Claude Code v2.1.290 发布：修复数百张图片长会话卡死等问题

What's changed

Added serverToolUses to the result of a mod's turn.step hook: the tool calls the API ran itself (the advisor), each with its id, name, input, start and end
Added agentId to the tool.check event of plugin hooks, so a hook can tell a subagent's permission check from the main session's
Added ceiling to the question and verdict a mod's tool.check hook reads, naming the approval an organization requires for a tool
Added ThemeKey and Color types to the plugin hooks typings, so an editor lists the theme colors a mod's drawing can name
Added to claude plugin validate: each hook a mod registers at a gating site is listed with whether it has a .catch (gatingHooks under --json)
Added a Deny button to the Claude apps gateway's sign-in approval page: it ends the pending sign-in, so the waiting terminal stops within seconds
Added claude attach <name> and claude logs <name>: part of a session name works in place of the id
Added /claude-api managed-agents-onboard <url> to set up the Managed Agents pattern a page describes as ant apply files
Added /claude-api managed-agents-onboard <quickstart-name> to build a Console quickstart template, such as deep-researcher, with the ant CLI
Added a warning when a managed settings file is a link to a file outside the managed settings folder
Added a /status and doctor warning when managed settings ignore user-configured sandbox allowRead paths or allowed domains
Fixed requests failing behind proxies and gateways that reject one of Claude Code's beta headers with a status other than 400, or together with a second beta
Fixed long sessions with hundreds of images getting stuck on "Request rejected as unprocessable by the model" errors
Fixed a turn ending at once when the API's output content filter stopped a reply while Claude was still thinking; the request is now retried once before the error is shown
Fixed resumed subagents and teammates losing their earlier thinking and prompt cache after receiving a message mid-run
Fixed WebFetch silently dropping page text past 100,000 characters; it now says how much was unread and takes an offset to read on
Fixed a crash ("Maximum call stack size exceeded") when a response nested lists or quotes thousands of levels deep
Fixed /rewind not listing a prompt sent while Claude was still working
Fixed scheduled tasks (/loop with an interval, reminders) silently not coming back on resume once the conversation was compacted; covers compactions made from this version on
Fixed scheduled tasks set in the foreground never firing after a ← or /background hand-off, and recurring ones firing an extra run on every resume, respawn or fork
Fixed headless --json-schema runs exiting non-zero with is_error: true on a success result when the connection dropped after the structured output was already delivered
Fixed plan mode letting the auto mode classifier approve non-read-only connector tools that carry a server-pushed ask policy
Fixed a project CLAUDE.md, rule or AGENTS.md symlinked outside the working directories loading under permissions.blockReadsOutsideWorkingDirectories or a Read deny rule
Fixed URL allow and deny patterns with a wildcard inside an xn-- host label matching differently from one process to the next
Fixed an MCP server provided by your organization being relisted as your own after signing in or reconnecting, including from a late result in headless and SDK sessions
Fixed /ultrareview dropping uncommitted changes without a warning on Windows when git stash create failed, and refusing them after a git add -N file was deleted or moved
Fixed the plansDirectory setting's project-root check for paths that contain a backslash on macOS and Linux
Fixed replies in very long Remote Control and cloud sessions that could appear a block at a time instead of streaming in
Fixed the background daemon's log passing terminal control characters to the screen under claude daemon run and claude daemon logs; they now show as \uXXXX escapes
Self-hosted runner: Fixed a crafted, very long line of a session's error output freezing the runner for several seconds
Fixed a plugin hook with a .catch being unloaded, and its .catch skipped, when the hook kept the hooks worker busy on a prompt or tool call
Fixed a mod's turn.step result listing a tool call that a mid-response model fallback had discarded
Fixed a Cowork cloud session's reply sometimes never finishing when its container restarted just after Claude sent a message or a file
Fixed claude plugin validate and plugin loading refusing a hooks module that destructures an option named like one of its top-level functions
Fixed /ultrareview failing to upload uncommitted changes when core.safecrlf=true is set in git's configuration
Fixed the effort level changing when a flagged message is retried on a fallback model that has a different level saved in settings
Windows: Fixed multi-line ! shell blocks in skills and commands failing when the file is saved with CRLF line endings
Fixed Claude Code hanging until killed when a /permissions tab was clicked while searching in fullscreen mode
Fixed conversation compaction sometimes failing with a "null is not an object" error
Fixed plugin hooks reading an empty answer on turn.complete for a subagent that hands its report back in auto mode
