回顾行）在 GNU screen 以及使用 screen 终端类型的 tmux 会话中显示为高亮块的问题。
• 修复了 claude mcp add --header 和 claude mcp add-json 帮助文本中标示错误传输方式的问题。
• 修复了当云端会话无法启动时，claude ultrareview 和 /ultrareview 仍会完整等待 30 分钟的问题；现在会提前停止并报告原因。
• 修复了 Bash 权限检查会自动批准向整数 shell 变量赋算术表达式的命令（例如 OPTIND=1/0、RANDOM=2+2）的问题；现在会要求批准。
• 修复了后台化会话（←、/background、--bg）会丢失在 shell 中导出的 Vertex/Bedrock 网关配置（ANTHROPIC_*_BASE_URL + CLAUDE_CODE_SKIP_*_AUTH），从而导致所有请求失败的问题。
• 修复了 Max 套餐中，claude --bg --model fable 会停下来要求使用量积分、而同账户交互会话仍有 Fable 额度的问题。
• 修复了一次性的“将自动模式设为默认”邀请会在无人值守会话中出现的问题（例如 Agent 团队队友窗格）；此前一次意外按键可能在未阅读的情况下接受邀请。
• 修复了重新登录同一 Claude apps 网关后，即使设置未变，更改后的托管设置审批提示仍会重新出现的问题。
• 修复了已禁用的 /bug 和 /share 会报告 /feedback 被禁用的问题；当组织策略或环境变量关闭 /feedback 时，提示、/help 和拒绝消息也不再建议使用 /feedback。
• 修复了云端会话创建在 GitHub 短暂连接失败后建议进行 GitHub 设置的问题；现在消息会提示用户重试。
• 改进了交互会话在轮次执行期间的 CPU 使用率，减少冗余 UI 重绘。
• 改进了安装体积：原生二进制文件缩小约 5 MB。
• 改进了云端会话：当会话的网络代理在 Bash 命令执行期间断开连接时，工具结果现在会显示主机和原因，而不再仅显示“connection reset”。
• 改进了 /schedule：当 Claude Code 中配置的 MCP 服务器无法附加至云端例程时，现在会解释原因，而不再只显示“No MCP connectors”。
• 改进了来自用户自身子代理的消息上下文：现在会告知 Claude，发送者是当前会话内的工作代理，而非无关的 Claude 会话。
• 改进了提示词占位符：在从子代理面板或 /tasks 打开的后台子代理或分叉记录中查看时，显示为“Message @name…”。
• 改进了错误消息、菜单和命令结果中 MCP 服务器名称的清理处理。
• 改进了 CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST 下的 Amazon Bedrock 会话启动（例如 Claude Desktop）：获得 Bedrock 模型 ID 或 ARN 的会话不再等待推理配置文件发现。
• 改进了托管设置审批对话框：现在仅列出自上次批准以来发生变化的设置。
• 改进了模型工具调用格式错误时的重试机制：损坏的输出现在会从重试上下文中移除，包括 Bedrock、Vertex 和 Foundry。
• 修改 /radio，使其可在 Bedrock、Vertex AI、Foundry、Claude Platform on AWS 上使用，并支持在禁用遥测时使用。
• 修改 Claude in Chrome：浏览器操作现在始终经过 Claude Code 的权限检查，包括禁用遥测的会话；此前此类会话使用 Chrome 扩展自身的提示。
• 修改 CLAUDE_CODE_SUBAGENT_MODEL 的行为：现在用于设置默认子代理模型，而非覆盖所有配置；代理定义中的 model: 和每次生成代理时显式指定的模型优先级更高。
• 修改默认提交尾注：当活动模型不是已识别的 Claude 模型时（例如位于自定义 ANTHROPIC_BASE_URL 之后的第三方模型），默认使用 Co-Authored-By: Claude Code。
• 修改按席位计费的 Enterprise 订阅默认模型为 Opus 5，以与其他高级套餐保持一致。
• 修改 /effort：现在会按模型保存默认 effort 级别，因此切换模型时，每个模型都会保留自己的设置。
• 修改分析功能：不再仅因托管设置强制网关登录（或无法读取）而在登录前关闭；在登录网关后或通过 DISABLE_TELEMETRY 禁用时仍会保持关闭。
• 修改 Bedrock、Vertex 和 Foundry 上以及关闭遥测时的页脚 PR 徽章：现在会直接调用 GitHub API（通过 gh auth token、GH_TOKEN 或 GITHUB_TOKEN），而非使用 gh pr view。
• 修改在沙箱中运行命令时 Bash 命令输出文件的创建与读回方式，防止沙箱命令重定向或替换这些文件。
• 修改插件/LSP 安装建议和自动模式默认邀请的显示时机：现在会等待用户已发送或清除正在输入的内容，因此发送提示词的 Enter 键不会意外回答这些提示。
• 修改由服务器管理的设置：终止沙箱 TLS、将沙箱流量路由至自有代理、注入凭据或削弱沙箱隔离的设置，现在须在生效前获得批准。
• 修改 ANTHROPIC_CUSTOM_HEADERS：从托管或项目设置中设置凭据、组织/租户、路由或 API 行为相关请求头时（例如 Authorization、Host），现在需要获得批准。
• 修改项目级 .claude/settings.json 的 env：不再设置 CLAUDE_CONFIG_DIR、CLAUDE_CODE_TMPDIR 或 TMPDIR/TMP/TEMP；请改在 shell、用户设置或托管设置中配置。
• 移除了六种较少使用语言的语法高亮：1c、gml、isbl、mathematica、maxima、sqf；二进制文件缩小 2.5 MB。
• [VSCode] 修复了登录页面中“Bedrock, Foundry, or Vertex”按钮打开文档页顶部、而非第三方提供商设置章节的问题。
• [VSCode] 将 Remote Control 横幅改为页脚胶囊提示（在 Remote Control 已开启或发生失败时显示），点击后会在 claude.ai/code 打开会话；可通过 /remote-control 开启或关闭。