Fixed a mod being unloaded without a message when a refresh followed its failed reload; its failure line now says the version loaded before is unloaded
Fixed a mod's prompt.submit hook that drops a prompt after calling next(e) being ignored silently: the hook is now reported as failed, by name
Fixed a mod's pane or band being redrawn without end when it followed its end over a tree that changed height at every drawing
Fixed an image read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read
Fixed a case where a user-installed mod could get an organization's plugin unloaded; the mod is now the one unloaded
Fixed disableClaudeAiConnectors and allowedMcpServers URL rules not being applied to some MCP entries declared in .mcp.json, plugins or agents
Fixed a mod's inline pane being redrawn without end when its tree changed height at every drawing
Fixed an @-mention under the read block or --restricted being able to read a file outside the working directories through a link changed mid-read
Fixed Esc in the agents view confirming "Press enter again to restart this session — it isn't responding"; Esc now just reopens the session
Fixed agent view losing a background session's /loop run count, countdown and live status line after the session enters a worktree that it creates
Fixed claude agents sessions in manual permission mode asking for approval to read an image pasted into a reply or a new agent's prompt
Fixed a deny or ask rule missing a command or path whose name came from a variable set as a prefix on declare, typeset, export or readonly
Fixed Read deny rules not applying to image paths pasted or dragged into the prompt, or to file names listed for an @-mentioned folder
Fixed a case where a user-installed mod could make an organization's guard skip its check; such a mod is now unloaded
Fixed plugin hooks stalling each redraw when a mod draws a long multi-line text holding non-Latin characters
Fixed repeated Ctrl+X in the agents view deleting the whole next section after the bottom session of a section was deleted
Fixed You should know writing its notes in English regardless of the language setting
Fixed a freeze after sending some very long messages
Fixed a slowdown when expanding the transcript (ctrl+o) or resizing over large tool output that contains non-ASCII characters such as arrows, dashes or box-drawing
Fixed claude respawn re-sending an earlier message to a backgrounded session that has no saved transcript instead of starting it with an empty conversation
Fixed Esc after an n: or Ctrl+F search in the agents view moving focus to a section header, where Ctrl+X twice would delete every session in the section
Fixed claude agents saving a slash command it could not deliver to a stopped session and then running it by itself the next time that session restarted
Fixed /ultrareview uploading uncommitted changes unfiltered for files under a git filter driver named unset or unspecified; the upload now stops and asks you to rename the driver
Fixed auto mode denials suggesting a permission rule that would skip the classifier for a whole tool or that Claude Code would ignore
Fixed claude --teleport and /teleport deleting the files in a folder that had replaced a tracked file of the same name when you chose to stash: the stash is now refused, and says why
Fixed Esc confirming agent view's "Press enter again to restart this session fresh" prompt
Fixed agent view's /loop run count freezing and its countdown disappearing after /clear; the count now restarts with the new conversation
Fixed --channels permission relay: a reply ID that repeats within a session is now ignored instead of approving a different prompt
Fixed /chrome "Reconnect extension" not restoring browser tools after a failed Chrome connection, and added an explanation when it can't (#98135)
Fixed mods staying off for people who reach Claude through a gateway (ANTHROPIC_BASE_URL with ANTHROPIC_AUTH_TOKEN) and have no Anthropic account
Fixed replies sent from claude agents just after a background session crashed being refused after 2 seconds: they are now retried for up to 12 seconds while the session restarts
Fixed slash commands and answers to a multiple-choice question that claude agents could not deliver to a running session being saved and sent by themselves the next time it was restarted
Fixed sandboxed commands that pipe a heredoc into another command (cat <<EOF | python3) asking for approval on every run
Fixed claude agents failing with "Couldn't restart the background service" and background sessions stopping after a Homebrew upgrade (takes effect from the upgrade after this one)
Fixed agent view's "restart this session fresh" re-sending an earlier message from the session instead of starting with an empty conversation
Fixed Bash permission checks auto-approving some read-only commands (such as rg or git grep) whose arguments the shell would still expand as wildcards; these now prompt for approval
Fixed claude plugin test refusing to run after an upgrade because of an out-of-date saved setting
Fixed Bash permission checks auto-approving certain commands whose variable names zsh reads differently from bash; these now prompt for approval
Fixed a short form of a git clone option keeping the sandbox exemption from a git pattern such as git * in sandbox.excludedCommands; it is now treated like the long form
Fixed the first feature-flag request of a session ignoring a proxy or API endpoint set in a project's settings
Fixed /ultrareview of a local branch silently leaving uncommitted work out of the upload in a repository that keeps its branches outside .git (git 2.54+); it now refuses with an explanation
Fixed cloud sessions staying asleep after a container restart lost a pending /loop wakeup or scheduled task; Claude is now told and can schedule it again
Fixed the Claude apps gateway's retention sweep deleting a returning developer's identity row refreshed at the same moment, on PostgreSQL versions without the November 2025 fixes
Fixed sandboxed Monitor tool commands skipping the permission prompt under sandbox auto-allow; they now follow your permission rules
Fixed the Claude apps gateway failing to start when the certificate it presents to the identity provider has an empty subject
Fixed the Claude apps gateway exiting with a bare "Invalid URL" when store.postgres_url can't be parsed; the error now names the setting and says what the URL may hold
Fixed background agents failing with "Agent stalled" and Workflow tool subagents restarting from their prompt when a Mac woke from sleep
Fixed slow or failed startup since 2.1.285 under SDK hosts such as the VS Code extension when managed settings deny reads of many paths on a slow filesystem (notably Windows drives under WSL)
Fixed a response interrupted by computer sleep being treated as a stalled stream on Bedrock, Vertex, Foundry, and custom gateways
Fixed a freeze before the first request and in the /sandbox Config tab on Linux and WSL when a sandbox read rule such as ~/**/.env covers a large folder
Fixed skills not being found when asked for by the name in SKILL.md when their folder has a different name (for example a non-English name): the skill listing now shows both names
Fixed a plan written in plan mode being lost when a cloud session's container restarted before the plan was presented
Fixed the Bash tool occasionally losing shell aliases, functions and plugin PATH entries for a whole session when its first command ran seconds after startup on a new config directory
Fixed unbounded memory use when an HTTP MCP server sends a very large response
Fixed artifact operations failing in a Claude Code run started from inside a cloud session (for example claude -p run from the Bash tool)
Fixed files sent from remote sessions sometimes being refused as "not the one approved" when four or more were sent at once
Fixed plan mode not being restored when resuming a session with --continue or --resume <session-id> in the terminal
Fixed a marketplace named after another GitHub marketplace's download folder stopping that marketplace from downloading
Fixed automatic compaction giving up with "Prompt is too long" when a Mac went to sleep while it was running
Fixed the rewind menu (Esc Esc / /rewind) freezing for hundreds of milliseconds per keypress when the conversation contains a very large pasted stack trace or source file
Fixed a subdirectory's AGENTS.md not being attached when a file under it is @-mentioned
Fixed self-hosted runner sessions resumed after a stopped runner failing with "missing but already registered worktree" when the sessions folder is a relative symlink
Fixed a freeze when the secret scan or a permission prompt met long token-like text
Fixed Bash permission checks not applying Read deny rules or the outside-directory read block to a wildcard in some option values of read-only commands
Fixed CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS=5m being read as 5 ms and cancelling remote dialogs at once; values with a unit suffix now fall back to dialogExpiry
Fixed a stall when an MCP server's tool listing contains very long runs of combining characters
Fixed two pastes that overlap in one prompt being sent to the model partly as typed text instead of as one pasted block
Fixed Claude in Chrome's browser picker showing a message meant for Claude when the chosen browser is no longer connected, and the VS Code dialog's list going stale after a switch
Fixed background subagents losing write and Bash access in their worktree after the main session enters or exits a different worktree
Fixed background commands, the agents view and daemon workers sending telemetry and a feature-flag request to Anthropic behind a Claude apps gateway when no managed settings on the machine force gateway login
Fixed --restricted (and CLAUDE_CODE_RESTRICTED=1) sessions opening the cross-session messaging socket
Fixed sessions moved to the background while idle reopening as "no saved transcript" after a restart or idle cleanup; they now resume their conversation
Fixed background workers honoring --allow-dangerously-skip-permissions on respawn without the bypass-permissions disclaimer having been accepted
Fixed Claude replying in an endless loop when a plugin's async Stop hook passes an unquoted script path under a folder with a space, such as Application Support
Fixed a freeze of several seconds when secret masking met very long unbroken text
Fixed some permission rules and safety checks not being applied to a tool call after a PreToolUse hook rewrote its input
Fixed first launch asking to pick a login method again after claude auth login or with a credentials file already in the config directory