1. Releases
2. v2.1.251

Compare

Sorry, something went wrong.

No results found

What's changed

• Added PreModelSwitch and PostModelSwitch hook events (block, confirm, or annotate a model switch); SessionStart resume hooks now receive session staleness and the estimated re-cache cost
• Added live streaming of a foreground subagent's tool calls and results to Remote Control clients (background subagents, the default, still show status only)
• Added a Spend limit bar to /usage and a rate_limits.spend_limit status line field for developers behind a Claude apps gateway with spend limits
• Added a per-session prompt-cache line to /cost (hit ratio, misses, tokens re-cached, warm/cold) and a matching prompt_cache object for status line scripts
• Added attach, logs, stop, respawn, and rm to claude --help; the --resume message for a running background session now names the exact claude attach <id> command
• Fixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location
• Fixed plugin commands declared in a marketplace entry being able to point outside the plugin directory; such paths are now rejected with a path-traversal error
• Fixed project settings being able to enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint bypassing an OTLP collector pinned by managed settings or a host app
• Fixed the Workflow tool reading (and quoting in errors) a scriptPath outside what the session may read before the permission check ran
• Fixed Grep and Glob not applying Read(...) deny rules to files reached through a symlinked search path
• Fixed conversations getting stuck on "text content blocks must be non-empty" errors after a turn where the model produced only thinking
• Fixed the first launch on a fresh install starting in default mode instead of auto mode for accounts whose startup default is auto mode
• Fixed Opus 5 requests failing with "effort … is not supported when thinking is disabled" when effort was xhigh/max and thinking was turned off; effort is now sent as high in that case
• Fixed replying to a message Claude Desktop delivered from another session: SendMessage to that session id now delivers through Claude Desktop instead of failing with "not reachable"
• Fixed TUI lag with many parallel subagents: per-second progress ticks now replace their predecessor instead of piling up in the transcript
• Fixed agent teams: a teammate's final answer not reaching the team lead — it now arrives in the idle notification instead of a content-free "available" notice
• Fixed background subagents being unable to reply to a message from an unnamed sibling or parent agent (from was the agent type, which is not an address)
• Fixed managed-settings disableAutoMode arriving mid-session not moving an already-running auto-mode session back to default mode
• Fixed a "switch to Opus 1M for 5x more context" tip that appeared even when the current Opus model already has a 1M context window
• Fixed Claude apps gateway sessions treating a stored Anthropic profile (e.g. a Console sign-in) as active: listing it in /status and retrying gateway 401s with it, though requests never use it
• Fixed cloud sessions telling Claude the model had changed when the host was only setting the session's initial model
• Fixed Remote Control reporting a failure when an organization's policy disables it; it now shows a single quiet notice instead
• Fixed /mcp reconnect on Remote Control showing a generic withheld-detail error instead of the real remedy when a server was disabled in another session
• Fixed --input-format stream-json: client-injected assistant tool calls sent without a message id were merged into the first one and their results lost, including when resuming older sessions
• Fixed session transcripts being silently overwritten when a directory change relocated a session onto an existing same-ID transcript
• Fixed background sessions and their subagents being unable to edit files inside a git worktree they created with git worktree add
• Fixed background sessions occasionally starting without any plugin skills (and staying that way) when another Claude Code process was refreshing the plugin marketplace at the same moment
• Fixed selecting text in an opened background session inside tmux over SSH: it now copies to the tmux buffer like a foreground session instead of falling back to OSC 52
• Fixed SDK and cloud sessions hanging indefinitely when an SDK MCP server's handshake acknowledgment was lost; the wait now times out after 70 seconds and marks only that server failed
• Fixed self-hosted runner leaving a stuck session's Bash tool processes running after the session was force-stopped
• Fixed /usage-credits for Team and Enterprise members whose admin set the org's usage-credit limit to $0: it now offers to ask the admin instead of saying a cap was reached
• Fixed --worktree --tmux with a merge-request number on a gitlab.com origin trying a doomed GitHub-style fetch first instead of fetching the GitLab ref directly
• Fixed Ctrl+G failing with "Emacs quit unexpectedly" in background sessions for editors that open /dev/tty, such as emacs -nw and micro
• Fixed an additionalDirectories entry containing a null byte crashing startup, or breaking /add-dir and later settings updates when it came from an SDK host, IDE, or hook; it is now skipped
• Fixed the MCP server menu's copy shortcut: it now says how the sign-in URL was copied instead of always claiming success
• Fixed italic text (such as the session recap line) rendering as highlighted blocks in GNU screen and in tmux sessions using a screen terminal type