Fixed file names containing line breaks being displayed incorrectly in file tool errors and permission prompts
Fixed a large paste expanded in place being sent to the model as typed text after the next keystroke when it held accents stored as separate characters, as macOS file names do
Fixed macOS /login reporting success when the keychain refused the new login and kept an old one it could not remove
Fixed SDK hosts using --include-partial-messages seeing a reply stay open after the turn ended when its stream was cut, interrupted or fell back to non-streaming
Fixed sandboxed Bash commands on Linux running ConfigChange hooks and reloading settings mid-command when .claude/settings.json or .claude/settings.local.json does not exist
Fixed errors reading "Premature close" instead of naming the missing program when a tool Claude Code runs, such as git or gh, is not installed (macOS, Linux)
Fixed /loop and other recurring session-only scheduled tasks running an extra time after a sandboxed Bash command on Linux or after .claude/scheduled_tasks.json was deleted
Fixed edits to the file a symlinked settings file points at running without the settings-file permission question
Improved MCP startup behind a network proxy: a server the proxy blocks (HTTP 403) is no longer retried three times
Improved permission prompts from background agents to show the Ctrl+X Ctrl+K shortcut that stops all background agents
Improved the built-in plugin-authoring skill: Claude now gives the one command another person runs to install a mod you made, and writes it in a README's install section
Improved the reply to /plugin in the desktop app's Code tab: it now says where to install and manage plugins there
Improved the Bash changed-files view: when a chained command includes git merge, pull or checkout, it lists the files without full diffs
Improved the Claude apps gateway's log when an upstream's cloud credentials or connection fail: the warning now ends with the underlying cause
Improved the error shown when a cloud session is started without a claude.ai sign-in: it now names claude auth login and /login and no longer blames API-key authentication
Improved the Read tool's message for binary files: it now points Claude to a skill or a shell command that can read the format
Improved the error shown when a git config file stops the /ultrareview upload: it is about half as long and says what kind of file is the problem
Improved the errors shown when the /ultrareview upload refuses a checkout: each known cause now has its own message, with a way to fix it
Improved the Claude apps gateway to log a warning during the last 30 days before the certificate it presents to the identity provider expires
Improved Claude in Chrome: a browser_batch call now gets 90 seconds, up from 60, before it is reported as timed out
Improved the Claude apps gateway's browser sign-in pages: brand fonts, centered layout, and dark mode
Improved responsiveness while resuming large sessions: timers, input and rendering keep running while the transcript loads
Improved the / and @ suggestion lists: the selected row now starts with a ❯ pointer, so you can see it without color
Changed CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC to also skip the startup connection warm-up
Changed Claude in Chrome so that a project's settings files can no longer turn it on; use --chrome, /chrome or your user settings
Changed the Bash tool to ask for permission before running pyright, which is no longer treated as a read-only command
Changed what a mod's $.process.spawn rejects with when another mod denies it after the child ran: it now says the call ran and a plugin withheld its result
Changed the background daemon's log to write a multi-line message as one JSON-quoted line
Changed skills and custom commands to refuse a ! shell command that contains raw control characters other than tab and newline, with a message that shows where they are
Changed /artifacts: opening an artifact in your browser now closes the list
Changed Bash permission checks so that more forms of the ps command ask for approval instead of running without asking
Changed plugin hooks so long text is clipped and logged instead of being refused or dropped silently
Changed background sessions whose scheduled task is gone: they now move to Completed about 20 seconds later and can be updated or shut down when idle
Changed the "Press ← again" confirm on a just-cleared prompt: a second ← no longer has to wait a second before it switches, and holding ← down now switches too
Changed the errors shown when the /ultrareview upload fails at a git step: they name the step and what to try, and no longer repeat git's own error text
Changed /code-review at medium effort to also report cleanup and CLAUDE.md conventions findings on models without tuned review settings, including Opus 5.5 and Sonnet 5.5
Changed an in-process teammate's agent_id in Agent results to its agent ID (its name@team address stays in teammate_id); TeammateIdle hooks no longer fire from its subagents or forks
Changed background sessions waiting on a scheduled wakeup (/loop): they are now left running through updates and low memory, where being restarted or shut down could silently lose the wakeup
Changed /model, /effort and /rename sent from claude agents to a busy background session to apply right away, without a confirmation, instead of when the turn ends
Changed the Claude apps gateway's minimum supported PostgreSQL version from 14 to 11
Changed the interactive session's WebSearch budget to refill over time (100 calls/hour; CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR sets the rate, 0 turns it off) instead of ending after 200 calls
Changed CLAUDE_CODE_DISABLE_ATTACHMENTS so a repository's .claude/settings.json or .claude/settings.local.json can no longer set it; shell, user and managed settings still can
Changed claude plugin update on a plugin loaded from a directory to print just its reason, without the "Failed to update plugin" prefix, as for built-in plugins
Changed the built-in gh api in cloud sessions: a host other than github.com set in GH_HOST or GH_REPO is now refused (use --hostname or a full URL), and stderr notes requests to other hosts
Changed the claude-api skill's Managed Agents examples to turn off the web tools unless the agent needs them and to use the auto permission policy
Self-hosted runners: Changed claude --environment <id> to create its session through the current Sessions API; printed and JSON session ids keep their session_… form
[VSCode] Added a screen reader announcement, "Message queued.", when you send a message while Claude is working
[VSCode] Added a way to review and run a plugin marketplace's install or update command from the Manage plugins dialog
[VSCode] Fixed a blank chat you never typed into keeping a background Claude process running after you open a saved conversation in its place
[VSCode] Fixed settings dialogs blaming a timeout when Claude Code stopped unexpectedly during a save
[VSCode] Fixed the branch switch dialog offering to switch when it could not check for uncommitted changes
[VSCode] Fixed a permission prompt that arrived behind an open dialog taking keyboard focus, so a key pressed in the dialog could answer it
[VSCode] Fixed sign-in and new sessions giving no clear reason when Claude Code cannot find or start its program
[VSCode] Fixed the agent map showing a nested sub-agent with "Tool calls (0)" and placing the agents it starts under the main agent
[VSCode] Improved Continue After Reload: tabs reopened after VS Code restarts its extensions now also finish a step the restart interrupted
[VSCode] Improved file pills in messages: hovering one now shows the file's path from the project folder, so same-named files can be told apart
[VSCode] Changed message timestamps to show by default (turn them off with the Claude Code: Show Message Timestamps setting)
[Cloud sessions] Fixed turning off prompt suggestions through a cloud environment's environment variables having no effect in new cloud sessions
[Cloud sessions] Fixed the working indicator in a cloud session spinning on for several seconds after Claude's reply had finished; it now stops with the reply
[Cloud sessions] Fixed History on a never-run routine's page still saying "No runs yet" after you pressed Run now; it now shows the new run
[Cloud sessions] Fixed an unarchived cloud session looking as if Claude were still working until you sent another message
[Remote Control] Fixed a computer that just started Remote Control taking up to a minute to appear in the Remote Control menu of a new session; it now appears within seconds
[Claude Tag] Added fast mode in Slack: mention Claude with !fast to switch a thread to fast mode, moving it to Opus if needed, and !fast off to switch back; replies show (fast) while it's on
[Claude Tag] Added the optional Path prefixes field when creating a custom connection in an access bundle, so its allow rule can cover only those paths instead of the whole host
[Claude Tag] Fixed members with the Claude Tag Admin permission getting "Couldn't load memory files" on the Activity page's Memory tab; they can now read workspace and channel memory
[Claude Tag] Fixed a workspace guest's Confirm on a Claude settings card in Slack removing its buttons for everyone; only the guest sees the refusal, and members can still confirm or cancel
[Claude Tag] Fixed scheduled routines in Slack channels running on a model other than the channel's default; each run that starts a new session now uses the current default model
[Claude Tag] Fixed GitHub repositories in an access bundle attached by a channel-name rule being refused in the channels the rule covers; Claude can now add, list and clone them there
[Claude Tag] Improved Claude's notice in your direct messages when your own Claude plan's usage limit is reached: it shows within seconds and says when the limit resets
[Claude Tag] Improved the earlier Claude in Slack app's reply when it can't start a session: it now says what failed and who can fix it, in full only once per thread
[Claude Tag] Changed the channel instructions limit to 8,192 characters instead of bytes, so non-English text gets the same room, and added a character count beside Save on the Configure page
[Code Review] Fixed blocking review comments sometimes opening with a "nit" label that contradicted their severity
[Code Review] Fixed tips to comment "@claude review" being posted on fork and Manual-mode pull requests in organizations that have turned Code Review off