• Fixed claude mcp add --header and claude mcp add-json help text naming the wrong transports
• Fixed claude ultrareview and /ultrareview waiting the full 30 minutes when the cloud session fails to start; they now stop early and report the reason
• Fixed Bash permission checks auto-approving commands that assign an arithmetic expression to an integer shell variable (e.g. OPTIND=1/0, RANDOM=2+2); these now prompt for approval
• Fixed backgrounded sessions (←, /background, --bg) losing a Vertex/Bedrock gateway (ANTHROPIC_*_BASE_URL + CLAUDE_CODE_SKIP_*_AUTH) exported in the shell, so every request failed
• Fixed claude --bg --model fable on Max plans stopping to ask for usage credits while the interactive session on the same account still had Fable allowance
• Fixed the one-time "make auto mode your default" offer appearing in unattended sessions (e.g. agent-team teammate panes), where a stray keypress could accept it unread
• Fixed the managed-settings approval prompt re-appearing after signing in again to the same Claude apps gateway when the settings are unchanged
• Fixed disabled /bug and /share reporting that /feedback was disabled; tips, /help, and refusal messages no longer suggest /feedback when an org policy or env var turns it off
• Fixed cloud session creation advising GitHub setup after a transient GitHub connection failure — the message now says to retry instead
• Improved CPU usage during turns in interactive sessions by cutting redundant UI re-renders
• Improved install size: the native binary is about 5 MB smaller
• Improved cloud sessions: when the session's network proxy drops a connection during a Bash command, the tool result now names the host and reason instead of only "connection reset"
• Improved /schedule to explain that MCP servers configured in Claude Code can't be attached to cloud routines, instead of a bare "No MCP connectors" message
• Improved framing of messages from your own subagents: Claude is told the sender is a worker inside this session, not an unrelated Claude session
• Improved the prompt placeholder to read "Message @name…" while viewing a background subagent or fork transcript opened from the subagent panel or /tasks
• Improved sanitization of MCP server names in error messages, menus, and command results
• Improved Amazon Bedrock session start under CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST (e.g. Claude Desktop): a session given a Bedrock model ID or ARN no longer waits for inference-profile discovery
• Improved the managed settings approval dialog to list only the settings that changed since you last approved them
• Improved retry when the model's tool call is malformed: the broken output is now dropped from the retry context, including on Bedrock, Vertex, and Foundry
• Changed /radio to be available on Bedrock, Vertex AI, Foundry, and Claude Platform on AWS, and when telemetry is disabled
• Changed Claude in Chrome so browser actions always go through Claude Code's permission checks, including in sessions with telemetry disabled, which previously used the Chrome extension's own prompts
• Changed CLAUDE_CODE_SUBAGENT_MODEL to set the default subagent model rather than override everything: an agent definition's model: and an explicit per-spawn model now take precedence over it
• Changed the default commit trailer to Co-Authored-By: Claude Code when the active model isn't a recognized Claude model (e.g. third-party models behind a custom ANTHROPIC_BASE_URL)
• Changed the default model for seat-based Enterprise subscriptions to Opus 5, matching other premium plans
• Changed /effort to save your default effort level per model, so each model keeps its own setting when you switch
• Changed analytics to no longer turn off before sign-in solely because managed settings force gateway login (or cannot be read); they stay off once signed in to the gateway or via DISABLE_TELEMETRY
• Changed the footer PR badge on Bedrock, Vertex, and Foundry, and when telemetry is off, to call the GitHub API directly (via gh auth token, GH_TOKEN, or GITHUB_TOKEN) instead of gh pr view
• Changed how Bash command output files are created and read back when commands run in the sandbox, so a sandboxed command cannot redirect or replace them
• Changed plugin/LSP install suggestions and the auto-mode default offer to wait until you've sent or cleared what you're typing, so the Enter that sends your prompt can't answer them
• Changed server-managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials, or weaken sandbox isolation to require approval before they apply
• Changed ANTHROPIC_CUSTOM_HEADERS from managed or project settings to require approval when it sets a credential, org/tenant, routing, or API-behavior header (e.g. Authorization, Host)
• Changed project-level .claude/settings.json env to no longer set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR/TMP/TEMP; set them in your shell, user, or managed settings instead
• Removed syntax highlighting for six rarely used languages (1c, gml, isbl, mathematica, maxima, sqf); the binary is 2.5 MB smaller
• [VSCode] Fixed the sign-in screen's "Bedrock, Foundry, or Vertex" button opening the docs at the top of the page instead of the third-party provider setup section
• [VSCode] Changed the Remote Control banner to a footer pill (shown while Remote Control is on or has failed) that opens the session on claude.ai/code; turn it on or off with /remote-control

You can’t perform that action at this time.